| |
| |||||||
Log-Analyse und Auswertung: Babylon.A , Incredibar.A , PriceGong, Spigot, Dealply & Co in C:\Users\...\AppData\Roaming\Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
04.08.2014, 15:30
| #1 | |
 |  Babylon.A , Incredibar.A , PriceGong, Spigot, Dealply & Co in C:\Users\...\AppData\Roaming\ Ein herzliches Hallo an die/den Leser! Nachdem mir letztes Mal hier so wunderbar schnell und effizient geholfen wurde wende ich mit fast derselben Problematik wieder an euch. Die letzte Hilfe liegt ein gutes Jahr zurück. http://www.trojaner-board.de/132072-...entfernen.html Ich hoffe es ist in Ordnung, dass ich einen neuen Thread erstelle. Sollte das nicht der Fall sein, werde ich dies gerne in den alten Thread übertragen. Der Hauptbenutzer des PCs ist mein kleiner Bruder, der nachdem er ein halbes Jahr weg war, kurz nach seiner Rückkehr es wieder geschafft hat uns schöne kleine Überraschungen zu besorgen! Gefunden durch einen Scan mit MBAM der von mir nur hin und wieder durchgeführt wird, da ich kaum an besagtem Rechner bin. Bevor ich euch in den Genuss diverser Logs kommen lasse möchte ich noch auf Probleme aufmerksam machen, die mir während der Scans aufgefallen sind und hätte noch gerne eine Meinung zu kleinen Programmen die eventuell der Auslöser dafür sein könnten. Update: Problem 1 durch manuelle Installation des Updates behoben. Ich lasse die Info trotzdem drin, um die verschiedenen neuen Dateien und Ordner zu erklären. Problem 1 Da ich standardmäßig automatische Windows Updates laufen lasse ist mir erst gestern aufgefallen, dass die Installation des Windows Update KB2803821 seit Mitte August letzten Jahres fehlschlägt. Auch empfohlene Schritte haben keine Besserungen gebracht (ich kann seltsamerweise keine Verlinkungen auf die Microsoft Websites einfügen..). Bleibt mir wie empfohlen nur die Neuinstallation des OS als ultima ratio? Oder wurde der Inhalt des Updates bereits durch ein nachfolgendes ersetzt bzw. eingefügt? Hier die Fehlermeldung von Windows Code:
ATTFilter Sicherheitsupdate für Windows 7 für x64-basierte Systeme (KB2803821)
Installationsdatum: ?03.?08.?2014 23:17
Installationsstatus: Fehlgeschlagen
Fehlerdetails: Code 800B0100
Updatetyp: Wichtig
In einem Microsoft-Softwareprodukt wurde ein Sicherheitsproblem festgestellt, das Auswirkungen auf Ihr System haben könnte. Durch die Installation dieses Updates von Microsoft können Sie zum Schutz Ihres Systems beitragen. Eine vollständige Liste der Problembehebungen in diesem Update finden Sie in dem entsprechenden Microsoft Knowledge Base-Artikel. Nach der Installation dieses Updates müssen Sie das System gegebenenfalls neu starten.
Weitere Informationen:
hxxp://go.microsoft.com/fwlink/?LinkID=301528
Hilfe und Support:
hxxp://support.microsoft.com
 Bevor es zu möglichen Nachfragen kommt hier ein paar vorweg genommene Infos:
Zur Info vorweg: Defogger wurde nicht genutzt, MSE ist mein Antiviren Programm und ich bitte um Entschuldigung für die vielen unsortierten Logs. Ich werde das Ganze in zeitlicher Reihenfolge posten. Anhang 68628 Initialfund MBAM (neues Programm Layout, vorsichtiger User, erstes Log rauskopiert bevor Dateien in Quarantäne gelandet sind) Code:
ATTFilter Logfile MBAM 03082014.txt
Mir fällt gerade etwas auf: Code:
ATTFilter Ran by Julian at 2014-08-03 18:06:58
Running from C:\Users\Julian\Downloads
Boot Mode: Normal
 Schande über mein Haupt...  Code:
ATTFilter FRST.txt
Code:
ATTFilter Addition.txt
Code:
ATTFilter mbam.txt
Code:
ATTFilter AdwCleaner[R0].txt
Code:
ATTFilter ESET log 03082014
Code:
ATTFilter mbam2.txt
 Mausbewegungen usw. wurden jedoch nicht gemacht)Code:
ATTFilter gmer.log
Code:
ATTFilter FRST renewed.txt
Code:
ATTFilter mbam3.txt
Code:
ATTFilter OTL.txt
Code:
ATTFilter Extras.txt
 Ein Dankeschön im vorraus. P.S. Wer findet raus wie der kleine Bruder heißt?! |
|
04.08.2014, 15:33
| #2 |
| /// the machine /// TB-Ausbilder    | Babylon.A , Incredibar.A , PriceGong, Spigot, Dealply & Co in C:\Users\...\AppData\Roaming\ Hi,
__________________Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen. Ich kann auf Arbeit keine Anhänge öffnen, danke.  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
04.08.2014, 15:47
| #3 |
| | Babylon.A , Incredibar.A , PriceGong, Spigot, Dealply & Co in C:\Users\...\AppData\Roaming\ Hi schrauber,
__________________danke für die schnelle Reaktion! Teil 1 Initialfund MBAM (neues Programm Layout, vorsichtiger User, erstes Log rauskopiert bevor Dateien in Quarantäne gelandet sind) Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 03.08.2014 Suchlauf-Zeit: 17:54:09 Logdatei: Logfile MBAM 03082014.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.08.03.05 Rootkit Datenbank: v2014.08.01.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Julian Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 503308 Verstrichene Zeit: 5 Min, 21 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 13 PUP.Optional.Babylon.A, HKU\S-1-5-21-82016817-340743653-2786680247-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}, , [e78313ae3a413ef8dd266100b84a34cc], PUP.Optional.Incredibar.A, HKLM\SOFTWARE\IB Updater, , [d397d6eb354640f6c97a7d6c16ecd62a], PUP.Optional.BundleInstaller.A, HKLM\SOFTWARE\WOW6432NODE\VITTALIA\AxtanInstaller, , [77f3962b374414225fdb9564da28f10f], PUP.Optional.PriceGong.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\PriceGong, , [73f79f22502b3cfaad73f7ffcd353ac6], PUP.Optional.Spigot.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Search Settings, , [5c0e16ab84f75fd744b7e849719304fc], PUP.Optional.DataMngr.A, HKU\S-1-5-21-82016817-340743653-2786680247-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DataMngr, , [6802863b403bb77f990e5db441c3de22], PUP.Optional.DataMngr.A, HKU\S-1-5-21-82016817-340743653-2786680247-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DataMngr_Toolbar, , [3535cff263183cfaf9adc74af410b050], PUP.Optional.PriceGong.A, HKU\S-1-5-21-82016817-340743653-2786680247-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\PriceGong, , [4327d3eee49740f6c25e51a58c7643bd], PUP.Optional.Spigot.A, HKU\S-1-5-21-82016817-340743653-2786680247-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Search Settings, , [1b4f4978bebdd75f27d4f1406b996a96], PUP.Optional.DealPly.A, HKU\S-1-5-21-82016817-340743653-2786680247-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\gaiilaahiahdejapggenmdmafpmbipje, , [28429e232655e650bc3f5d83956d15eb], PUP.Optional.BProtector.A, HKU\S-1-5-21-82016817-340743653-2786680247-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\bProtectSettings, , [a7c3ab16d8a3f73ffcfc967e8c78a060], PUP.Optional.Softonic.A, HKU\S-1-5-21-82016817-340743653-2786680247-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOFTONIC\Universal Downloader, , [eb7fc100fc7fa096c2039f4b40c2768a], PUP.Optional.DealPly.A, HKU\S-1-5-21-82016817-340743653-2786680247-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\gaiilaahiahdejapggenmdmafpmbipje, , [4a207a478eede94d26d5fee282800bf5], Registrierungswerte: 6 PUP.Optional.StartPage.A, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS\{336D0C35-8A85-403a-B9D2-65C292C39087}, , [d39778494d2e1f17475f510f0ff3fd03], PUP.Optional.StartPage.A, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|{336D0C35-8A85-403A-B9D2-65C292C39087}, C:\Program Files\IB Updater\Firefox, , [d39778494d2e1f17475f510f0ff3fd03] PUP.Optional.Incredibar, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}, C:\Program Files\IB Updater\Firefox, , [6406863be695c47255f0da430ef64cb4] PUP.Optional.Incredibar, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}, C:\Program Files\IB Updater\Firefox, , [ce9c249da1daaf87281d2feeab59f010] PUP.BProtector, HKU\S-1-5-21-82016817-340743653-2786680247-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|bProtector Start Page, hxxp://search.babylon.com/?affID=115284&tt=4612_4&babsrc=HP_ss&mntrId=b4f9547d00000000000000ff01000001, , [aac0962b413abb7b2f79d53c9f65b34d] PUP.BProtector, HKU\S-1-5-21-82016817-340743653-2786680247-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|bProtectorDefaultScope, {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}, , [5f0b843d1d5ecb6b4d5c0d04877d6b95] Registrierungsdaten: 0 (No malicious items detected) Ordner: 11 PUP.Optional.OpenCandy, C:\Users\Adrian\AppData\Roaming\OpenCandy, , [0664665be2990333339301acca387789], PUP.Optional.OpenCandy, C:\Users\Adrian\AppData\Roaming\OpenCandy\434853B05B3C418EB60998C8E85F5ADE, , [0664665be2990333339301acca387789], PUP.Optional.OpenCandy, C:\Users\Adrian\AppData\Roaming\OpenCandy\DB70981154B94407978A0294757166D4, , [0664665be2990333339301acca387789], PUP.Optional.OpenCandy, C:\Users\Adrian\AppData\Roaming\OpenCandy\OpenCandy_DB70981154B94407978A0294757166D4, , [0664665be2990333339301acca387789], PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\LocalLow\BabylonToolbar, , [85e52d94ff7cb680bce4a91646bc758b], PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\LocalLow\BabylonToolbar\BabylonToolbar, , [85e52d94ff7cb680bce4a91646bc758b], PUP.Optional.Spigot.A, C:\Users\Adrian\AppData\LocalLow\Search Settings, , [c3a7ead7b0cb162024ecc0067d858878], PUP.Optional.Spigot.A, C:\Users\Adrian\AppData\LocalLow\Search Settings\res, , [c3a7ead7b0cb162024ecc0067d858878], PUP.Optional.Spigot.A, C:\Users\Adrian\AppData\LocalLow\Search Settings\temp, , [c3a7ead7b0cb162024ecc0067d858878], PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\LocalLow\Incredibar.com, , [2743269bea913afc5e6100ca1de541bf], PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\LocalLow\Incredibar.com\incredibar, , [2743269bea913afc5e6100ca1de541bf], Dateien: 138 PUP.Optional.InstallMonetizer, C:\$Recycle.Bin\S-1-5-21-82016817-340743653-2786680247-1000\$R8BM3J9.exe, , [82e8ecd5a2d90c2ac2f078c7ac587888], PUP.Optional.DealPly.A, C:\Windows\System32\Tasks\DealPlyUpdate, , [afbbffc20c6ff83e9d2fa33539c9c040], PUP.Optional.Browsemngr.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\searchplugins\browsemngr.xml, , [e9818938384354e2fdddc41bbb4737c9], PUP.Optional.Perion.A, C:\Windows\System32\ARFC\wrtc.exe, , [105a0cb5fb80ec4a47fedc0dba485fa1], PUP.Optional.MyStartSearch.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\searchplugins\MyStart Search.xml, , [99d18d348dee0234bf7018d79969f907], PUP.Optional.BProtector.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\bProtector_extensions.sqlite, , [5218378a83f892a43c977c74ce348a76], PUP.Optional.BProtector.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\bprotector_prefs.js, , [95d59c253348999d8252af4161a16799], PUP.Optional.Conduit.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\searchplugins\conduit.xml, , [d496299859222a0c5f8f46aaf60c649c], PUP.Optional.OpenCandy, C:\Users\Adrian\AppData\Roaming\OpenCandy\434853B05B3C418EB60998C8E85F5ADE\2877.ico, , [0664665be2990333339301acca387789], PUP.Optional.OpenCandy, C:\Users\Adrian\AppData\Roaming\OpenCandy\434853B05B3C418EB60998C8E85F5ADE\AVG Toolbar Installer.exe, , [0664665be2990333339301acca387789], PUP.Optional.OpenCandy, C:\Users\Adrian\AppData\Roaming\OpenCandy\434853B05B3C418EB60998C8E85F5ADE\AVG_Toolbar_CB_ALL_p2v0.exe, , [0664665be2990333339301acca387789], PUP.Optional.OpenCandy, C:\Users\Adrian\AppData\Roaming\OpenCandy\434853B05B3C418EB60998C8E85F5ADE\EBB77268-338F-4C6A-8590-AD88FED26F4A, , [0664665be2990333339301acca387789], PUP.Optional.OpenCandy, C:\Users\Adrian\AppData\Roaming\OpenCandy\434853B05B3C418EB60998C8E85F5ADE\OCBrowserHelper_1.0.3.85.dll, , [0664665be2990333339301acca387789], PUP.Optional.OpenCandy, C:\Users\Adrian\AppData\Roaming\OpenCandy\DB70981154B94407978A0294757166D4\TuneUpUtilities2012_de-DE_1002175.exe, , [0664665be2990333339301acca387789], PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.admin", false);), ,[5a10efd21863e6509e264ea030d4e61a] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.aflt", "babsst");), ,[b3b7d2ef1962bd790fb565894eb6936d] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.appId", "{BDB69379-802F-4eaf-B541-F8DE92DD98DB}");), ,[a0caa120f2893105e2e2f6f8bd475ca4] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.babext", "babExt");), ,[1f4b873a3c3f53e394307579fb09d828] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.babtrack", "babTrack");), ,[7cee378a205bc175388c48a68d77956b] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.bbDpng", "17");), ,[8bdf952c037869cdbc08d11d1de7ca36] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.cntry", "DE");), ,[2e3c9a27a6d5c96d1aaa935b2bd9ea16] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.dfltLng", "en");), ,[0664a918205ba88ee7dd8569ed17ec14] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.dfltsrch", "false");), ,[68027a470477c373ccf86985699b0df3] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.dpkLst", "");), ,[d7935968c2b9b086a71d20ced82cef11] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.envrmnt", "production");), ,[1159823f9dde43f3388c02ec996ba060] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.excTlbr", false);), ,[bcaeebd6fd7e74c210b45c92828237c9] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.firstrun", false);), ,[ec7e2e936b102c0abd07c92523e106fa] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.hdrMd5", "114E245EB796C630DBB4F3172D337247");), ,[2d3d774a4e2dac8a17ad6589a3618e72] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.hmpg", false);), ,[0d5d8e330477211511b36b83a95b45bb] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.hrdid", "b4f9547d00000000000000ff01000001");), ,[ea80a51c3e3de056e1e3f8f6956f1ce4] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.id", "b4f9547d00000000000000ff01000001");), ,[bcaeccf5205bae882c9807e720e46e92] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.instlDay", "15658");), ,[f179d0f17dfe122417adc727fe062ed2] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.instlRef", "sst");), ,[95d57f423a4170c6c400836b9e66d32d] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.isdcmntcmplt", "false");), ,[4921b50c7704ee48754fbe3046be29d7] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.keywordurl", "");), ,[a2c8962b7dfeb97d4b799559897b08f8] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.8.3.817:19:28");), ,[6802d4ed96e543f39a2a5797a75d758b] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.lastdp", 15);), ,[ee7cc2ff7cff1a1cf5cf47a706fe4ab6] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.mntrvrsn", "1.3.1");), ,[beac9a277dfe50e6774d47a77c88e818] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.newTab", false);), ,[7af0f0d15526ec4aad17856926de1de3] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.newtab", "false");), ,[9fcb8b366b1041f54b79ab43679d39c7] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.newtaburl", "");), ,[4525a21fbebddc5a883ce10d9c6832ce] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.pnu_base", "{\"newVrsn\":\"60\",\"lastVrsn\":\"60\",\"vrsnLoad\":\"\",\"showMsg\":\"false\",\"showSilent\":\"true\",\"msgTs\":0,\"lstMsgTs\":\"0\"}");), ,[2545a31e2655979f2e9601eddc28f808] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");), ,[a7c305bcb0cb41f57b49d21cda2a4cb4] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.prtnrId", "babylon");), ,[5f0b08b972098ea810b442ac040026da] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.savedVrsnTs", "1");), ,[3f2b556ce79486b0d3f1e60841c3ff01] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.sg", "azb");), ,[e288e6db8cef2511467e9e50dc2860a0] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.smplGrp", "azb");), ,[57133e8318630333b90ba6487a8aad53] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.srcext", "");), ,[0a60ba07adce46f06e565698d331d52b] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.srch", "");), ,[d09a1ca53d3e0c2ad7ed608ea55f7b85] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.srchprvdr", "");), ,[1d4d3d84106b90a614b09658c53f7789] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.tlbrId", "base");), ,[89e1e3def18aea4c596b29c54fb57d83] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "hxxp://search.babylon.com/?babsrc=TB_def&mntrId=b4f9547d00000000000000ff01000001&q=");), ,[81e917aa2a512a0c2a9aab4343c16898] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.vrsn", "1.8.3.8");), ,[1357d9e81b607cba9b293db156aed22e] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.vrsnTs", "1.8.3.817:19:28");), ,[1357b30eabd047ef7f453bb329db3fc1] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.vrsni", "1.8.3.8");), ,[bcaec6fb1e5dfe38e1e31ed0c53fd927] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar_i.smplGrp", "none");), ,[2f3bb0119cdf40f61ca8a6486e96ee12] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.8.3.817:19:28");), ,[bab0962bd3a843f3289c49a528dc738d] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.actvtyRptTime", "1352990610226");), ,[a3c730915922ec4a8a3c03ebc53f7090] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.admin", false);), ,[a9c1f3ceec8f85b16b5b1fcf5aaa946c] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.aflt", "orgnl");), ,[ef7b754c7cff30060bbbf5f90202d030] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.afterInstallRpt", "sent");), ,[bbaf833e2d4e7eb8c40211dd4bb9fd03] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.cntry", "DE");), ,[3733e8d9334849ed14b26688db297f81] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.dfltLng", "EN");), ,[7ded7150ccaf5fd7ecda3cb2788c9c64] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.dfltSrch", false);), ,[5d0de0e1d5a64ee8aa1c9b53de26d927] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.dfltsrch", "false");), ,[cd9d3b86fc7f5fd7497d09e509fbbf41] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.did", "10665");), ,[0b5f328fed8e1f17f2d4529c84806b95] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.envrmnt", "production");), ,[b9b109b846356cca4f77569836ce7b85] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.excTlbr", false);), ,[cb9f625f7b0096a0fcca00ee32d258a8] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.hdrMd5", "340AD678C872ADDF850F9648B6EF9827");), ,[7dede5dcb5c6bc7a289ec42a7094a957] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.hmpg", false);), ,[6cfe5d64b1cadb5b398d30bee0248b75] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.hrdid", "b4f9547d00000000000000ff01000001");), ,[ea8003be95e679bd01c531bdf50f11ef] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.id", "b4f9547d00000000000000ff01000001");), ,[f575e2df3546d6608a3c7b735ba9728e] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.installerproductid", "26");), ,[2e3ca1209ae1201630961bd39173d927] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.instlDay", "15640");), ,[a5c51ca5d5a690a6913528c66d97b54b] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.instlRef", "");), ,[5911ab16e7944de9982ea84632d2946c] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.isDcmntCmplt", true);), ,[b6b4358c3546ed49f8ce15d9d92b02fe] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.isdcmntcmplt", "false");), ,[0f5b368b43381e188c3ac62814f0946c] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.keywordurl", "");), ,[2f3b18a9f78494a226a09b53a46016ea] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.lastVrsnTs", "1.5.11.1419:44:52");), ,[9cce9928443767cfe2e48f5fbd478779] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.mntrvrsn", "1.2.0");), ,[c8a2bd04d3a889ad84427f6f35cfd12f] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.newTab", false);), ,[11596160067574c2cff7a6488a7a48b8] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.newtab", "false");), ,[95d57a470a71c0767b4bc727f90bbf41] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.newtaburl", "");), ,[74f6e4ddb3c83bfbfacc42aca55f57a9] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.noFFXTlbr", false);), ,[bbaf9e23d8a30036be08fcf21fe56d93] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.ppd", "");), ,[16543e833645a1954086915d58ac23dd] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.prdct", "incredibar");), ,[5713b30ec1ba1c1a5571af3f24e08779] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.productid", "26");), ,[402a764b38431b1b0abc26c842c25ea2] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.prtnrId", "Incredibar");), ,[54162899e497fe382b9b49a580849769] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.sg", "none");), ,[c5a580416318bd79289e56986e966997] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.smplGrp", "none");), ,[52186d542754b1858343836bd232a15f] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.srch", "");), ,[25453b864734bc7ae1e5628cf50f9868] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.srchprvdr", "");), ,[f9712f928bf016207f474ba32fd517e9] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.tlbrId", "base");), ,[78f23091403bcd69c9fdf7f77d87649c] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6R8JrRz5pI&loc=IB_TB&i=26&search=");), ,[640618a991eaf93d0cba49a5679ddf21] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.upn2", "6R8JrRz5pI");), ,[c3a7546db9c259dd279f599515ef02fe] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.upn2n", "92825299328126310");), ,[8edce5dc0f6c39fddde9ac4259ab3bc5] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.vrsn", "1.5.11.14");), ,[b1b939881269f442ccfafef06c98e917] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.vrsnTs", "1.5.11.1419:44:52");), ,[6dfd3e8375063bfbc501806e41c3916f] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.vrsni", "1.5.11.14");), ,[7ceead14403bf4423294fef0f60e3fc1] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.aflt", "orgnl");), ,[83e77d44c1ba7cbaeadc40aef014cf31] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.dfltLng", "");), ,[6cfec4fd1368ef47c30338b62ed66898] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.did", "10665");), ,[3b2f3e8317646dc9ffc7be3059ab2fd1] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.excTlbr", false);), ,[82e8f9c83a4143f3a02602ec5da70bf5] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.id", "b4f9547d00000000000000ff01000001");), ,[c6a4f5ccb6c5b680a0264f9f36ceb34d] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.installerproductid", "26");), ,[1b4f8e33bfbcc47208be3db18e76de22] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.instlDay", "15640");), ,[66049928394265d1f9cdbe304db77f81] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.instlRef", "");), ,[98d2ba076516b1858640a24c50b41be5] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.ms_url_id", "");), ,[dc8e913073081521b11503eb6c982fd1] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.newTab", false);), ,[e48678496219270f319578765ba9df21] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.ppd", "");), ,[11593e83f18a1323cef8905e9d672dd3] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.prdct", "incredibar");), ,[d397e2df27541c1ae0e649a5ab59df21] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.productid", "26");), ,[e9813988770463d3824479757c88966a] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.prtnrId", "Incredibar");), ,[a6c48a3762194aec8244bc326d97a15f] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.smplGrp", "none");), ,[beac41805229bb7b2b9ba24c51b3a65a] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.tlbrId", "base");), ,[c1a950711f5c6dc9e9ddbe30bc482dd3] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6R8JrRz5pI&loc=IB_TB&i=26&search=");), ,[105ab01192e92214e6e0dc126a9ae11f] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.upn2", "6R8JrRz5pI");), ,[95d5d3ee44373303784e8f5fd92bfb05] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.upn2n", "92825299328126310");), ,[3634ac15a2d978bec006aa447193cd33] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.vrsn", "1.5.11.14");), ,[2347b60bed8efe38fec899551aea12ee] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1419:44:52");), ,[cd9de2df2655bb7b0db99e50ce36e020] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.vrsni", "1.5.11.14");), ,[4723734e265575c18e3818d6966ef010] PUP.Optional.Softonic.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_whiteList", "{\"search.babylon.com\":\"q\",\"search.sweetim.com\":\"q\",\"search.imesh.net\":\"q\",\"www.search-results.com\":\"q\",\"home.mywebsearch.com\":\"searchfor\",\"search.mywebsearch.com\":\"searchfor\",\"search.mindspark.com\":\"searchfor\",\"search.conduit.com\":\"q\",\"search.zugo.com\":\"p\",\"www2.mystart.com\":\"q\",\"www.mystart.com\":\"q\",\"www.bigseekpro.com\":\"q\",\"bigseekpro.com\":\"q\",\"bigspeedpro.com\":\"q\",\"search.esnips.com\":\"searchQuery\",\"search.foxtab.com\":\"q\",\"search.brothersoft.com\":\"keyword\",\"search.softonic.com\":\"q\",\"www.dogpile.com\":\"q\",\"search.infospace.com\":\"q\",\"search.iobit.com\":\"q\",\"search.iminent.com\":\"\",\"search.facemoods.com\":\"s\",\"www.plusnetwork.com\":\"q\",\"www.alothome.com\":\"q\",\"alothome.com\":\"q\",\"search.alothome.com\":\"q\",\"search.chatvibes.com\":\"q\",\"search.blekko.com\":\"\",\"www.searchnu.com\":\"q\",\"searchnu.com\":\"q\",\"search.icq.com\":\"q\",\"search.etype.com\":\"query\",\"isearch.babylon.com\":\"q\",\"search.utorrent.com\":\"\",\"search.bittorrent.com\":\"\",\"search.bearshare.com\":\"q\",\"search.bearshare.net\":\"q\",\"searchya.com\":\"q\",\"int.search-results.com\":\"q\",\"search.searchcompletion.com\":\"q\",\"www.adoresearch.com\":\"q\",\"www.searchcore.net\":\"q\",\"googosearch.info\":\"terms\",\"bar.searchqu.com\":\"q\",\"search.speedbit.com\":\"q\",\"search.toggle.com\":\"q\",\"click.searchnation.net\":\"query\",\"isearch.whitesmoke.com\":\"q\",\"search.handycafe.com\":\"q\",\"searchassist.babylon.com\":\"q\",\"searchnation.net\":\"query\",\"video.searchcompletion.com\":\"q\",\"www.searchbrowsing.com\":\"q\",\"search.anchorfree.net\":\"q\",\"search.hotspotshield.com\":\"q\",\"dts.search-results.com\":\"q\",\"uk.search-results.com\":\"q\",\"search.chatzum.com\":\"q\",\"search.phpnuke.org\":\"q\",\"www.i-mysearch.com\":\"q\",\"search.smartaddressbar.com\":\"q\",\"www.search-guru.com\":\"q\",\"mysearch.sweetim.com\":\"q\",\"searchgby.com\":\"\",\"thespecialsearch.com\":\"q\",\"search.bpath.com\":\"q\",\"start.funmoods.com\":\"s\",\"fr.search-results.com\":\"q\",\"de.search-results.com\":\"q\",\"it.search-results.com\":\"q\",\"es.search-results.com\":\"q\",\"search.imesh.com\":\"q\",\"search.swagbucks.com\":\"q\",\"isearch.avg.com\":\"q\",\"search.avg.com\":\"q\",\"search.yippy.com\":\"query\",\"cludr.com\":\"q\",\"search.vmn.net\":\"q\",\"www.gigablast.com\":\"q\",\"www.metacrawler.com\":\"q\",\"www.webcrawler.com\":\"q\",\"www.ixquick.com\":\"\",\"www.search.com\":\"q\",\"www.excite.com\":\"q\",\"duckduckgo.com\":\"q\",\"search.lycos.com\":\"q\",\"webfetch.com\":\"q\",\"monstercrawler.com\":\"q\",\"go.com\":\"p\",\"hotbot.com\":\"keyword\",\"home.myplaycity.com\":\"s\",\"www.findamo.com\":\"q\",\"search.gboxapp.com\":\"q\",\"start.iplay.com\":\"q\",\"home.speedbit.com\":\"q\",\"home.sweetim.com\":\"q\",\"search.alot.com\":\"q\",\"search.searchplusnetwork.com\":\"q\",\"www.searchqu.net\":\"\",\"us.yhs4.search.yahoo.com\":\"p\",\"search.insiteapp.com\":\"q\",\"somoto.com\":\"q\",\"blekko.com\":\"\",\"uk.yhs4.search.yahoo.com\":\"p\",\"fr.yhs4.search.yahoo.com\":\"p\",\"suggestor.netliker.com\":\"\",\"search.netliker.com\":\"\",\"insta-search.com\":\"q\",\"www.fast-search.biz\":\"q\",\"start.facemoods.com\":\"s\",\"search.coolnovo.com\":\"\",\"chromeplus.info\":\"q\",\"in.yhs4.search.yahoo.com\":\"p\",\"in.yhs.search.yahoo.com\":\"p\",\"www.searchble.com\":\"keyword\",\"home.allgameshome.com\":\"s\",\"forsearch.net\":\"q\",\"allssearch.com\":\"q\",\"search.snap.do\":\"q\",\"us.yhs.search.yahoo.com\":\"p\",\"uk.yhs.search.yahoo.com\":\"p\",\"fr.yhs.search.yahoo.com\":\"p\",\"search.smartsearchbox.net\":\"\",\"search.seznam.cz\":\"q\",\"search.funmoods.com\":\"s\",\"search.avira.com\":\"q\",\"search.jzip.com\":\"q\",\"search.findeer.com\":\"\",\"search-faster.com\":\"\",\"dnssearch.rr.com\":\"search\",\"search.rr.com\":\"q\",\"search.kalloutsearch4.com\":\"q\",\"kalloutsearch4.com\":\"Keywords\",\"search.rapidns.net\":\"SearchQuery\",\"websearch.4shared.com\":\"q\",\"images.search.conduit.com\":\"q\",\"search.cpchero.biz\":\"q\",\"search.kikin.com\":\"q\",\"www.engine-search.biz\":\"q\",\"www.mysearchresults.com\":\"q\",\"search.vdc.com.vn\":\"SearchQuery\",\"search.charter.net\":\"search\",\"search-vbc.com\":\"keywords\",\"search.pch.com\":\"q\",\"search.pantip.com\":\"\",\"www.startsearcher.com\":\"q\",\"search.icafemanager.com\":\"q\",\"aolsearcht10.search.aol.com\":\"q\",\"search.free.fr\":\"\",\"www.similarsitesearch.com\":\"URL\",\"qoqole.com\":\"q\",\"www.claro-search.com\":\"q\",\"isearch.claro-search.com\":\"q\",\"www.uncoverthenet.com/search\":\"q\",\"www.searchcanvas.com\":\"q\",\"search.etoolkit.com\":\"q\",\"www.searchalgo.com\":\"q\",\"bestsearchall.com\":\"q\",\"bestorganicsearch.com\":\"q\",\"mysearchproperties.com\":\"q\",\"search.treasuretrooper.com\":\"q\",\"btsearch.name\":\"q\",\"optu.search-help.net\":\"search\",\"search.clinck.in\":\"q\",\"search.shareazaweb.net\":\"q\",\"search.solarmash.com\":\"q\",\"search.surfcanyon.com\":\"q\",\"search.tedata.net\":\"SearchQuery\",\"www.gooofullsearch.com\":\"keywords\",\"www.alnaddy.com\":\"q\",\"searchsafer.com\":\"q\",\"www.searchqu.com\":\"q\",\"searchfunmoods.com\":\"s\",\"www.searchfunmoods.com\":\"s\",\"www.searchya.com\":\"q\",\"search.lphant.net\":\"\",\"searchremagnified.com\":\"\",\"www.pagequeryresults.com\":\"\",\"www.searchqueryresults.com\":\"\",\"domainhelp.search.com\":\"q\",\"search.b1.org\":\"q\",\"search.pontofrio.com.br\":\"q\",\"search.maxonline.com.sg\":\"q\",\"search.us.com\":\"k\",\"www.picsearch.com\":\"q\",\"www.search-document.com\":\"q\",\"www.searchsafer.com\":\"q\",\"www.website-unavailable.com\":\"q\",\"fantastigames.metacrawler.com\":\"q\"}|||8641356441385431");), ,[f674c6fba6d5ce68c90607e7778d43bd] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "hxxp://search.babylon.com/?babsrc=TB_def&mntrId=b4f9547d00000000000000ff01000001&q=");), ,[a3c78c35cab178be9da9678753b155ab] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.id", "b4f9547d00000000000000ff01000001");), ,[6bff556c0d6e2a0ce36306e8cf35aa56] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.appId", "{BDB69379-802F-4eaf-B541-F8DE92DD98DB}");), ,[5911d6eb9edddd592e18509e9074c53b] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.instlDay", "15658");), ,[2f3b7f423f3c0f2788be09e55aaacb35] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.vrsn", "1.8.3.8");), ,[8cdeecd5fa818ea8c581d21c39cbba46] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.vrsni", "1.8.3.8");), ,[5e0cac15403b0d29c086826c1de7d12f] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.8.3.817:19:28");), ,[2248a21f700b2b0b2c1a0de17d87a55b] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.prtnrId", "babylon");), ,[cb9fcaf782f9b0866bdb18d6f212d62a] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");), ,[2c3ef9c80675340232140ce24bb908f8] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.aflt", "babsst");), ,[2b3f7849b1ca05313a0cb5393fc560a0] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar_i.smplGrp", "none");), ,[adbd942d1a617abcc482aa44679d956b] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.tlbrId", "base");), ,[36345071fe7d280e073fee00cb39f20e] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.instlRef", "sst");), ,[bcae10b12754b0863b0bc925ff050cf4] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.dfltLng", "en");), ,[d4962e93a5d65fd77bcb16d8ae569b65] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.excTlbr", false);), ,[2b3f6f52285348ee7ccab13d5ca8857b] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.admin", false);), ,[e08ac7faee8db87e52f4608e37cdef11] Physische Sektoren: 0 (No malicious items detected) (end) FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-08-2014 Ran by Julian (administrator) on USER-PC on 03-08-2014 18:06:29 Running from C:\Users\Julian\Downloads Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe () C:\Windows\SysWOW64\PnkBstrA.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_w32.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_x64.exe (Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe (Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (FNet Co., Ltd.) C:\Program Files (x86)\XFastUsb\XFastUsb.exe () C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe (Razer USA Ltd.) C:\Program Files (x86)\Razer\Lycosa\razerhid.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe () C:\Program Files (x86)\Razer\DeathAdder\razertra.exe () C:\Program Files (x86)\Razer\Lycosa\razertra.exe (Razer Inc.) C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe () C:\Program Files (x86)\Razer\DeathAdder\vdDaemon.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [615584 2011-03-01] (Atheros Communications) HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [379552 2011-03-01] (Atheros Commnucations) HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2403104 2014-07-25] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-05] (Intel Corporation) HKLM-x32\...\Run: [XFastUsb] => C:\Program Files (x86)\XFastUsb\XFastUsb.exe [4942336 2011-09-05] (FNet Co., Ltd.) HKLM-x32\...\Run: [DeathAdder] => C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe [248320 2011-03-21] () HKLM-x32\...\Run: [Lycosa] => C:\Program Files (x86)\Razer\Lycosa\razerhid.exe [238592 2010-04-13] (Razer USA Ltd.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-05-07] (Oracle Corporation) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-82016817-340743653-2786680247-1007\...\Policies\system: [LogonHoursAction] 2 HKU\S-1-5-21-82016817-340743653-2786680247-1007\...\Policies\system: [DontDisplayLogonHoursWarnings] 1 AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [166568 2014-07-02] (NVIDIA Corporation) AppInit_DLLs: ,C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [166568 2014-07-02] (NVIDIA Corporation) AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [146480 2014-07-02] (NVIDIA Corporation) Startup: C:\Users\Adrian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk ShortcutTarget: OpenOffice.org 3.4.1.lnk -> D:\Programme\OpenOffice\program\quickstart.exe () Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet Pro 8600.lnk ShortcutTarget: Tintenwarnungen überwachen - HP Officejet Pro 8600.lnk -> C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPStatusBL.dll (Hewlett-Packard Co.) BootExecute: GroupPolicyUsers\S-1-5-21-82016817-340743653-2786680247-1002\User: Group Policy restriction detected <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) SearchScopes: HKLM - DefaultScope value is missing. SearchScopes: HKLM-x32 - DefaultScope value is missing. BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\mhasid1l.default FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll () FF Plugin: @java.com/DTPlugin,version=10.60.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.60.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 -> C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB) FF Plugin-x32: @esn/esnlaunch,version=1.118.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll (ESN Social Software AB) FF Plugin-x32: @esn/esnlaunch,version=1.122.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll (ESN Social Software AB) FF Plugin-x32: @java.com/DTPlugin,version=10.60.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.60.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\staged [2014-08-02] FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF} [2014-08-02] FF HKLM\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\IB Updater\Firefox FF HKLM\...\Firefox\Extensions: [{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}] - C:\Program Files\IB Updater\Firefox FF HKLM-x32\...\Firefox\Extensions: [{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}] - C:\Program Files\IB Updater\Firefox ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [76448 2011-03-01] (Atheros Commnucations) [File not signed] S4 DevoloNetworkService; D:\Programme\devolo\dlan\devolonetsvc.exe [3647992 2014-05-14] (devolo AG) R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation) R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation) R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720608 2014-07-25] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18956064 2014-07-25] (NVIDIA Corporation) R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-04-21] () S2 SetupARService; C:\Program Files (x86)\Realtek\Audio\SetupAfterRebootService.exe [24576 2011-12-16] (Realtek Semiconductor.) [File not signed] S4 Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [542912 2014-07-16] (Valve Corporation) [File not signed] S4 WireHelpSvc; C:\Program Files\Common Files\WireHelpSvc.exe [168864 2011-11-28] () S4 FirebirdServerMAGIXInstance; C:\Program Files (x86)\MAGIX\Common\Database\bin\fbserver.exe [X] S4 UPnPService; C:\Program Files (x86)\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 ALSysIO; No ImagePath U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) S3 bulkadi; C:\Windows\System32\DRIVERS\bulkrazer_x64.sys [25088 2011-02-09] (Windows (R) Codename Longhorn DDK provider) R3 ESLvnic1; C:\Windows\System32\DRIVERS\ESLvnic.sys [25528 2011-11-28] (Turtle Entertainment GmbH) R2 ESLWireAC; C:\Windows\system32\drivers\ESLWireACD.sys [147472 2011-11-28] (<Turtle Entertainment>) S3 FNETTBOH_305; C:\Windows\System32\drivers\FNETTBOH_305.SYS [31808 2011-12-16] (FNet Co., Ltd.) R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [15936 2011-09-05] (FNet Co., Ltd.) R3 Lycosa; C:\Windows\System32\drivers\Lycosa.sys [20352 2009-09-30] (Razer USA Ltd.) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-08-03] (Malwarebytes Corporation) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation) R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation) R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2014-05-14] (CACE Technologies) R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-07-25] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation) S1 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2006-07-24] () [File not signed] S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 IntcAzAudAddService; system32\drivers\RTKVHD64.sys [X] S2 SSPORT; \??\C:\Windows\system32\Drivers\SSPORT.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-03 18:06 - 2014-08-03 18:06 - 00014469 _____ () C:\Users\Julian\Downloads\FRST.txt 2014-08-03 18:06 - 2014-08-03 18:06 - 00000000 ____D () C:\FRST 2014-08-03 18:03 - 2014-08-03 18:03 - 00380416 _____ () C:\Users\Julian\Downloads\Gmer-19357.exe 2014-08-03 18:02 - 2014-08-03 18:02 - 02094080 _____ (Farbar) C:\Users\Julian\Downloads\FRST64.exe 2014-08-03 18:00 - 2014-08-03 18:00 - 00000000 ____D () C:\Users\Julian\Desktop\Logfi 2014-08-03 17:52 - 2014-08-03 17:54 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-08-03 17:49 - 2014-08-03 17:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-08-03 17:49 - 2014-08-03 17:49 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-08-03 17:49 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-08-03 17:49 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-08-03 17:48 - 2014-08-03 17:48 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Julian\Downloads\mbam-setup-2.0.2.1012.exe 2014-08-03 17:46 - 2014-08-03 17:49 - 00000000 ____D () C:\Users\Julian\AppData\Roaming\Malwarebytes 2014-08-03 17:38 - 2014-08-03 17:38 - 00336176 _____ () C:\Windows\Minidump\080314-20888-01.dmp 2014-08-03 09:34 - 2014-08-03 09:34 - 00000809 _____ () C:\Users\Adrian\Desktop\FUSSBALL MANAGER 13.lnk 2014-08-03 09:05 - 2014-08-03 09:05 - 00336184 _____ () C:\Windows\Minidump\080314-16785-01.dmp 2014-08-02 23:58 - 2014-08-02 23:58 - 00000000 ____D () C:\Users\Adrian\Desktop\Neuer Ordner 2014-08-02 23:58 - 2013-05-14 20:56 - 00000847 _____ () C:\Users\Adrian\Desktop\FIFA 13.lnk 2014-08-02 23:43 - 2014-08-02 23:46 - 00000350 _____ () C:\Users\Adrian\Desktop\Hallo Adrian.txt 2014-08-02 23:37 - 2013-05-10 11:57 - 01661440 _____ (Slackerhome Productions) C:\Users\User\Desktop\Better DS3.exe 2014-08-02 23:32 - 2013-03-13 23:11 - 00000513 _____ () C:\Users\User\Desktop\Programme und Funktionen - Verknüpfung (2).lnk 2014-08-02 23:32 - 2013-03-13 22:56 - 00000493 _____ () C:\Users\User\Desktop\Wartungscenter - Verknüpfung (2).lnk 2014-08-02 23:31 - 2013-04-20 18:18 - 00000000 _____ () C:\Users\User\Desktop\Neues Textdokument (5).txt 2014-08-02 23:31 - 2013-03-13 22:56 - 00000493 _____ () C:\Users\User\Desktop\Windows Update - Verknüpfung (2).lnk 2014-08-02 23:31 - 2013-03-01 15:18 - 00001123 _____ () C:\Users\User\Desktop\ Malwarebytes Anti-Malware (2).lnk 2014-08-02 23:31 - 2013-02-20 19:01 - 00002117 _____ () C:\Users\User\Desktop\Microsoft Security Essentials (2).lnk 2014-08-02 23:31 - 2012-07-03 17:11 - 27904000 _____ () C:\Users\User\Desktop\CF-Root-SGS3-v6.4.tar 2014-08-02 23:30 - 2013-03-13 23:11 - 00000513 _____ () C:\Users\User\Desktop\Programme und Funktionen - Verknüpfung.lnk 2014-08-02 23:30 - 2013-03-13 22:56 - 00000493 _____ () C:\Users\User\Desktop\Windows Update - Verknüpfung.lnk 2014-08-02 23:30 - 2013-03-13 22:56 - 00000493 _____ () C:\Users\User\Desktop\Wartungscenter - Verknüpfung.lnk 2014-08-02 23:29 - 2013-04-20 18:18 - 00000000 _____ () C:\Users\User\Desktop\Neues Textdokument (4).txt 2014-08-02 23:29 - 2013-02-20 19:01 - 00002117 _____ () C:\Users\User\Desktop\Microsoft Security Essentials.lnk 2014-08-02 23:27 - 2014-08-02 23:28 - 00000000 ____D () C:\Users\Julian\AppData\Local\NVIDIA Corporation 2014-08-02 23:27 - 2014-08-02 23:27 - 00000000 ____D () C:\Users\Julian\AppData\Local\NVIDIA 2014-08-02 23:17 - 2014-08-03 09:32 - 00000000 ____D () C:\Users\Adrian\AppData\Local\BetterDS3 2014-08-02 23:16 - 2013-05-10 11:57 - 01661440 _____ (Slackerhome Productions) C:\Users\Adrian\Desktop\Better DS3.exe 2014-08-02 23:12 - 2014-07-02 19:44 - 00609240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe 2014-08-02 23:10 - 2014-07-02 22:48 - 31512520 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll 2014-08-02 23:10 - 2014-07-02 22:48 - 24196896 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll 2014-08-02 23:10 - 2014-07-02 22:48 - 22994208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll 2014-08-02 23:10 - 2014-07-02 22:48 - 17555104 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll 2014-08-02 23:10 - 2014-07-02 22:48 - 15294296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll 2014-08-02 23:10 - 2014-07-02 22:48 - 13922752 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll 2014-08-02 23:10 - 2014-07-02 22:48 - 13835208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll 2014-08-02 23:10 - 2014-07-02 22:48 - 12866008 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys 2014-08-02 23:10 - 2014-07-02 22:48 - 11283344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll 2014-08-02 23:10 - 2014-07-02 22:48 - 11222048 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll 2014-08-02 23:10 - 2014-07-02 22:48 - 04247000 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll 2014-08-02 23:10 - 2014-07-02 22:48 - 03989960 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll 2014-08-02 23:10 - 2014-07-02 22:48 - 01890080 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434052.dll 2014-08-02 23:10 - 2014-07-02 22:48 - 01539928 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434052.dll 2014-08-02 23:10 - 2014-07-02 22:48 - 00944928 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll 2014-08-02 23:10 - 2014-07-02 22:48 - 00907096 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll 2014-08-02 23:10 - 2014-07-02 22:48 - 00903624 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll 2014-08-02 23:10 - 2014-07-02 22:48 - 00869152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll 2014-08-02 23:10 - 2014-07-02 22:48 - 00846832 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll 2014-08-02 23:10 - 2014-07-02 22:48 - 00354016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll 2014-08-02 23:10 - 2014-07-02 22:48 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll 2014-08-02 23:10 - 2014-07-02 22:48 - 00166568 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll 2014-08-02 22:59 - 2014-08-02 22:59 - 00000000 ____D () C:\Users\scndAdmin\Desktop\Neuer Ordner 2014-08-02 22:54 - 2014-08-02 22:54 - 00000000 ____D () C:\Users\scndAdmin\AppData\Roaming\MotioninJoy 2014-08-02 22:53 - 2014-08-02 22:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MotioninJoy 2014-08-02 22:53 - 2014-08-02 22:53 - 00000000 ____D () C:\Program Files\MotioninJoy 2014-08-02 22:53 - 2011-12-07 19:42 - 00328712 _____ (Logitech Inc.) C:\Windows\system32\MijFrc.dll 2014-08-02 22:52 - 2014-08-02 22:52 - 00000000 ____D () C:\Users\Public\Documents\Atheros 2014-08-02 22:37 - 2014-08-02 23:00 - 00000000 ____D () C:\Users\scndAdmin\Documents\Bluetooth Folder 2014-08-02 22:37 - 2014-08-02 22:37 - 00000000 ____D () C:\Users\scndAdmin\AppData\Local\BMExplorer 2014-08-02 22:05 - 2014-08-02 22:05 - 00008068 _____ () C:\Users\scndAdmin\AppData\Local\CleanupUninstall.txt 2014-08-02 21:36 - 2014-07-25 15:50 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll 2014-08-02 21:36 - 2014-07-25 15:50 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll 2014-08-02 21:18 - 2014-08-02 21:19 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-08-02 21:18 - 2014-08-02 21:18 - 00000000 ____D () C:\Users\scndAdmin\AppData\Roaming\WinRAR 2014-08-02 21:18 - 2014-08-02 21:18 - 00000000 ____D () C:\Users\scndAdmin\AppData\Local\BetterDS3 2014-08-02 21:18 - 2013-05-10 11:57 - 01661440 _____ (Slackerhome Productions) C:\Users\scndAdmin\Desktop\Better DS3.exe 2014-08-02 20:16 - 2014-08-02 20:16 - 00000000 ____D () C:\Users\scndAdmin\AppData\Roaming\de.devolo.dLAN.Cockpit 2014-08-02 19:51 - 2014-08-02 19:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech 2014-08-02 19:51 - 2014-08-02 19:51 - 00000000 ____D () C:\ProgramData\LogiShrd 2014-08-02 19:50 - 2014-08-02 19:50 - 00000000 ____D () C:\Program Files\Common Files\LogiShrd 2014-08-02 19:46 - 2014-08-02 19:46 - 00000000 __SHD () C:\Users\Adrian\AppData\Local\EmieUserList 2014-08-02 19:46 - 2014-08-02 19:46 - 00000000 __SHD () C:\Users\Adrian\AppData\Local\EmieSiteList 2014-08-02 13:45 - 2014-08-02 13:45 - 00000000 ____D () C:\Users\Adrian\AppData\Local\NVIDIA Corporation 2014-08-02 13:45 - 2014-08-02 13:45 - 00000000 ____D () C:\Users\Adrian\AppData\Local\NVIDIA 2014-08-02 11:40 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2014-08-02 11:40 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll 2014-08-02 11:40 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll 2014-08-02 11:40 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe 2014-08-02 11:40 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll 2014-08-02 11:40 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll 2014-08-02 11:40 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll 2014-08-02 11:40 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll 2014-08-02 11:40 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll 2014-08-02 11:40 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll 2014-08-02 11:40 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll 2014-08-02 11:40 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll 2014-08-02 11:40 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe 2014-08-02 11:40 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe 2014-07-28 21:58 - 2014-07-28 21:58 - 00002059 _____ () C:\Users\User\Desktop\autoexec (orig).cfg 2014-07-28 21:58 - 2014-07-28 20:35 - 00010880 _____ () C:\Users\User\Desktop\config (orig).cfg 2014-07-28 16:14 - 2014-07-28 21:58 - 00002059 _____ () C:\Users\User\Desktop\autoexec.cfg 2014-07-28 16:14 - 2014-07-27 15:08 - 00010179 _____ () C:\Users\User\Desktop\config.cfg 2014-07-28 15:45 - 2014-07-28 21:57 - 00001013 _____ () C:\Users\User\Desktop\Neues Textdokument (3).txt 2014-07-24 15:23 - 2014-07-24 15:23 - 00000000 ____D () C:\Users\User\AppData\Roaming\de.devolo.dLAN.Cockpit 2014-07-24 15:20 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-07-24 15:20 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-07-24 15:20 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-07-24 15:20 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-07-24 15:20 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-07-24 15:20 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-07-24 15:20 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-07-24 15:20 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-07-24 15:20 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-07-24 15:20 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-07-24 15:20 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-07-24 15:20 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-07-24 15:20 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-07-24 15:20 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-07-24 15:20 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-07-24 15:20 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-07-24 15:20 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-07-24 15:20 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-07-24 15:20 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-07-24 15:20 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-07-24 15:20 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-07-24 15:20 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-07-24 15:20 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-07-24 15:20 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-07-24 15:20 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-07-24 15:20 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-07-24 15:20 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-07-24 15:20 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-07-24 15:20 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-07-24 15:20 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-07-24 15:20 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-07-24 15:20 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-07-24 15:20 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-07-24 15:20 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-07-24 15:20 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-07-24 15:20 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-07-24 15:20 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-07-24 15:20 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-07-24 15:20 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-07-24 15:20 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-07-24 15:20 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-07-24 15:20 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-07-24 15:20 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-07-24 15:20 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-07-24 15:20 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-07-24 15:20 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-07-24 15:20 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-07-24 15:20 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-07-24 15:20 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-07-24 15:20 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-07-24 15:20 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-07-24 15:20 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-07-24 15:20 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-07-24 15:20 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-07-24 15:20 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-07-24 15:20 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-07-24 15:20 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe 2014-07-24 15:20 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe 2014-07-24 15:20 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-07-24 15:20 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll 2014-07-24 15:20 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll 2014-07-24 15:20 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-07-24 15:20 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2014-07-24 15:20 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2014-07-24 15:20 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2014-07-24 15:20 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2014-07-24 15:20 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2014-07-24 15:20 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2014-07-24 15:20 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2014-07-24 15:20 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2014-07-24 15:20 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2014-07-24 15:20 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2014-07-24 15:20 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2014-07-24 15:20 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2014-07-24 15:20 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2014-07-24 15:20 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys 2014-07-24 15:18 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-07-24 15:18 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2014-07-24 15:18 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-03 18:06 - 2014-08-03 18:06 - 00014469 _____ () C:\Users\Julian\Downloads\FRST.txt 2014-08-03 18:06 - 2014-08-03 18:06 - 00000000 ____D () C:\FRST 2014-08-03 18:03 - 2014-08-03 18:03 - 00380416 _____ () C:\Users\Julian\Downloads\Gmer-19357.exe 2014-08-03 18:02 - 2014-08-03 18:02 - 02094080 _____ (Farbar) C:\Users\Julian\Downloads\FRST64.exe 2014-08-03 18:00 - 2014-08-03 18:00 - 00000000 ____D () C:\Users\Julian\Desktop\Logfi 2014-08-03 17:54 - 2014-08-03 17:52 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-08-03 17:50 - 2009-07-14 06:45 - 00021840 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-08-03 17:50 - 2009-07-14 06:45 - 00021840 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-08-03 17:49 - 2014-08-03 17:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-08-03 17:49 - 2014-08-03 17:49 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-08-03 17:49 - 2014-08-03 17:46 - 00000000 ____D () C:\Users\Julian\AppData\Roaming\Malwarebytes 2014-08-03 17:49 - 2013-03-01 15:18 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-08-03 17:48 - 2014-08-03 17:48 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Julian\Downloads\mbam-setup-2.0.2.1012.exe 2014-08-03 17:45 - 2011-04-12 09:43 - 13982030 _____ () C:\Windows\system32\perfh007.dat 2014-08-03 17:45 - 2011-04-12 09:43 - 04324882 _____ () C:\Windows\system32\perfc007.dat 2014-08-03 17:45 - 2009-07-14 07:13 - 00006292 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-08-03 17:44 - 2013-03-13 22:54 - 00000000 ____D () C:\Users\Julian\AppData\Local\Mozilla 2014-08-03 17:41 - 2011-09-05 13:10 - 01129529 _____ () C:\Windows\WindowsUpdate.log 2014-08-03 17:39 - 2012-07-12 08:36 - 00000035 _____ () C:\Users\Public\Documents\AtherosServiceConfig.ini 2014-08-03 17:38 - 2014-08-03 17:38 - 00336176 _____ () C:\Windows\Minidump\080314-20888-01.dmp 2014-08-03 17:38 - 2013-03-03 17:39 - 00047713 _____ () C:\Windows\setupact.log 2014-08-03 17:38 - 2011-10-04 15:50 - 00000000 ____D () C:\Windows\Minidump 2014-08-03 17:38 - 2011-09-06 11:51 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-08-03 17:38 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-08-03 17:36 - 2011-10-02 19:57 - 00000000 ____D () C:\ProgramData\Origin 2014-08-03 16:15 - 2012-04-25 15:41 - 00000000 ____D () C:\Users\Adrian\AppData\Roaming\Spotify 2014-08-03 09:34 - 2014-08-03 09:34 - 00000809 _____ () C:\Users\Adrian\Desktop\FUSSBALL MANAGER 13.lnk 2014-08-03 09:34 - 2013-04-21 22:59 - 00148696 _____ () C:\Windows\DirectX.log 2014-08-03 09:32 - 2014-08-02 23:17 - 00000000 ____D () C:\Users\Adrian\AppData\Local\BetterDS3 2014-08-03 09:07 - 2011-10-02 19:57 - 00000000 ____D () C:\Program Files (x86)\Origin 2014-08-03 09:05 - 2014-08-03 09:05 - 00336184 _____ () C:\Windows\Minidump\080314-16785-01.dmp 2014-08-02 23:58 - 2014-08-02 23:58 - 00000000 ____D () C:\Users\Adrian\Desktop\Neuer Ordner 2014-08-02 23:46 - 2014-08-02 23:43 - 00000350 _____ () C:\Users\Adrian\Desktop\Hallo Adrian.txt 2014-08-02 23:34 - 2011-09-05 13:18 - 00082768 _____ () C:\Users\User\AppData\Local\GDIPFONTCACHEV1.DAT 2014-08-02 23:28 - 2014-08-02 23:27 - 00000000 ____D () C:\Users\Julian\AppData\Local\NVIDIA Corporation 2014-08-02 23:27 - 2014-08-02 23:27 - 00000000 ____D () C:\Users\Julian\AppData\Local\NVIDIA 2014-08-02 23:27 - 2013-03-13 22:50 - 00082768 _____ () C:\Users\Julian\AppData\Local\GDIPFONTCACHEV1.DAT 2014-08-02 23:27 - 2013-03-13 22:50 - 00001417 _____ () C:\Users\Julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-08-02 23:27 - 2013-03-13 22:50 - 00000680 __RSH () C:\Users\Julian\ntuser.pol 2014-08-02 23:27 - 2013-03-13 22:50 - 00000000 ____D () C:\Users\Julian 2014-08-02 23:15 - 2011-09-06 17:27 - 00082768 _____ () C:\Users\Adrian\AppData\Local\GDIPFONTCACHEV1.DAT 2014-08-02 23:14 - 2012-11-20 18:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation 2014-08-02 23:12 - 2011-09-06 11:51 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation 2014-08-02 23:11 - 2011-09-06 11:50 - 00000000 ____D () C:\Program Files\NVIDIA Corporation 2014-08-02 23:00 - 2014-08-02 22:37 - 00000000 ____D () C:\Users\scndAdmin\Documents\Bluetooth Folder 2014-08-02 22:59 - 2014-08-02 22:59 - 00000000 ____D () C:\Users\scndAdmin\Desktop\Neuer Ordner 2014-08-02 22:54 - 2014-08-02 22:54 - 00000000 ____D () C:\Users\scndAdmin\AppData\Roaming\MotioninJoy 2014-08-02 22:53 - 2014-08-02 22:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MotioninJoy 2014-08-02 22:53 - 2014-08-02 22:53 - 00000000 ____D () C:\Program Files\MotioninJoy 2014-08-02 22:52 - 2014-08-02 22:52 - 00000000 ____D () C:\Users\Public\Documents\Atheros 2014-08-02 22:46 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories 2014-08-02 22:43 - 2013-04-21 22:54 - 00000000 ____D () C:\Users\scndAdmin 2014-08-02 22:43 - 2009-07-14 06:45 - 00339008 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-08-02 22:40 - 2012-05-05 15:12 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-08-02 22:37 - 2014-08-02 22:37 - 00000000 ____D () C:\Users\scndAdmin\AppData\Local\BMExplorer 2014-08-02 22:37 - 2013-04-21 22:54 - 00082768 _____ () C:\Users\scndAdmin\AppData\Local\GDIPFONTCACHEV1.DAT 2014-08-02 22:16 - 2013-04-16 12:00 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung Printers 2014-08-02 22:05 - 2014-08-02 22:05 - 00008068 _____ () C:\Users\scndAdmin\AppData\Local\CleanupUninstall.txt 2014-08-02 22:05 - 2013-05-15 20:41 - 00000000 ____D () C:\Users\scndAdmin\AppData\Local\Razer 2014-08-02 22:05 - 2011-09-07 13:05 - 00000000 ____D () C:\ProgramData\Razer 2014-08-02 22:05 - 2011-09-07 13:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer 2014-08-02 22:05 - 2011-09-07 13:05 - 00000000 ____D () C:\Program Files (x86)\Razer 2014-08-02 21:36 - 2014-05-29 15:43 - 00000000 ____D () C:\Users\scndAdmin\AppData\Local\Nvidia Corporation 2014-08-02 21:19 - 2014-08-02 21:18 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-08-02 21:18 - 2014-08-02 21:18 - 00000000 ____D () C:\Users\scndAdmin\AppData\Roaming\WinRAR 2014-08-02 21:18 - 2014-08-02 21:18 - 00000000 ____D () C:\Users\scndAdmin\AppData\Local\BetterDS3 2014-08-02 20:18 - 2013-04-22 18:43 - 00000000 ____D () C:\Users\scndAdmin\AppData\Local\Mozilla 2014-08-02 20:16 - 2014-08-02 20:16 - 00000000 ____D () C:\Users\scndAdmin\AppData\Roaming\de.devolo.dLAN.Cockpit 2014-08-02 20:16 - 2013-04-22 18:42 - 00000680 __RSH () C:\Users\scndAdmin\ntuser.pol 2014-08-02 19:51 - 2014-08-02 19:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech 2014-08-02 19:51 - 2014-08-02 19:51 - 00000000 ____D () C:\ProgramData\LogiShrd 2014-08-02 19:50 - 2014-08-02 19:50 - 00000000 ____D () C:\Program Files\Common Files\LogiShrd 2014-08-02 19:49 - 2012-04-25 15:42 - 00000000 ____D () C:\Users\Adrian\AppData\Local\Spotify 2014-08-02 19:46 - 2014-08-02 19:46 - 00000000 __SHD () C:\Users\Adrian\AppData\Local\EmieUserList 2014-08-02 19:46 - 2014-08-02 19:46 - 00000000 __SHD () C:\Users\Adrian\AppData\Local\EmieSiteList 2014-08-02 13:45 - 2014-08-02 13:45 - 00000000 ____D () C:\Users\Adrian\AppData\Local\NVIDIA Corporation 2014-08-02 13:45 - 2014-08-02 13:45 - 00000000 ____D () C:\Users\Adrian\AppData\Local\NVIDIA 2014-08-02 13:45 - 2011-09-06 17:27 - 00001330 __RSH () C:\Users\Adrian\ntuser.pol 2014-08-02 13:45 - 2011-09-06 17:27 - 00000000 ____D () C:\Users\Adrian 2014-07-30 12:13 - 2014-05-29 15:41 - 00000000 ____D () C:\Users\User\AppData\Local\NVIDIA 2014-07-28 21:58 - 2014-07-28 21:58 - 00002059 _____ () C:\Users\User\Desktop\autoexec (orig).cfg 2014-07-28 21:58 - 2014-07-28 16:14 - 00002059 _____ () C:\Users\User\Desktop\autoexec.cfg 2014-07-28 21:57 - 2014-07-28 15:45 - 00001013 _____ () C:\Users\User\Desktop\Neues Textdokument (3).txt 2014-07-28 20:35 - 2014-07-28 21:58 - 00010880 _____ () C:\Users\User\Desktop\config (orig).cfg 2014-07-28 12:31 - 2012-02-09 13:07 - 00000000 ____D () C:\Users\User\AppData\Roaming\TS3Client 2014-07-28 12:22 - 2012-02-08 18:37 - 00000000 ____D () C:\Users\User\AppData\Local\TeamSpeak 3 Client 2014-07-27 15:08 - 2014-07-28 16:14 - 00010179 _____ () C:\Users\User\Desktop\config.cfg 2014-07-25 15:50 - 2014-08-02 21:36 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll 2014-07-25 15:50 - 2014-08-02 21:36 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll 2014-07-25 15:50 - 2014-05-29 15:41 - 01283136 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll 2014-07-25 15:50 - 2014-05-29 15:41 - 01126480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll 2014-07-24 15:44 - 2012-03-31 20:56 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-07-24 15:44 - 2011-09-06 11:48 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-07-24 15:43 - 2012-05-09 23:16 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-07-24 15:43 - 2012-05-09 23:16 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-07-24 15:43 - 2011-04-12 09:55 - 00000000 ____D () C:\Program Files\Windows Journal 2014-07-24 15:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism 2014-07-24 15:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism 2014-07-24 15:34 - 2013-07-23 22:07 - 00000000 ____D () C:\Windows\system32\MRT 2014-07-24 15:33 - 2011-09-05 13:54 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-07-24 15:32 - 2012-05-09 23:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2014-07-24 15:23 - 2014-07-24 15:23 - 00000000 ____D () C:\Users\User\AppData\Roaming\de.devolo.dLAN.Cockpit Some content of TEMP: ==================== C:\Users\scndAdmin\AppData\Local\temp\install_flashplayer14x32au_mssd_aaa_aih.exe C:\Users\scndAdmin\AppData\Local\temp\nv3DVStreaming.dll C:\Users\scndAdmin\AppData\Local\temp\nvSCPAPI.dll C:\Users\scndAdmin\AppData\Local\temp\nvStereoApiI.dll C:\Users\scndAdmin\AppData\Local\temp\nvStInst.exe C:\Users\User\AppData\Local\temp\eauninstall.exe C:\Users\User\AppData\Local\temp\The Battle for Middle-earth_uninst.exe C:\Users\User\AppData\Local\temp\uninst1.exe C:\Users\User\AppData\Local\temp\uninst2.exe C:\Users\User\AppData\Local\temp\unwise.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-08-02 14:05 ==================== End Of Log ============================ Addition.txt Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-08-2014
Ran by Julian at 2014-08-03 18:06:58
Running from C:\Users\Julian\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
3M Littmann Sound Analysis Software (HKLM-x32\...\{FF1C62C5-AF43-46F7-87A4-8B4B9CAEDF23}) (Version: 2.0.c - MMM)
7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version: - )
Acrobat.com (HKLM-x32\...\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.1.377 - Adobe Systems Incorporated)
Acrobat.com (x32 Version: 0.0.0 - Adobe Systems Incorporated) Hidden
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.0.4990 - Adobe Systems Inc.)
Adobe AIR (x32 Version: 1.0.8.4990 - Adobe Systems Inc.) Hidden
Adobe Flash Player 11 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 11.6.602.180 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
APB Reloaded (HKLM-x32\...\Steam App 113400) (Version: - )
Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ASUS Bluetooth Suite (HKLM\...\{230D1595-57DA-4933-8C4E-375797EBB7E1}) (Version: 7.02.000.60 - ASUS Communications)
Battlefield 3™ (HKLM-x32\...\{64BFBE7A-886C-4CA2-A9B4-0C2B5A5942BC}) (Version: 1.0.0.0 - Electronic Arts)
Battlefield 3™ (HKLM-x32\...\{76285C16-411A-488A-BCE3-C83CB933D8CF}) (Version: 1.3.0.0 - Electronic Arts)
Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 1.122.0 - EA Digital Illusions CE AB)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Counter-Strike (HKLM-x32\...\Steam App 10) (Version: - Valve)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version: - Valve)
Counter-Strike: Source (HKLM-x32\...\Steam App 240) (Version: - Valve)
Day of Defeat (HKLM-x32\...\Steam App 30) (Version: - Valve)
devolo Cockpit (HKLM-x32\...\dlancockpit) (Version: 4.2.2.0 - devolo AG)
devolo dLAN-Konfigurationsassistent (HKLM-x32\...\dlanconf) (Version: 20.0.0.0 - devolo AG)
devolo Informer (HKLM-x32\...\dslmon) (Version: 28.0.0.0 - devolo AG)
Die Sims™ 3 (HKLM-x32\...\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}) (Version: 1.42.130 - Electronic Arts)
Dota 2 (HKLM-x32\...\Steam App 570) (Version: - Valve )
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
ESL Wire 1.11 (HKLM\...\ESL Wire_is1) (Version: - Turtle Entertainment GmbH)
ESN Sonar (HKLM-x32\...\ESN Sonar-0.70.4) (Version: 0.70.4 - ESN Social Software AB)
Etron USB3.0 Host Controller (HKLM-x32\...\InstallShield_{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}) (Version: 0.96 - Etron Technology)
Etron USB3.0 Host Controller (x32 Version: 0.96 - Etron Technology) Hidden
FIFA 12 (HKLM-x32\...\{EA8ADAA9-6671-4839-A51E-0C6792B78F3E}) (Version: 1.6.0.0 - Electronic Arts)
FIFA 13 (HKLM-x32\...\{A29E18C2-7AB1-4b6b-848C-5D5E2C85F0C0}) (Version: 1.7.0.0 - Electronic Arts)
FUSSBALL MANAGER 13 (HKLM-x32\...\{80AF0300-866F-400F-A350-D53E3C3E34E0}) (Version: 1.0.4.0 - Electronic Arts)
HP FWUpdateEDO2 (HKLM-x32\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Officejet Pro 8600 - Grundlegende Software für das Gerät (HKLM\...\{D2D05FDB-4EDA-462D-8DB6-E0B9AD4FA25F}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Officejet Pro 8600 Hilfe (HKLM-x32\...\{FDE820DD-CC88-4395-AD5C-801365B8F316}) (Version: 28.0.0 - Hewlett Packard)
HP Update (HKLM-x32\...\{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}) (Version: 5.003.003.001 - Hewlett-Packard)
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2932 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.0.1008 - Intel Corporation)
iTunes (HKLM\...\{B8BA155B-1E75-405F-9CB4-8A99615D09DC}) (Version: 11.1.5.5 - Apple Inc.)
Java 7 Update 60 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417060FF}) (Version: 7.0.600 - Oracle)
Java 7 Update 60 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217017FF}) (Version: 7.0.600 - Oracle)
Java Auto Updater (x32 Version: 2.1.60.19 - Oracle, Inc.) Hidden
LibUSB-Win32-0.1.12.2 (HKLM-x32\...\LibUSB-Win32_is1) (Version: 0.1.12.2 - LibUSB-Win32)
Logitech Unifying-Software 2.50 (HKLM\...\Logitech Unifying) (Version: 2.50.25 - Logitech)
LuPO 2.0.2.14 (HKLM-x32\...\LuPO_is1) (Version: - Ministerium für Schule, Wissenschaft und Forschung NRW)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Antimalware Service DE-DE Language Pack (Version: 3.0.8402.2 - Microsoft Corporation) Hidden
Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden
Microsoft Security Client DE-DE Language Pack (Version: 2.1.1116.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.5.216.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft XML Parser (x32 Version: 8.0.7820.0 - Microsoft Corporation) Hidden
MotioninJoy Gamepad tool 0.7.1001 (HKLM\...\{330DAC67-5B62-452A-A0E4-6B4A5923940F}_is1) (Version: 0.7.1001 - www.motioninjoy.com)
Mozilla Firefox 31.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
MSI Afterburner 2.1.0 (HKLM-x32\...\Afterburner) (Version: 2.1.0 - MSI Co., LTD)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Mumble 1.2.3 (HKLM-x32\...\{C3E9887A-23BA-4777-8080-191A5AFCAB74}) (Version: 1.2.3 - Thorvald Natvig)
NirSoft BlueScreenView (HKLM-x32\...\NirSoft BlueScreenView) (Version: - )
NVIDIA 3D Vision Controller Driver (x32 Version: 280.19 - NVIDIA Corporation) Hidden
NVIDIA 3D Vision Controller-Treiber 340.50 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 340.50 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 340.52 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.1.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.157.1165 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.1220 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA ShadowPlay 15.3.33 (Version: 15.3.33 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.6514 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 340.52 (Version: 340.52 - NVIDIA Corporation) Hidden
NVIDIA Update 15.3.33 (Version: 15.3.33 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 15.3.33 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.23 (Version: 1.2.23 - NVIDIA Corporation) Hidden
OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)
Origin (HKLM-x32\...\Origin) (Version: 9.0.14.2148 - Electronic Arts, Inc.)
PlanetSide 2 (HKLM-x32\...\Steam App 218230) (Version: - Sony Online Entertainment)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
Razer DeathAdder(TM) Mouse (HKLM-x32\...\{EB1B8449-CD8F-485B-ADB6-02FBCFE180D3}) (Version: 3.03 - Razer USA Ltd.)
Razer Lycosa (HKLM-x32\...\{E0FA1DC5-FEBF-4E7B-8FA3-DB94233E952D}) (Version: 3.00.0000 - Razer USA Ltd.)
Razer Megalodon Firmware Updater (HKLM-x32\...\{C67A3F9D-E55D-4288-B4EC-1B9863EFB288}) (Version: 2.12.02 - Razer USA Ltd.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.41.216.2011 - Realtek)
Samsung Mobile phone USB driver Drive Software (HKLM\...\Samsung Mobile phone USB driver Drive) (Version: - )
SHIELD Streaming (Version: 3.1.100 - NVIDIA Corporation) Hidden
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version: - Valve)
TeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.26038 - TeamViewer)
TechPowerUp GPU-Z (HKLM-x32\...\TechPowerUp GPU-Z) (Version: - )
Text-To-Speech-Runtime (HKLM-x32\...\{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}) (Version: 1.0.0.0 - Magix Development GmbH)
Unlocker 1.9.1-x64 (HKLM\...\Unlocker) (Version: 1.9.1 - Cedrick Collomb)
VLC media player 1.1.11 (HKLM-x32\...\VLC media player) (Version: 1.1.11 - VideoLAN)
WinRAR 4.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.01.0 - win.rar GmbH)
XFastUsb (HKLM-x32\...\XFastUsb) (Version: - )
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2013-03-12 19:52 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {299CD92F-1BD1-48BA-9B31-952AC0F2DEAE} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {2F160F0F-E3E4-4EB0-9304-3C2828903444} - System32\Tasks\Browser Manager => Sc.exe start Browser Manager
Task: {5D77668A-F4D3-4D96-BC3F-5FBD9F36A500} - System32\Tasks\DealPlyUpdate => C:\Program Files (x86)\DealPly\DealPlyUpdate.exe <==== ATTENTION
Task: {99BAA6BB-4205-42BE-8715-3F7B383CD2C9} - System32\Tasks\hpUtility.exe_{12AC27D7-F135-48DF-98D2-7DA7C1376157} => C:\Program Files\HP\HP Officejet Pro 8600\Bin\utils\hpUtility.exe [2012-10-17] (Hewlett-Packard Co.)
==================== Loaded Modules (whitelisted) =============
2012-01-07 04:28 - 2014-07-02 20:55 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-04-16 11:59 - 2011-04-11 07:26 - 00034304 _____ () C:\Windows\System32\spe__l.dll
2012-01-07 04:17 - 2013-04-21 23:01 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2011-12-16 12:38 - 2011-05-28 23:05 - 00164864 _____ () C:\Program Files\WinRAR\rarext.dll
2011-09-05 13:14 - 2011-04-10 04:40 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2011-09-07 13:23 - 2011-03-21 11:06 - 00248320 _____ () C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe
2011-09-07 13:23 - 2010-04-27 14:41 - 00218112 _____ () C:\Program Files (x86)\Razer\DeathAdder\razertra.exe
2013-08-24 10:18 - 2009-10-09 15:32 - 00143360 _____ () C:\Program Files (x86)\Razer\Lycosa\razertra.exe
2011-09-07 13:23 - 2011-04-14 11:48 - 01758208 _____ () C:\Program Files (x86)\Razer\DeathAdder\vdDaemon.exe
2014-04-03 12:06 - 2014-04-03 12:06 - 00169472 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\0a0467413a424068d1471448ff6ca6cc\IsdiInterop.ni.dll
2011-09-05 13:17 - 2010-11-05 23:50 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2014-08-02 21:18 - 2014-08-02 21:18 - 03800688 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-07-24 15:44 - 2014-07-24 15:44 - 17029808 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: Apple Mobile Device => 2
MSCONFIG\Services: Application Updater => 2
MSCONFIG\Services: Bonjour Service => 2
MSCONFIG\Services: DevoloNetworkService => 2
MSCONFIG\Services: ehRecvr => 3
MSCONFIG\Services: ehSched => 3
MSCONFIG\Services: Fax => 3
MSCONFIG\Services: FirebirdServerMAGIXInstance => 3
MSCONFIG\Services: iPod Service => 3
MSCONFIG\Services: SkypeUpdate => 2
MSCONFIG\Services: Steam Client Service => 3
MSCONFIG\Services: UPnPService => 3
MSCONFIG\Services: WireHelpSvc => 2
MSCONFIG\startupfolder: C:^Users^scndAdmin^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.4.1.lnk => C:\Windows\pss\OpenOffice.org 3.4.1.lnk.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: AutoStartNPSAgent =>
MSCONFIG\startupreg: ESL Wire => "C:\Program Files\EslWire\wire.exe" --tray
MSCONFIG\startupreg: HP Software Update => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: QuickTime Task => "D:\Programme\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: Razer Synapse => "C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe"
MSCONFIG\startupreg: RunDLLEntry => C:\Windows\system32\RunDLL32.exe C:\Windows\system32\AmbRunE.dll,RunDLLEntry
MSCONFIG\startupreg: SearchSettings => "C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe"
MSCONFIG\startupreg: Spotify Web Helper => "c:\users\adrian\appdata\roaming\spotify\data\spotifywebhelper.exe"
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (08/03/2014 05:45:10 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
Error: (08/03/2014 05:45:10 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (08/03/2014 05:45:10 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (08/03/2014 05:40:12 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/03/2014 05:38:23 PM) (Source: SetupARService) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.NullReferenceException: Der Objektverweis wurde nicht auf eine Objektinstanz festgelegt.
bei SetupAfterRebootService.SetupARService.OnStart(String[] args)
bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)
Error: (08/03/2014 00:56:15 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (08/03/2014 00:56:12 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.
