|
Log-Analyse und Auswertung: viel Werbung,unglaublich langsamer RechnerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
27.08.2014, 19:39 | #1 |
| viel Werbung,unglaublich langsamer Rechner Guten Tag, nachdem ich meinen eigenen PC hier schon hab reinigen lassen, nun der Nächste. Auf diesem Laptop ist unglaublich viel Müll,Werbung etc drauf. Alles wasangeklickt wird, öffnet gleich 1-3 neue Fenster. Es darf alles runter was nicht drauf gehört. Die wichtigen Dateien sind gesichert. Die Anleitung bin ich durchgegangen. Problematisch ist allerdings jetzt der Viren Scanner, denn der behauptet ich hab keine Berechtigung mehr in anzuschalten. Was tun? Anbei die Auswertungen Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1) Log created at 20:01 on 27/08/2014 (Anki) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-08-2014 Ran by Anki (administrator) on ANKIS-LAPTOP on 27-08-2014 20:03:24 Running from C:\Users\Anki\Desktop Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTDevSrv.exe (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe () C:\Windows\System32\dmwu.exe (Eastman Kodak Company) D:\Programme\Kodak\AiO\Center\EKAiOHostService.exe (Eastman Kodak Company) D:\Programme\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe (FUJITSU LIMITED) C:\Program Files\Fujitsu\Plugfree NETWORK\PFNService.exe (FUJITSU LIMITED) C:\Program Files\Fujitsu\PSUtility\PSUService.exe (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe () C:\Windows\SysWOW64\mjcm\dnkt.exe () C:\Windows\System32\tprb\dnkt.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (FUJITSU LIMITED) C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe (FUJITSU LIMITED) C:\Program Files\Fujitsu\FDM7\FdmDaemon.exe (FUJITSU LIMITED) C:\Program Files\Fujitsu\PSUtility\TrayManager.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Sonix) C:\Windows\vsnp2uvc.exe (FUJITSU LIMITED) C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe (FUJITSU LIMITED) C:\Program Files\Fujitsu\Application Panel\BtnHnd.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Creative Technology Ltd) C:\Program Files (x86)\Creative\Software Update 3\SoftAuto.exe (Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe (Google) C:\Program Files (x86)\Google\Google Calendar Sync\GoogleCalendarSync.exe (Dropbox, Inc.) C:\Users\Anki\AppData\Roaming\Dropbox\bin\Dropbox.exe (Microsoft Corporation) D:\Programme\Office 2010\Office14\ONENOTEM.EXE (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (FUJITSU LIMITED) C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe (Fujitsu Technology Solutions) C:\Fujitsu\Programs\DeskUpdate\DeskUpdateNotifier.exe (CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamTray.exe (SweetIM Technologies Ltd.) C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe (Eastman Kodak Company) D:\Programme\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe (Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe (Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (FUJITSU LIMITED) C:\Program Files\Fujitsu\Plugfree NETWORK\PFNetDm.exe (FUJITSU LIMITED) C:\Program Files\Fujitsu\Plugfree NETWORK\PFNTray.exe (Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe (Akamai Technologies, Inc.) C:\Users\Anki\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.) C:\Users\Anki\AppData\Local\Akamai\netsession_win.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Mozilla Corporation) D:\Programme\Mozilla\firefox.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1886504 2009-11-19] (Synaptics Incorporated) HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp HKLM\...\Run: [LoadFUJ02E3] => C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe [45680 2010-06-08] (FUJITSU LIMITED) HKLM\...\Run: [FDM7] => C:\Program Files\Fujitsu\FDM7\FdmDaemon.exe [164712 2009-11-26] (FUJITSU LIMITED) HKLM\...\Run: [PSUTility] => C:\Program Files\Fujitsu\PSUtility\TrayManager.exe [199528 2010-11-13] (FUJITSU LIMITED) HKLM\...\Run: [PfNet] => C:\Program Files\Fujitsu\Plugfree NETWORK\PfNet.exe [6311424 2010-10-08] (FUJITSU LIMITED) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11663464 2010-12-07] (Realtek Semiconductor) HKLM\...\Run: [IntelWireless] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1933584 2011-01-05] (Intel(R) Corporation) HKLM\...\Run: [snp2uvc] => C:\Windows\vsnp2uvc.exe [662016 2009-08-13] (Sonix) HKLM\...\Run: [LoadFujitsuQuickTouch] => C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe [162416 2010-07-16] (FUJITSU LIMITED) HKLM\...\Run: [LoadBtnHnd] => C:\Program Files\Fujitsu\Application Panel\BtnHnd.exe [21616 2010-07-09] (FUJITSU LIMITED) HKLM\...\Run: [CIS_{81EFDD93-DBBE-415B-BE6E-49B9664E3E82}] => "C:\ProgramData\cis2271.exe" --PostUninstall {81EFDD93-DBBE-415B-BE6E-49B9664E3E82} HKLM-x32\...\Run: [IndicatorUtility] => C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe [48752 2010-09-30] (FUJITSU LIMITED) HKLM-x32\...\Run: [snp2uvc] => C:\Windows\vsnp2uvc.exe [662016 2009-08-13] (Sonix) HKLM-x32\...\Run: [DeskUpdateNotifier] => c:\Fujitsu\Programs\DeskUpdate\DeskUpdateNotifier.exe [97560 2010-10-13] (Fujitsu Technology Solutions) HKLM-x32\...\Run: [UCam_Menu] => C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.) HKLM-x32\...\Run: [YouCam Mirror Tray icon] => C:\Program Files (x86)\CyberLink\YouCam\YouCamTray.exe [162912 2009-07-08] (CyberLink Corp.) HKLM-x32\...