Error: (08/03/2014 09:11:23 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
Error: (08/03/2014 09:11:23 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (08/03/2014 09:11:23 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
System errors:
=============
Error: (08/03/2014 05:38:33 PM) (Source: BugCheck) (EventID: 1001) (User: )
Description: 0x0000001e (0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000)C:\Windows\MEMORY.DMP080314-20888-01
Error: (08/03/2014 05:38:25 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
StarOpen
Error: (08/03/2014 05:38:23 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (08/03/2014 05:38:16 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\Drivers\StarOpen.SYS nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (08/03/2014 02:47:08 PM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
Error: (08/03/2014 09:05:35 AM) (Source: BugCheck) (EventID: 1001) (User: )
Description: 0x0000001e (0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000)C:\Windows\MEMORY.DMP080314-16785-01
Error: (08/03/2014 09:05:31 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
StarOpen
Error: (08/03/2014 09:05:29 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (08/03/2014 09:05:22 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\Drivers\StarOpen.SYS nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (08/02/2014 11:48:28 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
StarOpen
Microsoft Office Sessions:
=========================
Error: (08/03/2014 05:45:10 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000
Error: (08/03/2014 05:45:10 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000
Error: (08/03/2014 05:45:10 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000
Error: (08/03/2014 05:40:12 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/03/2014 05:38:23 PM) (Source: SetupARService) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.NullReferenceException: Der Objektverweis wurde nicht auf eine Objektinstanz festgelegt.
bei SetupAfterRebootService.SetupARService.OnStart(String[] args)
bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)
Error: (08/03/2014 00:56:15 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\program files (x86)\ESET\eset online scanner\ESETSmartInstaller.exe
Error: (08/03/2014 00:56:12 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORC:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllC:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3
Error: (08/03/2014 09:11:23 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000
Error: (08/03/2014 09:11:23 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000
Error: (08/03/2014 09:11:23 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000
CodeIntegrity Errors:
===================================
Date: 2013-03-12 18:51:33.672
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-03-12 18:51:33.641
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 21%
Total physical RAM: 8102.44 MB
Available physical RAM: 6322.69 MB
Total Pagefile: 16203.06 MB
Available Pagefile: 14342.1 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:55.8 GB) (Free:6.19 GB) NTFS
Drive d: () (Fixed) (Total:931.51 GB) (Free:754.38 GB) NTFS
Drive e: (Spain) (CDROM) (Total:0.95 GB) (Free:0 GB) CDFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 56 GB) (Disk ID: D9A187B0)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=56 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: D9A187C7)
Partition 1: (Not Active) - (Size=932 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Geändert von ene.mene.muh (04.08.2014 um 15:58 Uhr) |
|
04.08.2014, 15:52
| #4 |
| | Babylon.A , Incredibar.A , PriceGong, Spigot, Dealply & Co in C:\Users\...\AppData\Roaming\ Teil 2 Weiter gehts mit dem MBAM log nachdem die Dateien in Quarantäne gelandet sind Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 03.08.2014 Suchlauf-Zeit: 17:54:09 Logdatei: mbam.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.08.03.05 Rootkit Datenbank: v2014.08.01.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Julian Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 503308 Verstrichene Zeit: 5 Min, 21 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 13 PUP.Optional.Babylon.A, HKU\S-1-5-21-82016817-340743653-2786680247-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}, In Quarantäne, [e78313ae3a413ef8dd266100b84a34cc], PUP.Optional.Incredibar.A, HKLM\SOFTWARE\IB Updater, In Quarantäne, [d397d6eb354640f6c97a7d6c16ecd62a], PUP.Optional.BundleInstaller.A, HKLM\SOFTWARE\WOW6432NODE\VITTALIA\AxtanInstaller, In Quarantäne, [77f3962b374414225fdb9564da28f10f], PUP.Optional.PriceGong.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\PriceGong, In Quarantäne, [73f79f22502b3cfaad73f7ffcd353ac6], PUP.Optional.Spigot.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Search Settings, In Quarantäne, [5c0e16ab84f75fd744b7e849719304fc], PUP.Optional.DataMngr.A, HKU\S-1-5-21-82016817-340743653-2786680247-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DataMngr, In Quarantäne, [6802863b403bb77f990e5db441c3de22], PUP.Optional.DataMngr.A, HKU\S-1-5-21-82016817-340743653-2786680247-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DataMngr_Toolbar, In Quarantäne, [3535cff263183cfaf9adc74af410b050], PUP.Optional.PriceGong.A, HKU\S-1-5-21-82016817-340743653-2786680247-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\PriceGong, In Quarantäne, [4327d3eee49740f6c25e51a58c7643bd], PUP.Optional.Spigot.A, HKU\S-1-5-21-82016817-340743653-2786680247-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Search Settings, In Quarantäne, [1b4f4978bebdd75f27d4f1406b996a96], PUP.Optional.DealPly.A, HKU\S-1-5-21-82016817-340743653-2786680247-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\gaiilaahiahdejapggenmdmafpmbipje, In Quarantäne, [28429e232655e650bc3f5d83956d15eb], PUP.Optional.BProtector.A, HKU\S-1-5-21-82016817-340743653-2786680247-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\bProtectSettings, In Quarantäne, [a7c3ab16d8a3f73ffcfc967e8c78a060], PUP.Optional.Softonic.A, HKU\S-1-5-21-82016817-340743653-2786680247-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOFTONIC\Universal Downloader, In Quarantäne, [eb7fc100fc7fa096c2039f4b40c2768a], PUP.Optional.DealPly.A, HKU\S-1-5-21-82016817-340743653-2786680247-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\gaiilaahiahdejapggenmdmafpmbipje, In Quarantäne, [4a207a478eede94d26d5fee282800bf5], Registrierungswerte: 6 PUP.Optional.StartPage.A, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS\{336D0C35-8A85-403a-B9D2-65C292C39087}, In Quarantäne, [d39778494d2e1f17475f510f0ff3fd03], PUP.Optional.StartPage.A, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|{336D0C35-8A85-403A-B9D2-65C292C39087}, C:\Program Files\IB Updater\Firefox, In Quarantäne, [d39778494d2e1f17475f510f0ff3fd03] PUP.Optional.Incredibar, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}, C:\Program Files\IB Updater\Firefox, In Quarantäne, [6406863be695c47255f0da430ef64cb4] PUP.Optional.Incredibar, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}, C:\Program Files\IB Updater\Firefox, In Quarantäne, [ce9c249da1daaf87281d2feeab59f010] PUP.BProtector, HKU\S-1-5-21-82016817-340743653-2786680247-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|bProtector Start Page, hxxp://search.babylon.com/?affID=115284&tt=4612_4&babsrc=HP_ss&mntrId=b4f9547d00000000000000ff01000001, In Quarantäne, [aac0962b413abb7b2f79d53c9f65b34d] PUP.BProtector, HKU\S-1-5-21-82016817-340743653-2786680247-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|bProtectorDefaultScope, {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}, In Quarantäne, [5f0b843d1d5ecb6b4d5c0d04877d6b95] Registrierungsdaten: 0 (No malicious items detected) Ordner: 11 PUP.Optional.OpenCandy, C:\Users\Adrian\AppData\Roaming\OpenCandy, In Quarantäne, [0664665be2990333339301acca387789], PUP.Optional.OpenCandy, C:\Users\Adrian\AppData\Roaming\OpenCandy\434853B05B3C418EB60998C8E85F5ADE, In Quarantäne, [0664665be2990333339301acca387789], PUP.Optional.OpenCandy, C:\Users\Adrian\AppData\Roaming\OpenCandy\DB70981154B94407978A0294757166D4, In Quarantäne, [0664665be2990333339301acca387789], PUP.Optional.OpenCandy, C:\Users\Adrian\AppData\Roaming\OpenCandy\OpenCandy_DB70981154B94407978A0294757166D4, In Quarantäne, [0664665be2990333339301acca387789], PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\LocalLow\BabylonToolbar, In Quarantäne, [85e52d94ff7cb680bce4a91646bc758b], PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\LocalLow\BabylonToolbar\BabylonToolbar, In Quarantäne, [85e52d94ff7cb680bce4a91646bc758b], PUP.Optional.Spigot.A, C:\Users\Adrian\AppData\LocalLow\Search Settings, In Quarantäne, [c3a7ead7b0cb162024ecc0067d858878], PUP.Optional.Spigot.A, C:\Users\Adrian\AppData\LocalLow\Search Settings\res, In Quarantäne, [c3a7ead7b0cb162024ecc0067d858878], PUP.Optional.Spigot.A, C:\Users\Adrian\AppData\LocalLow\Search Settings\temp, In Quarantäne, [c3a7ead7b0cb162024ecc0067d858878], PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\LocalLow\Incredibar.com, In Quarantäne, [2743269bea913afc5e6100ca1de541bf], PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\LocalLow\Incredibar.com\incredibar, In Quarantäne, [2743269bea913afc5e6100ca1de541bf], Dateien: 138 PUP.Optional.InstallMonetizer, C:\$Recycle.Bin\S-1-5-21-82016817-340743653-2786680247-1000\$R8BM3J9.exe, In Quarantäne, [82e8ecd5a2d90c2ac2f078c7ac587888], PUP.Optional.DealPly.A, C:\Windows\System32\Tasks\DealPlyUpdate, In Quarantäne, [afbbffc20c6ff83e9d2fa33539c9c040], PUP.Optional.Browsemngr.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\searchplugins\browsemngr.xml, In Quarantäne, [e9818938384354e2fdddc41bbb4737c9], PUP.Optional.Perion.A, C:\Windows\System32\ARFC\wrtc.exe, In Quarantäne, [105a0cb5fb80ec4a47fedc0dba485fa1], PUP.Optional.MyStartSearch.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\searchplugins\MyStart Search.xml, In Quarantäne, [99d18d348dee0234bf7018d79969f907], PUP.Optional.BProtector.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\bProtector_extensions.sqlite, In Quarantäne, [5218378a83f892a43c977c74ce348a76], PUP.Optional.BProtector.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\bprotector_prefs.js, In Quarantäne, [95d59c253348999d8252af4161a16799], PUP.Optional.Conduit.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\searchplugins\conduit.xml, In Quarantäne, [d496299859222a0c5f8f46aaf60c649c], PUP.Optional.OpenCandy, C:\Users\Adrian\AppData\Roaming\OpenCandy\434853B05B3C418EB60998C8E85F5ADE\2877.ico, In Quarantäne, [0664665be2990333339301acca387789], PUP.Optional.OpenCandy, C:\Users\Adrian\AppData\Roaming\OpenCandy\434853B05B3C418EB60998C8E85F5ADE\AVG Toolbar Installer.exe, In Quarantäne, [0664665be2990333339301acca387789], PUP.Optional.OpenCandy, C:\Users\Adrian\AppData\Roaming\OpenCandy\434853B05B3C418EB60998C8E85F5ADE\AVG_Toolbar_CB_ALL_p2v0.exe, In Quarantäne, [0664665be2990333339301acca387789], PUP.Optional.OpenCandy, C:\Users\Adrian\AppData\Roaming\OpenCandy\434853B05B3C418EB60998C8E85F5ADE\EBB77268-338F-4C6A-8590-AD88FED26F4A, In Quarantäne, [0664665be2990333339301acca387789], PUP.Optional.OpenCandy, C:\Users\Adrian\AppData\Roaming\OpenCandy\434853B05B3C418EB60998C8E85F5ADE\OCBrowserHelper_1.0.3.85.dll, In Quarantäne, [0664665be2990333339301acca387789], PUP.Optional.OpenCandy, C:\Users\Adrian\AppData\Roaming\OpenCandy\DB70981154B94407978A0294757166D4\TuneUpUtilities2012_de-DE_1002175.exe, In Quarantäne, [0664665be2990333339301acca387789], PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.admin", false);), Ersetzt,[5a10efd21863e6509e264ea030d4e61a] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.aflt", "babsst");), Ersetzt,[b3b7d2ef1962bd790fb565894eb6936d] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.appId", "{BDB69379-802F-4eaf-B541-F8DE92DD98DB}");), Ersetzt,[a0caa120f2893105e2e2f6f8bd475ca4] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.babext", "babExt");), Ersetzt,[1f4b873a3c3f53e394307579fb09d828] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.babtrack", "babTrack");), Ersetzt,[7cee378a205bc175388c48a68d77956b] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.bbDpng", "17");), Ersetzt,[8bdf952c037869cdbc08d11d1de7ca36] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.cntry", "DE");), Ersetzt,[2e3c9a27a6d5c96d1aaa935b2bd9ea16] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.dfltLng", "en");), Ersetzt,[0664a918205ba88ee7dd8569ed17ec14] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.dfltsrch", "false");), Ersetzt,[68027a470477c373ccf86985699b0df3] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.dpkLst", "");), Ersetzt,[d7935968c2b9b086a71d20ced82cef11] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.envrmnt", "production");), Ersetzt,[1159823f9dde43f3388c02ec996ba060] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.excTlbr", false);), Ersetzt,[bcaeebd6fd7e74c210b45c92828237c9] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.firstrun", false);), Ersetzt,[ec7e2e936b102c0abd07c92523e106fa] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.hdrMd5", "114E245EB796C630DBB4F3172D337247");), Ersetzt,[2d3d774a4e2dac8a17ad6589a3618e72] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.hmpg", false);), Ersetzt,[0d5d8e330477211511b36b83a95b45bb] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.hrdid", "b4f9547d00000000000000ff01000001");), Ersetzt,[ea80a51c3e3de056e1e3f8f6956f1ce4] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.id", "b4f9547d00000000000000ff01000001");), Ersetzt,[bcaeccf5205bae882c9807e720e46e92] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.instlDay", "15658");), Ersetzt,[f179d0f17dfe122417adc727fe062ed2] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.instlRef", "sst");), Ersetzt,[95d57f423a4170c6c400836b9e66d32d] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.isdcmntcmplt", "false");), Ersetzt,[4921b50c7704ee48754fbe3046be29d7] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.keywordurl", "");), Ersetzt,[a2c8962b7dfeb97d4b799559897b08f8] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.8.3.817:19:28");), Ersetzt,[6802d4ed96e543f39a2a5797a75d758b] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.lastdp", 15);), Ersetzt,[ee7cc2ff7cff1a1cf5cf47a706fe4ab6] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.mntrvrsn", "1.3.1");), Ersetzt,[beac9a277dfe50e6774d47a77c88e818] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.newTab", false);), Ersetzt,[7af0f0d15526ec4aad17856926de1de3] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.newtab", "false");), Ersetzt,[9fcb8b366b1041f54b79ab43679d39c7] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.newtaburl", "");), Ersetzt,[4525a21fbebddc5a883ce10d9c6832ce] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.pnu_base", "{\"newVrsn\":\"60\",\"lastVrsn\":\"60\",\"vrsnLoad\":\"\",\"showMsg\":\"false\",\"showSilent\":\"true\",\"msgTs\":0,\"lstMsgTs\":\"0\"}");), Ersetzt,[2545a31e2655979f2e9601eddc28f808] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");), Ersetzt,[a7c305bcb0cb41f57b49d21cda2a4cb4] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.prtnrId", "babylon");), Ersetzt,[5f0b08b972098ea810b442ac040026da] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.savedVrsnTs", "1");), Ersetzt,[3f2b556ce79486b0d3f1e60841c3ff01] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.sg", "azb");), Ersetzt,[e288e6db8cef2511467e9e50dc2860a0] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.smplGrp", "azb");), Ersetzt,[57133e8318630333b90ba6487a8aad53] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.srcext", "");), Ersetzt,[0a60ba07adce46f06e565698d331d52b] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.srch", "");), Ersetzt,[d09a1ca53d3e0c2ad7ed608ea55f7b85] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.srchprvdr", "");), Ersetzt,[1d4d3d84106b90a614b09658c53f7789] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.tlbrId", "base");), Ersetzt,[89e1e3def18aea4c596b29c54fb57d83] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "hxxp://search.babylon.com/?babsrc=TB_def&mntrId=b4f9547d00000000000000ff01000001&q=");), Ersetzt,[81e917aa2a512a0c2a9aab4343c16898] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.vrsn", "1.8.3.8");), Ersetzt,[1357d9e81b607cba9b293db156aed22e] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.vrsnTs", "1.8.3.817:19:28");), Ersetzt,[1357b30eabd047ef7f453bb329db3fc1] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.vrsni", "1.8.3.8");), Ersetzt,[bcaec6fb1e5dfe38e1e31ed0c53fd927] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar_i.smplGrp", "none");), Ersetzt,[2f3bb0119cdf40f61ca8a6486e96ee12] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.8.3.817:19:28");), Ersetzt,[bab0962bd3a843f3289c49a528dc738d] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.actvtyRptTime", "1352990610226");), Ersetzt,[a3c730915922ec4a8a3c03ebc53f7090] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.admin", false);), Ersetzt,[a9c1f3ceec8f85b16b5b1fcf5aaa946c] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.aflt", "orgnl");), Ersetzt,[ef7b754c7cff30060bbbf5f90202d030] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.afterInstallRpt", "sent");), Ersetzt,[bbaf833e2d4e7eb8c40211dd4bb9fd03] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.cntry", "DE");), Ersetzt,[3733e8d9334849ed14b26688db297f81] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.dfltLng", "EN");), Ersetzt,[7ded7150ccaf5fd7ecda3cb2788c9c64] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.dfltSrch", false);), Ersetzt,[5d0de0e1d5a64ee8aa1c9b53de26d927] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.dfltsrch", "false");), Ersetzt,[cd9d3b86fc7f5fd7497d09e509fbbf41] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.did", "10665");), Ersetzt,[0b5f328fed8e1f17f2d4529c84806b95] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.envrmnt", "production");), Ersetzt,[b9b109b846356cca4f77569836ce7b85] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.excTlbr", false);), Ersetzt,[cb9f625f7b0096a0fcca00ee32d258a8] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.hdrMd5", "340AD678C872ADDF850F9648B6EF9827");), Ersetzt,[7dede5dcb5c6bc7a289ec42a7094a957] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.hmpg", false);), Ersetzt,[6cfe5d64b1cadb5b398d30bee0248b75] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.hrdid", "b4f9547d00000000000000ff01000001");), Ersetzt,[ea8003be95e679bd01c531bdf50f11ef] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.id", "b4f9547d00000000000000ff01000001");), Ersetzt,[f575e2df3546d6608a3c7b735ba9728e] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.installerproductid", "26");), Ersetzt,[2e3ca1209ae1201630961bd39173d927] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.instlDay", "15640");), Ersetzt,[a5c51ca5d5a690a6913528c66d97b54b] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.instlRef", "");), Ersetzt,[5911ab16e7944de9982ea84632d2946c] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.isDcmntCmplt", true);), Ersetzt,[b6b4358c3546ed49f8ce15d9d92b02fe] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.isdcmntcmplt", "false");), Ersetzt,[0f5b368b43381e188c3ac62814f0946c] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.keywordurl", "");), Ersetzt,[2f3b18a9f78494a226a09b53a46016ea] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.lastVrsnTs", "1.5.11.1419:44:52");), Ersetzt,[9cce9928443767cfe2e48f5fbd478779] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.mntrvrsn", "1.2.0");), Ersetzt,[c8a2bd04d3a889ad84427f6f35cfd12f] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.newTab", false);), Ersetzt,[11596160067574c2cff7a6488a7a48b8] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.newtab", "false");), Ersetzt,[95d57a470a71c0767b4bc727f90bbf41] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.newtaburl", "");), Ersetzt,[74f6e4ddb3c83bfbfacc42aca55f57a9] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.noFFXTlbr", false);), Ersetzt,[bbaf9e23d8a30036be08fcf21fe56d93] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.ppd", "");), Ersetzt,[16543e833645a1954086915d58ac23dd] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.prdct", "incredibar");), Ersetzt,[5713b30ec1ba1c1a5571af3f24e08779] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.productid", "26");), Ersetzt,[402a764b38431b1b0abc26c842c25ea2] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.prtnrId", "Incredibar");), Ersetzt,[54162899e497fe382b9b49a580849769] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.sg", "none");), Ersetzt,[c5a580416318bd79289e56986e966997] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.smplGrp", "none");), Ersetzt,[52186d542754b1858343836bd232a15f] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.srch", "");), Ersetzt,[25453b864734bc7ae1e5628cf50f9868] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.srchprvdr", "");), Ersetzt,[f9712f928bf016207f474ba32fd517e9] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.tlbrId", "base");), Ersetzt,[78f23091403bcd69c9fdf7f77d87649c] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6R8JrRz5pI&loc=IB_TB&i=26&search=");), Ersetzt,[640618a991eaf93d0cba49a5679ddf21] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.upn2", "6R8JrRz5pI");), Ersetzt,[c3a7546db9c259dd279f599515ef02fe] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.upn2n", "92825299328126310");), Ersetzt,[8edce5dc0f6c39fddde9ac4259ab3bc5] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.vrsn", "1.5.11.14");), Ersetzt,[b1b939881269f442ccfafef06c98e917] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.vrsnTs", "1.5.11.1419:44:52");), Ersetzt,[6dfd3e8375063bfbc501806e41c3916f] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.vrsni", "1.5.11.14");), Ersetzt,[7ceead14403bf4423294fef0f60e3fc1] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.aflt", "orgnl");), Ersetzt,[83e77d44c1ba7cbaeadc40aef014cf31] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.dfltLng", "");), Ersetzt,[6cfec4fd1368ef47c30338b62ed66898] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.did", "10665");), Ersetzt,[3b2f3e8317646dc9ffc7be3059ab2fd1] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.excTlbr", false);), Ersetzt,[82e8f9c83a4143f3a02602ec5da70bf5] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.id", "b4f9547d00000000000000ff01000001");), Ersetzt,[c6a4f5ccb6c5b680a0264f9f36ceb34d] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.installerproductid", "26");), Ersetzt,[1b4f8e33bfbcc47208be3db18e76de22] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.instlDay", "15640");), Ersetzt,[66049928394265d1f9cdbe304db77f81] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.instlRef", "");), Ersetzt,[98d2ba076516b1858640a24c50b41be5] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.ms_url_id", "");), Ersetzt,[dc8e913073081521b11503eb6c982fd1] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.newTab", false);), Ersetzt,[e48678496219270f319578765ba9df21] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.ppd", "");), Ersetzt,[11593e83f18a1323cef8905e9d672dd3] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.prdct", "incredibar");), Ersetzt,[d397e2df27541c1ae0e649a5ab59df21] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.productid", "26");), Ersetzt,[e9813988770463d3824479757c88966a] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.prtnrId", "Incredibar");), Ersetzt,[a6c48a3762194aec8244bc326d97a15f] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.smplGrp", "none");), Ersetzt,[beac41805229bb7b2b9ba24c51b3a65a] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.tlbrId", "base");), Ersetzt,[c1a950711f5c6dc9e9ddbe30bc482dd3] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6R8JrRz5pI&loc=IB_TB&i=26&search=");), Ersetzt,[105ab01192e92214e6e0dc126a9ae11f] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.upn2", "6R8JrRz5pI");), Ersetzt,[95d5d3ee44373303784e8f5fd92bfb05] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.upn2n", "92825299328126310");), Ersetzt,[3634ac15a2d978bec006aa447193cd33] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.vrsn", "1.5.11.14");), Ersetzt,[2347b60bed8efe38fec899551aea12ee] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1419:44:52");), Ersetzt,[cd9de2df2655bb7b0db99e50ce36e020] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.vrsni", "1.5.11.14");), Ersetzt,[4723734e265575c18e3818d6966ef010] PUP.Optional.Softonic.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_whiteList", "{\"search.babylon.com\":\"q\",\"search.sweetim.com\":\"q\",\"search.imesh.net\":\"q\",\"www.search-results.com\":\"q\",\"home.mywebsearch.com\":\"searchfor\",\"search.mywebsearch.com\":\"searchfor\",\"search.mindspark.com\":\"searchfor\",\"search.conduit.com\":\"q\",\"search.zugo.com\":\"p\",\"www2.mystart.com\":\"q\",\"www.mystart.com\":\"q\",\"www.bigseekpro.com\":\"q\",\"bigseekpro.com\":\"q\",\"bigspeedpro.com\":\"q\",\"search.esnips.com\":\"searchQuery\",\"search.foxtab.com\":\"q\",\"search.brothersoft.com\":\"keyword\",\"search.softonic.com\":\"q\",\"www.dogpile.com\":\"q\",\"search.infospace.com\":\"q\",\"search.iobit.com\":\"q\",\"search.iminent.com\":\"\",\"search.facemoods.com\":\"s\",\"www.plusnetwork.com\":\"q\",\"www.alothome.com\":\"q\",\"alothome.com\":\"q\",\"search.alothome.com\":\"q\",\"search.chatvibes.com\":\"q\",\"search.blekko.com\":\"\",\"www.searchnu.com\":\"q\",\"searchnu.com\":\"q\",\"search.icq.com\":\"q\",\"search.etype.com\":\"query\",\"isearch.babylon.com\":\"q\",\"search.utorrent.com\":\"\",\"search.bittorrent.com\":\"\",\"search.bearshare.com\":\"q\",\"search.bearshare.net\":\"q\",\"searchya.com\":\"q\",\"int.search-results.com\":\"q\",\"search.searchcompletion.com\":\"q\",\"www.adoresearch.com\":\"q\",\"www.searchcore.net\":\"q\",\"googosearch.info\":\"terms\",\"bar.searchqu.com\":\"q\",\"search.speedbit.com\":\"q\",\"search.toggle.com\":\"q\",\"click.searchnation.net\":\"query\",\"isearch.whitesmoke.com\":\"q\",\"search.handycafe.com\":\"q\",\"searchassist.babylon.com\":\"q\",\"searchnation.net\":\"query\",\"video.searchcompletion.com\":\"q\",\"www.searchbrowsing.com\":\"q\",\"search.anchorfree.net\":\"q\",\"search.hotspotshield.com\":\"q\",\"dts.search-results.com\":\"q\",\"uk.search-results.com\":\"q\",\"search.chatzum.com\":\"q\",\"search.phpnuke.org\":\"q\",\"www.i-mysearch.com\":\"q\",\"search.smartaddressbar.com\":\"q\",\"www.search-guru.com\":\"q\",\"mysearch.sweetim.com\":\"q\",\"searchgby.com\":\"\",\"thespecialsearch.com\":\"q\",\"search.bpath.com\":\"q\",\"start.funmoods.com\":\"s\",\"fr.search-results.com\":\"q\",\"de.search-results.com\":\"q\",\"it.search-results.com\":\"q\",\"es.search-results.com\":\"q\",\"search.imesh.com\":\"q\",\"search.swagbucks.com\":\"q\",\"isearch.avg.com\":\"q\",\"search.avg.com\":\"q\",\"search.yippy.com\":\"query\",\"cludr.com\":\"q\",\"search.vmn.net\":\"q\",\"www.gigablast.com\":\"q\",\"www.metacrawler.com\":\"q\",\"www.webcrawler.com\":\"q\",\"www.ixquick.com\":\"\",\"www.search.com\":\"q\",\"www.excite.com\":\"q\",\"duckduckgo.com\":\"q\",\"search.lycos.com\":\"q\",\"webfetch.com\":\"q\",\"monstercrawler.com\":\"q\",\"go.com\":\"p\",\"hotbot.com\":\"keyword\",\"home.myplaycity.com\":\"s\",\"www.findamo.com\":\"q\",\"search.gboxapp.com\":\"q\",\"start.iplay.com\":\"q\",\"home.speedbit.com\":\"q\",\"home.sweetim.com\":\"q\",\"search.alot.com\":\"q\",\"search.searchplusnetwork.com\":\"q\",\"www.searchqu.net\":\"\",\"us.yhs4.search.yahoo.com\":\"p\",\"search.insiteapp.com\":\"q\",\"somoto.com\":\"q\",\"blekko.com\":\"\",\"uk.yhs4.search.yahoo.com\":\"p\",\"fr.yhs4.search.yahoo.com\":\"p\",\"suggestor.netliker.com\":\"\",\"search.netliker.com\":\"\",\"insta-search.com\":\"q\",\"www.fast-search.biz\":\"q\",\"start.facemoods.com\":\"s\",\"search.coolnovo.com\":\"\",\"chromeplus.info\":\"q\",\"in.yhs4.search.yahoo.com\":\"p\",\"in.yhs.search.yahoo.com\":\"p\",\"www.searchble.com\":\"keyword\",\"home.allgameshome.com\":\"s\",\"forsearch.net\":\"q\",\"allssearch.com\":\"q\",\"search.snap.do\":\"q\",\"us.yhs.search.yahoo.com\":\"p\",\"uk.yhs.search.yahoo.com\":\"p\",\"fr.yhs.search.yahoo.com\":\"p\",\"search.smartsearchbox.net\":\"\",\"search.seznam.cz\":\"q\",\"search.funmoods.com\":\"s\",\"search.avira.com\":\"q\",\"search.jzip.com\":\"q\",\"search.findeer.com\":\"\",\"search-faster.com\":\"\",\"dnssearch.rr.com\":\"search\",\"search.rr.com\":\"q\",\"search.kalloutsearch4.com\":\"q\",\"kalloutsearch4.com\":\"Keywords\",\"search.rapidns.net\":\"SearchQuery\",\"websearch.4shared.com\":\"q\",\"images.search.conduit.com\":\"q\",\"search.cpchero.biz\":\"q\",\"search.kikin.com\":\"q\",\"www.engine-search.biz\":\"q\",\"www.mysearchresults.com\":\"q\",\"search.vdc.com.vn\":\"SearchQuery\",\"search.charter.net\":\"search\",\"search-vbc.com\":\"keywords\",\"search.pch.com\":\"q\",\"search.pantip.com\":\"\",\"www.startsearcher.com\":\"q\",\"search.icafemanager.com\":\"q\",\"aolsearcht10.search.aol.com\":\"q\",\"search.free.fr\":\"\",\"www.similarsitesearch.com\":\"URL\",\"qoqole.com\":\"q\",\"www.claro-search.com\":\"q\",\"isearch.claro-search.com\":\"q\",\"www.uncoverthenet.com/search\":\"q\",\"www.searchcanvas.com\":\"q\",\"search.etoolkit.com\":\"q\",\"www.searchalgo.com\":\"q\",\"bestsearchall.com\":\"q\",\"bestorganicsearch.com\":\"q\",\"mysearchproperties.com\":\"q\",\"search.treasuretrooper.com\":\"q\",\"btsearch.name\":\"q\",\"optu.search-help.net\":\"search\",\"search.clinck.in\":\"q\",\"search.shareazaweb.net\":\"q\",\"search.solarmash.com\":\"q\",\"search.surfcanyon.com\":\"q\",\"search.tedata.net\":\"SearchQuery\",\"www.gooofullsearch.com\":\"keywords\",\"www.alnaddy.com\":\"q\",\"searchsafer.com\":\"q\",\"www.searchqu.com\":\"q\",\"searchfunmoods.com\":\"s\",\"www.searchfunmoods.com\":\"s\",\"www.searchya.com\":\"q\",\"search.lphant.net\":\"\",\"searchremagnified.com\":\"\",\"www.pagequeryresults.com\":\"\",\"www.searchqueryresults.com\":\"\",\"domainhelp.search.com\":\"q\",\"search.b1.org\":\"q\",\"search.pontofrio.com.br\":\"q\",\"search.maxonline.com.sg\":\"q\",\"search.us.com\":\"k\",\"www.picsearch.com\":\"q\",\"www.search-document.com\":\"q\",\"www.searchsafer.com\":\"q\",\"www.website-unavailable.com\":\"q\",\"fantastigames.metacrawler.com\":\"q\"}|||8641356441385431");), Ersetzt,[f674c6fba6d5ce68c90607e7778d43bd] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "hxxp://search.babylon.com/?babsrc=TB_def&mntrId=b4f9547d00000000000000ff01000001&q=");), Ersetzt,[a3c78c35cab178be9da9678753b155ab] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.id", "b4f9547d00000000000000ff01000001");), Ersetzt,[6bff556c0d6e2a0ce36306e8cf35aa56] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.appId", "{BDB69379-802F-4eaf-B541-F8DE92DD98DB}");), Ersetzt,[5911d6eb9edddd592e18509e9074c53b] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.instlDay", "15658");), Ersetzt,[2f3b7f423f3c0f2788be09e55aaacb35] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.vrsn", "1.8.3.8");), Ersetzt,[8cdeecd5fa818ea8c581d21c39cbba46] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.vrsni", "1.8.3.8");), Ersetzt,[5e0cac15403b0d29c086826c1de7d12f] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.8.3.817:19:28");), Ersetzt,[2248a21f700b2b0b2c1a0de17d87a55b] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.prtnrId", "babylon");), Ersetzt,[cb9fcaf782f9b0866bdb18d6f212d62a] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");), Ersetzt,[2c3ef9c80675340232140ce24bb908f8] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.aflt", "babsst");), Ersetzt,[2b3f7849b1ca05313a0cb5393fc560a0] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar_i.smplGrp", "none");), Ersetzt,[adbd942d1a617abcc482aa44679d956b] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.tlbrId", "base");), Ersetzt,[36345071fe7d280e073fee00cb39f20e] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.instlRef", "sst");), Ersetzt,[bcae10b12754b0863b0bc925ff050cf4] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.dfltLng", "en");), Ersetzt,[d4962e93a5d65fd77bcb16d8ae569b65] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.excTlbr", false);), Ersetzt,[2b3f6f52285348ee7ccab13d5ca8857b] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.admin", false);), Ersetzt,[e08ac7faee8db87e52f4608e37cdef11] Physische Sektoren: 0 (No malicious items detected) (end) Code:
ATTFilter # AdwCleaner v3.302 - Bericht erstellt am 03/08/2014 um 19:08:37
# Aktualisiert 30/07/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Julian - USER-PC
# Gestartet von : C:\Users\Julian\Desktop\adwcleaner_3.302.exe
# Option : Suchen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Datei Gefunden : C:\Program Files (x86)\Mozilla Firefox\user.js
Datei Gefunden : C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js
Datei Gefunden : C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\igclhn7f.default\foxydeal.sqlite
Datei Gefunden : C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\igclhn7f.default\user.js
Datei Gefunden : C:\Windows\System32\dmwu.exe
Datei Gefunden : C:\Windows\System32\ImhxxpComm.dll
Ordner Gefunden : C:\Program Files (x86)\Mozilla Firefox\Extensions\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}
Ordner Gefunden : C:\ProgramData\DeviceVM
Ordner Gefunden : C:\Users\Adrian\AppData\Local\Conduit
Ordner Gefunden : C:\Users\Adrian\AppData\LocalLow\Conduit
Ordner Gefunden : C:\Users\Adrian\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gefunden : C:\Users\Adrian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Browser Manager
Ordner Gefunden : C:\Users\User\AppData\Roaming\DeviceVM
Ordner Gefunden : C:\Windows\System32\ARFC
***** [ Tasks ] *****
Task Gefunden : Browser Manager
Task Gefunden : DealPlyUpdate
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{94496571-6AC5-4836-82D5-D46260C44B17}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{FD8F79A0-D2E2-4FA2-AEAF-393EAC8064F7}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\DVDVideoSoftTBAutoUpdateHelper_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\DVDVideoSoftTBAutoUpdateHelper_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SearchSettings_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SearchSettings_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_tuxguitar_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_tuxguitar_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASMANCS
Schlüssel Gefunden : HKLM\Software\Uniblue
Schlüssel Gefunden : HKLM\Software\Uniblue\DriverScanner
Schlüssel Gefunden : HKLM\Software\Vittalia
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{FD8F79A0-D2E2-4FA2-AEAF-393EAC8064F7}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\WNLT
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17207
-\\ Mozilla Firefox v31.0 (x86 de)
[ Datei : C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js ]
Zeile gefunden : user_pref("CT2269050_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1358436091972,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");
Zeile gefunden : user_pref("Smartbar.ConduitHomepagesList", "");
Zeile gefunden : user_pref("Smartbar.ConduitSearchEngineList", "");
Zeile gefunden : user_pref("Smartbar.ConduitSearchUrlList", "");
Zeile gefunden : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=685749&p=");
Zeile gefunden : user_pref("Smartbar.keywordURLSelectedCTID", "CT2269050");
Zeile gefunden : user_pref("browser.BabylonToolbar_i.newTab", "");
Zeile gefunden : user_pref("browser.BabylonToolbar_i.newTabUrl", "");
Zeile gefunden : user_pref("browser.babylon.HPOnNewTab", "");
Zeile gefunden : user_pref("extensions.BabylonToolbar.dfltlng", "en");
Zeile gefunden : user_pref("extensions.BabylonToolbar.instlday", "15658");
Zeile gefunden : user_pref("extensions.BabylonToolbar.instlref", "sst");
Zeile gefunden : user_pref("extensions.BabylonToolbar.prtnrid", "babylon");
Zeile gefunden : user_pref("extensions.BabylonToolbar.smplgrp", "azb");
Zeile gefunden : user_pref("extensions.BabylonToolbar.tlbrid", "base");
Zeile gefunden : user_pref("extensions.BabylonToolbar.tlbrsrchurl", "hxxp://search.babylon.com/?babsrc=TB_def&mntrId=b4f9547d00000000000000ff01000001&q=");
Zeile gefunden : user_pref("extensions.BabylonToolbar.vrsnts", "1.8.3.817:19:28");
Zeile gefunden : user_pref("extensions.incredibar.dfltlng", "en");
Zeile gefunden : user_pref("extensions.incredibar.instlday", "15640");
Zeile gefunden : user_pref("extensions.incredibar.instlref", "");
Zeile gefunden : user_pref("extensions.incredibar.prtnrid", "Incredibar");
Zeile gefunden : user_pref("extensions.incredibar.smplgrp", "none");
Zeile gefunden : user_pref("extensions.incredibar.tlbrid", "base");
Zeile gefunden : user_pref("extensions.incredibar.tlbrsrchurl", "hxxp://mystart.Incredibar.com/?a=6R8JrRz5pI&loc=IB_TB&i=26&search=");
Zeile gefunden : user_pref("extensions.incredibar.vrsnts", "1.5.11.1419:44:52");
Zeile gefunden : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_blackList", "form=CONTLB|babsrc=toolbar|babsrc=tb_ss|invocationType=tb50-ie-aolsoftonic-tbsbox-en-us|invocationType=tb50-ff-aolsoftonic[...]
Zeile gefunden : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_referrer", "hxxp://search.babylon.com/?affID=115284&tt=4612_4&babsrc=NT_ss&mntrId=b4f9547d00000000000000ff01000001/|||8641352992363487"[...]
Zeile gefunden : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_temp_referer", "hxxp://search.babylon.com/?affID=115284&tt=4612_4&babsrc=NT_ss&mntrId=b4f9547d00000000000000ff01000001");
[ Datei : C:\Users\Constantin\AppData\Roaming\Mozilla\Firefox\Profiles\j5q0ffjr.default\prefs.js ]
[ Datei : C:\Users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\mhasid1l.default\prefs.js ]
[ Datei : C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\vm7brfvt.default\prefs.js ]
[ Datei : C:\Users\scndAdmin\AppData\Roaming\Mozilla\Firefox\Profiles\27r3p1bz.default\prefs.js ]
[ Datei : C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\igclhn7f.default\prefs.js ]
*************************
AdwCleaner[R0].txt - [6565 octets] - [03/08/2014 19:08:37]
########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [6625 octets] ##########
ESET log Code:
ATTFilter C:\Program Files (x86)\Mozilla Firefox\extensions\staged\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}\chrome\content\dealply.xul Win32/DealPly.J potentially unwanted application
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CVY49772\update[1] a variant of Win32/Toolbar.Perion.A potentially unwanted application
C:\Windows\System32\config\systemprofile\AppData\LocalLow\DVDVideoSoftTB\ldrtbDVDV.dll a variant of Win32/Toolbar.Conduit.P potentially unwanted application
C:\Windows\System32\config\systemprofile\AppData\LocalLow\DVDVideoSoftTB\tbDVDV.dll a variant of Win32/Toolbar.Conduit.B potentially unwanted application
C:\Windows\System32\config\systemprofile\AppData\LocalLow\DVDVideoSoftTB\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.5.3\bin\PriceGongIE.dll a variant of Win32/PriceGong.A potentially unwanted application
C:\Windows\System32\config\systemprofile\AppData\Roaming\DealPly\UpdateProc\UpdateTask.exe Win32/DealPly.B potentially unwanted application
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CVY49772\update[1] a variant of Win32/Toolbar.Perion.A potentially unwanted application
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\DVDVideoSoftTB\ldrtbDVDV.dll a variant of Win32/Toolbar.Conduit.P potentially unwanted application
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\DVDVideoSoftTB\tbDVDV.dll a variant of Win32/Toolbar.Conduit.B potentially unwanted application
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\DVDVideoSoftTB\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.5.3\bin\PriceGongIE.dll a variant of Win32/PriceGong.A potentially unwanted application
C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\DealPly\UpdateProc\UpdateTask.exe Win32/DealPly.B potentially unwanted application
D:\Downloads\Unlocker1.9.1-x64.exe Win32/Adware.ADON potentially unwanted application
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 03.08.2014 Suchlauf-Zeit: 19:54:50 Logdatei: mbam 2.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.08.03.06 Rootkit Datenbank: v2014.08.01.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Julian Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 503582 Verstrichene Zeit: 6 Min, 0 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 16 PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.dfltlng", "en");), Ersetzt,[78f2e1e0a1da300605fa3ab434d0857b] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.instlday", "15658");), Ersetzt,[96d4c3fe3645fd39ea15638b4abacb35] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.instlref", "sst");), Ersetzt,[6109dfe2ee8d8da92ed11bd317ed768a] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.prtnrid", "babylon");), Ersetzt,[8ae0dbe65625270f45ba0be30ff5d62a] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.smplgrp", "azb");), Ersetzt,[77f3f4cd1b60bc7a847b688606fe7789] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.tlbrid", "base");), Ersetzt,[0c5e17aa2d4e4aec758a41ad897b1ee2] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.tlbrsrchurl", "hxxp://search.babylon.com/?babsrc=TB_def&mntrId=b4f9547d00000000000000ff01000001&q=");), Ersetzt,[a0ca517073081620798643ab3dc7fb05] PUP.Optional.Babylon.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.vrsnts", "1.8.3.817:19:28");), Ersetzt,[80eab20fc9b20a2cec13d618ad5729d7] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.dfltlng", "en");), Ersetzt,[f07a922f4b300e28bc45a8472bd93bc5] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.instlday", "15640");), Ersetzt,[6307b20fa0dbb086f20f608f966eaa56] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.instlref", "");), Ersetzt,[eb7f6d54df9cc274966b539c09fba25e] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.prtnrid", "Incredibar");), Ersetzt,[92d801c0b9c2999d40c1915ec4402cd4] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.smplgrp", "none");), Ersetzt,[31396f52ed8e64d22bd6cc231de7a15f] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.tlbrid", "base");), Ersetzt,[6208c3fe176449ed51b0e30c26de867a] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.tlbrsrchurl", "hxxp://mystart.Incredibar.com/?a=6R8JrRz5pI&loc=IB_TB&i=26&search=");), Ersetzt,[4624249d7a01f14520e18f605fa557a9] PUP.Optional.Incredibar.A, C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.vrsnts", "1.5.11.1419:44:52");), Ersetzt,[373320a14a316bcbf90838b7a1639e62] Physische Sektoren: 0 (No malicious items detected) (end) Mausbewegungen usw. wurden jedoch nicht gemacht)Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net Rootkit scan 2014-08-03 21:36:09 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 OCZ-AGIL rev.2.11 55,90GB Running: 6wo5yswk.exe; Driver: C:\Users\Julian\AppData\Local\Temp\kxldapob.sys ---- Kernel code sections - GMER 2.1 ---- INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff800045f0000 63 bytes [00, 00, 83, 00, 4D, 64, 6C, ...] INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 592 fffff800045f0040 6 bytes [14, 82, 08, 00, 00, 00] ---- User code sections - GMER 2.1 ---- .text C:\Windows\SysWOW64\PnkBstrA.exe[1956] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322 0000000073671a22 2 bytes [67, 73] .text C:\Windows\SysWOW64\PnkBstrA.exe[1956] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496 0000000073671ad0 2 bytes [67, 73] .text C:\Windows\SysWOW64\PnkBstrA.exe[1956] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552 0000000073671b08 2 bytes [67, 73] .text C:\Windows\SysWOW64\PnkBstrA.exe[1956] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730 0000000073671bba 2 bytes [67, 73] .text C:\Windows\SysWOW64\PnkBstrA.exe[1956] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762 0000000073671bda 2 bytes [67, 73] .text C:\Windows\SysWOW64\PnkBstrA.exe[1956] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b01465 2 bytes [B0, 75] .text C:\Windows\SysWOW64\PnkBstrA.exe[1956] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b014bb 2 bytes [B0, 75] .text ... * 2 .text C:\Program Files (x86)\Secunia\PSI\PSIA.exe[2468] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b01465 2 bytes [B0, 75] .text C:\Program Files (x86)\Secunia\PSI\PSIA.exe[2468] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b014bb 2 bytes [B0, 75] .text ... * 2 .text C:\Program Files (x86)\Secunia\PSI\PSI_TRAY.exe[3208] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b01465 2 bytes [B0, 75] .text C:\Program Files (x86)\Secunia\PSI\PSI_TRAY.exe[3208] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b014bb 2 bytes [B0, 75] .text ... * 2 .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[4488] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b01465 2 bytes [B0, 75] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[4488] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b014bb 2 bytes [B0, 75] .text ... * 2 ? C:\Windows\system32\mssprxy.dll [4488] entry point in ".rdata" section 000000006c7c71e6 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\000272b0f46e Reg HKLM\SYSTEM\ControlSet003\services\BTHPORT\Parameters\Keys\000272b0f46e (not active ControlSet) ---- EOF - GMER 2.1 ---- |
|
04.08.2014, 15:55
| #5 |
| | Babylon.A , Incredibar.A , PriceGong, Spigot, Dealply & Co in C:\Users\...\AppData\Roaming\ Teil 3 ein weiterer FRST Scan FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-08-2014
Ran by Julian (administrator) on USER-PC on 03-08-2014 21:42:14
Running from C:\Users\Julian\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_x64.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(FNet Co., Ltd.) C:\Program Files (x86)\XFastUsb\XFastUsb.exe
() C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe
(Razer USA Ltd.) C:\Program Files (x86)\Razer\Lycosa\razerhid.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\Razer\Lycosa\razertra.exe
() C:\Program Files (x86)\Razer\DeathAdder\razertra.exe
(Razer Inc.) C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe
() C:\Program Files (x86)\Razer\DeathAdder\vdDaemon.exe
(Panda Security) C:\Program Files (x86)\Panda USB Vaccine\USBVaccine.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [615584 2011-03-01] (Atheros Communications)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [379552 2011-03-01] (Atheros Commnucations)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2403104 2014-07-25] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-05] (Intel Corporation)
HKLM-x32\...\Run: [XFastUsb] => C:\Program Files (x86)\XFastUsb\XFastUsb.exe [4942336 2011-09-05] (FNet Co., Ltd.)
HKLM-x32\...\Run: [DeathAdder] => C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe [248320 2011-03-21] ()
HKLM-x32\...\Run: [Lycosa] => C:\Program Files (x86)\Razer\Lycosa\razerhid.exe [238592 2010-04-13] (Razer USA Ltd.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-11] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-82016817-340743653-2786680247-1007\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-82016817-340743653-2786680247-1007\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [166568 2014-07-02] (NVIDIA Corporation)
AppInit_DLLs: , C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [166568 2014-07-02] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [146480 2014-07-02] (NVIDIA Corporation)
Startup: C:\Users\Adrian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> D:\Programme\OpenOffice\program\quickstart.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet Pro 8600.lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet Pro 8600.lnk -> C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
BootExecute:
GroupPolicyUsers\S-1-5-21-82016817-340743653-2786680247-1002\User: Group Policy restriction detected <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM-x32 - DefaultScope value is missing.
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\mhasid1l.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 -> C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=1.118.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=1.122.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: HTTPS-Everywhere - C:\Users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\mhasid1l.default\Extensions\https-everywhere@eff.org [2014-08-03]
FF Extension: WOT - C:\Users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\mhasid1l.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014-08-03]
FF Extension: Ghostery - C:\Users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\mhasid1l.default\Extensions\firefox@ghostery.com.xpi [2014-08-03]
FF Extension: Screengrab (fix version) - C:\Users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\mhasid1l.default\Extensions\{02450914-cdd9-410f-b1da-db004e18c671}.xpi [2014-08-03]
FF Extension: NoScript - C:\Users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\mhasid1l.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-08-03]
FF Extension: Adblock Edge - C:\Users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\mhasid1l.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2014-08-03]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\staged [2014-08-02]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF} [2014-08-02]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [76448 2011-03-01] (Atheros Commnucations) [File not signed]
S4 DevoloNetworkService; D:\Programme\devolo\dlan\devolonetsvc.exe [3647992 2014-05-14] (devolo AG)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720608 2014-07-25] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18956064 2014-07-25] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-04-21] ()
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
S2 SetupARService; C:\Program Files (x86)\Realtek\Audio\SetupAfterRebootService.exe [24576 2011-12-16] (Realtek Semiconductor.) [File not signed]
S4 WireHelpSvc; C:\Program Files\Common Files\WireHelpSvc.exe [168864 2011-11-28] ()
S4 FirebirdServerMAGIXInstance; C:\Program Files (x86)\MAGIX\Common\Database\bin\fbserver.exe [X]
S4 UPnPService; C:\Program Files (x86)\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 ALSysIO; No ImagePath
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 bulkadi; C:\Windows\System32\DRIVERS\bulkrazer_x64.sys [25088 2011-02-09] (Windows (R) Codename Longhorn DDK provider)
R3 ESLvnic1; C:\Windows\System32\DRIVERS\ESLvnic.sys [25528 2011-11-28] (Turtle Entertainment GmbH)
R2 ESLWireAC; C:\Windows\system32\drivers\ESLWireACD.sys [147472 2011-11-28] (<Turtle Entertainment>)
S3 FNETTBOH_305; C:\Windows\System32\drivers\FNETTBOH_305.SYS [31808 2011-12-16] (FNet Co., Ltd.)
R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [15936 2011-09-05] (FNet Co., Ltd.)
R3 Lycosa; C:\Windows\System32\drivers\Lycosa.sys [20352 2009-09-30] (Razer USA Ltd.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2014-05-14] (CACE Technologies)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-07-25] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
S1 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2006-07-24] () [File not signed]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 IntcAzAudAddService; system32\drivers\RTKVHD64.sys [X]
S2 SSPORT; \??\C:\Windows\system32\Drivers\SSPORT.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-03 21:42 - 2014-08-03 21:42 - 00014711 _____ () C:\Users\Julian\Desktop\FRST.txt
2014-08-03 21:37 - 2014-08-03 21:37 - 00002522 _____ () C:\Windows\PFRO.log
2014-08-03 21:37 - 2014-08-03 21:37 - 00000168 _____ () C:\Windows\setupact.log
2014-08-03 21:37 - 2014-08-03 21:37 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-03 20:27 - 2014-08-03 20:27 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-03 20:27 - 2014-08-03 20:27 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-03 20:27 - 2014-08-03 20:27 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-03 20:27 - 2014-08-03 20:27 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-03 20:27 - 2014-08-03 20:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-08-03 20:25 - 2014-08-03 20:36 - 00000000 ____D () C:\Users\Julian\AppData\Local\CrashDumps
2014-08-03 19:58 - 2014-08-03 19:58 - 00002774 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-08-03 19:58 - 2014-08-03 19:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-08-03 19:58 - 2014-08-03 19:58 - 00000000 ____D () C:\Program Files\CCleaner
2014-08-03 19:51 - 2014-08-03 19:51 - 00003072 _____ () C:\Windows\System32\Tasks\PandaUSBVaccine
2014-08-03 19:51 - 2014-08-03 19:51 - 00000000 ____D () C:\ProgramData\Panda Security
2014-08-03 19:51 - 2014-08-03 19:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-08-03 19:51 - 2014-08-03 19:51 - 00000000 ____D () C:\Program Files (x86)\Panda USB Vaccine
2014-08-03 19:09 - 2014-01-23 13:35 - 229338408 _____ () C:\Users\Julian\Desktop\Paragon-Backup_Recovery_2014_free_64Bit.exe
2014-08-03 19:08 - 2014-08-03 19:08 - 00000000 ____D () C:\AdwCleaner
2014-08-03 19:05 - 2014-08-03 19:05 - 00001065 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
2014-08-03 19:05 - 2014-08-03 19:05 - 00000000 ____D () C:\Users\Julian\AppData\Local\Secunia PSI
2014-08-03 19:05 - 2014-08-03 19:05 - 00000000 ____D () C:\Program Files (x86)\Secunia
2014-08-03 18:37 - 2014-08-03 18:37 - 01016261 _____ (Thisisu) C:\Users\Julian\Desktop\JRT.exe
2014-08-03 18:32 - 2014-08-03 21:41 - 00000000 ____D () C:\Users\Julian\Desktop\Sec
2014-08-03 18:20 - 2014-08-03 18:20 - 00000000 __SHD () C:\Users\Julian\AppData\Local\EmieUserList
2014-08-03 18:20 - 2014-08-03 18:20 - 00000000 __SHD () C:\Users\Julian\AppData\Local\EmieSiteList
2014-08-03 18:06 - 2014-08-03 21:42 - 00000000 ____D () C:\FRST
2014-08-03 18:02 - 2014-08-03 18:02 - 02094080 _____ (Farbar) C:\Users\Julian\Desktop\FRST64.exe
2014-08-03 17:52 - 2014-08-03 19:54 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-03 17:49 - 2014-08-03 17:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-08-03 17:49 - 2014-08-03 17:49 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-08-03 17:49 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-03 17:49 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-03 17:46 - 2014-08-03 17:49 - 00000000 ____D () C:\Users\Julian\AppData\Roaming\Malwarebytes
2014-08-03 09:34 - 2014-08-03 09:34 - 00000809 _____ () C:\Users\Adrian\Desktop\FUSSBALL MANAGER 13.lnk
2014-08-02 23:58 - 2014-08-02 23:58 - 00000000 ____D () C:\Users\Adrian\Desktop\Neuer Ordner
2014-08-02 23:58 - 2013-05-14 20:56 - 00000847 _____ () C:\Users\Adrian\Desktop\FIFA 13.lnk
2014-08-02 23:43 - 2014-08-02 23:46 - 00000350 _____ () C:\Users\Adrian\Desktop\Hallo Adrian.txt
2014-08-02 23:37 - 2013-05-10 11:57 - 01661440 _____ (Slackerhome Productions) C:\Users\User\Desktop\Better DS3.exe
2014-08-02 23:32 - 2013-03-13 23:11 - 00000513 _____ () C:\Users\User\Desktop\Programme und Funktionen - Verknüpfung (2).lnk
2014-08-02 23:32 - 2013-03-13 22:56 - 00000493 _____ () C:\Users\User\Desktop\Wartungscenter - Verknüpfung (2).lnk
2014-08-02 23:31 - 2013-04-20 18:18 - 00000000 _____ () C:\Users\User\Desktop\Neues Textdokument (5).txt
2014-08-02 23:31 - 2013-03-13 22:56 - 00000493 _____ () C:\Users\User\Desktop\Windows Update - Verknüpfung (2).lnk
2014-08-02 23:31 - 2013-03-01 15:18 - 00001123 _____ () C:\Users\User\Desktop\ Malwarebytes Anti-Malware (2).lnk
2014-08-02 23:31 - 2013-02-20 19:01 - 00002117 _____ () C:\Users\User\Desktop\Microsoft Security Essentials (2).lnk
2014-08-02 23:31 - 2012-07-03 17:11 - 27904000 _____ () C:\Users\User\Desktop\CF-Root-SGS3-v6.4.tar
2014-08-02 23:30 - 2013-03-13 23:11 - 00000513 _____ () C:\Users\User\Desktop\Programme und Funktionen - Verknüpfung.lnk
2014-08-02 23:30 - 2013-03-13 22:56 - 00000493 _____ () C:\Users\User\Desktop\Windows Update - Verknüpfung.lnk
2014-08-02 23:30 - 2013-03-13 22:56 - 00000493 _____ () C:\Users\User\Desktop\Wartungscenter - Verknüpfung.lnk
2014-08-02 23:29 - 2013-04-20 18:18 - 00000000 _____ () C:\Users\User\Desktop\Neues Textdokument (4).txt
2014-08-02 23:29 - 2013-02-20 19:01 - 00002117 _____ () C:\Users\User\Desktop\Microsoft Security Essentials.lnk
2014-08-02 23:27 - 2014-08-02 23:28 - 00000000 ____D () C:\Users\Julian\AppData\Local\NVIDIA Corporation
2014-08-02 23:27 - 2014-08-02 23:27 - 00000000 ____D () C:\Users\Julian\AppData\Local\NVIDIA
2014-08-02 23:17 - 2014-08-03 09:32 - 00000000 ____D () C:\Users\Adrian\AppData\Local\BetterDS3
2014-08-02 23:16 - 2013-05-10 11:57 - 01661440 _____ (Slackerhome Productions) C:\Users\Adrian\Desktop\Better DS3.exe
2014-08-02 23:12 - 2014-07-02 19:44 - 00609240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-08-02 23:10 - 2014-07-02 22:48 - 31512520 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 24196896 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 22994208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 17555104 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 15294296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 13922752 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 13835208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 12866008 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-08-02 23:10 - 2014-07-02 22:48 - 11283344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 11222048 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 04247000 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 03989960 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 01890080 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434052.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 01539928 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434052.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 00944928 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 00907096 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 00903624 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 00869152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 00846832 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 00354016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 00166568 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2014-08-02 22:59 - 2014-08-02 22:59 - 00000000 ____D () C:\Users\scndAdmin\Desktop\Neuer Ordner
2014-08-02 22:54 - 2014-08-02 22:54 - 00000000 ____D () C:\Users\scndAdmin\AppData\Roaming\MotioninJoy
2014-08-02 22:53 - 2014-08-02 22:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MotioninJoy
2014-08-02 22:53 - 2014-08-02 22:53 - 00000000 ____D () C:\Program Files\MotioninJoy
2014-08-02 22:53 - 2011-12-07 19:42 - 00328712 _____ (Logitech Inc.) C:\Windows\system32\MijFrc.dll
2014-08-02 22:52 - 2014-08-02 22:52 - 00000000 ____D () C:\Users\Public\Documents\Atheros
2014-08-02 22:37 - 2014-08-02 23:00 - 00000000 ____D () C:\Users\scndAdmin\Documents\Bluetooth Folder
2014-08-02 22:37 - 2014-08-02 22:37 - 00000000 ____D () C:\Users\scndAdmin\AppData\Local\BMExplorer
2014-08-02 22:05 - 2014-08-02 22:05 - 00008068 _____ () C:\Users\scndAdmin\AppData\Local\CleanupUninstall.txt
2014-08-02 21:36 - 2014-07-25 15:50 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2014-08-02 21:36 - 2014-07-25 15:50 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2014-08-02 21:18 - 2014-08-02 21:19 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-08-02 21:18 - 2014-08-02 21:18 - 00000000 ____D () C:\Users\scndAdmin\AppData\Roaming\WinRAR
2014-08-02 21:18 - 2014-08-02 21:18 - 00000000 ____D () C:\Users\scndAdmin\AppData\Local\BetterDS3
2014-08-02 21:18 - 2013-05-10 11:57 - 01661440 _____ (Slackerhome Productions) C:\Users\scndAdmin\Desktop\Better DS3.exe
2014-08-02 20:16 - 2014-08-02 20:16 - 00000000 ____D () C:\Users\scndAdmin\AppData\Roaming\de.devolo.dLAN.Cockpit
2014-08-02 19:51 - 2014-08-02 19:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech
2014-08-02 19:51 - 2014-08-02 19:51 - 00000000 ____D () C:\ProgramData\LogiShrd
2014-08-02 19:50 - 2014-08-02 19:50 - 00000000 ____D () C:\Program Files\Common Files\LogiShrd
2014-08-02 19:46 - 2014-08-02 19:46 - 00000000 __SHD () C:\Users\Adrian\AppData\Local\EmieUserList
2014-08-02 19:46 - 2014-08-02 19:46 - 00000000 __SHD () C:\Users\Adrian\AppData\Local\EmieSiteList
2014-08-02 13:45 - 2014-08-02 13:45 - 00000000 ____D () C:\Users\Adrian\AppData\Local\NVIDIA Corporation
2014-08-02 13:45 - 2014-08-02 13:45 - 00000000 ____D () C:\Users\Adrian\AppData\Local\NVIDIA
2014-08-02 11:40 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-02 11:40 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-02 11:40 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-08-02 11:40 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-02 11:40 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-02 11:40 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-02 11:40 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-08-02 11:40 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-02 11:40 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-02 11:40 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-08-02 11:40 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-02 11:40 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-08-02 11:40 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-08-02 11:40 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-07-28 21:58 - 2014-07-28 21:58 - 00002059 _____ () C:\Users\User\Desktop\autoexec (orig).cfg
2014-07-28 21:58 - 2014-07-28 20:35 - 00010880 _____ () C:\Users\User\Desktop\config (orig).cfg
2014-07-28 16:14 - 2014-07-28 21:58 - 00002059 _____ () C:\Users\User\Desktop\autoexec.cfg
2014-07-28 16:14 - 2014-07-27 15:08 - 00010179 _____ () C:\Users\User\Desktop\config.cfg
2014-07-28 15:45 - 2014-07-28 21:57 - 00001013 _____ () C:\Users\User\Desktop\Neues Textdokument (3).txt
2014-07-24 15:23 - 2014-07-24 15:23 - 00000000 ____D () C:\Users\User\AppData\Roaming\de.devolo.dLAN.Cockpit
2014-07-24 15:20 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-24 15:20 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-24 15:20 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-24 15:20 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-24 15:20 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-24 15:20 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-24 15:20 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-24 15:20 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-24 15:20 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-24 15:20 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-24 15:20 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-24 15:20 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-24 15:20 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-24 15:20 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-24 15:20 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-24 15:20 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-24 15:20 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-24 15:20 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-24 15:20 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-24 15:20 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-24 15:20 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-24 15:20 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-24 15:20 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-24 15:20 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-24 15:20 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-24 15:20 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-24 15:20 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-24 15:20 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-24 15:20 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-24 15:20 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-24 15:20 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-24 15:20 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-24 15:20 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-24 15:20 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-24 15:20 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-24 15:20 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-24 15:20 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-24 15:20 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-24 15:20 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-24 15:20 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-24 15:20 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-24 15:20 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-24 15:20 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-24 15:20 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-24 15:20 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-24 15:20 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-24 15:20 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-24 15:20 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-24 15:20 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-24 15:20 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-24 15:20 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-24 15:20 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-24 15:20 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-24 15:20 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-24 15:20 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-24 15:20 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-24 15:20 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-24 15:20 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-24 15:20 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-24 15:20 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-24 15:20 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-24 15:20 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-24 15:20 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-24 15:20 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-24 15:20 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-24 15:20 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-24 15:20 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-24 15:20 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-24 15:20 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-24 15:20 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-24 15:20 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-24 15:20 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-24 15:20 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-24 15:20 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-24 15:20 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-24 15:20 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-24 15:18 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-24 15:18 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-24 15:18 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-03 21:42 - 2014-08-03 21:42 - 00014711 _____ () C:\Users\Julian\Desktop\FRST.txt
2014-08-03 21:42 - 2014-08-03 18:06 - 00000000 ____D () C:\FRST
2014-08-03 21:41 - 2014-08-03 18:32 - 00000000 ____D () C:\Users\Julian\Desktop\Sec
2014-08-03 21:37 - 2014-08-03 21:37 - 00002522 _____ () C:\Windows\PFRO.log
2014-08-03 21:37 - 2014-08-03 21:37 - 00000168 _____ () C:\Windows\setupact.log
2014-08-03 21:37 - 2014-08-03 21:37 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-03 21:37 - 2012-07-12 08:36 - 00000035 _____ () C:\Users\Public\Documents\AtherosServiceConfig.ini
2014-08-03 21:37 - 2011-09-06 11:51 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-08-03 21:37 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-03 21:36 - 2011-09-05 13:10 - 01211193 _____ () C:\Windows\WindowsUpdate.log
2014-08-03 20:36 - 2014-08-03 20:25 - 00000000 ____D () C:\Users\Julian\AppData\Local\CrashDumps
2014-08-03 20:36 - 2011-10-04 15:50 - 00000000 ____D () C:\Windows\Minidump
2014-08-03 20:36 - 2011-09-05 20:01 - 00000000 ____D () C:\Windows\Panther
2014-08-03 20:27 - 2014-08-03 20:27 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-03 20:27 - 2014-08-03 20:27 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-03 20:27 - 2014-08-03 20:27 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-03 20:27 - 2014-08-03 20:27 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-03 20:27 - 2014-08-03 20:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-08-03 20:27 - 2014-05-29 15:29 - 00000000 ____D () C:\ProgramData\Oracle
2014-08-03 20:27 - 2011-11-09 18:44 - 00000000 ____D () C:\Program Files (x86)\Java
2014-08-03 19:58 - 2014-08-03 19:58 - 00002774 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-08-03 19:58 - 2014-08-03 19:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-08-03 19:58 - 2014-08-03 19:58 - 00000000 ____D () C:\Program Files\CCleaner
2014-08-03 19:54 - 2014-08-03 17:52 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-03 19:51 - 2014-08-03 19:51 - 00003072 _____ () C:\Windows\System32\Tasks\PandaUSBVaccine
2014-08-03 19:51 - 2014-08-03 19:51 - 00000000 ____D () C:\ProgramData\Panda Security
2014-08-03 19:51 - 2014-08-03 19:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-08-03 19:51 - 2014-08-03 19:51 - 00000000 ____D () C:\Program Files (x86)\Panda USB Vaccine
2014-08-03 19:08 - 2014-08-03 19:08 - 00000000 ____D () C:\AdwCleaner
2014-08-03 19:05 - 2014-08-03 19:05 - 00001065 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
2014-08-03 19:05 - 2014-08-03 19:05 - 00000000 ____D () C:\Users\Julian\AppData\Local\Secunia PSI
2014-08-03 19:05 - 2014-08-03 19:05 - 00000000 ____D () C:\Program Files (x86)\Secunia
2014-08-03 18:37 - 2014-08-03 18:37 - 01016261 _____ (Thisisu) C:\Users\Julian\Desktop\JRT.exe
2014-08-03 18:25 - 2009-07-14 06:45 - 00021840 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-03 18:25 - 2009-07-14 06:45 - 00021840 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-03 18:24 - 2011-04-12 09:43 - 13996740 _____ () C:\Windows\system32\perfh007.dat
2014-08-03 18:24 - 2011-04-12 09:43 - 04329568 _____ () C:\Windows\system32\perfc007.dat
2014-08-03 18:24 - 2009-07-14 07:13 - 00006292 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-03 18:20 - 2014-08-03 18:20 - 00000000 __SHD () C:\Users\Julian\AppData\Local\EmieUserList
2014-08-03 18:20 - 2014-08-03 18:20 - 00000000 __SHD () C:\Users\Julian\AppData\Local\EmieSiteList
2014-08-03 18:13 - 2013-04-21 22:54 - 00000000 ____D () C:\Users\scndAdmin
2014-08-03 18:13 - 2012-10-27 19:44 - 00000000 ____D () C:\Windows\system32\ARFC
2014-08-03 18:02 - 2014-08-03 18:02 - 02094080 _____ (Farbar) C:\Users\Julian\Desktop\FRST64.exe
2014-08-03 17:49 - 2014-08-03 17:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-08-03 17:49 - 2014-08-03 17:49 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-08-03 17:49 - 2014-08-03 17:46 - 00000000 ____D () C:\Users\Julian\AppData\Roaming\Malwarebytes
2014-08-03 17:49 - 2013-03-01 15:18 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-03 17:44 - 2013-03-13 22:54 - 00000000 ____D () C:\Users\Julian\AppData\Local\Mozilla
2014-08-03 17:36 - 2011-10-02 19:57 - 00000000 ____D () C:\ProgramData\Origin
2014-08-03 16:15 - 2012-04-25 15:41 - 00000000 ____D () C:\Users\Adrian\AppData\Roaming\Spotify
2014-08-03 09:34 - 2014-08-03 09:34 - 00000809 _____ () C:\Users\Adrian\Desktop\FUSSBALL MANAGER 13.lnk
2014-08-03 09:32 - 2014-08-02 23:17 - 00000000 ____D () C:\Users\Adrian\AppData\Local\BetterDS3
2014-08-03 09:07 - 2011-10-02 19:57 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-08-02 23:58 - 2014-08-02 23:58 - 00000000 ____D () C:\Users\Adrian\Desktop\Neuer Ordner
2014-08-02 23:46 - 2014-08-02 23:43 - 00000350 _____ () C:\Users\Adrian\Desktop\Hallo Adrian.txt
2014-08-02 23:34 - 2011-09-05 13:18 - 00082768 _____ () C:\Users\User\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-02 23:28 - 2014-08-02 23:27 - 00000000 ____D () C:\Users\Julian\AppData\Local\NVIDIA Corporation
2014-08-02 23:27 - 2014-08-02 23:27 - 00000000 ____D () C:\Users\Julian\AppData\Local\NVIDIA
2014-08-02 23:27 - 2013-03-13 22:50 - 00082768 _____ () C:\Users\Julian\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-02 23:27 - 2013-03-13 22:50 - 00001417 _____ () C:\Users\Julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-08-02 23:27 - 2013-03-13 22:50 - 00000680 __RSH () C:\Users\Julian\ntuser.pol
2014-08-02 23:27 - 2013-03-13 22:50 - 00000000 ____D () C:\Users\Julian
2014-08-02 23:15 - 2011-09-06 17:27 - 00082768 _____ () C:\Users\Adrian\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-02 23:14 - 2012-11-20 18:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2014-08-02 23:12 - 2011-09-06 11:51 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-08-02 23:11 - 2011-09-06 11:50 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-08-02 23:00 - 2014-08-02 22:37 - 00000000 ____D () C:\Users\scndAdmin\Documents\Bluetooth Folder
2014-08-02 22:59 - 2014-08-02 22:59 - 00000000 ____D () C:\Users\scndAdmin\Desktop\Neuer Ordner
2014-08-02 22:54 - 2014-08-02 22:54 - 00000000 ____D () C:\Users\scndAdmin\AppData\Roaming\MotioninJoy
2014-08-02 22:53 - 2014-08-02 22:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MotioninJoy
2014-08-02 22:53 - 2014-08-02 22:53 - 00000000 ____D () C:\Program Files\MotioninJoy
2014-08-02 22:52 - 2014-08-02 22:52 - 00000000 ____D () C:\Users\Public\Documents\Atheros
2014-08-02 22:46 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-08-02 22:43 - 2009-07-14 06:45 - 00339008 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-02 22:40 - 2012-05-05 15:12 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-08-02 22:37 - 2014-08-02 22:37 - 00000000 ____D () C:\Users\scndAdmin\AppData\Local\BMExplorer
2014-08-02 22:37 - 2013-04-21 22:54 - 00082768 _____ () C:\Users\scndAdmin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-02 22:16 - 2013-04-16 12:00 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung Printers
2014-08-02 22:05 - 2014-08-02 22:05 - 00008068 _____ () C:\Users\scndAdmin\AppData\Local\CleanupUninstall.txt
2014-08-02 22:05 - 2013-05-15 20:41 - 00000000 ____D () C:\Users\scndAdmin\AppData\Local\Razer
2014-08-02 22:05 - 2011-09-07 13:05 - 00000000 ____D () C:\ProgramData\Razer
2014-08-02 22:05 - 2011-09-07 13:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer
2014-08-02 22:05 - 2011-09-07 13:05 - 00000000 ____D () C:\Program Files (x86)\Razer
2014-08-02 21:36 - 2014-05-29 15:43 - 00000000 ____D () C:\Users\scndAdmin\AppData\Local\Nvidia Corporation
2014-08-02 21:19 - 2014-08-02 21:18 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-08-02 21:18 - 2014-08-02 21:18 - 00000000 ____D () C:\Users\scndAdmin\AppData\Roaming\WinRAR
2014-08-02 21:18 - 2014-08-02 21:18 - 00000000 ____D () C:\Users\scndAdmin\AppData\Local\BetterDS3
2014-08-02 20:18 - 2013-04-22 18:43 - 00000000 ____D () C:\Users\scndAdmin\AppData\Local\Mozilla
2014-08-02 20:16 - 2014-08-02 20:16 - 00000000 ____D () C:\Users\scndAdmin\AppData\Roaming\de.devolo.dLAN.Cockpit
2014-08-02 20:16 - 2013-04-22 18:42 - 00000680 __RSH () C:\Users\scndAdmin\ntuser.pol
2014-08-02 19:51 - 2014-08-02 19:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech
2014-08-02 19:51 - 2014-08-02 19:51 - 00000000 ____D () C:\ProgramData\LogiShrd
2014-08-02 19:50 - 2014-08-02 19:50 - 00000000 ____D () C:\Program Files\Common Files\LogiShrd
2014-08-02 19:49 - 2012-04-25 15:42 - 00000000 ____D () C:\Users\Adrian\AppData\Local\Spotify
2014-08-02 19:46 - 2014-08-02 19:46 - 00000000 __SHD () C:\Users\Adrian\AppData\Local\EmieUserList
2014-08-02 19:46 - 2014-08-02 19:46 - 00000000 __SHD () C:\Users\Adrian\AppData\Local\EmieSiteList
2014-08-02 13:45 - 2014-08-02 13:45 - 00000000 ____D () C:\Users\Adrian\AppData\Local\NVIDIA Corporation
2014-08-02 13:45 - 2014-08-02 13:45 - 00000000 ____D () C:\Users\Adrian\AppData\Local\NVIDIA
2014-08-02 13:45 - 2011-09-06 17:27 - 00001330 __RSH () C:\Users\Adrian\ntuser.pol
2014-08-02 13:45 - 2011-09-06 17:27 - 00000000 ____D () C:\Users\Adrian
2014-07-30 12:13 - 2014-05-29 15:41 - 00000000 ____D () C:\Users\User\AppData\Local\NVIDIA
2014-07-28 21:58 - 2014-07-28 21:58 - 00002059 _____ () C:\Users\User\Desktop\autoexec (orig).cfg