\Run: [BCSSync] => D:\Programme\Office 2010\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation) HKLM-x32\...\Run: [SweetIM] => C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe [114992 2012-02-16] (SweetIM Technologies Ltd.) HKLM-x32\...\Run: [EKStatusMonitor] => D:\Programme\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe [2844608 2012-10-15] (Eastman Kodak Company) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [685048 2012-08-03] (Cisco Systems, Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-05] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [Conime] => %windir%\system32\conime.exe HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [161584 2014-08-04] (Avira Operations GmbH & Co. KG) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\.DEFAULT\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-08-07] (Garmin Ltd or its subsidiaries) HKU\.DEFAULT\...\RunOnce: [KodakHomeCenter] => D:\Programme\Kodak\AiO\Center\AiOHomeCenter.exe [2235840 2012-10-19] (Eastman Kodak Company) HKU\S-1-5-21-2552170177-1754437681-1621803140-1001\...\Run: [XSC SIP Client] => "D:\Programme\sipgate X-Lite\sipgateXLite.exe" HKU\S-1-5-21-2552170177-1754437681-1621803140-1001\...\Run: [SoftAuto.exe] => C:\Program Files (x86)\Creative\Software Update 3\SoftAuto.exe [405504 2008-08-13] (Creative Technology Ltd) HKU\S-1-5-21-2552170177-1754437681-1621803140-1001\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2011-09-28] (Google Inc.) HKU\S-1-5-21-2552170177-1754437681-1621803140-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Anki\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.) HKU\S-1-5-21-2552170177-1754437681-1621803140-1001\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-08-07] (Garmin Ltd or its subsidiaries) HKU\S-1-5-21-2552170177-1754437681-1621803140-1001\...\Policies\Explorer: [] HKU\S-1-5-21-2552170177-1754437681-1621803140-1001\...\MountPoints2: {1a87284c-4405-11e1-82c6-bc7737325f68} - F:\AutoRun.exe HKU\S-1-5-21-2552170177-1754437681-1621803140-1001\...\MountPoints2: {ce386820-3c43-11e1-8524-bc7737325f68} - H:\AutoRun.exe HKU\S-1-5-21-2552170177-1754437681-1621803140-1001\...\MountPoints2: {e8f3a3ae-3af1-11e1-9a50-bc7737325f68} - F:\AutoRun.exe HKU\S-1-5-21-2552170177-1754437681-1621803140-1001\...\MountPoints2: {e8f3a3be-3af1-11e1-9a50-bc7737325f68} - F:\AutoRun.exe AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [226920 2010-11-17] (NVIDIA Corporation) AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [192616 2010-11-17] (NVIDIA Corporation) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Google Calendar Sync.lnk ShortcutTarget: Google Calendar Sync.lnk -> C:\Program Files (x86)\Google\Google Calendar Sync\GoogleCalendarSync.exe (Google) Startup: C:\Users\Anki\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Anki\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\Anki\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> D:\Programme\Office 2010\Office14\ONENOTEM.EXE (Microsoft Corporation) Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LaunchCenter.lnk ShortcutTarget: LaunchCenter.lnk -> C:\Program Files\Fujitsu\LaunchCenter\LaunchCenter.exe (Fujitsu Technology Solutions) Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\newreminderdialog.lnk ShortcutTarget: newreminderdialog.lnk -> C:\Program Files\Fujitsu\FujitsuRecovery\NewReminderDialog.exe (Fujitsu Technology Solutions) Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LaunchCenter.lnk ShortcutTarget: LaunchCenter.lnk -> C:\Program Files\Fujitsu\LaunchCenter\LaunchCenter.exe (Fujitsu Technology Solutions) Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\newreminderdialog.lnk ShortcutTarget: newreminderdialog.lnk -> C:\Program Files\Fujitsu\FujitsuRecovery\NewReminderDialog.exe (Fujitsu Technology Solutions) ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 1 (GFS Unread Stub) -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => D:\Programme\Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation) ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 2 (GFS Stub) -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => D:\Programme\Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation) ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 2.5 (GFS Unread Folder) -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => D:\Programme\Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation) ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 3 (GFS Folder) -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => D:\Programme\Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation) ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 4 (GFS Unread Mark) -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => D:\Programme\Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ts.fujitsu.com HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=FTSG&bmod=FTSG SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKCU - DefaultScope {08DCE5A1-D006-4F5F-8452-0AC58EBE6DDC} URL = hxxp://start.funmoods.com/results.php?f=4&a=ddrnw&q={searchTerms} SearchScopes: HKCU - {08DCE5A1-D006-4F5F-8452-0AC58EBE6DDC} URL = hxxp://start.funmoods.com/results.php?f=4&a=ddrnw&q={searchTerms} SearchScopes: HKCU - {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://mysearch.sweetpacks.com?src=6&q={searchTerms}&barid=&&st=23 BHO: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL No File BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> D:\Programme\java\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation) BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> D:\Programme\Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> D:\Programme\Office 2010\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: SweetPacks Browser Helper -> {EEE6C35C-6118-11DC-9C72-001320C79847} -> C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKLM-x32 - SweetPacks Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKCU - No Name - {EEE6C35B-6118-11DC-9C72-001320C79847} - No File Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 Tcpip\..\Interfaces\{8B3FB879-A879-4DA2-A511-75640B25BE91}: [NameServer] 144.41.2.20,144.41.5.20 FireFox: ======== FF ProfilePath: C:\Users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default FF Homepage: hxxp://www.google.de/ FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll () FF Plugin: @java.com/JavaPlugin -> D:\Programme\java\bin\new_plugin\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL No File FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll () FF Plugin-x32: @java.com/DTPlugin,version=10.17.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.17.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> D:\PROGRA~1\OFFICE~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> D:\PROGRA~1\OFFICE~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.0.5 -> D:\Programme\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF user.js: detected! => C:\Users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\user.js FF SearchPlugin: C:\Users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\searchplugins\funmoods.xml FF SearchPlugin: C:\Users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\searchplugins\MyStart Search.xml FF SearchPlugin: C:\Users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\searchplugins\MyStart.xml FF SearchPlugin: C:\Users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\searchplugins\sweetim.xml FF SearchPlugin: C:\Users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\searchplugins\Sweetpacks Search.xml FF Extension: Avira Browser Safety - C:\Users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\Extensions\abs@avira.com [2014-08-19] FF Extension: Funmoods.com - C:\Users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\Extensions\ffxtlbr@funmoods.com [2012-04-15] FF Extension: PrivDog - C:\Users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\Extensions\PrivDog@AdTrustMedia.com [2014-06-19] FF Extension: Garmin Communicator - C:\Users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2014-04-06] FF Extension: Adblock Plus - C:\Users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-09-28] FF Extension: SweetPacks Toolbar for Firefox - C:\Users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\Extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi [2012-06-04] FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2014-04-22] FF StartMenuInternet: FIREFOX.EXE - D:\Programme\Mozilla\firefox.exe Chrome: ======= CHR HomePage: Default -> hxxp://start.funmoods.com/?f=1&a=ddrnw CHR RestoreOnStartup: Default -> "hxxp://start.funmoods.com/?f=1&a=ddrnw" CHR DefaultSearchProvider: Default -> Search CHR DefaultSearchURL: Default -> hxxp://start.funmoods.com/results.php?f=4&a=ddrnw&q={searchTerms} CHR DefaultSuggestURL: Default -> CHR Plugin: (Remoting Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.76\ppGoogleNaClPluginChrome.dll No File CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.76\pdf.dll No File CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.76\gcswf32.dll No File CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File CHR Plugin: (Java Deployment Toolkit 6.0.300.12) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File CHR Plugin: (Java(TM) Platform SE 6 U30) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll No File CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll No File CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Plugin: (Microsoft Office 2010) - D:\PROGRA~1\OFFICE~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) CHR Plugin: (Microsoft Office 2010) - D:\PROGRA~1\OFFICE~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) CHR Plugin: (Foxit Reader Plugin for Mozilla) - D:\Programme\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File CHR Plugin: (Default Plug-in) - default_plugin No File CHR Profile: C:\Users\Anki\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (YouTube) - C:\Users\Anki\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-01-15] CHR Extension: (PrivDog) - C:\Users\Anki\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmaiofennmphjldldcpphcechfnnohja [2013-10-03] CHR Extension: (Google-Suche) - C:\Users\Anki\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-01-15] CHR Extension: (SweetIM for Facebook) - C:\Users\Anki\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn [2013-10-03] CHR Extension: (Yontoo) - C:\Users\Anki\AppData\Local\Google\Chrome\User Data\Default\Extensions\niapdbllcanepiiimjjndipklodoedlc [2013-10-03] CHR Extension: (Google Mail) - C:\Users\Anki\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-01-15] CHR HKLM-x32\...