2014-07-28 21:58 - 2014-07-28 16:14 - 00002059 _____ () C:\Users\User\Desktop\autoexec.cfg
2014-07-28 21:57 - 2014-07-28 15:45 - 00001013 _____ () C:\Users\User\Desktop\Neues Textdokument (3).txt
2014-07-28 20:35 - 2014-07-28 21:58 - 00010880 _____ () C:\Users\User\Desktop\config (orig).cfg
2014-07-28 12:31 - 2012-02-09 13:07 - 00000000 ____D () C:\Users\User\AppData\Roaming\TS3Client
2014-07-28 12:22 - 2012-02-08 18:37 - 00000000 ____D () C:\Users\User\AppData\Local\TeamSpeak 3 Client
2014-07-27 15:08 - 2014-07-28 16:14 - 00010179 _____ () C:\Users\User\Desktop\config.cfg
2014-07-25 15:50 - 2014-08-02 21:36 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2014-07-25 15:50 - 2014-08-02 21:36 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2014-07-25 15:50 - 2014-05-29 15:41 - 01283136 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2014-07-25 15:50 - 2014-05-29 15:41 - 01126480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2014-07-24 15:44 - 2012-03-31 20:56 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-24 15:44 - 2011-09-06 11:48 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-24 15:43 - 2012-05-09 23:16 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-07-24 15:43 - 2012-05-09 23:16 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-07-24 15:43 - 2011-04-12 09:55 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-24 15:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-24 15:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-07-24 15:34 - 2013-07-23 22:07 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-24 15:33 - 2011-09-05 13:54 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-24 15:32 - 2012-05-09 23:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-07-24 15:23 - 2014-07-24 15:23 - 00000000 ____D () C:\Users\User\AppData\Roaming\de.devolo.dLAN.Cockpit
Some content of TEMP:
====================
C:\Users\scndAdmin\AppData\Local\temp\install_flashplayer14x32au_mssd_aaa_aih.exe
C:\Users\scndAdmin\AppData\Local\temp\nv3DVStreaming.dll
C:\Users\scndAdmin\AppData\Local\temp\nvSCPAPI.dll
C:\Users\scndAdmin\AppData\Local\temp\nvStereoApiI.dll
C:\Users\scndAdmin\AppData\Local\temp\nvStInst.exe
C:\Users\User\AppData\Local\temp\eauninstall.exe
C:\Users\User\AppData\Local\temp\The Battle for Middle-earth_uninst.exe
C:\Users\User\AppData\Local\temp\uninst1.exe
C:\Users\User\AppData\Local\temp\uninst2.exe
C:\Users\User\AppData\Local\temp\unwise.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-08-02 14:05
==================== End Of Log ============================
--- --- --- Ein letztes Mal MBAM hinterher Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 03.08.2014 Suchlauf-Zeit: 21:57:46 Logdatei: mbam3.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.08.03.06 Rootkit Datenbank: v2014.08.01.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Julian Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 502618 Verstrichene Zeit: 5 Min, 33 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 0 (No malicious items detected) Physische Sektoren: 0 (No malicious items detected) (end) Code:
ATTFilter OTL logfile created on: 04.08.2014 13:49:47 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Julian\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.11.9600.17207) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 7,91 Gb Total Physical Memory | 5,70 Gb Available Physical Memory | 72,04% Memory free 15,82 Gb Paging File | 13,69 Gb Available in Paging File | 86,49% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 55,80 Gb Total Space | 6,23 Gb Free Space | 11,17% Space Free | Partition Type: NTFS Drive D: | 931,51 Gb Total Space | 754,38 Gb Free Space | 80,98% Space Free | Partition Type: NTFS Computer Name: USER-PC | User Name: Julian | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Julian\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe (TeamViewer GmbH) PRC - C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe (TeamViewer GmbH) PRC - C:\Program Files (x86)\TeamViewer\Version8\tv_w32.exe (TeamViewer GmbH) PRC - C:\Program Files (x86)\Secunia\PSI\PSIA.exe (Secunia) PRC - C:\Program Files (x86)\Secunia\PSI\sua.exe (Secunia) PRC - C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia) PRC - C:\Windows\SysWOW64\PnkBstrA.exe () PRC - C:\Program Files (x86)\XFastUsb\XFastUsb.exe (FNet Co., Ltd.) PRC - C:\Program Files (x86)\Razer\DeathAdder\vdDaemon.exe () PRC - C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe () PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) PRC - C:\Program Files (x86)\Razer\Lycosa\razerhid.exe (Razer USA Ltd.) PRC - C:\Program Files (x86)\Razer\Lycosa\razertra.exe () PRC - C:\Program Files (x86)\Panda USB Vaccine\USBVaccine.exe (Panda Security) PRC - C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe (Razer Inc.) ========== Modules (No Company Name) ========== MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\0eef5f1e5c15e0171152ee8f1cfc6924\IAStorUtil.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\98c91b8d3f1d54c41ada5f37e0935303\System.Runtime.Remoting.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\b1f7b4e15aef3faf382db6ba14c81371\IAStorCommon.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\8bc548587e91ecf0552a40e47bbf99cc\System.Windows.Forms.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\5c24d3b0041ebf4f48a93615b9fa3de9\System.Drawing.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\217ece46920546d718414291d463bb1c\System.Xml.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\5b6ddf934128d538cd5cd77bf4209b93\System.Configuration.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\1d696b2d3de530f7ee971070263667ff\WindowsBase.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\b3a78269847005365001c33870cd121f\System.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ede2c6c842840e009f01bcc74fa4c457\mscorlib.ni.dll () MOD - C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll () MOD - C:\Program Files (x86)\Razer\DeathAdder\vdDaemon.exe () MOD - C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe () MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll () MOD - C:\Program Files (x86)\Razer\Lycosa\razertra.exe () ========== Services (SafeList) ========== SRV:64bit: - (IEEtwCollectorService) -- C:\Windows\SysNative\IEEtwCollector.exe (Microsoft Corporation) SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (NvNetworkService) -- C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) SRV - (NvStreamSvc) -- C:\Programme\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) SRV - (DevoloNetworkService) -- D:\Programme\devolo\dlan\devolonetsvc.exe (devolo AG) SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (NisSrv) -- C:\Programme\Microsoft Security Client\NisSrv.exe (Microsoft Corporation) SRV - (MsMpSvc) -- C:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation) SRV - (TeamViewer8) -- C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe (TeamViewer GmbH) SRV - (cphs) -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe (Intel Corporation) SRV - (Secunia PSI Agent) -- C:\Program Files (x86)\Secunia\PSI\PSIA.exe (Secunia) SRV - (Secunia Update Agent) -- C:\Program Files (x86)\Secunia\PSI\sua.exe (Secunia) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe () SRV - (SetupARService) -- C:\Program Files (x86)\Realtek\Audio\SetupAfterRebootService.exe (Realtek Semiconductor.) SRV - (WireHelpSvc) -- C:\Programme\Common Files\WireHelpSvc.exe () SRV - (AtherosSvc) -- C:\Program Files (x86)\Bluetooth Suite\adminservice.exe (Atheros Commnucations) SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) SRV - (IAStorDataMgrSvc) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation) DRV:64bit: - (nvvad_WaveExtensible) -- C:\Windows\SysNative\drivers\nvvad64v.sys (NVIDIA Corporation) DRV:64bit: - (NisDrv) -- C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation) DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation) DRV:64bit: - (PSI) -- C:\Windows\SysNative\drivers\psi_mf_amd64.sys (Secunia) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation) DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation) DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.) DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.) DRV:64bit: - (MotioninJoyXFilter) -- C:\Windows\SysNative\drivers\MijXfilt.sys (MotioninJoy) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (FNETTBOH_305) -- C:\Windows\SysNative\drivers\FNETTBOH_305.SYS (FNet Co., Ltd.) DRV:64bit: - (ESLWireAC) -- C:\Windows\SysNative\drivers\ESLWireACD.sys (<Turtle Entertainment>) DRV:64bit: - (ESLvnic1) -- C:\Windows\SysNative\drivers\ESLvnic.sys (Turtle Entertainment GmbH) DRV:64bit: - (FNETURPX) -- C:\Windows\SysNative\drivers\FNETURPX.SYS (FNet Co., Ltd.) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (BtFilter) -- C:\Windows\SysNative\drivers\btfilter.sys (Atheros) DRV:64bit: - (BTATH_A2DP) -- C:\Windows\SysNative\drivers\btath_a2dp.sys (Atheros) DRV:64bit: - (BTATH_HCRP) -- C:\Windows\SysNative\drivers\btath_hcrp.sys (Atheros) DRV:64bit: - (BTATH_RCP) -- C:\Windows\SysNative\drivers\btath_rcp.sys (Atheros) DRV:64bit: - (BTATH_LWFLT) -- C:\Windows\SysNative\drivers\btath_lwflt.sys (Atheros) DRV:64bit: - (AthBTPort) -- C:\Windows\SysNative\drivers\btath_flt.sys (Atheros) DRV:64bit: - (BTATH_BUS) -- C:\Windows\SysNative\drivers\btath_bus.sys (Atheros) DRV:64bit: - (ATHDFU) -- C:\Windows\SysNative\drivers\AthDfu.sys (Windows (R) Win 7 DDK provider) DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek ) DRV:64bit: - (bulkadi) -- C:\Windows\SysNative\drivers\bulkrazer_x64.sys (Windows (R) Codename Longhorn DDK provider) DRV:64bit: - (EtronXHCI) -- C:\Windows\SysNative\drivers\EtronXHCI.sys (Etron Technology Inc) DRV:64bit: - (EtronHub3) -- C:\Windows\SysNative\drivers\EtronHub3.sys (Etron Technology Inc) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation) DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation) DRV:64bit: - (IntcDAud) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation) DRV:64bit: - (VKbms) -- C:\Windows\SysNative\drivers\VKbms.sys (Windows (R) Win 7 DDK provider) DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation) DRV:64bit: - (TFsExDisk) -- C:\Windows\SysNative\drivers\TFsExDisk.sys (Teruten Inc) DRV:64bit: - (danewFltr) -- C:\Windows\SysNative\drivers\danew.sys (Razer (Asia-Pacific) Pte Ltd) DRV:64bit: - (vhidmini) -- C:\Windows\SysNative\drivers\vHidDev.sys (Windows (R) Win 7 DDK provider) DRV:64bit: - (Lycosa) -- C:\Windows\SysNative\drivers\Lycosa.sys (Razer USA Ltd.) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV - (NvStreamKms) -- C:\Programme\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys (NVIDIA Corporation) DRV - (NPF_devolo) -- C:\Windows\SysWOW64\drivers\npf_devolo.sys (CACE Technologies) DRV - (TFsExDisk) -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys (Teruten Inc) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) DRV - (StarOpen) -- C:\Windows\SysWow64\drivers\StarOpen.sys () ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-82016817-340743653-2786680247-1007\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-21-82016817-340743653-2786680247-1007\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR IE - HKU\S-1-5-21-82016817-340743653-2786680247-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20131118 FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:2.6.8.36 FF - prefs.js..extensions.enabledAddons: %7B02450914-cdd9-410f-b1da-db004e18c671%7D:0.97.23c FF - prefs.js..extensions.enabledAddons: https-everywhere%40eff.org:3.5.1 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:31.0 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.110.0: File not found FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.118.0: C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.122.0: C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.65.2: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.65.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 31.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2014.08.02 22:08:45 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 31.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.03.13 22:54:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Julian\AppData\Roaming\mozilla\Extensions [2014.08.03 19:39:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Julian\AppData\Roaming\mozilla\Firefox\Profiles\mhasid1l.default\extensions [2014.08.03 19:39:55 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Julian\AppData\Roaming\mozilla\Firefox\Profiles\mhasid1l.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014.08.03 19:39:56 | 000,000,000 | ---D | M] (HTTPS-Everywhere) -- C:\Users\Julian\AppData\Roaming\mozilla\Firefox\Profiles\mhasid1l.default\extensions\https-everywhere@eff.org [2014.08.03 19:31:40 | 001,225,715 | ---- | M] () (No name found) -- C:\Users\Julian\AppData\Roaming\mozilla\firefox\profiles\mhasid1l.default\extensions\firefox@ghostery.com.xpi [2014.08.03 19:39:56 | 000,102,729 | ---- | M] () (No name found) -- C:\Users\Julian\AppData\Roaming\mozilla\firefox\profiles\mhasid1l.default\extensions\{02450914-cdd9-410f-b1da-db004e18c671}.xpi [2014.08.03 19:39:56 | 000,538,675 | ---- | M] () (No name found) -- C:\Users\Julian\AppData\Roaming\mozilla\firefox\profiles\mhasid1l.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014.08.03 19:34:11 | 000,700,980 | ---- | M] () (No name found) -- C:\Users\Julian\AppData\Roaming\mozilla\firefox\profiles\mhasid1l.default\extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2014.08.02 21:18:50 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2014.08.02 21:18:50 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF} [2014.08.02 21:18:50 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions\staged [2014.08.02 21:18:50 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions [2014.08.02 21:19:03 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} O1 HOSTS File: ([2013.03.12 19:52:34 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (CIESpeechBHO Class) - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - No CLSID value found. O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - No CLSID value found. O4:64bit: - HKLM..\Run: [AthBtTray] C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe (Atheros Commnucations) O4:64bit: - HKLM..\Run: [AtherosBtStack] C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe (Atheros Communications) O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [NvBackend] C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (NVIDIA Corporation) O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [ShadowPlay] C:\Windows\SysNative\nvspcap64.dll (NVIDIA Corporation) O4 - HKLM..\Run: [DeathAdder] C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe () O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) O4 - HKLM..\Run: [Lycosa] C:\Program Files (x86)\Razer\Lycosa\razerhid.exe (Razer USA Ltd.) O4 - HKLM..\Run: [XFastUsb] C:\Program Files (x86)\XFastUsb\XFastUsb.exe (FNet Co., Ltd.) O4 - Startup: C:\Users\Adrian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk = D:\Programme\OpenOffice\program\quickstart.exe () O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKU\S-1-5-21-82016817-340743653-2786680247-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-82016817-340743653-2786680247-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2 O7 - HKU\S-1-5-21-82016817-340743653-2786680247-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1 O9:64bit: - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - Reg Error: Value error. File not found O9 - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{78801749-ED50-471B-9B87-0FC0D1E59171}: DhcpNameServer = 192.168.1.1 O20:64bit: - AppInit_DLLs: (C:\Windows\System32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation) O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation) O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) - C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation) O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation) O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2013.04.16 13:27:48 | 000,000,073 | ---- | M] () - C:\Autoconfig.ini -- [ NTFS ] O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2014.08.04 13:47:43 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Julian\Desktop\OTL.exe [2014.08.04 13:38:47 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\catroot2 [2014.08.04 13:04:07 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution [2014.08.04 12:52:27 | 006,574,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mstscax.dll [2014.08.04 12:52:27 | 005,694,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mstscax.dll [2014.08.03 23:20:43 | 000,000,000 | ---D | C] -- C:\Users\Julian\AppData\Local\Razer_Inc [2014.08.03 23:19:37 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TsUsbGDCoInstaller.dll [2014.08.03 23:19:34 | 001,068,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mstsc.exe [2014.08.03 23:19:34 | 000,420,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wksprt.exe [2014.08.03 23:19:34 | 000,083,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TSWbPrxy.exe [2014.08.03 23:19:34 | 000,062,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tsgqec.dll [2014.08.03 23:19:34 | 000,056,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys [2014.08.03 23:19:34 | 000,056,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsRdpWebAccess.dll [2014.08.03 23:19:34 | 000,053,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tsgqec.dll [2014.08.03 23:19:34 | 000,050,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MsRdpWebAccess.dll [2014.08.03 23:19:34 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wksprtPS.dll [2014.08.03 23:19:34 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wksprtPS.dll [2014.08.03 23:19:34 | 000,013,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TsUsbRedirectionGroupPolicyControl.exe [2014.08.03 23:19:34 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TsUsbRedirectionGroupPolicyExtension.dll [2014.08.03 23:19:33 | 001,147,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mstsc.exe [2014.08.03 23:19:33 | 001,057,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdvidcrl.dll [2014.08.03 23:19:33 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rdvidcrl.dll [2014.08.03 23:18:04 | 001,030,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TSWorkspace.dll [2014.08.03 23:18:04 | 000,792,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\TSWorkspace.dll [2014.08.03 20:27:32 | 000,272,808 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe [2014.08.03 20:27:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java [2014.08.03 20:27:30 | 000,098,216 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll [2014.08.03 20:27:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java [2014.08.03 20:27:29 | 000,175,528 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe [2014.08.03 20:27:29 | 000,175,528 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe [2014.08.03 20:25:04 | 000,000,000 | ---D | C] -- C:\Users\Julian\AppData\Local\CrashDumps [2014.08.03 19:58:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner [2014.08.03 19:58:03 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner [2014.08.03 19:51:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Panda Security [2014.08.03 19:51:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security [2014.08.03 19:51:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Panda USB Vaccine [2014.08.03 19:08:33 | 000,000,000 | ---D | C] -- C:\AdwCleaner [2014.08.03 19:05:50 | 000,000,000 | ---D | C] -- C:\Users\Julian\AppData\Local\Secunia PSI [2014.08.03 19:05:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Secunia [2014.08.03 18:37:36 | 001,016,261 | ---- | C] (Thisisu) -- C:\Users\Julian\Desktop\JRT.exe [2014.08.03 18:32:17 | 000,000,000 | ---D | C] -- C:\Users\Julian\Desktop\Sec [2014.08.03 18:20:49 | 000,000,000 | -HSD | C] -- C:\Users\Julian\AppData\Local\EmieUserList [2014.08.03 18:20:49 | 000,000,000 | -HSD | C] -- C:\Users\Julian\AppData\Local\EmieSiteList [2014.08.03 18:06:13 | 000,000,000 | ---D | C] -- C:\FRST [2014.08.03 18:02:35 | 002,094,080 | ---- | C] (Farbar) -- C:\Users\Julian\Desktop\FRST64.exe [2014.08.03 17:52:11 | 000,122,584 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys [2014.08.03 17:49:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware [2014.08.03 17:49:09 | 000,091,352 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbamchameleon.sys [2014.08.03 17:49:09 | 000,063,704 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mwac.sys [2014.08.03 17:49:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ Malwarebytes Anti-Malware [2014.08.03 17:47:24 | 000,000,000 | ---D | C] -- C:\Users\Julian\AppData\Local\Programs [2014.08.03 17:46:41 | 000,000,000 | ---D | C] -- C:\Users\Julian\AppData\Roaming\Malwarebytes [2014.08.02 23:27:46 | 000,000,000 | ---D | C] -- C:\Users\Julian\AppData\Local\NVIDIA Corporation [2014.08.02 23:27:46 | 000,000,000 | ---D | C] -- C:\Users\Julian\AppData\Local\NVIDIA [2014.08.02 23:12:04 | 000,609,240 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvStreaming.exe [2014.08.02 23:10:31 | 031,512,520 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvoglv64.dll [2014.08.02 23:10:31 | 024,196,896 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvoglv32.dll [2014.08.02 23:10:31 | 022,994,208 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcompiler.dll [2014.08.02 23:10:31 | 017,555,104 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvd3dumx.dll [2014.08.02 23:10:31 | 015,294,296 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcompiler.dll [2014.08.02 23:10:31 | 013,922,752 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvopencl.dll [2014.08.02 23:10:31 | 013,835,208 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuda.dll [2014.08.02 23:10:31 | 011,283,344 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvopencl.dll [2014.08.02 23:10:31 | 011,222,048 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuda.dll [2014.08.02 23:10:31 | 004,247,000 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvid.dll [2014.08.02 23:10:31 | 003,989,960 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuvid.dll [2014.08.02 23:10:31 | 001,890,080 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispco6434052.dll [2014.08.02 23:10:31 | 001,539,928 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispgenco6434052.dll [2014.08.02 23:10:31 | 000,944,928 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\NvIFR64.dll [2014.08.02 23:10:31 | 000,907,096 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\NvIFR.dll [2014.08.02 23:10:31 | 000,903,624 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\NvFBC64.dll [2014.08.02 23:10:31 | 000,869,152 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\NvFBC.dll [2014.08.02 23:10:31 | 000,846,832 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvumdshim.dll [2014.08.02 23:10:31 | 000,354,016 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvoglshim64.dll [2014.08.02 23:10:31 | 000,305,600 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvoglshim32.dll [2014.08.02 23:10:31 | 000,166,568 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvinitx.dll [2014.08.02 22:53:54 | 000,328,712 | ---- | C] (Logitech Inc.) -- C:\Windows\SysNative\MijFrc.dll [2014.08.02 22:53:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MotioninJoy [2014.08.02 22:53:53 | 000,000,000 | ---D | C] -- C:\Program Files\MotioninJoy [2014.08.02 21:36:02 | 001,715,224 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvspbridge64.dll [2014.08.02 21:36:02 | 001,291,280 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvspbridge.dll [2014.08.02 21:18:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2014.08.02 19:51:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech [2014.08.02 19:51:01 | 000,000,000 | ---D | C] -- C:\ProgramData\LogiShrd [2014.08.02 19:50:56 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\LogiShrd [2014.08.02 11:40:40 | 002,620,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll [2014.08.02 11:40:40 | 000,058,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe [2014.08.02 11:40:40 | 000,044,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll [2014.08.02 11:40:37 | 000,700,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll [2014.08.02 11:40:37 | 000,581,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wuapi.dll [2014.08.02 11:40:37 | 000,097,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll [2014.08.02 11:40:37 | 000,092,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wudriver.dll [2014.08.02 11:40:37 | 000,038,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll [2014.08.02 11:40:37 | 000,036,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wups.dll [2014.08.02 11:40:36 | 000,198,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll [2014.08.02 11:40:36 | 000,179,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wuwebv.dll [2014.08.02 11:40:36 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapp.exe [2014.08.02 11:40:36 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wuapp.exe [2014.07.24 15:20:37 | 000,692,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\osk.exe [2014.07.24 15:20:37 | 000,646,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\osk.exe [2014.07.24 15:20:19 | 000,624,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\qedit.dll [2014.07.24 15:20:19 | 000,509,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\qedit.dll [2014.07.24 15:20:18 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll [2014.07.24 15:20:16 | 000,592,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9diag.dll [2014.07.24 15:20:16 | 000,069,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2014.07.24 15:20:16 | 000,051,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieetwproxystub.dll [2014.07.24 15:20:16 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll [2014.07.24 15:20:15 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll [2014.07.24 15:20:15 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwproxystub.dll [2014.07.24 15:20:15 | 000,038,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\JavaScriptCollectionAgent.dll [2014.07.24 15:20:15 | 000,032,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll [2014.07.24 15:20:15 | 000,032,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll [2014.07.24 15:20:14 | 001,964,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2014.07.24 15:20:14 | 000,631,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2014.07.24 15:20:14 | 000,452,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll [2014.07.24 15:20:14 | 000,442,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2014.07.24 15:20:14 | 000,111,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollector.exe [2014.07.24 15:20:14 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollectorres.dll [2014.07.24 15:20:13 | 002,040,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2014.07.24 15:20:13 | 001,068,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll [2014.07.24 15:20:13 | 000,608,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe [2014.07.24 15:20:13 | 000,112,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2014.07.24 15:20:13 | 000,066,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll [2014.07.24 15:20:12 | 000,704,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll [2014.07.24 15:20:12 | 000,598,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2014.07.24 15:20:12 | 000,292,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll [2014.07.24 15:20:12 | 000,164,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll [2014.07.24 15:20:12 | 000,062,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MshtmlDac.dll [2014.07.24 15:20:11 | 005,721,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2014.07.24 15:20:11 | 001,249,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll [2014.07.24 15:20:11 | 000,846,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll [2014.07.24 15:20:11 | 000,752,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9diag.dll [2014.07.24 15:20:11 | 000,548,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll [2014.07.24 15:20:11 | 000,139,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe [2014.07.24 15:20:11 | 000,085,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2014.07.24 15:20:10 | 000,940,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe [2014.07.24 15:20:10 | 000,195,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll [2014.07.24 15:20:10 | 000,083,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MshtmlDac.dll [2014.07.24 15:18:36 | 001,460,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll ========== Files - Modified Within 30 Days ========== [2014.08.04 13:47:48 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Julian\Desktop\OTL.exe [2014.08.04 13:45:48 | 000,021,840 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2014.08.04 13:45:48 | 000,021,840 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2014.08.04 13:44:59 | 014,055,580 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2014.08.04 13:44:59 | 004,637,590 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2014.08.04 13:44:59 | 004,348,312 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2014.08.04 13:44:59 | 003,899,716 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2014.08.04 13:44:59 | 000,006,292 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2014.08.04 13:38:44 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2014.08.04 13:38:36 | 2077,048,831 | -HS- | M] () -- C:\hiberfil.sys [2014.08.03 23:06:45 | 000,001,102 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk [2014.08.03 22:32:58 | 000,096,953 | ---- | M] () -- C:\Users\Julian\Desktop\Secunia PSI Startbildschirm.PNG [2014.08.03 22:14:13 | 000,050,477 | ---- | M] () -- C:\Users\Julian\Desktop\Defogger.exe [2014.08.03 21:57:06 | 000,122,584 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys [2014.08.03 21:25:53 | 000,380,416 | ---- | M] () -- C:\Users\Julian\Desktop\6wo5yswk.exe [2014.08.03 20:27:27 | 000,098,216 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll [2014.08.03 20:27:26 | 000,272,808 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe [2014.08.03 20:27:26 | 000,175,528 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe [2014.08.03 20:27:26 | 000,175,528 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe [2014.08.03 18:37:38 | 001,016,261 | ---- | M] (Thisisu) -- C:\Users\Julian\Desktop\JRT.exe [2014.08.03 18:02:40 | 002,094,080 | ---- | M] (Farbar) -- C:\Users\Julian\Desktop\FRST64.exe [2014.08.02 23:27:46 | 000,000,680 | RHS- | M] () -- C:\Users\Julian\ntuser.pol [2014.08.02 22:43:29 | 000,339,008 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2014.07.25 15:50:29 | 001,291,280 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvspbridge.dll [2014.07.25 15:50:29 | 001,126,480 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvspcap.dll [2014.07.25 15:50:11 | 001,715,224 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvspbridge64.dll [2014.07.25 15:50:11 | 001,283,136 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvspcap64.dll [2014.07.24 15:44:34 | 000,699,056 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2014.07.24 15:44:34 | 000,071,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl ========== Files Created - No Company Name ========== [2014.08.03 22:32:58 | 000,096,953 | ---- | C] () -- C:\Users\Julian\Desktop\Secunia PSI Startbildschirm.PNG [2014.08.03 22:14:11 | 000,050,477 | ---- | C] () -- C:\Users\Julian\Desktop\Defogger.exe [2014.08.03 21:25:51 | 000,380,416 | ---- | C] () -- C:\Users\Julian\Desktop\6wo5yswk.exe [2014.08.03 19:09:00 | 229,338,408 | ---- | C] () -- C:\Users\Julian\Desktop\Paragon-Backup_Recovery_2014_free_64Bit.exe [2014.08.03 19:05:45 | 000,001,102 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk [2014.08.03 19:05:45 | 000,001,065 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk [2014.01.29 23:02:22 | 000,077,312 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll [2013.10.29 18:57:07 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini [2013.04.16 11:59:58 | 001,571,160 | ---- | C] () -- C:\Windows\TotalUninstaller.exe [2013.03.13 22:50:02 | 000,000,680 | RHS- | C] () -- C:\Users\Julian\ntuser.pol [2012.12.14 03:42:30 | 000,963,452 | ---- | C] () -- C:\Windows\SysWow64\igcodeckrng600.bin [2012.12.14 03:42:28 | 000,272,928 | ---- | C] () -- C:\Windows\SysWow64\igvpkrng600.bin [2012.09.25 15:55:32 | 000,260,580 | ---- | C] () -- C:\Windows\SysWow64\temp.bin [2011.12.01 17:50:04 | 000,168,864 | ---- | C] () -- C:\Program Files\Common Files\WireHelpSvc.exe [2011.11.13 19:38:57 | 000,000,000 | ---- | C] () -- C:\ProgramData\LauncherAccess.dt ========== ZeroAccess Check ========== [2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2014.03.25 04:43:12 | 014,175,744 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2014.03.25 04:09:54 | 012,874,240 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2011.11.27 15:05:54 | 000,000,000 | ---D | M] -- C:\Users\Adrian\AppData\Roaming\Cornelsen [2012.09.16 16:50:20 | 000,000,000 | ---D | M] -- C:\Users\Adrian\AppData\Roaming\DVDVideoSoft [2012.06.22 20:21:44 | 000,000,000 | ---D | M] -- C:\Users\Adrian\AppData\Roaming\DVDVideoSoftIEHelpers [2013.03.13 17:26:47 | 000,000,000 | ---D | M] -- C:\Users\Adrian\AppData\Roaming\Guitar Pro 6 [2013.03.01 15:31:13 | 000,000,000 | ---D | M] -- C:\Users\Adrian\AppData\Roaming\IObit [2011.12.22 19:04:15 | 000,000,000 | ---D | M] -- C:\Users\Adrian\AppData\Roaming\MAGIX [2012.01.07 20:54:53 | 000,000,000 | ---D | M] -- C:\Users\Adrian\AppData\Roaming\MotioninJoy [2011.11.09 19:56:53 | 000,000,000 | ---D | M] -- C:\Users\Adrian\AppData\Roaming\OpenOffice.org [2013.08.06 17:47:27 | 000,000,000 | ---D | M] -- C:\Users\Adrian\AppData\Roaming\Origin [2011.09.07 14:40:24 | 000,000,000 | ---D | M] -- C:\Users\Adrian\AppData\Roaming\Razer [2011.12.27 17:17:42 | 000,000,000 | ---D | M] -- C:\Users\Adrian\AppData\Roaming\redsn0w [2014.08.03 16:15:53 | 000,000,000 | ---D | M] -- C:\Users\Adrian\AppData\Roaming\Spotify [2013.04.27 16:33:41 | 000,000,000 | ---D | M] -- C:\Users\Adrian\AppData\Roaming\TeamViewer [2012.06.22 20:22:39 | 000,000,000 | ---D | M] -- C:\Users\Adrian\AppData\Roaming\TuneUp Software [2012.01.18 20:13:37 | 000,000,000 | ---D | M] -- C:\Users\Constantin\AppData\Roaming\IObit [2013.04.29 15:35:39 | 000,000,000 | ---D | M] -- C:\Users\Constantin\AppData\Roaming\Razer [2012.01.18 20:13:37 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\IObit [2012.01.18 20:13:37 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\IObit [2012.01.18 20:13:37 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\IObit [2013.03.13 23:05:13 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\Mumble [2013.03.13 22:50:11 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\Razer [2013.04.16 13:19:54 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\Samsung [2012.01.18 20:13:37 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\IObit [2013.05.10 10:25:49 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\Razer [2014.08.02 20:16:27 | 000,000,000 | ---D | M] -- C:\Users\scndAdmin\AppData\Roaming\de.devolo.dLAN.Cockpit [2012.01.18 20:13:37 | 000,000,000 | ---D | M] -- C:\Users\scndAdmin\AppData\Roaming\IObit [2014.08.02 22:54:53 | 000,000,000 | ---D | M] -- C:\Users\scndAdmin\AppData\Roaming\MotioninJoy [2013.04.22 18:53:42 | 000,000,000 | ---D | M] -- C:\Users\scndAdmin\AppData\Roaming\OpenOffice.org [2013.07.09 09:23:45 | 000,000,000 | ---D | M] -- C:\Users\scndAdmin\AppData\Roaming\Origin [2013.04.22 18:42:37 | 000,000,000 | ---D | M] -- C:\Users\scndAdmin\AppData\Roaming\Razer [2011.11.26 19:50:57 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Atari [2011.11.27 14:34:41 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Cornelsen [2014.07.24 15:23:34 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\de.devolo.dLAN.Cockpit [2011.09.05 13:50:13 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\DeviceVm [2013.03.05 15:26:39 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\DVDVideoSoft [2012.05.06 17:59:02 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\EurekaLog [2013.03.13 17:22:01 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Guitar Pro 6 [2013.03.05 11:46:52 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\IObit [2011.12.05 16:45:42 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\MAGIX [2013.03.13 17:43:12 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Meine Die Schlacht um Mittelerde-Dateien [2011.12.26 13:50:51 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\MotioninJoy [2013.04.24 13:55:29 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Mumble [2011.11.13 21:23:52 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\OpenOffice.org [2013.04.19 11:55:06 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Origin [2013.08.24 10:17:28 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Razer [2011.11.13 19:56:52 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Samsung [2014.07.28 12:31:48 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\TS3Client [2012.06.01 22:41:00 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\ts3overlay [2013.03.05 13:05:21 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\TuneUp Software [2012.03.31 20:44:52 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Vso ========== Purity Check ========== < End of report > |
|
04.08.2014, 15:56
| #6 |
| | Babylon.A , Incredibar.A , PriceGong, Spigot, Dealply & Co in C:\Users\...\AppData\Roaming\ Teil 4 und das wars dann auch "schon" Extras Code:
ATTFilter OTL Extras logfile created on: 04.08.2014 13:49:47 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Julian\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.17207)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
7,91 Gb Total Physical Memory | 5,70 Gb Available Physical Memory | 72,04% Memory free
15,82 Gb Paging File | 13,69 Gb Available in Paging File | 86,49% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 55,80 Gb Total Space | 6,23 Gb Free Space | 11,17% Space Free | Partition Type: NTFS
Drive D: | 931,51 Gb Total Space | 754,38 Gb Free Space | 80,98% Space Free | Partition Type: NTFS
Computer Name: USER-PC | User Name: Julian | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-82016817-340743653-2786680247-1007\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
========== Firewall Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0C73D9C5-2BDA-464A-9D1B-A0C04FFD5FFB}" = lport=10243 | protocol=6 | dir=in | app=system |
"{23DBB31E-693F-46DF-9EC4-72AADF759832}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{2BBFD3BB-31C0-4466-9106-1CC0933D6E3F}" = lport=10301 | protocol=17 | dir=in | app=d:\programme\devolo\informer\devinf.exe |
"{2C11540E-F086-45B5-A17F-A65C1703A415}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{2EC49CFC-8296-4C5B-A583-3493676424BC}" = lport=47991 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{341AA7B3-A26E-40A9-A4D3-E3506C49C75B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{3584319C-F584-4043-97E8-D92C2A18DB69}" = lport=443 | protocol=6 | dir=in | app=c:\program files (x86)\nvidia corporation\netservice\nvnetworkservice.exe |
"{3B7DB9DF-EE73-4B09-B47E-FA8B283A6E40}" = lport=445 | protocol=6 | dir=in | app=system |
"{3C9B2499-9362-4928-990B-548CF5D31F55}" = lport=5353 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{3E1E3F51-6CE2-4CF1-9656-2E75C64EA297}" = rport=445 | protocol=6 | dir=out | app=system |
"{407B895E-09E2-47BC-BE77-7B804B684844}" = lport=1900 | protocol=17 | dir=in | name=microsoft upnp-port (udp) |
"{421ED6A4-84B5-4826-B4F9-7022E98F1FAF}" = rport=137 | protocol=17 | dir=out | app=system |
"{5048A0D5-5740-4541-80E0-31B618DFFF24}" = rport=139 | protocol=6 | dir=out | app=system |
"{5608EF56-9F21-4D5D-9E37-E20FBF41EAF7}" = lport=2869 | protocol=6 | dir=in | app=system |
"{5614465D-FB21-48DE-A393-A40FDA5DDB49}" = lport=2869 | protocol=6 | dir=in | name=microsoft upnp-port (tcp) |
"{61909D1E-69F5-406B-B128-69015B36F95F}" = lport=139 | protocol=6 | dir=in | app=system |
"{6A3B21AB-ACA6-4226-AD7F-37EBF8D45024}" = lport=48000 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{6F1EFE78-7BE8-4427-90BA-F32514390790}" = lport=0 | protocol=6 | dir=in | name=magix upnp media server |
"{7C83B537-821F-48F9-9F2E-746D51E95C08}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{7E854F9D-A226-4A61-A877-4056D8C3FFBE}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{7E9E7F79-86E8-4B53-9950-A3555BA704EF}" = lport=138 | protocol=17 | dir=in | app=system |
"{838F7A0A-03EF-49CE-9D21-3DCDED33AC1E}" = rport=10243 | protocol=6 | dir=out | app=system |
"{9A7438C0-1404-4B2C-B1C7-8DC70634B16C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{9CD0662D-B37A-4634-8203-30E7B176BB14}" = lport=10300 | protocol=6 | dir=in | app=d:\programme\devolo\informer\devinf.exe |
"{A2A41B8B-5056-46A0-9735-9821E4C5F9B8}" = lport=19375 | protocol=17 | dir=in | app=d:\programme\devolo\dlan\devolonetsvc.exe |
"{C18C65B9-0B29-4593-82AA-4F4A30CFC3A9}" = lport=19376 | protocol=6 | dir=in | app=d:\programme\devolo\dlan\devolonetsvc.exe |
"{D1626298-3A92-46EB-BD63-65CF577ECB6E}" = rport=138 | protocol=17 | dir=out | app=system |
"{D1CF4205-FA88-4A2E-B9BD-5D160AC380D2}" = lport=80 | protocol=6 | dir=in | app=c:\program files (x86)\nvidia corporation\netservice\nvnetworkservice.exe |
"{D1E112CF-F62E-46A0-B878-ED2AD85141BC}" = lport=47984 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{D2D08246-40B8-4EA3-AC21-F83BCD78D87F}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{D399BBAC-A93E-46FD-A5A2-E957989EE9B4}" = lport=137 | protocol=17 | dir=in | app=system |
"{DF2CC510-7C74-40F6-9BD5-0EB4941F74F5}" = lport=19375 | protocol=17 | dir=in | app=d:\programme\devolo\dlan\devolonetsvc.exe |
"{E06CCBF7-BC8C-4827-B75C-02E8AF7F4ECC}" = lport=19376 | protocol=6 | dir=in | app=d:\programme\devolo\dlan\devolonetsvc.exe |
"{E1AD1FAB-A3E9-4C11-8FD6-76AAAB836503}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{E9AD1F9F-F196-4078-879F-6D30CEA94FDC}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{FFA11522-366E-45BB-8ECC-A14155D14B2A}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{009E8B6A-7D43-4A76-8914-95751F54C54D}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{0114DF8B-C1EE-415A-85C3-504280E0F979}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{0248D413-40B6-4160-A34F-C5DCA9A29E05}" = dir=in | app=c:\program files\hp\hp officejet pro 8600\bin\devicesetup.exe |
"{0490384F-C851-4ED0-8CFF-D6B177020713}" = protocol=6 | dir=in | app=d:\programme\steam\steamapps\common\apb reloaded\binaries\vivoxvoiceservice.exe |
"{0C9D5662-5245-46FD-A0D5-2AD288CA9FF1}" = protocol=17 | dir=in | app=d:\programme\steam\steamapps\scorch995\counter-strike source\hl2.exe |
"{0CEEBFC6-DADA-49FE-AFF2-1258B5E2FD87}" = protocol=17 | dir=in | app=e:\alicecd.exe |
"{0F47C935-0C63-407D-9FF5-D38A3EA87058}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{156CEFAE-EB29-4E64-8DA9-B03DF28E7D24}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{175F7F73-61CD-4FCD-9274-7EA462EB3EA6}" = protocol=17 | dir=in | app=d:\games\origin games\fifa manager 13\manager13.exe |
"{1D71975A-4BC9-449E-B572-B90FF569825A}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{1D97EA05-3550-4AD8-AF97-7C67485AE6EC}" = protocol=6 | dir=in | app=d:\programme\steam\steamapps\common\apb reloaded\launcher\apblauncher.exe |
"{1E78F0EF-D0D9-4469-985F-9FDABEEA68E5}" = protocol=6 | dir=in | app=c:\windows\system32\dmwu.exe |
"{20561629-F493-487A-BDAD-C6A0A3C477BC}" = protocol=6 | dir=in | app=d:\games\battlefield\fifa 13\game\fifa13.exe |
"{209F2C43-08EA-476C-8520-34FDDE142B72}" = protocol=17 | dir=in | app=d:\games\battlefield\fifa 13\game\fifa13.exe |
"{20AC83C9-4B4B-46FE-A952-3E33D68D3E8C}" = protocol=6 | dir=in | app=d:\games\origin games\fifa manager 13\manager13.exe |
"{23C7272E-F462-4D59-B01A-7F4C17F20C43}" = protocol=6 | dir=in | app=d:\programme\steam\steamapps\scorch995\counter-strike source\hl2.exe |
"{23C99E04-7C0E-400D-9FA1-B8E8B664A143}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{247332E6-FD69-419C-ADB6-0B2CD6A2B93F}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{26239A4D-B870-443D-A01C-8AB03B6E8E0B}" = protocol=17 | dir=in | app=d:\programme\steam\steamapps\common\counter-strike global offensive\csgo.exe |
"{26E85FFB-92BA-476C-9B9C-C90890168F07}" = protocol=6 | dir=in | app=d:\programme\steam\steam.exe |
"{2CA7D15D-0450-4CB6-8741-F10FB3D026E6}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{3041CF62-41F8-49FC-B0A2-3331BE949FE9}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{34741385-231E-4597-B8C5-6053A44D825A}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{367E5D9E-EFA5-4874-9C00-A4C6AF5C6AD0}" = protocol=6 | dir=out | app=system |
"{370B7F2F-E59C-47DD-A6F0-79FA19C1B84A}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{3C974749-DA57-4D21-8A43-BC931355B38F}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer.exe |
"{3D505BAA-88E0-406E-9299-6F2020258CC3}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{43D3BB5A-9C87-42B5-83E4-9181D55A2344}" = protocol=6 | dir=in | app=d:\games\origin games\fifa 12\game\fifa.exe |
"{4608C057-4355-408F-BBF1-2E3FC3879957}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{46D532E2-AD02-4806-B46C-950A6C00DF22}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{49D73AD3-2DA5-46AF-8DFC-F2C0103A5D0F}" = protocol=17 | dir=in | app=d:\programme\steam\steamapps\common\apb reloaded\launcher\apblauncher.exe |
"{4B4020DB-9FBB-4380-B351-7B4E8DCD8E09}" = dir=in | app=c:\program files\eslwire\wire.exe |
"{507F13EF-4BAC-426B-9D62-786781A6BF93}" = protocol=6 | dir=in | app=e:\alicecd.exe |
"{59413495-D9FE-459B-877D-1F6990E654E6}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{61B68F28-2080-487C-8B07-8BAA8AF144EB}" = protocol=17 | dir=in | app=d:\programme\steam\steam.exe |
"{62CD2EA3-93FE-4170-90BC-1464740BE0D5}" = protocol=6 | dir=in | app=d:\programme\steam\steamapps\common\apb reloaded\binaries\apb.exe |
"{66DD1FC0-0374-40D0-9B23-28B465828966}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{683A8074-3FF1-47A3-A3BB-D4BB3050F5D4}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{694D9C83-6CCC-4D7A-8446-1E87EAA2EAA9}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{6AF98858-8D39-4DFD-8C99-1A5B067501FB}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{6D160040-16C6-410A-9630-A9E0FDD71C4D}" = protocol=6 | dir=in | app=d:\programme\steam\steamapps\scorch995\counter-strike source\hl2.exe |
"{71CCF5F5-86D2-4E8D-BA96-1F3DA8AF543F}" = protocol=17 | dir=in | app=c:\windows\system32\arfc\wrtc.exe |
"{725BE1E1-2C9E-4432-8653-4BEE2BC6329C}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{733D377A-E7DF-4E13-8BD4-9CE594389875}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{780765CD-A61C-4C57-9FF1-08C1BDBEBE40}" = protocol=6 | dir=in | app=d:\games\origin games\fifa 13\game\fifa13.exe |
"{790FAC38-EB7F-49F7-9E42-96C4691003E1}" = protocol=17 | dir=in | app=d:\programme\steam\steamapps\common\apb reloaded\binaries\vivoxvoiceservice.exe |
"{7A385947-E3D6-48F2-88E7-EAB783AEF0CB}" = dir=in | app=c:\program files\hp\hp officejet pro 8600\bin\digitalwizards.exe |
"{7A6F112B-B58D-4FAA-B4D5-841EA3044B8F}" = protocol=6 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe |
"{851B8B5F-E7F0-40F6-B762-2B3057BF5F62}" = protocol=6 | dir=in | app=d:\programme\steam\steamapps\common\counter-strike global offensive\csgo.exe |
"{85FD6A5B-556F-4DDF-818D-377A29D79D07}" = protocol=6 | dir=in | app=c:\program files (x86)\origin games\fifa manager 13\manager13.exe |
"{8F3BBDE4-982C-4610-9384-329F951C0BA3}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{93067249-6505-4C5D-B97F-D27BBA68C248}" = protocol=6 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe |
"{956C63FE-C075-4B63-8947-2C5988C768D2}" = protocol=17 | dir=in | app=d:\games\origin games\fifa 12\game\fifa.exe |
"{96191F77-E65E-44F1-A2C2-F581B42B4A8E}" = dir=in | app=c:\program files\hp\hp officejet pro 8600\bin\faxapplications.exe |
"{976A4CB8-9634-4FD3-8F97-4B7C8A0E0283}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer.exe |
"{989D1C85-2452-4563-9DD4-989AEC368E61}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{9C4097B7-597E-4364-962A-5B063F152334}" = protocol=17 | dir=in | app=d:\programme\steam\steam.exe |
"{9CC5F572-5A86-4A47-B1D0-281537391D20}" = protocol=6 | dir=in | app=c:\program files (x86)\origin games\fifa 12\game\fifa.exe |
"{9F54D5B5-307E-4033-8171-43D52F68F42B}" = dir=in | app=c:\program files\hp\hp officejet pro 8600\bin\hpnetworkcommunicator.exe |
"{9FE23D71-E0B9-4BAE-9D33-2986BBCF8974}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A35B5615-2E97-468E-B63C-61271CFECAB6}" = protocol=17 | dir=in | app=c:\program files (x86)\common files\magix shared\upnpservice\upnpservice.exe |
"{A599D92A-25EB-4664-9F39-4A184079736B}" = dir=out | app=c:\program files\eslwire\wire.exe |
"{A6034A6F-A378-4564-BC11-F5186B9B0413}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer_service.exe |
"{A706EA49-17F7-49CF-A765-00C2494A2535}" = protocol=17 | dir=in | app=c:\windows\system32\dmwu.exe |
"{A7D4C512-E460-4E9E-B8D0-E274A70D8347}" = protocol=6 | dir=in | app=c:\program files (x86)\common files\magix shared\upnpservice\upnpservice.exe |
"{AA1F94F3-4056-46AF-9AE2-53B4CB5CACC5}" = protocol=17 | dir=in | app=d:\games\origin games\fifa 13\game\fifa13.exe |
"{B5DECC74-FF56-42C8-92CB-D7DFF1CCDB57}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{C2D21169-C106-4A69-ACC4-F70A668C8FAE}" = protocol=17 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe |
"{C9E1AC2C-9167-4BDD-91D8-008C374734B6}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{CD5C7350-A73F-4A5A-9E41-A5C7A63F1D8E}" = protocol=17 | dir=in | app=c:\program files (x86)\origin games\fifa manager 13\manager13.exe |
"{CE88EDD8-389C-4A8D-A4B9-7554576A7226}" = protocol=6 | dir=in | app=d:\programme\steam\steamapps\common\counter-strike source\hl2.exe |
"{D0FA66F4-8A5C-441A-B553-ECDEE1A793BC}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{D2B57B2A-6BA2-406D-9C50-00EC68AFA3B0}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{D62DBE4D-919E-4B8F-9E84-6C9B93467DE8}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{D7C189E8-023B-496D-A26C-7FAC46086B28}" = protocol=17 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe |
"{D80DE664-655D-43BF-A43A-B0CFACABA46B}" = protocol=17 | dir=in | app=d:\programme\steam\steamapps\scorch995\counter-strike source\hl2.exe |
"{D8211160-39AF-4F29-9AD9-6BCF37AB2613}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer_service.exe |
"{E193535D-C54A-4A2C-B5D5-C95A310FB55D}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E22A8ED7-E131-4CB7-86D0-77DCE5ACCA4B}" = protocol=17 | dir=in | app=d:\programme\steam\steamapps\common\counter-strike source\hl2.exe |
"{E4AA6CE1-EC2E-4D45-9D31-584688AADC17}" = protocol=17 | dir=in | app=c:\program files (x86)\origin games\fifa 12\game\fifa.exe |
"{E738DFFF-3FFA-4D14-9F2D-1E146183D11A}" = protocol=6 | dir=in | app=c:\windows\system32\arfc\wrtc.exe |
"{EA109336-8E86-44A9-9E56-135985DC3E69}" = dir=in | app=c:\program files\hp\hp officejet pro 8600\bin\sendafax.exe |
"{EC5629D8-23DE-4238-BEAC-9D887825FE60}" = protocol=17 | dir=in | app=c:\program files (x86)\origin games\battlefield 3\bf3.exe |
"{EE73A02A-71CA-4960-9E6A-DCD5E9B53E25}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{EEEC98A1-69CA-4E69-9003-0DA1C4C86B21}" = dir=in | app=c:\program files\hp\hp officejet pro 8600\bin\hpnetworkcommunicatorcom.exe |
"{F2C1C4D0-54DE-46EC-8964-579ABDAB04B0}" = protocol=17 | dir=in | app=d:\programme\steam\steamapps\common\apb reloaded\binaries\apb.exe |
"{F8ED569F-8C07-4D20-895D-00F64FE3C9E0}" = protocol=6 | dir=in | app=c:\program files (x86)\origin games\battlefield 3\bf3.exe |
"{FD199FD0-BD86-4A8A-B1F7-A57144C130FD}" = protocol=6 | dir=in | app=d:\programme\steam\steam.exe |
"TCP Query User{5179461C-30EC-4D7E-AB12-DB99EC65825A}C:\program files (x86)\origin games\fifa 12\game\fifa.exe" = protocol=6 | dir=in | app=c:\program files (x86)\origin games\fifa 12\game\fifa.exe |
"TCP Query User{715A93EA-860B-4357-A24F-44E633202C50}D:\games\manager11.exe" = protocol=6 | dir=in | app=d:\games\manager11.exe |
"TCP Query User{866404C9-77FE-4F02-A47D-33D445D256B4}C:\users\adrian\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\adrian\appdata\roaming\spotify\spotify.exe |
"UDP Query User{326D5A9D-23BF-40E6-9350-75965253E639}C:\users\adrian\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\adrian\appdata\roaming\spotify\spotify.exe |
"UDP Query User{3E0365F7-A40F-4705-A319-45B23B0D598D}D:\games\manager11.exe" = protocol=17 | dir=in | app=d:\games\manager11.exe |
"UDP Query User{787BB5B6-C221-4F70-8038-C26CFB638EA0}C:\program files (x86)\origin games\fifa 12\game\fifa.exe" = protocol=17 | dir=in | app=c:\program files (x86)\origin games\fifa 12\game\fifa.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1280E900-35DA-4E08-A700-B79A5B2B8532}" = Microsoft Antimalware Service DE-DE Language Pack
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{230D1595-57DA-4933-8C4E-375797EBB7E1}" = ASUS Bluetooth Suite
"{330DAC67-5B62-452A-A0E4-6B4A5923940F}_is1" = MotioninJoy Gamepad tool 0.7.1001
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{787136D2-F0F8-4625-AA3F-72D7795AC842}" = Apple Mobile Device Support
"{7DEBE4EB-6B40-3766-BB35-5CBBC385DA37}" = Microsoft .NET Framework 4.5.1
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031" = Microsoft .NET Framework 4.5.1 (Deutsch)
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5.1
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 340.52
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 340.52
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 340.52
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience" = NVIDIA GeForce Experience 2.1.1
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 340.50
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.13.1220
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 15.3.33
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_GFExperience.LEDVisualizer" = NVIDIA LED Visualizer 1.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_GFExperience.NvStreamSrv" = SHIELD Streaming
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.3.30.1
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Network.Service" = NVIDIA Network Service
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_ShadowPlay" = NVIDIA ShadowPlay 15.3.33
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Update.Core" = NVIDIA Update Core
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver" = NVIDIA Virtual Audio 1.2.23
"{B8BA155B-1E75-405F-9CB4-8A99615D09DC}" = iTunes
"{BFAE8D5B-F918-486F-B74E-90762DF11C5C}" = Microsoft Security Client
"{C513739C-5F16-37B5-9ACF-99925FF1C1F3}" = Microsoft .NET Framework 4.5.1 (DEU)
"{D2D05FDB-4EDA-462D-8DB6-E0B9AD4FA25F}" = HP Officejet Pro 8600 - Grundlegende Software für das Gerät
"{DC911ADF-7B60-40F2-A112-FB1EB6402D07}" = Microsoft Security Client DE-DE Language Pack
"CCleaner" = CCleaner
"ESL Wire_is1" = ESL Wire 1.11
"Logitech Unifying" = Logitech Unifying-Software 2.50
"Microsoft Security Client" = Microsoft Security Essentials
"Samsung Mobile phone USB driver Drive" = Samsung Mobile phone USB driver Drive Software
"Unlocker" = Unlocker 1.9.1-x64
"WinRAR archiver" = WinRAR 4.01 (64-Bit)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}" = OpenOffice.org 3.4.1
"{26A24AE4-039D-4CA4-87B4-2F03217065FF}" = Java 7 Update 65
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{415FA9AD-DA10-4ABE-97B6-5051D4795C90}" = HP FWUpdateEDO2
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{55A41219-9B22-4098-BAE7-AE289B3C569A}_is1" = Panda USB Vaccine 1.0.1.4
"{64BFBE7A-886C-4CA2-A9B4-0C2B5A5942BC}" = Battlefield 3™
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{6C772996-BFF3-3C8C-860B-B3D48FF05D65}" = Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106
"{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}" = HP Update
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{76285C16-411A-488A-BCE3-C83CB933D8CF}" = Battlefield 3™
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}" = Text-To-Speech-Runtime
"{80407BA7-7763-4395-AB98-5233F1B34E65}" = NVIDIA PhysX
"{80AF0300-866F-400F-A350-D53E3C3E34E0}" = FUSSBALL MANAGER 13
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{8e70e4e1-06d7-470b-9f74-a51bef21088e}" = Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A29E18C2-7AB1-4b6b-848C-5D5E2C85F0C0}" = FIFA 13
"{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}" = Apple Application Support
"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.07) - Deutsch
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die Sims™ 3
"{C3E9887A-23BA-4777-8080-191A5AFCAB74}" = Mumble 1.2.3
"{C67A3F9D-E55D-4288-B4EC-1B9863EFB288}" = Razer Megalodon Firmware Updater
"{C7340571-7773-4A8C-9EBC-4E4243B38C76}" = Microsoft XML Parser
"{CA6BCA2F-EDEB-408F-850B-31404BE16A61}" = I.R.I.S. OCR
"{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}" = Etron USB3.0 Host Controller
"{E0FA1DC5-FEBF-4E7B-8FA3-DB94233E952D}" = Razer Lycosa
"{E824E81C-80A4-3DFF-B5F9-4842A9FF5F7F}" = Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106
"{EA8ADAA9-6671-4839-A51E-0C6792B78F3E}" = FIFA 12
"{EB1B8449-CD8F-485B-ADB6-02FBCFE180D3}" = Razer DeathAdder(TM) Mouse
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{FDE820DD-CC88-4395-AD5C-801365B8F316}" = HP Officejet Pro 8600 Hilfe
"{FF1C62C5-AF43-46F7-87A4-8B4B9CAEDF23}" = 3M Littmann Sound Analysis Software
"7-Zip" = 7-Zip 9.20
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 14 Plugin
"Afterburner" = MSI Afterburner 2.1.0
"Battlelog Web Plugins" = Battlelog Web Plugins
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"dlancockpit" = devolo Cockpit
"dlanconf" = devolo dLAN-Konfigurationsassistent
"dslmon" = devolo Informer
"ESN Sonar-0.70.4" = ESN Sonar
"InstallShield_{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}" = Etron USB3.0 Host Controller
"LibUSB-Win32_is1" = LibUSB-Win32-0.1.12.2
"LuPO_is1" = LuPO 2.0.2.14
"Malwarebytes Anti-Malware_is1" = Malwarebytes Anti-Malware Version 2.0.2.1012
"Mozilla Firefox 31.0 (x86 de)" = Mozilla Firefox 31.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NirSoft BlueScreenView" = NirSoft BlueScreenView
"NVIDIA StereoUSB Driver" = NVIDIA 3D Vision Controller Driver
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Origin" = Origin
"PunkBusterSvc" = PunkBuster Services
"Secunia PSI" = Secunia PSI (3.0.0.9016)
"Steam App 10" = Counter-Strike
"Steam App 113400" = APB Reloaded
"Steam App 218230" = PlanetSide 2
"Steam App 240" = Counter-Strike: Source
"Steam App 30" = Day of Defeat
"Steam App 440" = Team Fortress 2
"Steam App 570" = Dota 2
"Steam App 730" = Counter-Strike: Global Offensive
"TeamViewer 8" = TeamViewer 8
"TechPowerUp GPU-Z" = TechPowerUp GPU-Z
"VLC media player" = VLC media player 1.1.11
"XFastUsb" = XFastUsb
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 04.08.2014 07:10:20 | Computer Name = User-PC | Source = SetupARService | ID = 0
Description = Der Dienst kann nicht gestartet werden. System.NullReferenceException:
Der Objektverweis wurde nicht auf eine Objektinstanz festgelegt. bei SetupAfterRebootService.SetupARService.OnStart(String[]
args) bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object
state)
Error - 04.08.2014 07:12:09 | Computer Name = User-PC | Source = WinMgmt | ID = 10
Description =
Error - 04.08.2014 07:17:13 | Computer Name = User-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error - 04.08.2014 07:17:13 | Computer Name = User-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error - 04.08.2014 07:17:13 | Computer Name = User-PC | Source = Microsoft-Windows-LoadPerf | ID = 3011
Description = Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren
für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
Error - 04.08.2014 07:38:46 | Computer Name = User-PC | Source = SetupARService | ID = 0
Description = Der Dienst kann nicht gestartet werden. System.NullReferenceException:
Der Objektverweis wurde nicht auf eine Objektinstanz festgelegt. bei SetupAfterRebootService.SetupARService.OnStart(String[]
args) bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object
state)
Error - 04.08.2014 07:40:31 | Computer Name = User-PC | Source = WinMgmt | ID = 10
Description =
Error - 04.08.2014 07:44:56 | Computer Name = User-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error - 04.08.2014 07:44:56 | Computer Name = User-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error - 04.08.2014 07:44:56 | Computer Name = User-PC | Source = Microsoft-Windows-LoadPerf | ID = 3011
Description = Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren
für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
[ System Events ]
Error - 04.08.2014 07:13:19 | Computer Name = User-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
Fehler 0x8024200d fehlgeschlagen: Sicherheitsupdate für Windows 7 für x64-basierte
Systeme (KB2803821)
Error - 04.08.2014 07:13:59 | Computer Name = User-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
Fehler 0x8024200d fehlgeschlagen: Sicherheitsupdate für Windows 7 für x64-basierte
Systeme (KB2803821)
Error - 04.08.2014 07:37:30 | Computer Name = User-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
Fehler 0x8024200d fehlgeschlagen: Sicherheitsupdate für Windows 7 für x64-basierte
Systeme (KB2803821)
Error - 04.08.2014 07:37:30 | Computer Name = User-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
Fehler 0x8024200d fehlgeschlagen: Sicherheitsupdate für Windows 7 für x64-basierte
Systeme (KB2803821)
Error - 04.08.2014 07:37:55 | Computer Name = User-PC | Source = DCOM | ID = 10010
Description =
Error - 04.08.2014 07:38:04 | Computer Name = User-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
Fehler 0x8024200d fehlgeschlagen: Sicherheitsupdate für Windows 7 für x64-basierte
Systeme (KB2803821)
Error - 04.08.2014 07:38:36 | Computer Name = User-PC | Source = Application Popup | ID = 1060
Description = Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\Drivers\StarOpen.SYS
nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version
des Treibers zu erhalten.
Error - 04.08.2014 07:38:46 | Computer Name = User-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 04.08.2014 07:38:47 | Computer Name = User-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
StarOpen
Error - 04.08.2014 07:48:44 | Computer Name = User-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
Fehler 0x8024200d fehlgeschlagen: Sicherheitsupdate für Windows 7 für x64-basierte
Systeme (KB2803821)
< End of report >
|
|
05.08.2014, 06:35
| #7 |
| /// the machine /// TB-Ausbilder | Babylon.A , Incredibar.A , PriceGong, Spigot, Dealply & Co in C:\Users\...\AppData\Roaming\ AdwCLeaner löschen, neu laden, suchen und vor allem Löschen lassen. ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
05.08.2014, 12:13
| #8 |
| | Babylon.A , Incredibar.A , PriceGong, Spigot, Dealply & Co in C:\Users\...\AppData\Roaming\ Mahlzeit schrauber, danke für die frühe Unterstützung  AdwCleaner[S0].txt Code:
ATTFilter # AdwCleaner v3.302 - Bericht erstellt am 05/08/2014 um 10:38:22
# Aktualisiert 30/07/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Julian - USER-PC
# Gestartet von : C:\Users\Julian\Desktop\adwcleaner_3.302.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\DeviceVM
Ordner Gelöscht : C:\Windows\System32\ARFC
Ordner Gelöscht : C:\Users\Adrian\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\Adrian\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Adrian\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Adrian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Browser Manager
Ordner Gelöscht : C:\Users\User\AppData\Roaming\DeviceVM
Ordner Gelöscht : C:\Program Files (x86)\Mozilla Firefox\Extensions\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}
Datei Gelöscht : C:\Windows\System32\dmwu.exe
Datei Gelöscht : C:\Windows\System32\ImhxxpComm.dll
Datei Gelöscht : C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\igclhn7f.default\foxydeal.sqlite
Datei Gelöscht : C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\user.js
Datei Gelöscht : C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\igclhn7f.default\user.js
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\user.js
***** [ Tasks ] *****
Task Gelöscht : Browser Manager
Task Gelöscht : DealPlyUpdate
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\DVDVideoSoftTBAutoUpdateHelper_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\DVDVideoSoftTBAutoUpdateHelper_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchSettings_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchSettings_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_tuxguitar_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_tuxguitar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{94496571-6AC5-4836-82D5-D46260C44B17}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FD8F79A0-D2E2-4FA2-AEAF-393EAC8064F7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FD8F79A0-D2E2-4FA2-AEAF-393EAC8064F7}
Schlüssel Gelöscht : HKLM\Software\Uniblue
Schlüssel Gelöscht : HKLM\Software\Vittalia
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\WNLT
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17207
-\\ Mozilla Firefox v31.0 (x86 de)
[ Datei : C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\vxxpl523.default\prefs.js ]
Zeile gelöscht : user_pref("CT2269050_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1358436091972,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");
Zeile gelöscht : user_pref("Smartbar.ConduitHomepagesList", "");
Zeile gelöscht : user_pref("Smartbar.ConduitSearchEngineList", "");
Zeile gelöscht : user_pref("Smartbar.ConduitSearchUrlList", "");
Zeile gelöscht : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=685749&p=");
Zeile gelöscht : user_pref("Smartbar.keywordURLSelectedCTID", "CT2269050");
Zeile gelöscht : user_pref("browser.BabylonToolbar_i.newTab", "");
Zeile gelöscht : user_pref("browser.BabylonToolbar_i.newTabUrl", "");
Zeile gelöscht : user_pref("browser.babylon.HPOnNewTab", "");
Zeile gelöscht : user_pref("extensions.incredibar_i.aflt", "orgnl");
Zeile gelöscht : user_pref("extensions.incredibar_i.dfltLng", "");
Zeile gelöscht : user_pref("extensions.incredibar_i.did", "10665");
Zeile gelöscht : user_pref("extensions.incredibar_i.excTlbr", false);
Zeile gelöscht : user_pref("extensions.incredibar_i.id", "b4f9547d00000000000000ff01000001");
Zeile gelöscht : user_pref("extensions.incredibar_i.installerproductid", "26");
Zeile gelöscht : user_pref("extensions.incredibar_i.instlDay", "15640");
Zeile gelöscht : user_pref("extensions.incredibar_i.instlRef", "");
Zeile gelöscht : user_pref("extensions.incredibar_i.ms_url_id", "");
Zeile gelöscht : user_pref("extensions.incredibar_i.newTab", false);
Zeile gelöscht : user_pref("extensions.incredibar_i.ppd", "");
Zeile gelöscht : user_pref("extensions.incredibar_i.prdct", "incredibar");
Zeile gelöscht : user_pref("extensions.incredibar_i.productid", "26");
Zeile gelöscht : user_pref("extensions.incredibar_i.prtnrId", "Incredibar");
Zeile gelöscht : user_pref("extensions.incredibar_i.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.incredibar_i.tlbrId", "base");
Zeile gelöscht : user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6R8JrRz5pI&loc=IB_TB&i=26&search=");
Zeile gelöscht : user_pref("extensions.incredibar_i.upn2", "6R8JrRz5pI");
Zeile gelöscht : user_pref("extensions.incredibar_i.upn2n", "92825299328126310");
Zeile gelöscht : user_pref("extensions.incredibar_i.vrsn", "1.5.11.14");
Zeile gelöscht : user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1419:44:52");
Zeile gelöscht : user_pref("extensions.incredibar_i.vrsni", "1.5.11.14");
Zeile gelöscht : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_blackList", "form=CONTLB|babsrc=toolbar|babsrc=tb_ss|invocationType=tb50-ie-aolsoftonic-tbsbox-en-us|invocationType=tb50-ff-aolsoftonic[...]
Zeile gelöscht : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_referrer", "hxxp://search.babylon.com/?affID=115284&tt=4612_4&babsrc=NT_ss&mntrId=b4f9547d00000000000000ff01000001/|||8641352992363487"[...]
Zeile gelöscht : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_temp_referer", "hxxp://search.babylon.com/?affID=115284&tt=4612_4&babsrc=NT_ss&mntrId=b4f9547d00000000000000ff01000001");
[ Datei : C:\Users\Constantin\AppData\Roaming\Mozilla\Firefox\Profiles\j5q0ffjr.default\prefs.js ]
[ Datei : C:\Users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\mhasid1l.default\prefs.js ]
[ Datei : C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\vm7brfvt.default\prefs.js ]
[ Datei : C:\Users\scndAdmin\AppData\Roaming\Mozilla\Firefox\Profiles\27r3p1bz.default\prefs.js ]
[ Datei : C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\igclhn7f.default\prefs.js ]
*************************
AdwCleaner[R0].txt - [6713 octets] - [03/08/2014 19:08:37]
AdwCleaner[R1].txt - [7146 octets] - [05/08/2014 10:37:17]
AdwCleaner[S0].txt - [7001 octets] - [05/08/2014 10:38:22]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [7061 octets] ##########
Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=b4e80296c543ea42ba3d26aa0f01adfb
# engine=19506
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-08-05 10:49:25
# local_time=2014-08-05 12:49:25 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Microsoft Security Essentials'
# compatibility_mode=5895 16777213 100 100 8778649 101416975 0 0
# scanned=237429
# found=12
# cleaned=0
# scan_time=7159
sh=282E43766D30716E793A5122951C2AE76FD8CBCC ft=0 fh=0000000000000000 vn="Win32/DealPly.J evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\Mozilla Firefox\extensions\staged\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}\chrome\content\dealply.xul"
sh=E6EB57D31EBB34333C7946B099CD30A2AF3A4BE0 ft=1 fh=9c58a27d54f366a1 vn="Variante von Win32/Toolbar.Perion.A evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CVY49772\update[1]"
sh=0460B794834ED78BE69BA5EB9C0E6211EBEAD9B6 ft=1 fh=0f8145e534b0e78b vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\LocalLow\DVDVideoSoftTB\ldrtbDVDV.dll"
sh=8CA209A796CAB152BC9907BCEF283C221AC5F058 ft=1 fh=16efebacbcd5a9c9 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\LocalLow\DVDVideoSoftTB\tbDVDV.dll"
sh=ABF759CA3BFB16DE62197DD7C417AC5039A43AE0 ft=1 fh=1801af74030ebca1 vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\LocalLow\DVDVideoSoftTB\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.5.3\bin\PriceGongIE.dll"
sh=69A35E782A90296DC01CD4184D2775CE1A35C4B2 ft=1 fh=7f4a4e7ae8724a95 vn="Win32/DealPly.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Roaming\DealPly\UpdateProc\UpdateTask.exe"
sh=E6EB57D31EBB34333C7946B099CD30A2AF3A4BE0 ft=1 fh=9c58a27d54f366a1 vn="Variante von Win32/Toolbar.Perion.A evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CVY49772\update[1]"
sh=0460B794834ED78BE69BA5EB9C0E6211EBEAD9B6 ft=1 fh=0f8145e534b0e78b vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\DVDVideoSoftTB\ldrtbDVDV.dll"
sh=8CA209A796CAB152BC9907BCEF283C221AC5F058 ft=1 fh=16efebacbcd5a9c9 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\DVDVideoSoftTB\tbDVDV.dll"
sh=ABF759CA3BFB16DE62197DD7C417AC5039A43AE0 ft=1 fh=1801af74030ebca1 vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\DVDVideoSoftTB\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.5.3\bin\PriceGongIE.dll"
sh=69A35E782A90296DC01CD4184D2775CE1A35C4B2 ft=1 fh=7f4a4e7ae8724a95 vn="Win32/DealPly.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\DealPly\UpdateProc\UpdateTask.exe"
sh=0BFF84AA6CC4CCF580EAE2FBF4C129FA6EA612C4 ft=1 fh=9fe1a4845276fe8f vn="Win32/Adware.ADON evtl. unerwünschte Anwendung" ac=I fn="D:\Downloads\Unlocker1.9.1-x64.exe"
Code:
ATTFilter Results of screen317's Security Check version 0.99.86
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Microsoft Security Essentials
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Secunia PSI (3.0.0.9016)
Java 7 Update 65
Adobe Flash Player 14.0.0.145
Adobe Reader XI
Mozilla Firefox (31.0)
````````Process Check: objlist.exe by Laurent````````
Microsoft Security Essentials MSMpEng.exe
Microsoft Security Essentials msseces.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST.txt FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-08-2014
Ran by Julian (administrator) on USER-PC on 05-08-2014 13:03:36
Running from C:\Users\Julian\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(devolo AG) D:\Programme\devolo\dlan\devolonetsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_x64.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(FNet Co., Ltd.) C:\Program Files (x86)\XFastUsb\XFastUsb.exe
() C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe
(Razer USA Ltd.) C:\Program Files (x86)\Razer\Lycosa\razerhid.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\Razer\Lycosa\razertra.exe
(Razer Inc.) C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe
() C:\Program Files (x86)\Razer\DeathAdder\vdDaemon.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Panda Security) C:\Program Files (x86)\Panda USB Vaccine\USBVaccine.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [615584 2011-03-01] (Atheros Communications)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [379552 2011-03-01] (Atheros Commnucations)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2403104 2014-07-25] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-05] (Intel Corporation)
HKLM-x32\...\Run: [XFastUsb] => C:\Program Files (x86)\XFastUsb\XFastUsb.exe [4942336 2011-09-05] (FNet Co., Ltd.)
HKLM-x32\...\Run: [DeathAdder] => C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe [248320 2011-03-21] ()
HKLM-x32\...\Run: [Lycosa] => C:\Program Files (x86)\Razer\Lycosa\razerhid.exe [238592 2010-04-13] (Razer USA Ltd.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-11] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-82016817-340743653-2786680247-1007\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-82016817-340743653-2786680247-1007\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [166568 2014-07-02] (NVIDIA Corporation)
AppInit_DLLs: , C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [166568 2014-07-02] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [146480 2014-07-02] (NVIDIA Corporation)
Startup: C:\Users\Adrian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> D:\Programme\OpenOffice\program\quickstart.exe ()
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet Pro 8600.lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet Pro 8600.lnk -> C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
BootExecute:
GroupPolicyUsers\S-1-5-21-82016817-340743653-2786680247-1002\User: Group Policy restriction detected <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\mhasid1l.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 -> C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=1.118.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=1.122.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: HTTPS-Everywhere - C:\Users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\mhasid1l.default\Extensions\https-everywhere@eff.org [2014-08-04]
FF Extension: WOT - C:\Users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\mhasid1l.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014-08-03]
FF Extension: Ghostery - C:\Users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\mhasid1l.default\Extensions\firefox@ghostery.com.xpi [2014-08-03]
FF Extension: Screengrab (fix version) - C:\Users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\mhasid1l.default\Extensions\{02450914-cdd9-410f-b1da-db004e18c671}.xpi [2014-08-03]
FF Extension: NoScript - C:\Users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\mhasid1l.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-08-03]
FF Extension: Adblock Edge - C:\Users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\mhasid1l.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2014-08-03]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\staged [2014-08-02]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [76448 2011-03-01] (Atheros Commnucations) [File not signed]
R2 DevoloNetworkService; D:\Programme\devolo\dlan\devolonetsvc.exe [3645432 2014-07-18] (devolo AG)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720608 2014-07-25] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18956064 2014-07-25] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-04-21] ()
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
S2 SetupARService; C:\Program Files (x86)\Realtek\Audio\SetupAfterRebootService.exe [24576 2011-12-16] (Realtek Semiconductor.) [File not signed]
S4 WireHelpSvc; C:\Program Files\Common Files\WireHelpSvc.exe [168864 2011-11-28] ()
S4 FirebirdServerMAGIXInstance; C:\Program Files (x86)\MAGIX\Common\Database\bin\fbserver.exe [X]
S4 UPnPService; C:\Program Files (x86)\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 ALSysIO; No ImagePath
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 bulkadi; C:\Windows\System32\DRIVERS\bulkrazer_x64.sys [25088 2011-02-09] (Windows (R) Codename Longhorn DDK provider)
R3 ESLvnic1; C:\Windows\System32\DRIVERS\ESLvnic.sys [25528 2011-11-28] (Turtle Entertainment GmbH)
R2 ESLWireAC; C:\Windows\system32\drivers\ESLWireACD.sys [147472 2011-11-28] (<Turtle Entertainment>)
S3 FNETTBOH_305; C:\Windows\System32\drivers\FNETTBOH_305.SYS [31808 2011-12-16] (FNet Co., Ltd.)
R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [15936 2011-09-05] (FNet Co., Ltd.)