\Chrome\Extension: [cmaiofennmphjldldcpphcechfnnohja] - C:\Program Files (x86)\AdTrustMedia\PrivDog\PrivDog_chrome.crx [2013-10-03] CHR HKLM-x32\...\Chrome\Extension: [fdloijijlkoblmigdofommgnheckmaki] - C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodsOEM.crx [2013-10-03] CHR HKLM-x32\...\Chrome\Extension: [jcdgjdiieiljkfkdcloehkohchhpekkn] - C:\Users\Anki\AppData\Local\Google\Chrome\User Data\Default\External Extensions\{EEE6C373-6118-11DC-9C72-001320C79847}\SweetFB.crx [2012-06-04] CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - C:\Program Files (x86)\Citavi 4\Pickers\Chrome\ChromePicker.crx [2014-02-07] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-05] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-05] (Avira Operations GmbH & Co. KG) U4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1021520 2014-08-05] (Avira Operations GmbH & Co. KG) R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [149296 2014-08-04] (Avira Operations GmbH & Co. KG) R2 Bluetooth Device Monitor; C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe [897088 2010-11-03] (Intel Corporation) [File not signed] R3 Bluetooth Media Service; C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe [1298496 2010-11-03] (Intel Corporation) [File not signed] R2 Bluetooth OBEX Service; C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe [983104 2010-11-03] (Intel Corporation) [File not signed] R2 CTDevice_Srv; C:\Program Files (x86)\Creative\Shared Files\CTDevSrv.exe [61440 2007-04-02] (Creative Technology Ltd) [File not signed] S3 CTUPnPSv; C:\Program Files (x86)\Creative\Creative Centrale\CTUPnPSv.exe [64000 2008-05-21] (Creative Technology Ltd) [File not signed] R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [438616 2014-08-07] (Garmin Ltd or its subsidiaries) R2 IBUpdaterService; C:\Windows\system32\dmwu.exe [2919728 2014-08-21] () R2 Kodak AiO Network Discovery Service; D:\Programme\Kodak\AiO\Center\EKAiOHostService.exe [395200 2012-10-19] (Eastman Kodak Company) R2 Kodak AiO Status Monitor Service; D:\Programme\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe [779200 2012-10-15] (Eastman Kodak Company) S3 Microsoft SharePoint Workspace Audit Service; D:\Programme\Office 2010\Office14\GROOVE.EXE [30814400 2013-12-19] (Microsoft Corporation) S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-01-05] () R2 PFNService; C:\Program Files\Fujitsu\Plugfree NETWORK\PFNService.exe [331776 2010-10-08] (FUJITSU LIMITED) [File not signed] R2 PowerSavingUtilityService; C:\Program Files\Fujitsu\PSUtility\PSUService.exe [63336 2010-06-18] (FUJITSU LIMITED) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-06-24] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-05-22] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-09] (Avira Operations GmbH & Co. KG) U4 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [42040 2014-07-15] (Avira Operations GmbH & Co. KG) R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [270912 2011-09-29] (DT Soft Ltd) R0 FBIOSDRV; C:\Windows\System32\Drivers\FBIOSDRV.sys [21104 2009-06-24] (FUJITSU LIMITED) R3 FUJ02B1; C:\Windows\System32\DRIVERS\FUJ02B1.sys [7808 2006-11-01] (FUJITSU LIMITED) R3 FUJ02E3; C:\Windows\system32\drivers\FUJ02E3.sys [7296 2006-11-01] (FUJITSU LIMITED) S3 hwusbdev; C:\Windows\System32\DRIVERS\ewusbdev.sys [113792 2009-06-22] (Huawei Technologies Co., Ltd.) R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1801216 2010-10-09] () ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-27 20:03 - 2014-08-27 20:04 - 00029572 _____ () C:\Users\Anki\Desktop\FRST.txt 2014-08-27 20:03 - 2014-08-27 20:03 - 00000000 ____D () C:\FRST 2014-08-27 20:02 - 2014-08-27 20:02 - 02103296 _____ (Farbar) C:\Users\Anki\Desktop\FRST64.exe 2014-08-27 20:01 - 2014-08-27 20:01 - 00000470 _____ () C:\Users\Anki\Desktop\defogger_disable.log 2014-08-27 20:01 - 2014-08-27 20:01 - 00000000 _____ () C:\Users\Anki\defogger_reenable 2014-08-27 20:00 - 2014-08-27 20:00 - 00050477 _____ () C:\Users\Anki\Desktop\Defogger.exe 2014-08-26 18:19 - 2014-08-26 18:19 - 00000000 ____D () C:\Users\Anki\AppData\Local\SWDS 2014-08-22 20:55 - 2014-08-22 20:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2014-08-22 20:55 - 2014-08-22 20:55 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-08-22 20:55 - 2014-08-22 20:55 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-08-22 11:06 - 2014-08-22 11:06 - 00003156 _____ () C:\Windows\System32\Tasks\{C2521FB9-C902-451C-8B9B-F5D6B38D32A7} 2014-08-16 14:27 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll 2014-08-16 14:27 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll 2014-08-16 14:27 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe 2014-08-16 14:27 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe 2014-08-16 14:27 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe 2014-08-16 14:27 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll 2014-08-16 14:27 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe 2014-08-16 14:27 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll 2014-08-16 10:27 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-08-16 10:27 