R3 Lycosa; C:\Windows\System32\drivers\Lycosa.sys [20352 2009-09-30] (Razer USA Ltd.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2014-07-18] (CACE Technologies)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-07-25] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
S1 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2006-07-24] () [File not signed]
R1 UimBus; C:\Windows\System32\DRIVERS\UimBus.sys [102664 2014-01-23] ()
R1 Uim_DEVIM; C:\Windows\System32\DRIVERS\uim_devim.sys [25992 2014-01-23] ()
R1 Uim_IM; C:\Windows\System32\DRIVERS\uim_im.sys [700680 2014-01-23] ()
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 IntcAzAudAddService; system32\drivers\RTKVHD64.sys [X]
S2 SSPORT; \??\C:\Windows\system32\Drivers\SSPORT.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-05 13:03 - 2014-08-05 13:03 - 00014679 _____ () C:\Users\Julian\Desktop\FRST.txt
2014-08-05 13:02 - 2014-08-05 13:02 - 02094080 _____ (Farbar) C:\Users\Julian\Desktop\FRST64.exe
2014-08-05 13:01 - 2014-08-05 13:01 - 00000800 _____ () C:\Users\Julian\Desktop\checkup.txt
2014-08-05 12:54 - 2014-08-05 12:54 - 00003674 _____ () C:\Users\Julian\Desktop\Neues Textdokument (4).txt
2014-08-05 12:51 - 2014-08-05 12:51 - 00001940 _____ () C:\Users\Julian\Desktop\ESET.txt
2014-08-05 10:43 - 2014-08-05 10:37 - 00007146 _____ () C:\Users\Julian\Desktop\AdwCleaner[R1].txt
2014-08-05 10:41 - 2014-08-05 10:41 - 00007149 _____ () C:\Users\Julian\Desktop\AdwCleaner[S0].txt
2014-08-05 10:33 - 2014-08-05 10:33 - 01361309 _____ () C:\Users\Julian\Desktop\adwcleaner_3.302.exe
2014-08-05 10:31 - 2014-08-05 10:36 - 00002230 _____ () C:\Users\Julian\Desktop\Neues Textdokument (2).txt
2014-08-05 10:30 - 2014-08-05 10:30 - 00854410 _____ () C:\Users\Julian\Desktop\SecurityCheck.exe
2014-08-05 10:29 - 2014-08-05 10:29 - 02347384 _____ (ESET) C:\Users\Julian\Desktop\esetsmartinstaller_deu.exe
2014-08-04 22:12 - 2014-08-04 22:12 - 00000000 ____D () C:\Users\Julian\Documents\FIFA 13
2014-08-04 22:12 - 2014-08-04 22:12 - 00000000 ____D () C:\Users\Julian\AppData\Roaming\Origin
2014-08-04 22:12 - 2014-08-04 22:12 - 00000000 ____D () C:\Users\Julian\AppData\Local\Origin
2014-08-04 22:12 - 2014-08-04 22:12 - 00000000 ____D () C:\Program Files (x86)\Origin Games
2014-08-04 21:17 - 2014-08-04 21:17 - 00000000 ____D () C:\Users\Julian\AppData\Local\Apple
2014-08-04 20:36 - 2014-08-04 20:36 - 00002371 _____ () C:\Users\Public\Desktop\Paragon Backup & Recovery™ 2014 Free.lnk
2014-08-04 20:36 - 2014-08-04 20:36 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_blockmounter_01_09_00.Wdf
2014-08-04 20:36 - 2014-08-04 20:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paragon Backup & Recovery™ 2014 Free
2014-08-04 20:35 - 2014-08-04 20:35 - 00000000 ____D () C:\Users\Julian\AppData\Local\Downloaded Installations
2014-08-04 20:35 - 2014-08-04 20:35 - 00000000 ____D () C:\Program Files\Paragon Software
2014-08-04 20:34 - 2014-08-04 20:34 - 00000000 ____D () C:\Users\Julian\Desktop\Maintainance
2014-08-04 20:30 - 2014-07-18 14:19 - 00221184 _____ (CACE Technologies) C:\Windows\SysWOW64\devolopcap.dll
2014-08-04 20:30 - 2014-07-18 14:19 - 00081920 _____ (CACE Technologies) C:\Windows\SysWOW64\devolopacket.dll
2014-08-04 20:30 - 2014-07-18 14:19 - 00034048 _____ (CACE Technologies) C:\Windows\SysWOW64\Drivers\npf_devolo.sys
2014-08-04 18:15 - 2014-08-04 18:15 - 00000000 ____D () C:\Users\Julian\AppData\Roaming\de.devolo.dLAN.Cockpit
2014-08-04 18:07 - 2014-08-04 18:07 - 00000178 _____ () C:\Users\User\Desktop\TB Update.txt
2014-08-04 17:55 - 2014-08-04 18:00 - 00000291 _____ () C:\Users\Julian\Desktop\Anleitungen.txt
2014-08-04 14:39 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2014-08-04 14:39 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2014-08-04 13:16 - 2014-08-04 14:44 - 00001126 _____ () C:\Users\User\Desktop\Neues Textdokument (7).txt
2014-08-04 12:58 - 2014-08-04 13:09 - 00000351 _____ () C:\Users\User\Desktop\Neues Textdokument (6).txt
2014-08-04 12:52 - 2014-01-09 04:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-08-04 12:52 - 2014-01-04 00:44 - 06574592 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-08-03 23:20 - 2014-08-03 23:20 - 00000000 ____D () C:\Users\Julian\AppData\Local\Razer_Inc
2014-08-03 23:19 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2014-08-03 23:19 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2014-08-03 23:19 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2014-08-03 23:19 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2014-08-03 23:19 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2014-08-03 23:19 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-08-03 23:19 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2014-08-03 23:19 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2014-08-03 23:19 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2014-08-03 23:19 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2014-08-03 23:19 - 2013-10-02 02:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2014-08-03 23:19 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2014-08-03 23:19 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-08-03 23:19 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-08-03 23:19 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2014-08-03 23:19 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-08-03 23:18 - 2013-09-25 04:23 - 01030144 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-08-03 23:18 - 2013-09-25 03:57 - 00792576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-08-03 22:19 - 2014-08-04 17:20 - 00001128 _____ () C:\Users\Julian\Desktop\Neues Textdokument.txt
2014-08-03 21:37 - 2014-08-05 10:41 - 00003352 _____ () C:\Windows\setupact.log
2014-08-03 21:37 - 2014-08-05 10:40 - 00012136 _____ () C:\Windows\PFRO.log
2014-08-03 21:37 - 2014-08-03 21:37 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-03 20:27 - 2014-08-03 20:27 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-03 20:27 - 2014-08-03 20:27 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-03 20:27 - 2014-08-03 20:27 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-03 20:27 - 2014-08-03 20:27 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-03 20:27 - 2014-08-03 20:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-08-03 20:25 - 2014-08-04 20:22 - 00000000 ____D () C:\Users\Julian\AppData\Local\CrashDumps
2014-08-03 19:58 - 2014-08-03 19:58 - 00002774 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-08-03 19:58 - 2014-08-03 19:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-08-03 19:58 - 2014-08-03 19:58 - 00000000 ____D () C:\Program Files\CCleaner
2014-08-03 19:51 - 2014-08-03 19:51 - 00003072 _____ () C:\Windows\System32\Tasks\PandaUSBVaccine
2014-08-03 19:51 - 2014-08-03 19:51 - 00000000 ____D () C:\ProgramData\Panda Security
2014-08-03 19:51 - 2014-08-03 19:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-08-03 19:51 - 2014-08-03 19:51 - 00000000 ____D () C:\Program Files (x86)\Panda USB Vaccine
2014-08-03 19:08 - 2014-08-05 10:38 - 00000000 ____D () C:\AdwCleaner
2014-08-03 19:05 - 2014-08-03 23:06 - 00001065 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
2014-08-03 19:05 - 2014-08-03 19:05 - 00000000 ____D () C:\Users\Julian\AppData\Local\Secunia PSI
2014-08-03 19:05 - 2014-08-03 19:05 - 00000000 ____D () C:\Program Files (x86)\Secunia
2014-08-03 18:32 - 2014-08-05 10:32 - 00000000 ____D () C:\Users\Julian\Desktop\Sec
2014-08-03 18:20 - 2014-08-03 18:20 - 00000000 __SHD () C:\Users\Julian\AppData\Local\EmieUserList
2014-08-03 18:20 - 2014-08-03 18:20 - 00000000 __SHD () C:\Users\Julian\AppData\Local\EmieSiteList
2014-08-03 18:06 - 2014-08-05 13:03 - 00000000 ____D () C:\FRST
2014-08-03 17:52 - 2014-08-04 17:08 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-03 17:49 - 2014-08-03 17:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-08-03 17:49 - 2014-08-03 17:49 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-08-03 17:49 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-03 17:49 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-03 17:46 - 2014-08-03 17:49 - 00000000 ____D () C:\Users\Julian\AppData\Roaming\Malwarebytes
2014-08-03 09:34 - 2014-08-03 09:34 - 00000809 _____ () C:\Users\Adrian\Desktop\FUSSBALL MANAGER 13.lnk
2014-08-02 23:58 - 2014-08-02 23:58 - 00000000 ____D () C:\Users\Adrian\Desktop\Neuer Ordner
2014-08-02 23:58 - 2013-05-14 20:56 - 00000847 _____ () C:\Users\Adrian\Desktop\FIFA 13.lnk
2014-08-02 23:43 - 2014-08-02 23:46 - 00000350 _____ () C:\Users\Adrian\Desktop\Hallo Adrian.txt
2014-08-02 23:37 - 2013-05-10 11:57 - 01661440 _____ (Slackerhome Productions) C:\Users\User\Desktop\Better DS3.exe
2014-08-02 23:31 - 2013-04-20 18:18 - 00000000 _____ () C:\Users\User\Desktop\Neues Textdokument (5).txt
2014-08-02 23:30 - 2013-03-13 23:11 - 00000513 _____ () C:\Users\User\Desktop\Programme und Funktionen - Verknüpfung.lnk
2014-08-02 23:30 - 2013-03-13 22:56 - 00000493 _____ () C:\Users\User\Desktop\Windows Update - Verknüpfung.lnk
2014-08-02 23:30 - 2013-03-13 22:56 - 00000493 _____ () C:\Users\User\Desktop\Wartungscenter - Verknüpfung.lnk
2014-08-02 23:29 - 2013-04-20 18:18 - 00000000 _____ () C:\Users\User\Desktop\Neues Textdokument (4).txt
2014-08-02 23:29 - 2013-02-20 19:01 - 00002117 _____ () C:\Users\User\Desktop\Microsoft Security Essentials.lnk
2014-08-02 23:27 - 2014-08-02 23:28 - 00000000 ____D () C:\Users\Julian\AppData\Local\NVIDIA Corporation
2014-08-02 23:27 - 2014-08-02 23:27 - 00000000 ____D () C:\Users\Julian\AppData\Local\NVIDIA
2014-08-02 23:17 - 2014-08-04 21:49 - 00000000 ____D () C:\Users\Adrian\AppData\Local\BetterDS3
2014-08-02 23:16 - 2013-05-10 11:57 - 01661440 _____ (Slackerhome Productions) C:\Users\Adrian\Desktop\Better DS3.exe
2014-08-02 23:12 - 2014-07-02 19:44 - 00609240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-08-02 23:10 - 2014-07-02 22:48 - 31512520 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 24196896 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 22994208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 17555104 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 15294296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 13922752 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 13835208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 12866008 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-08-02 23:10 - 2014-07-02 22:48 - 11283344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 11222048 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 04247000 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 03989960 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 01890080 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434052.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 01539928 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434052.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 00944928 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 00907096 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 00903624 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 00869152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 00846832 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 00354016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 00166568 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2014-08-02 22:59 - 2014-08-02 22:59 - 00000000 ____D () C:\Users\scndAdmin\Desktop\Neuer Ordner
2014-08-02 22:54 - 2014-08-02 22:54 - 00000000 ____D () C:\Users\scndAdmin\AppData\Roaming\MotioninJoy
2014-08-02 22:53 - 2014-08-02 22:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MotioninJoy
2014-08-02 22:53 - 2014-08-02 22:53 - 00000000 ____D () C:\Program Files\MotioninJoy
2014-08-02 22:53 - 2011-12-07 19:42 - 00328712 _____ (Logitech Inc.) C:\Windows\system32\MijFrc.dll
2014-08-02 22:52 - 2014-08-02 22:52 - 00000000 ____D () C:\Users\Public\Documents\Atheros
2014-08-02 22:37 - 2014-08-02 23:00 - 00000000 ____D () C:\Users\scndAdmin\Documents\Bluetooth Folder
2014-08-02 22:37 - 2014-08-02 22:37 - 00000000 ____D () C:\Users\scndAdmin\AppData\Local\BMExplorer
2014-08-02 22:05 - 2014-08-02 22:05 - 00008068 _____ () C:\Users\scndAdmin\AppData\Local\CleanupUninstall.txt
2014-08-02 21:36 - 2014-07-25 15:50 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2014-08-02 21:36 - 2014-07-25 15:50 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2014-08-02 21:18 - 2014-08-05 10:38 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-08-02 21:18 - 2014-08-02 21:18 - 00000000 ____D () C:\Users\scndAdmin\AppData\Roaming\WinRAR
2014-08-02 21:18 - 2014-08-02 21:18 - 00000000 ____D () C:\Users\scndAdmin\AppData\Local\BetterDS3
2014-08-02 21:18 - 2013-05-10 11:57 - 01661440 _____ (Slackerhome Productions) C:\Users\scndAdmin\Desktop\Better DS3.exe
2014-08-02 20:16 - 2014-08-02 20:16 - 00000000 ____D () C:\Users\scndAdmin\AppData\Roaming\de.devolo.dLAN.Cockpit
2014-08-02 19:51 - 2014-08-02 19:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech
2014-08-02 19:51 - 2014-08-02 19:51 - 00000000 ____D () C:\ProgramData\LogiShrd
2014-08-02 19:50 - 2014-08-02 19:50 - 00000000 ____D () C:\Program Files\Common Files\LogiShrd
2014-08-02 19:46 - 2014-08-02 19:46 - 00000000 __SHD () C:\Users\Adrian\AppData\Local\EmieUserList
2014-08-02 19:46 - 2014-08-02 19:46 - 00000000 __SHD () C:\Users\Adrian\AppData\Local\EmieSiteList
2014-08-02 13:45 - 2014-08-02 13:45 - 00000000 ____D () C:\Users\Adrian\AppData\Local\NVIDIA Corporation
2014-08-02 13:45 - 2014-08-02 13:45 - 00000000 ____D () C:\Users\Adrian\AppData\Local\NVIDIA
2014-08-02 11:40 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-02 11:40 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-02 11:40 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-08-02 11:40 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-02 11:40 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-02 11:40 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-02 11:40 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-08-02 11:40 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-02 11:40 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-02 11:40 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-08-02 11:40 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-02 11:40 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-08-02 11:40 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-08-02 11:40 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-07-28 21:58 - 2014-07-28 21:58 - 00002059 _____ () C:\Users\User\Desktop\autoexec (orig).cfg
2014-07-28 21:58 - 2014-07-28 20:35 - 00010880 _____ () C:\Users\User\Desktop\config (orig).cfg
2014-07-28 16:14 - 2014-07-28 21:58 - 00002059 _____ () C:\Users\User\Desktop\autoexec.cfg
2014-07-28 16:14 - 2014-07-27 15:08 - 00010179 _____ () C:\Users\User\Desktop\config.cfg
2014-07-28 15:45 - 2014-07-28 21:57 - 00001013 _____ () C:\Users\User\Desktop\Neues Textdokument (3).txt
2014-07-24 15:23 - 2014-07-24 15:23 - 00000000 ____D () C:\Users\User\AppData\Roaming\de.devolo.dLAN.Cockpit
2014-07-24 15:20 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-24 15:20 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-24 15:20 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-24 15:20 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-24 15:20 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-24 15:20 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-24 15:20 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-24 15:20 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-24 15:20 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-24 15:20 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-24 15:20 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-24 15:20 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-24 15:20 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-24 15:20 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-24 15:20 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-24 15:20 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-24 15:20 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-24 15:20 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-24 15:20 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-24 15:20 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-24 15:20 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-24 15:20 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-24 15:20 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-24 15:20 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-24 15:20 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-24 15:20 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-24 15:20 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-24 15:20 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-24 15:20 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-24 15:20 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-24 15:20 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-24 15:20 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-24 15:20 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-24 15:20 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-24 15:20 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-24 15:20 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-24 15:20 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-24 15:20 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-24 15:20 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-24 15:20 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-24 15:20 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-24 15:20 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-24 15:20 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-24 15:20 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-24 15:20 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-24 15:20 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-24 15:20 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-24 15:20 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-24 15:20 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-24 15:20 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-24 15:20 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-24 15:20 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-24 15:20 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-24 15:20 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-24 15:20 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-24 15:20 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-24 15:20 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-24 15:20 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-24 15:20 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-24 15:20 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-24 15:20 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-24 15:20 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-24 15:20 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-24 15:20 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-24 15:20 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-24 15:20 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-24 15:20 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-24 15:20 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-24 15:20 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-24 15:20 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-24 15:20 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-24 15:20 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-24 15:20 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-24 15:20 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-24 15:20 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-24 15:20 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-24 15:18 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-24 15:18 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-24 15:18 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-05 13:03 - 2014-08-05 13:03 - 00014679 _____ () C:\Users\Julian\Desktop\FRST.txt
2014-08-05 13:03 - 2014-08-03 18:06 - 00000000 ____D () C:\FRST
2014-08-05 13:02 - 2014-08-05 13:02 - 02094080 _____ (Farbar) C:\Users\Julian\Desktop\FRST64.exe
2014-08-05 13:01 - 2014-08-05 13:01 - 00000800 _____ () C:\Users\Julian\Desktop\checkup.txt
2014-08-05 13:00 - 2011-09-05 13:10 - 01975849 _____ () C:\Windows\WindowsUpdate.log
2014-08-05 12:54 - 2014-08-05 12:54 - 00003674 _____ () C:\Users\Julian\Desktop\Neues Textdokument (4).txt
2014-08-05 12:51 - 2014-08-05 12:51 - 00001940 _____ () C:\Users\Julian\Desktop\ESET.txt
2014-08-05 10:48 - 2009-07-14 06:45 - 00021840 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-05 10:48 - 2009-07-14 06:45 - 00021840 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-05 10:47 - 2011-04-12 09:43 - 14114420 _____ () C:\Windows\system32\perfh007.dat
2014-08-05 10:47 - 2011-04-12 09:43 - 04367056 _____ () C:\Windows\system32\perfc007.dat
2014-08-05 10:47 - 2009-07-14 07:13 - 00006292 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-05 10:41 - 2014-08-05 10:41 - 00007149 _____ () C:\Users\Julian\Desktop\AdwCleaner[S0].txt
2014-08-05 10:41 - 2014-08-03 21:37 - 00003352 _____ () C:\Windows\setupact.log
2014-08-05 10:41 - 2012-07-12 08:36 - 00000035 _____ () C:\Users\Public\Documents\AtherosServiceConfig.ini
2014-08-05 10:40 - 2014-08-03 21:37 - 00012136 _____ () C:\Windows\PFRO.log
2014-08-05 10:40 - 2011-09-06 11:51 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-08-05 10:40 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-05 10:38 - 2014-08-03 19:08 - 00000000 ____D () C:\AdwCleaner
2014-08-05 10:38 - 2014-08-02 21:18 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-08-05 10:37 - 2014-08-05 10:43 - 00007146 _____ () C:\Users\Julian\Desktop\AdwCleaner[R1].txt
2014-08-05 10:36 - 2014-08-05 10:31 - 00002230 _____ () C:\Users\Julian\Desktop\Neues Textdokument (2).txt
2014-08-05 10:33 - 2014-08-05 10:33 - 01361309 _____ () C:\Users\Julian\Desktop\adwcleaner_3.302.exe
2014-08-05 10:32 - 2014-08-03 18:32 - 00000000 ____D () C:\Users\Julian\Desktop\Sec
2014-08-05 10:30 - 2014-08-05 10:30 - 00854410 _____ () C:\Users\Julian\Desktop\SecurityCheck.exe
2014-08-05 10:29 - 2014-08-05 10:29 - 02347384 _____ (ESET) C:\Users\Julian\Desktop\esetsmartinstaller_deu.exe
2014-08-04 23:20 - 2012-01-07 20:53 - 00000000 ____D () C:\Users\Adrian\Documents\FIFA 12
2014-08-04 22:16 - 2011-10-02 19:57 - 00000000 ____D () C:\ProgramData\Origin
2014-08-04 22:15 - 2011-10-02 19:57 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-08-04 22:12 - 2014-08-04 22:12 - 00000000 ____D () C:\Users\Julian\Documents\FIFA 13
2014-08-04 22:12 - 2014-08-04 22:12 - 00000000 ____D () C:\Users\Julian\AppData\Roaming\Origin
2014-08-04 22:12 - 2014-08-04 22:12 - 00000000 ____D () C:\Users\Julian\AppData\Local\Origin
2014-08-04 22:12 - 2014-08-04 22:12 - 00000000 ____D () C:\Program Files (x86)\Origin Games
2014-08-04 21:49 - 2014-08-02 23:17 - 00000000 ____D () C:\Users\Adrian\AppData\Local\BetterDS3
2014-08-04 21:40 - 2012-04-25 15:41 - 00000000 ____D () C:\Users\Adrian\AppData\Roaming\Spotify
2014-08-04 21:35 - 2012-04-25 15:42 - 00000000 ____D () C:\Users\Adrian\AppData\Local\Spotify
2014-08-04 21:17 - 2014-08-04 21:17 - 00000000 ____D () C:\Users\Julian\AppData\Local\Apple
2014-08-04 20:36 - 2014-08-04 20:36 - 00002371 _____ () C:\Users\Public\Desktop\Paragon Backup & Recovery™ 2014 Free.lnk
2014-08-04 20:36 - 2014-08-04 20:36 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_blockmounter_01_09_00.Wdf
2014-08-04 20:36 - 2014-08-04 20:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paragon Backup & Recovery™ 2014 Free
2014-08-04 20:35 - 2014-08-04 20:35 - 00000000 ____D () C:\Users\Julian\AppData\Local\Downloaded Installations
2014-08-04 20:35 - 2014-08-04 20:35 - 00000000 ____D () C:\Program Files\Paragon Software
2014-08-04 20:34 - 2014-08-04 20:34 - 00000000 ____D () C:\Users\Julian\Desktop\Maintainance
2014-08-04 20:22 - 2014-08-03 20:25 - 00000000 ____D () C:\Users\Julian\AppData\Local\CrashDumps
2014-08-04 20:18 - 2013-05-13 20:08 - 00000000 ____D () C:\Windows\pss
2014-08-04 18:15 - 2014-08-04 18:15 - 00000000 ____D () C:\Users\Julian\AppData\Roaming\de.devolo.dLAN.Cockpit
2014-08-04 18:07 - 2014-08-04 18:07 - 00000178 _____ () C:\Users\User\Desktop\TB Update.txt
2014-08-04 18:00 - 2014-08-04 17:55 - 00000291 _____ () C:\Users\Julian\Desktop\Anleitungen.txt
2014-08-04 17:20 - 2014-08-03 22:19 - 00001128 _____ () C:\Users\Julian\Desktop\Neues Textdokument.txt
2014-08-04 17:08 - 2014-08-03 17:52 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-04 14:44 - 2014-08-04 13:16 - 00001126 _____ () C:\Users\User\Desktop\Neues Textdokument (7).txt
2014-08-04 13:38 - 2013-03-13 22:50 - 00000000 ____D () C:\Users\Julian
2014-08-04 13:09 - 2014-08-04 12:58 - 00000351 _____ () C:\Users\User\Desktop\Neues Textdokument (6).txt
2014-08-04 12:52 - 2013-03-05 14:34 - 00000000 ____D () C:\Users\User\Desktop\sec
2014-08-03 23:29 - 2011-09-07 13:05 - 00000000 ____D () C:\Program Files (x86)\Razer
2014-08-03 23:20 - 2014-08-03 23:20 - 00000000 ____D () C:\Users\Julian\AppData\Local\Razer_Inc
2014-08-03 23:06 - 2014-08-03 19:05 - 00001065 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
2014-08-03 21:37 - 2014-08-03 21:37 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-03 20:36 - 2011-10-04 15:50 - 00000000 ____D () C:\Windows\Minidump
2014-08-03 20:36 - 2011-09-05 20:01 - 00000000 ____D () C:\Windows\Panther
2014-08-03 20:27 - 2014-08-03 20:27 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-03 20:27 - 2014-08-03 20:27 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-03 20:27 - 2014-08-03 20:27 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-03 20:27 - 2014-08-03 20:27 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-03 20:27 - 2014-08-03 20:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-08-03 20:27 - 2014-05-29 15:29 - 00000000 ____D () C:\ProgramData\Oracle
2014-08-03 20:27 - 2011-11-09 18:44 - 00000000 ____D () C:\Program Files (x86)\Java
2014-08-03 19:58 - 2014-08-03 19:58 - 00002774 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-08-03 19:58 - 2014-08-03 19:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-08-03 19:58 - 2014-08-03 19:58 - 00000000 ____D () C:\Program Files\CCleaner
2014-08-03 19:51 - 2014-08-03 19:51 - 00003072 _____ () C:\Windows\System32\Tasks\PandaUSBVaccine
2014-08-03 19:51 - 2014-08-03 19:51 - 00000000 ____D () C:\ProgramData\Panda Security
2014-08-03 19:51 - 2014-08-03 19:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-08-03 19:51 - 2014-08-03 19:51 - 00000000 ____D () C:\Program Files (x86)\Panda USB Vaccine
2014-08-03 19:05 - 2014-08-03 19:05 - 00000000 ____D () C:\Users\Julian\AppData\Local\Secunia PSI
2014-08-03 19:05 - 2014-08-03 19:05 - 00000000 ____D () C:\Program Files (x86)\Secunia
2014-08-03 18:20 - 2014-08-03 18:20 - 00000000 __SHD () C:\Users\Julian\AppData\Local\EmieUserList
2014-08-03 18:20 - 2014-08-03 18:20 - 00000000 __SHD () C:\Users\Julian\AppData\Local\EmieSiteList
2014-08-03 18:13 - 2013-04-21 22:54 - 00000000 ____D () C:\Users\scndAdmin
2014-08-03 17:49 - 2014-08-03 17:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-08-03 17:49 - 2014-08-03 17:49 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-08-03 17:49 - 2014-08-03 17:46 - 00000000 ____D () C:\Users\Julian\AppData\Roaming\Malwarebytes
2014-08-03 17:49 - 2013-03-01 15:18 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-03 17:44 - 2013-03-13 22:54 - 00000000 ____D () C:\Users\Julian\AppData\Local\Mozilla
2014-08-03 09:34 - 2014-08-03 09:34 - 00000809 _____ () C:\Users\Adrian\Desktop\FUSSBALL MANAGER 13.lnk
2014-08-02 23:58 - 2014-08-02 23:58 - 00000000 ____D () C:\Users\Adrian\Desktop\Neuer Ordner
2014-08-02 23:46 - 2014-08-02 23:43 - 00000350 _____ () C:\Users\Adrian\Desktop\Hallo Adrian.txt
2014-08-02 23:34 - 2011-09-05 13:18 - 00082768 _____ () C:\Users\User\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-02 23:28 - 2014-08-02 23:27 - 00000000 ____D () C:\Users\Julian\AppData\Local\NVIDIA Corporation
2014-08-02 23:27 - 2014-08-02 23:27 - 00000000 ____D () C:\Users\Julian\AppData\Local\NVIDIA
2014-08-02 23:27 - 2013-03-13 22:50 - 00082768 _____ () C:\Users\Julian\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-02 23:27 - 2013-03-13 22:50 - 00001417 _____ () C:\Users\Julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-08-02 23:27 - 2013-03-13 22:50 - 00000680 __RSH () C:\Users\Julian\ntuser.pol
2014-08-02 23:15 - 2011-09-06 17:27 - 00082768 _____ () C:\Users\Adrian\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-02 23:14 - 2012-11-20 18:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2014-08-02 23:12 - 2011-09-06 11:51 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-08-02 23:11 - 2011-09-06 11:50 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-08-02 23:00 - 2014-08-02 22:37 - 00000000 ____D () C:\Users\scndAdmin\Documents\Bluetooth Folder
2014-08-02 22:59 - 2014-08-02 22:59 - 00000000 ____D () C:\Users\scndAdmin\Desktop\Neuer Ordner
2014-08-02 22:54 - 2014-08-02 22:54 - 00000000 ____D () C:\Users\scndAdmin\AppData\Roaming\MotioninJoy
2014-08-02 22:53 - 2014-08-02 22:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MotioninJoy
2014-08-02 22:53 - 2014-08-02 22:53 - 00000000 ____D () C:\Program Files\MotioninJoy
2014-08-02 22:52 - 2014-08-02 22:52 - 00000000 ____D () C:\Users\Public\Documents\Atheros
2014-08-02 22:46 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-08-02 22:43 - 2009-07-14 06:45 - 00339008 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-02 22:40 - 2012-05-05 15:12 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-08-02 22:37 - 2014-08-02 22:37 - 00000000 ____D () C:\Users\scndAdmin\AppData\Local\BMExplorer
2014-08-02 22:37 - 2013-04-21 22:54 - 00082768 _____ () C:\Users\scndAdmin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-02 22:16 - 2013-04-16 12:00 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung Printers
2014-08-02 22:05 - 2014-08-02 22:05 - 00008068 _____ () C:\Users\scndAdmin\AppData\Local\CleanupUninstall.txt
2014-08-02 22:05 - 2013-05-15 20:41 - 00000000 ____D () C:\Users\scndAdmin\AppData\Local\Razer
2014-08-02 22:05 - 2011-09-07 13:05 - 00000000 ____D () C:\ProgramData\Razer
2014-08-02 22:05 - 2011-09-07 13:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer
2014-08-02 21:36 - 2014-05-29 15:43 - 00000000 ____D () C:\Users\scndAdmin\AppData\Local\Nvidia Corporation
2014-08-02 21:18 - 2014-08-02 21:18 - 00000000 ____D () C:\Users\scndAdmin\AppData\Roaming\WinRAR
2014-08-02 21:18 - 2014-08-02 21:18 - 00000000 ____D () C:\Users\scndAdmin\AppData\Local\BetterDS3
2014-08-02 20:18 - 2013-04-22 18:43 - 00000000 ____D () C:\Users\scndAdmin\AppData\Local\Mozilla
2014-08-02 20:16 - 2014-08-02 20:16 - 00000000 ____D () C:\Users\scndAdmin\AppData\Roaming\de.devolo.dLAN.Cockpit
2014-08-02 20:16 - 2013-04-22 18:42 - 00000680 __RSH () C:\Users\scndAdmin\ntuser.pol
2014-08-02 19:51 - 2014-08-02 19:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech
2014-08-02 19:51 - 2014-08-02 19:51 - 00000000 ____D () C:\ProgramData\LogiShrd
2014-08-02 19:50 - 2014-08-02 19:50 - 00000000 ____D () C:\Program Files\Common Files\LogiShrd
2014-08-02 19:46 - 2014-08-02 19:46 - 00000000 __SHD () C:\Users\Adrian\AppData\Local\EmieUserList
2014-08-02 19:46 - 2014-08-02 19:46 - 00000000 __SHD () C:\Users\Adrian\AppData\Local\EmieSiteList
2014-08-02 13:45 - 2014-08-02 13:45 - 00000000 ____D () C:\Users\Adrian\AppData\Local\NVIDIA Corporation
2014-08-02 13:45 - 2014-08-02 13:45 - 00000000 ____D () C:\Users\Adrian\AppData\Local\NVIDIA
2014-08-02 13:45 - 2011-09-06 17:27 - 00001330 __RSH () C:\Users\Adrian\ntuser.pol
2014-08-02 13:45 - 2011-09-06 17:27 - 00000000 ____D () C:\Users\Adrian
2014-07-30 12:13 - 2014-05-29 15:41 - 00000000 ____D () C:\Users\User\AppData\Local\NVIDIA
2014-07-28 21:58 - 2014-07-28 21:58 - 00002059 _____ () C:\Users\User\Desktop\autoexec (orig).cfg
2014-07-28 21:58 - 2014-07-28 16:14 - 00002059 _____ () C:\Users\User\Desktop\autoexec.cfg
2014-07-28 21:57 - 2014-07-28 15:45 - 00001013 _____ () C:\Users\User\Desktop\Neues Textdokument (3).txt
2014-07-28 20:35 - 2014-07-28 21:58 - 00010880 _____ () C:\Users\User\Desktop\config (orig).cfg
2014-07-28 12:31 - 2012-02-09 13:07 - 00000000 ____D () C:\Users\User\AppData\Roaming\TS3Client
2014-07-28 12:22 - 2012-02-08 18:37 - 00000000 ____D () C:\Users\User\AppData\Local\TeamSpeak 3 Client
2014-07-27 15:08 - 2014-07-28 16:14 - 00010179 _____ () C:\Users\User\Desktop\config.cfg
2014-07-25 15:50 - 2014-08-02 21:36 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2014-07-25 15:50 - 2014-08-02 21:36 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2014-07-25 15:50 - 2014-05-29 15:41 - 01283136 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2014-07-25 15:50 - 2014-05-29 15:41 - 01126480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2014-07-24 15:44 - 2012-03-31 20:56 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-24 15:44 - 2011-09-06 11:48 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-24 15:43 - 2012-05-09 23:16 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-07-24 15:43 - 2012-05-09 23:16 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-07-24 15:43 - 2011-04-12 09:55 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-24 15:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-24 15:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-07-24 15:34 - 2013-07-23 22:07 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-24 15:33 - 2011-09-05 13:54 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-24 15:32 - 2012-05-09 23:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-07-24 15:23 - 2014-07-24 15:23 - 00000000 ____D () C:\Users\User\AppData\Roaming\de.devolo.dLAN.Cockpit
2014-07-18 14:19 - 2014-08-04 20:30 - 00221184 _____ (CACE Technologies) C:\Windows\SysWOW64\devolopcap.dll
2014-07-18 14:19 - 2014-08-04 20:30 - 00081920 _____ (CACE Technologies) C:\Windows\SysWOW64\devolopacket.dll
2014-07-18 14:19 - 2014-08-04 20:30 - 00034048 _____ (CACE Technologies) C:\Windows\SysWOW64\Drivers\npf_devolo.sys
Some content of TEMP:
====================
C:\Users\Julian\AppData\Local\temp\Quarantine.exe
C:\Users\scndAdmin\AppData\Local\temp\install_flashplayer14x32au_mssd_aaa_aih.exe
C:\Users\scndAdmin\AppData\Local\temp\nv3DVStreaming.dll
C:\Users\scndAdmin\AppData\Local\temp\nvSCPAPI.dll
C:\Users\scndAdmin\AppData\Local\temp\nvStereoApiI.dll
C:\Users\scndAdmin\AppData\Local\temp\nvStInst.exe
C:\Users\User\AppData\Local\temp\eauninstall.exe
C:\Users\User\AppData\Local\temp\The Battle for Middle-earth_uninst.exe
C:\Users\User\AppData\Local\temp\uninst1.exe
C:\Users\User\AppData\Local\temp\uninst2.exe
C:\Users\User\AppData\Local\temp\unwise.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-08-02 14:05
==================== End Of Log ============================
Ich hoffe es ist alles soweit richtig ausgeführt! Danke schonmal für deine Mühen! lg |
|
05.08.2014, 18:17
| #9 |
| /// the machine /// TB-Ausbilder | Babylon.A , Incredibar.A , PriceGong, Spigot, Dealply & Co in C:\Users\...\AppData\Roaming\ Revo Uninstaller - Download - Filepony damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren. Dann: https://support.mozilla.org/de/kb/fi...einfach-loesen Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop. Schließe nun alle offenen Programme und trenne Dich von dem Internet. Doppelklick auf die TFC.exe und drücke auf Start. Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen. Frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
05.08.2014, 19:58
| #10 |
| | Babylon.A , Incredibar.A , PriceGong, Spigot, Dealply & Co in C:\Users\...\AppData\Roaming\ Guten Abend, die Schritte wurden wie beschrieben durchgeführt. Hier der FRST Log FRST.txt FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-08-2014
Ran by Julian (administrator) on USER-PC on 05-08-2014 20:35:10
Running from C:\Users\Julian\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(devolo AG) D:\Programme\devolo\dlan\devolonetsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Windows\System32\userinit.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_x64.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(FNet Co., Ltd.) C:\Program Files (x86)\XFastUsb\XFastUsb.exe
() C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe
(Razer USA Ltd.) C:\Program Files (x86)\Razer\Lycosa\razerhid.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Razer Inc.) C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe
() C:\Program Files (x86)\Razer\Lycosa\razertra.exe
() C:\Program Files (x86)\Razer\DeathAdder\vdDaemon.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Panda Security) C:\Program Files (x86)\Panda USB Vaccine\USBVaccine.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [615584 2011-03-01] (Atheros Communications)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [379552 2011-03-01] (Atheros Commnucations)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2403104 2014-07-25] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-05] (Intel Corporation)
HKLM-x32\...\Run: [XFastUsb] => C:\Program Files (x86)\XFastUsb\XFastUsb.exe [4942336 2011-09-05] (FNet Co., Ltd.)
HKLM-x32\...\Run: [DeathAdder] => C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe [248320 2011-03-21] ()
HKLM-x32\...\Run: [Lycosa] => C:\Program Files (x86)\Razer\Lycosa\razerhid.exe [238592 2010-04-13] (Razer USA Ltd.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-11] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-82016817-340743653-2786680247-1007\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-82016817-340743653-2786680247-1007\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [166568 2014-07-02] (NVIDIA Corporation)
AppInit_DLLs: , C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [166568 2014-07-02] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [146480 2014-07-02] (NVIDIA Corporation)
Startup: C:\Users\Adrian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> D:\Programme\OpenOffice\program\quickstart.exe ()
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet Pro 8600.lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet Pro 8600.lnk -> C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
BootExecute:
GroupPolicyUsers\S-1-5-21-82016817-340743653-2786680247-1002\User: Group Policy restriction detected <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\u87ym3vs.default-1407263448171
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 -> C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=1.118.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=1.122.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [76448 2011-03-01] (Atheros Commnucations) [File not signed]
R2 DevoloNetworkService; D:\Programme\devolo\dlan\devolonetsvc.exe [3645432 2014-07-18] (devolo AG)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720608 2014-07-25] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18956064 2014-07-25] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-04-21] ()
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
S2 SetupARService; C:\Program Files (x86)\Realtek\Audio\SetupAfterRebootService.exe [24576 2011-12-16] (Realtek Semiconductor.) [File not signed]
S4 WireHelpSvc; C:\Program Files\Common Files\WireHelpSvc.exe [168864 2011-11-28] ()
S4 FirebirdServerMAGIXInstance; C:\Program Files (x86)\MAGIX\Common\Database\bin\fbserver.exe [X]
S4 UPnPService; C:\Program Files (x86)\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 ALSysIO; No ImagePath
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 bulkadi; C:\Windows\System32\DRIVERS\bulkrazer_x64.sys [25088 2011-02-09] (Windows (R) Codename Longhorn DDK provider)
R3 ESLvnic1; C:\Windows\System32\DRIVERS\ESLvnic.sys [25528 2011-11-28] (Turtle Entertainment GmbH)
R2 ESLWireAC; C:\Windows\system32\drivers\ESLWireACD.sys [147472 2011-11-28] (<Turtle Entertainment>)
S3 FNETTBOH_305; C:\Windows\System32\drivers\FNETTBOH_305.SYS [31808 2011-12-16] (FNet Co., Ltd.)
R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [15936 2011-09-05] (FNet Co., Ltd.)
R3 Lycosa; C:\Windows\System32\drivers\Lycosa.sys [20352 2009-09-30] (Razer USA Ltd.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2014-07-18] (CACE Technologies)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-07-25] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
S1 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2006-07-24] () [File not signed]
R1 UimBus; C:\Windows\System32\DRIVERS\UimBus.sys [102664 2014-01-23] ()
R1 Uim_DEVIM; C:\Windows\System32\DRIVERS\uim_devim.sys [25992 2014-01-23] ()
R1 Uim_IM; C:\Windows\System32\DRIVERS\uim_im.sys [700680 2014-01-23] ()
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 IntcAzAudAddService; system32\drivers\RTKVHD64.sys [X]
S2 SSPORT; \??\C:\Windows\system32\Drivers\SSPORT.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-05 20:35 - 2014-08-05 20:35 - 00013308 _____ () C:\Users\Julian\Desktop\FRST.txt
2014-08-05 20:33 - 2014-08-05 20:33 - 00002412 _____ () C:\Users\Julian\Desktop\Neues Textdokument (3).txt
2014-08-05 20:30 - 2014-08-05 20:30 - 00001155 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-08-05 20:30 - 2014-08-05 20:30 - 00001143 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-08-05 20:30 - 2014-08-05 20:30 - 00000000 ____D () C:\Users\Julian\Desktop\Alte Firefox-Daten
2014-08-05 20:29 - 2014-08-05 20:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-08-05 20:20 - 2014-08-05 20:20 - 00448512 _____ (OldTimer Tools) C:\Users\Julian\Desktop\TFC.exe
2014-08-05 20:20 - 2014-08-05 20:20 - 00000637 _____ () C:\Users\Julian\Desktop\Neues Textdokument (2).txt
2014-08-05 20:19 - 2014-08-05 20:19 - 00001260 _____ () C:\Users\Julian\Desktop\Revo Uninstaller.lnk
2014-08-05 20:19 - 2014-08-05 20:19 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-08-05 20:17 - 2014-08-05 20:18 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Julian\Desktop\revosetup95.exe
2014-08-05 17:16 - 2014-08-05 17:17 - 00000000 ____D () C:\Windows\rescache
2014-08-05 13:34 - 2014-08-05 13:35 - 00000115 _____ () C:\Users\User\Desktop\TB Link.txt
2014-08-05 13:25 - 2014-08-05 13:26 - 00000000 ____D () C:\Users\Julian\Desktop\Logs050814
2014-08-05 13:02 - 2014-08-05 13:02 - 02094080 _____ (Farbar) C:\Users\Julian\Desktop\FRST64.exe
2014-08-04 22:12 - 2014-08-04 22:12 - 00000000 ____D () C:\Users\Julian\Documents\FIFA 13
2014-08-04 22:12 - 2014-08-04 22:12 - 00000000 ____D () C:\Users\Julian\AppData\Roaming\Origin
2014-08-04 22:12 - 2014-08-04 22:12 - 00000000 ____D () C:\Users\Julian\AppData\Local\Origin
2014-08-04 22:12 - 2014-08-04 22:12 - 00000000 ____D () C:\Program Files (x86)\Origin Games
2014-08-04 21:17 - 2014-08-04 21:17 - 00000000 ____D () C:\Users\Julian\AppData\Local\Apple
2014-08-04 20:36 - 2014-08-04 20:36 - 00002371 _____ () C:\Users\Public\Desktop\Paragon Backup & Recovery™ 2014 Free.lnk
2014-08-04 20:36 - 2014-08-04 20:36 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_blockmounter_01_09_00.Wdf
2014-08-04 20:36 - 2014-08-04 20:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paragon Backup & Recovery™ 2014 Free
2014-08-04 20:35 - 2014-08-04 20:35 - 00000000 ____D () C:\Users\Julian\AppData\Local\Downloaded Installations
2014-08-04 20:35 - 2014-08-04 20:35 - 00000000 ____D () C:\Program Files\Paragon Software
2014-08-04 20:34 - 2014-08-04 20:34 - 00000000 ____D () C:\Users\Julian\Desktop\Maintainance
2014-08-04 20:30 - 2014-07-18 14:19 - 00221184 _____ (CACE Technologies) C:\Windows\SysWOW64\devolopcap.dll
2014-08-04 20:30 - 2014-07-18 14:19 - 00081920 _____ (CACE Technologies) C:\Windows\SysWOW64\devolopacket.dll
2014-08-04 20:30 - 2014-07-18 14:19 - 00034048 _____ (CACE Technologies) C:\Windows\SysWOW64\Drivers\npf_devolo.sys
2014-08-04 18:15 - 2014-08-04 18:15 - 00000000 ____D () C:\Users\Julian\AppData\Roaming\de.devolo.dLAN.Cockpit
2014-08-04 18:07 - 2014-08-04 18:07 - 00000178 _____ () C:\Users\User\Desktop\TB Update.txt
2014-08-04 17:55 - 2014-08-04 18:00 - 00000291 _____ () C:\Users\Julian\Desktop\Anleitungen.txt
2014-08-04 14:39 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2014-08-04 14:39 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2014-08-04 13:16 - 2014-08-04 14:44 - 00001126 _____ () C:\Users\User\Desktop\Neues Textdokument (7).txt
2014-08-04 12:58 - 2014-08-04 13:09 - 00000351 _____ () C:\Users\User\Desktop\Neues Textdokument (6).txt
2014-08-04 12:52 - 2014-01-09 04:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-08-04 12:52 - 2014-01-04 00:44 - 06574592 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-08-03 23:20 - 2014-08-03 23:20 - 00000000 ____D () C:\Users\Julian\AppData\Local\Razer_Inc
2014-08-03 23:19 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2014-08-03 23:19 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2014-08-03 23:19 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2014-08-03 23:19 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2014-08-03 23:19 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2014-08-03 23:19 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-08-03 23:19 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2014-08-03 23:19 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2014-08-03 23:19 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2014-08-03 23:19 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2014-08-03 23:19 - 2013-10-02 02:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2014-08-03 23:19 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2014-08-03 23:19 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-08-03 23:19 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-08-03 23:19 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2014-08-03 23:19 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-08-03 23:18 - 2013-09-25 04:23 - 01030144 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-08-03 23:18 - 2013-09-25 03:57 - 00792576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-08-03 22:19 - 2014-08-04 17:20 - 00001128 _____ () C:\Users\Julian\Desktop\Neues Textdokument.txt
2014-08-03 21:37 - 2014-08-05 20:34 - 00013898 _____ () C:\Windows\PFRO.log
2014-08-03 21:37 - 2014-08-05 20:34 - 00003520 _____ () C:\Windows\setupact.log
2014-08-03 21:37 - 2014-08-03 21:37 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-03 20:27 - 2014-08-03 20:27 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-03 20:27 - 2014-08-03 20:27 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-03 20:27 - 2014-08-03 20:27 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-03 20:27 - 2014-08-03 20:27 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-03 20:27 - 2014-08-03 20:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-08-03 20:25 - 2014-08-04 20:22 - 00000000 ____D () C:\Users\Julian\AppData\Local\CrashDumps
2014-08-03 19:58 - 2014-08-03 19:58 - 00002774 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-08-03 19:58 - 2014-08-03 19:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-08-03 19:58 - 2014-08-03 19:58 - 00000000 ____D () C:\Program Files\CCleaner
2014-08-03 19:51 - 2014-08-03 19:51 - 00003072 _____ () C:\Windows\System32\Tasks\PandaUSBVaccine
2014-08-03 19:51 - 2014-08-03 19:51 - 00000000 ____D () C:\ProgramData\Panda Security
2014-08-03 19:51 - 2014-08-03 19:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-08-03 19:51 - 2014-08-03 19:51 - 00000000 ____D () C:\Program Files (x86)\Panda USB Vaccine
2014-08-03 19:08 - 2014-08-05 10:38 - 00000000 ____D () C:\AdwCleaner
2014-08-03 19:05 - 2014-08-03 23:06 - 00001065 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
2014-08-03 19:05 - 2014-08-03 19:05 - 00000000 ____D () C:\Users\Julian\AppData\Local\Secunia PSI
2014-08-03 19:05 - 2014-08-03 19:05 - 00000000 ____D () C:\Program Files (x86)\Secunia
2014-08-03 18:32 - 2014-08-05 20:35 - 00000000 ____D () C:\Users\Julian\Desktop\Sec
2014-08-03 18:20 - 2014-08-03 18:20 - 00000000 __SHD () C:\Users\Julian\AppData\Local\EmieUserList
2014-08-03 18:20 - 2014-08-03 18:20 - 00000000 __SHD () C:\Users\Julian\AppData\Local\EmieSiteList
2014-08-03 18:06 - 2014-08-05 20:35 - 00000000 ____D () C:\FRST
2014-08-03 17:52 - 2014-08-04 17:08 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-03 17:49 - 2014-08-03 17:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-08-03 17:49 - 2014-08-03 17:49 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-08-03 17:49 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-03 17:49 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-03 17:46 - 2014-08-03 17:49 - 00000000 ____D () C:\Users\Julian\AppData\Roaming\Malwarebytes
2014-08-03 09:34 - 2014-08-03 09:34 - 00000809 _____ () C:\Users\Adrian\Desktop\FUSSBALL MANAGER 13.lnk
2014-08-02 23:58 - 2014-08-02 23:58 - 00000000 ____D () C:\Users\Adrian\Desktop\Neuer Ordner
2014-08-02 23:58 - 2013-05-14 20:56 - 00000847 _____ () C:\Users\Adrian\Desktop\FIFA 13.lnk
2014-08-02 23:43 - 2014-08-02 23:46 - 00000350 _____ () C:\Users\Adrian\Desktop\Hallo Adrian.txt
2014-08-02 23:37 - 2013-05-10 11:57 - 01661440 _____ (Slackerhome Productions) C:\Users\User\Desktop\Better DS3.exe
2014-08-02 23:31 - 2013-04-20 18:18 - 00000000 _____ () C:\Users\User\Desktop\Neues Textdokument (5).txt
2014-08-02 23:30 - 2013-03-13 23:11 - 00000513 _____ () C:\Users\User\Desktop\Programme und Funktionen - Verknüpfung.lnk
2014-08-02 23:30 - 2013-03-13 22:56 - 00000493 _____ () C:\Users\User\Desktop\Windows Update - Verknüpfung.lnk
2014-08-02 23:30 - 2013-03-13 22:56 - 00000493 _____ () C:\Users\User\Desktop\Wartungscenter - Verknüpfung.lnk
2014-08-02 23:29 - 2013-04-20 18:18 - 00000000 _____ () C:\Users\User\Desktop\Neues Textdokument (4).txt
2014-08-02 23:29 - 2013-02-20 19:01 - 00002117 _____ () C:\Users\User\Desktop\Microsoft Security Essentials.lnk
2014-08-02 23:27 - 2014-08-02 23:28 - 00000000 ____D () C:\Users\Julian\AppData\Local\NVIDIA Corporation
2014-08-02 23:27 - 2014-08-02 23:27 - 00000000 ____D () C:\Users\Julian\AppData\Local\NVIDIA
2014-08-02 23:17 - 2014-08-04 21:49 - 00000000 ____D () C:\Users\Adrian\AppData\Local\BetterDS3
2014-08-02 23:16 - 2013-05-10 11:57 - 01661440 _____ (Slackerhome Productions) C:\Users\Adrian\Desktop\Better DS3.exe
2014-08-02 23:12 - 2014-07-02 19:44 - 00609240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-08-02 23:10 - 2014-07-02 22:48 - 31512520 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 24196896 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 22994208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 17555104 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 15294296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 13922752 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 13835208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 12866008 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-08-02 23:10 - 2014-07-02 22:48 - 11283344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 11222048 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 04247000 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 03989960 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 01890080 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434052.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 01539928 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434052.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 00944928 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 00907096 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 00903624 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 00869152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 00846832 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 00354016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2014-08-02 23:10 - 2014-07-02 22:48 - 00166568 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2014-08-02 22:59 - 2014-08-02 22:59 - 00000000 ____D () C:\Users\scndAdmin\Desktop\Neuer Ordner
2014-08-02 22:54 - 2014-08-02 22:54 - 00000000 ____D () C:\Users\scndAdmin\AppData\Roaming\MotioninJoy
2014-08-02 22:53 - 2014-08-02 22:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MotioninJoy
2014-08-02 22:53 - 2014-08-02 22:53 - 00000000 ____D () C:\Program Files\MotioninJoy
2014-08-02 22:53 - 2011-12-07 19:42 - 00328712 _____ (Logitech Inc.) C:\Windows\system32\MijFrc.dll
2014-08-02 22:52 - 2014-08-02 22:52 - 00000000 ____D () C:\Users\Public\Documents\Atheros
2014-08-02 22:37 - 2014-08-02 23:00 - 00000000 ____D () C:\Users\scndAdmin\Documents\Bluetooth Folder
2014-08-02 22:37 - 2014-08-02 22:37 - 00000000 ____D () C:\Users\scndAdmin\AppData\Local\BMExplorer
2014-08-02 22:05 - 2014-08-02 22:05 - 00008068 _____ () C:\Users\scndAdmin\AppData\Local\CleanupUninstall.txt
2014-08-02 21:36 - 2014-07-25 15:50 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2014-08-02 21:36 - 2014-07-25 15:50 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2014-08-02 21:18 - 2014-08-02 21:18 - 00000000 ____D () C:\Users\scndAdmin\AppData\Roaming\WinRAR
2014-08-02 21:18 - 2014-08-02 21:18 - 00000000 ____D () C:\Users\scndAdmin\AppData\Local\BetterDS3
2014-08-02 21:18 - 2013-05-10 11:57 - 01661440 _____ (Slackerhome Productions) C:\Users\scndAdmin\Desktop\Better DS3.exe
2014-08-02 20:16 - 2014-08-02 20:16 - 00000000 ____D () C:\Users\scndAdmin\AppData\Roaming\de.devolo.dLAN.Cockpit
2014-08-02 19:51 - 2014-08-02 19:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech
2014-08-02 19:51 - 2014-08-02 19:51 - 00000000 ____D () C:\ProgramData\LogiShrd
2014-08-02 19:50 - 2014-08-02 19:50 - 00000000 ____D () C:\Program Files\Common Files\LogiShrd
2014-08-02 19:46 - 2014-08-02 19:46 - 00000000 __SHD () C:\Users\Adrian\AppData\Local\EmieUserList
2014-08-02 19:46 - 2014-08-02 19:46 - 00000000 __SHD () C:\Users\Adrian\AppData\Local\EmieSiteList
2014-08-02 13:45 - 2014-08-02 13:45 - 00000000 ____D () C:\Users\Adrian\AppData\Local\NVIDIA Corporation
2014-08-02 13:45 - 2014-08-02 13:45 - 00000000 ____D () C:\Users\Adrian\AppData\Local\NVIDIA
2014-08-02 11:40 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-02 11:40 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-02 11:40 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-08-02 11:40 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-02 11:40 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-02 11:40 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-02 11:40 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-08-02 11:40 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-02 11:40 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-02 11:40 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-08-02 11:40 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-02 11:40 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-08-02 11:40 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-08-02 11:40 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-07-28 21:58 - 2014-07-28 21:58 - 00002059 _____ () C:\Users\User\Desktop\autoexec (orig).cfg
2014-07-28 21:58 - 2014-07-28 20:35 - 00010880 _____ () C:\Users\User\Desktop\config (orig).cfg
2014-07-28 16:14 - 2014-07-28 21:58 - 00002059 _____ () C:\Users\User\Desktop\autoexec.cfg
2014-07-28 16:14 - 2014-07-27 15:08 - 00010179 _____ () C:\Users\User\Desktop\config.cfg
2014-07-28 15:45 - 2014-07-28 21:57 - 00001013 _____ () C:\Users\User\Desktop\Neues Textdokument (3).txt
2014-07-24 15:23 - 2014-07-24 15:23 - 00000000 ____D () C:\Users\User\AppData\Roaming\de.devolo.dLAN.Cockpit
2014-07-24 15:20 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-24 15:20 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-24 15:20 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-24 15:20 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-24 15:20 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-24 15:20 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-24 15:20 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-24 15:20 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-24 15:20 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-24 15:20 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-24 15:20 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-24 15:20 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-24 15:20 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-24 15:20 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-24 15:20 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-24 15:20 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-24 15:20 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-24 15:20 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-24 15:20 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-24 15:20 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-24 15:20 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-24 15:20 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-24 15:20 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-24 15:20 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-24 15:20 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-24 15:20 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-24 15:20 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-24 15:20 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-24 15:20 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-24 15:20 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-24 15:20 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-24 15:20 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-24 15:20 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-24 15:20 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-24 15:20 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-24 15:20 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-24 15:20 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-24 15:20 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-24 15:20 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-24 15:20 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-24 15:20 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-24 15:20 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-24 15:20 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-24 15:20 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-24 15:20 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-24 15:20 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-24 15:20 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-24 15:20 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-24 15:20 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-24 15:20 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-24 15:20 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-24 15:20 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-24 15:20 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-24 15:20 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-24 15:20 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-24 15:20 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-24 15:20 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-24 15:20 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-24 15:20 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-24 15:20 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-24 15:20 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-24 15:20 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-24 15:20 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-24 15:20 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-24 15:20 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-24 15:20 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-24 15:20 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-24 15:20 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-24 15:20 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-24 15:20 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-24 15:20 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-24 15:20 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-24 15:20 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-24 15:20 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-24 15:20 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-24 15:20 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-24 15:18 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-24 15:18 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-24 15:18 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-05 20:35 - 2014-08-05 20:35 - 00013308 _____ () C:\Users\Julian\Desktop\FRST.txt
2014-08-05 20:35 - 2014-08-03 18:32 - 00000000 ____D () C:\Users\Julian\Desktop\Sec
2014-08-05 20:35 - 2014-08-03 18:06 - 00000000 ____D () C:\FRST
2014-08-05 20:34 - 2014-08-03 21:37 - 00013898 _____ () C:\Windows\PFRO.log
2014-08-05 20:34 - 2014-08-03 21:37 - 00003520 _____ () C:\Windows\setupact.log
2014-08-05 20:34 - 2012-07-12 08:36 - 00000035 _____ () C:\Users\Public\Documents\AtherosServiceConfig.ini
2014-08-05 20:34 - 2011-09-06 11:51 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-08-05 20:34 - 2011-09-05 13:10 - 02010978 _____ () C:\Windows\WindowsUpdate.log
2014-08-05 20:34 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-05 20:33 - 2014-08-05 20:33 - 00002412 _____ () C:\Users\Julian\Desktop\Neues Textdokument (3).txt
2014-08-05 20:30 - 2014-08-05 20:30 - 00001155 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-08-05 20:30 - 2014-08-05 20:30 - 00001143 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-08-05 20:30 - 2014-08-05 20:30 - 00000000 ____D () C:\Users\Julian\Desktop\Alte Firefox-Daten
2014-08-05 20:30 - 2014-08-05 20:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-08-05 20:20 - 2014-08-05 20:20 - 00448512 _____ (OldTimer Tools) C:\Users\Julian\Desktop\TFC.exe
2014-08-05 20:20 - 2014-08-05 20:20 - 00000637 _____ () C:\Users\Julian\Desktop\Neues Textdokument (2).txt
2014-08-05 20:19 - 2014-08-05 20:19 - 00001260 _____ () C:\Users\Julian\Desktop\Revo Uninstaller.lnk
2014-08-05 20:19 - 2014-08-05 20:19 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-08-05 20:18 - 2014-08-05 20:17 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Julian\Desktop\revosetup95.exe
2014-08-05 20:16 - 2011-10-02 19:57 - 00000000 ____D () C:\ProgramData\Origin
2014-08-05 17:28 - 2011-10-02 19:57 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-08-05 17:17 - 2014-08-05 17:16 - 00000000 ____D () C:\Windows\rescache
2014-08-05 13:35 - 2014-08-05 13:34 - 00000115 _____ () C:\Users\User\Desktop\TB Link.txt
2014-08-05 13:26 - 2014-08-05 13:25 - 00000000 ____D () C:\Users\Julian\Desktop\Logs050814
2014-08-05 13:02 - 2014-08-05 13:02 - 02094080 _____ (Farbar) C:\Users\Julian\Desktop\FRST64.exe
2014-08-05 10:48 - 2009-07-14 06:45 - 00021840 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-05 10:48 - 2009-07-14 06:45 - 00021840 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-05 10:47 - 2011-04-12 09:43 - 14114420 _____ () C:\Windows\system32\perfh007.dat
2014-08-05 10:47 - 2011-04-12 09:43 - 04367056 _____ () C:\Windows\system32\perfc007.dat
2014-08-05 10:47 - 2009-07-14 07:13 - 00006292 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-05 10:38 - 2014-08-03 19:08 - 00000000 ____D () C:\AdwCleaner
2014-08-04 23:20 - 2012-01-07 20:53 - 00000000 ____D () C:\Users\Adrian\Documents\FIFA 12
2014-08-04 22:12 - 2014-08-04 22:12 - 00000000 ____D () C:\Users\Julian\Documents\FIFA 13
2014-08-04 22:12 - 2014-08-04 22:12 - 00000000 ____D () C:\Users\Julian\AppData\Roaming\Origin
2014-08-04 22:12 - 2014-08-04 22:12 - 00000000 ____D () C:\Users\Julian\AppData\Local\Origin
2014-08-04 22:12 - 2014-08-04 22:12 - 00000000 ____D () C:\Program Files (x86)\Origin Games
2014-08-04 21:49 - 2014-08-02 23:17 - 00000000 ____D () C:\Users\Adrian\AppData\Local\BetterDS3
2014-08-04 21:40 - 2012-04-25 15:41 - 00000000 ____D () C:\Users\Adrian\AppData\Roaming\Spotify
2014-08-04 21:35 - 2012-04-25 15:42 - 00000000 ____D () C:\Users\Adrian\AppData\Local\Spotify
2014-08-04 21:17 - 2014-08-04 21:17 - 00000000 ____D () C:\Users\Julian\AppData\Local\Apple
2014-08-04 20:36 - 2014-08-04 20:36 - 00002371 _____ () C:\Users\Public\Desktop\Paragon Backup & Recovery™ 2014 Free.lnk
2014-08-04 20:36 - 2014-08-04 20:36 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_blockmounter_01_09_00.Wdf
2014-08-04 20:36 - 2014-08-04 20:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paragon Backup & Recovery™ 2014 Free
2014-08-04 20:35 - 2014-08-04 20:35 - 00000000 ____D () C:\Users\Julian\AppData\Local\Downloaded Installations
2014-08-04 20:35 - 2014-08-04 20:35 - 00000000 ____D () C:\Program Files\Paragon Software
2014-08-04 20:34 - 2014-08-04 20:34 - 00000000 ____D () C:\Users\Julian\Desktop\Maintainance
2014-08-04 20:22 - 2014-08-03 20:25 - 00000000 ____D () C:\Users\Julian\AppData\Local\CrashDumps
2014-08-04 20:18 - 2013-05-13 20:08 - 00000000 ____D () C:\Windows\pss
2014-08-04 18:15 - 2014-08-04 18:15 - 00000000 ____D () C:\Users\Julian\AppData\Roaming\de.devolo.dLAN.Cockpit
2014-08-04 18:07 - 2014-08-04 18:07 - 00000178 _____ () C:\Users\User\Desktop\TB Update.txt
2014-08-04 18:00 - 2014-08-04 17:55 - 00000291 _____ () C:\Users\Julian\Desktop\Anleitungen.txt
2014-08-04 17:20 - 2014-08-03 22:19 - 00001128 _____ () C:\Users\Julian\Desktop\Neues Textdokument.txt
2014-08-04 17:08 - 2014-08-03 17:52 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-04 14:44 - 2014-08-04 13:16 - 00001126 _____ () C:\Users\User\Desktop\Neues Textdokument (7).txt
2014-08-04 13:38 - 2013-03-13 22:50 - 00000000 ____D () C:\Users\Julian
2014-08-04 13:09 - 2014-08-04 12:58 - 00000351 _____ () C:\Users\User\Desktop\Neues Textdokument (6).txt
2014-08-04 12:52 - 2013-03-05 14:34 - 00000000 ____D () C:\Users\User\Desktop\sec
2014-08-03 23:29 - 2011-09-07 13:05 - 00000000 ____D () C:\Program Files (x86)\Razer
2014-08-03 23:20 - 2014-08-03 23:20 - 00000000 ____D () C:\Users\Julian\AppData\Local\Razer_Inc
2014-08-03 23:06 - 2014-08-03 19:05 - 00001065 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
2014-08-03 21:37 - 2014-08-03 21:37 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-03 20:36 - 2011-10-04 15:50 - 00000000 ____D () C:\Windows\Minidump
2014-08-03 20:36 - 2011-09-05 20:01 - 00000000 ____D () C:\Windows\Panther
2014-08-03 20:27 - 2014-08-03 20:27 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-03 20:27 - 2014-08-03 20:27 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-03 20:27 - 2014-08-03 20:27 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-03 20:27 - 2014-08-03 20:27 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-03 20:27 - 2014-08-03 20:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-08-03 20:27 - 2014-05-29 15:29 - 00000000 ____D () C:\ProgramData\Oracle
2014-08-03 20:27 - 2011-11-09 18:44 - 00000000 ____D () C:\Program Files (x86)\Java
2014-08-03 19:58 - 2014-08-03 19:58 - 00002774 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-08-03 19:58 - 2014-08-03 19:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-08-03 19:58 - 2014-08-03 19:58 - 00000000 ____D () C:\Program Files\CCleaner
2014-08-03 19:51 - 2014-08-03 19:51 - 00003072 _____ () C:\Windows\System32\Tasks\PandaUSBVaccine
2014-08-03 19:51 - 2014-08-03 19:51 - 00000000 ____D () C:\ProgramData\Panda Security
2014-08-03 19:51 - 2014-08-03 19:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-08-03 19:51 - 2014-08-03 19:51 - 00000000 ____D () C:\Program Files (x86)\Panda USB Vaccine
2014-08-03 19:05 - 2014-08-03 19:05 - 00000000 ____D () C:\Users\Julian\AppData\Local\Secunia PSI
2014-08-03 19:05 - 2014-08-03 19:05 - 00000000 ____D () C:\Program Files (x86)\Secunia
2014-08-03 18:20 - 2014-08-03 18:20 - 00000000 __SHD () C:\Users\Julian\AppData\Local\EmieUserList
2014-08-03 18:20 - 2014-08-03 18:20 - 00000000 __SHD () C:\Users\Julian\AppData\Local\EmieSiteList
2014-08-03 18:13 - 2013-04-21 22:54 - 00000000 ____D () C:\Users\scndAdmin
2014-08-03 17:49 - 2014-08-03 17:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-08-03 17:49 - 2014-08-03 17:49 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-08-03 17:49 - 2014-08-03 17:46 - 00000000 ____D () C:\Users\Julian\AppData\Roaming\Malwarebytes
2014-08-03 17:49 - 2013-03-01 15:18 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-03 17:44 - 2013-03-13 22:54 - 00000000 ____D () C:\Users\Julian\AppData\Local\Mozilla
2014-08-03 09:34 - 2014-08-03 09:34 - 00000809 _____ () C:\Users\Adrian\Desktop\FUSSBALL MANAGER 13.lnk
2014-08-02 23:58 - 2014-08-02 23:58 - 00000000 ____D () C:\Users\Adrian\Desktop\Neuer Ordner
2014-08-02 23:46 - 2014-08-02 23:43 - 00000350 _____ () C:\Users\Adrian\Desktop\Hallo Adrian.txt
2014-08-02 23:34 - 2011-09-05 13:18 - 00082768 _____ () C:\Users\User\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-02 23:28 - 2014-08-02 23:27 - 00000000 ____D () C:\Users\Julian\AppData\Local\NVIDIA Corporation
2014-08-02 23:27 - 2014-08-02 23:27 - 00000000 ____D () C:\Users\Julian\AppData\Local\NVIDIA
2014-08-02 23:27 - 2013-03-13 22:50 - 00082768 _____ () C:\Users\Julian\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-02 23:27 - 2013-03-13 22:50 - 00001417 _____ () C:\Users\Julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-08-02 23:27 - 2013-03-13 22:50 - 00000680 __RSH () C:\Users\Julian\ntuser.pol
2014-08-02 23:15 - 2011-09-06 17:27 - 00082768 _____ () C:\Users\Adrian\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-02 23:14 - 2012-11-20 18:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2014-08-02 23:12 - 2011-09-06 11:51 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-08-02 23:11 - 2011-09-06 11:50 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-08-02 23:00 - 2014-08-02 22:37 - 00000000 ____D () C:\Users\scndAdmin\Documents\Bluetooth Folder
2014-08-02 22:59 - 2014-08-02 22:59 - 00000000 ____D () C:\Users\scndAdmin\Desktop\Neuer Ordner
2014-08-02 22:54 - 2014-08-02 22:54 - 00000000 ____D () C:\Users\scndAdmin\AppData\Roaming\MotioninJoy
2014-08-02 22:53 - 2014-08-02 22:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MotioninJoy
2014-08-02 22:53 - 2014-08-02 22:53 - 00000000 ____D () C:\Program Files\MotioninJoy
2014-08-02 22:52 - 2014-08-02 22:52 - 00000000 ____D () C:\Users\Public\Documents\Atheros
2014-08-02 22:46 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-08-02 22:43 - 2009-07-14 06:45 - 00339008 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-02 22:37 - 2014-08-02 22:37 - 00000000 ____D () C:\Users\scndAdmin\AppData\Local\BMExplorer
2014-08-02 22:37 - 2013-04-21 22:54 - 00082768 _____ () C:\Users\scndAdmin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-02 22:16 - 2013-04-16 12:00 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung Printers
2014-08-02 22:05 - 2014-08-02 22:05 - 00008068 _____ () C:\Users\scndAdmin\AppData\Local\CleanupUninstall.txt
2014-08-02 22:05 - 2013-05-15 20:41 - 00000000 ____D () C:\Users\scndAdmin\AppData\Local\Razer
2014-08-02 22:05 - 2011-09-07 13:05 - 00000000 ____D () C:\ProgramData\Razer
2014-08-02 22:05 - 2011-09-07 13:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer
2014-08-02 21:36 - 2014-05-29 15:43 - 00000000 ____D () C:\Users\scndAdmin\AppData\Local\Nvidia Corporation
2014-08-02 21:18 - 2014-08-02 21:18 - 00000000 ____D () C:\Users\scndAdmin\AppData\Roaming\WinRAR
2014-08-02 21:18 - 2014-08-02 21:18 - 00000000 ____D () C:\Users\scndAdmin\AppData\Local\BetterDS3
2014-08-02 20:18 - 2013-04-22 18:43 - 00000000 ____D () C:\Users\scndAdmin\AppData\Local\Mozilla
2014-08-02 20:16 - 2014-08-02 20:16 - 00000000 ____D () C:\Users\scndAdmin\AppData\Roaming\de.devolo.dLAN.Cockpit
2014-08-02 20:16 - 2013-04-22 18:42 - 00000680 __RSH () C:\Users\scndAdmin\ntuser.pol
2014-08-02 19:51 - 2014-08-02 19:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech
2014-08-02 19:51 - 2014-08-02 19:51 - 00000000 ____D () C:\ProgramData\LogiShrd
2014-08-02 19:50 - 2014-08-02 19:50 - 00000000 ____D () C:\Program Files\Common Files\LogiShrd
2014-08-02 19:46 - 2014-08-02 19:46 - 00000000 __SHD () C:\Users\Adrian\AppData\Local\EmieUserList
2014-08-02 19:46 - 2014-08-02 19:46 - 00000000 __SHD () C:\Users\Adrian\AppData\Local\EmieSiteList
2014-08-02 13:45 - 2014-08-02 13:45 - 00000000 ____D () C:\Users\Adrian\AppData\Local\NVIDIA Corporation
2014-08-02 13:45 - 2014-08-02 13:45 - 00000000 ____D () C:\Users\Adrian\AppData\Local\NVIDIA
2014-08-02 13:45 - 2011-09-06 17:27 - 00001330 __RSH () C:\Users\Adrian\ntuser.pol
2014-08-02 13:45 - 2011-09-06 17:27 - 00000000 ____D () C:\Users\Adrian
2014-07-30 12:13 - 2014-05-29 15:41 - 00000000 ____D () C:\Users\User\AppData\Local\NVIDIA
2014-07-28 21:58 - 2014-07-28 21:58 - 00002059 _____ () C:\Users\User\Desktop\autoexec (orig).cfg
2014-07-28 21:58 - 2014-07-28 16:14 - 00002059 _____ () C:\Users\User\Desktop\autoexec.cfg
2014-07-28 21:57 - 2014-07-28 15:45 - 00001013 _____ () C:\Users\User\Desktop\Neues Textdokument (3).txt
2014-07-28 20:35 - 2014-07-28 21:58 - 00010880 _____ () C:\Users\User\Desktop\config (orig).cfg
2014-07-28 12:31 - 2012-02-09 13:07 - 00000000 ____D () C:\Users\User\AppData\Roaming\TS3Client
2014-07-28 12:22 - 2012-02-08 18:37 - 00000000 ____D () C:\Users\User\AppData\Local\TeamSpeak 3 Client
2014-07-27 15:08 - 2014-07-28 16:14 - 00010179 _____ () C:\Users\User\Desktop\config.cfg
2014-07-25 15:50 - 2014-08-02 21:36 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2014-07-25 15:50 - 2014-08-02 21:36 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2014-07-25 15:50 - 2014-05-29 15:41 - 01283136 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2014-07-25 15:50 - 2014-05-29 15:41 - 01126480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2014-07-24 15:44 - 2012-03-31 20:56 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-24 15:44 - 2011-09-06 11:48 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-24 15:43 - 2012-05-09 23:16 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-07-24 15:43 - 2012-05-09 23:16 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-07-24 15:43 - 2011-04-12 09:55 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-24 15:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-24 15:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-07-24 15:34 - 2013-07-23 22:07 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-24 15:33 - 2011-09-05 13:54 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-24 15:32 - 2012-05-09 23:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-07-24 15:23 - 2014-07-24 15:23 - 00000000 ____D () C:\Users\User\AppData\Roaming\de.devolo.dLAN.Cockpit
2014-07-18 14:19 - 2014-08-04 20:30 - 00221184 _____ (CACE Technologies) C:\Windows\SysWOW64\devolopcap.dll
2014-07-18 14:19 - 2014-08-04 20:30 - 00081920 _____ (CACE Technologies) C:\Windows\SysWOW64\devolopacket.dll
2014-07-18 14:19 - 2014-08-04 20:30 - 00034048 _____ (CACE Technologies) C:\Windows\SysWOW64\Drivers\npf_devolo.sys
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-08-02 14:05
==================== End Of Log ============================
Soweit keine Probleme, bis auf das das Fifa 13 meines Bruders nicht mehr läuft, Fifa 12 hingegen schon. Seltsam, aber nichts was durch eine Neuinstallation des Spiels nicht behoben werden kann, denke ich. Wenn sich das nicht als hilfreich erweist melde ich mich wieder! Ich möchte mich noch einmal herzlich bei dir für deine Mühen und deinen zeitlichen Aufwand bedanken, den du mir entgegengebracht hast! Auf hoffentlich nicht sobaldiges Wiederhören  Liebe Grüße! |
|
06.08.2014, 15:22
| #11 |
| /// the machine /// TB-Ausbilder | Babylon.A , Incredibar.A , PriceGong, Spigot, Dealply & Co in C:\Users\...\AppData\Roaming\ Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Babylon.A , Incredibar.A , PriceGong, Spigot, Dealply & Co in C:\Users\...\AppData\Roaming\ |
| bundleinstaller, fehlermeldung, gmer.log, incredibar.a, pup.bprotector, pup.optional.babylon.a, pup.optional.bprotector.a, pup.optional.browsemngr.a, pup.optional.bundleinstaller.a, pup.optional.conduit.a, pup.optional.datamngr.a, pup.optional.dealply.a, pup.optional.incredibar, pup.optional.incredibar.a, pup.optional.installmonetizer, pup.optional.mystartsearch.a, pup.optional.opencandy, pup.optional.perion.a, pup.optional.pricegong.a, pup.optional.softonic.a, pup.optional.spigot.a, pup.optional.startpage.a, win32/dealply.j, win32/toolbar.conduit.b, win32/toolbar.conduit.p, win32/toolbar.perion.a |
Linear-Darstellung