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2014-08-16 10:26 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-08-16 10:26 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-08-16 10:26 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-08-16 10:26 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-08-16 10:26 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-08-16 10:26 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-08-16 10:26 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-08-16 10:26 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-08-16 10:26 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-08-16 10:26 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-08-16 10:26 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-08-16 10:26 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-08-16 10:26 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-08-16 10:26 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-08-16 10:26 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-08-16 10:26 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-08-16 10:26 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-08-16 10:26 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-08-16 10:26 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-08-16 10:26 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-08-16 10:26 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-08-16 10:26 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-08-16 10:26 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-08-16 10:26 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-08-16 10:26 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-08-16 10:26 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-08-16 10:26 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-08-16 10:26 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-08-16 10:26 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-08-16 10:26 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-08-16 10:26 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-08-16 10:26 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-08-16 10:26 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-08-16 10:26 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-08-16 10:26 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-08-16 10:26 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-08-16 10:26 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-08-16 10:26 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-08-16 10:26 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-08-16 10:26 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-08-16 10:26 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-08-16 10:26 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-08-16 10:26 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-08-16 10:26 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-08-16 10:26 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-08-16 10:26 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-08-16 10:26 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-08-16 10:26 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-08-16 10:26 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-08-16 10:26 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-08-16 10:26 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-08-16 10:26 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-08-16 10:26 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-08-16 10:26 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-08-16 10:26 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-08-16 10:26 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-08-16 10:26 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-08-16 10:26 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2014-08-16 10:26 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys 2014-08-16 10:26 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll 2014-08-16 10:26 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2014-08-16 10:26 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll 2014-08-16 10:26 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe 2014-08-16 10:26 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll 2014-08-16 10:26 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll 2014-08-16 10:26 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll 2014-08-16 10:23 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2014-08-16 10:23 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll 2014-08-16 10:21 - 2014-08-16 10:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garmin 2014-08-05 11:40 - 2014-08-05 11:40 - 00000000 ____D () C:\Users\Anki\AppData\Local\Skype 2014-08-05 11:40 - 2014-08-05 11:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype 2014-08-03 22:15 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2014-08-03 22:15 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe 2014-08-03 22:15 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll 2014-08-03 22:15 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll 2014-08-03 22:14 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll 2014-08-03 22:14 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll 2014-08-03 22:14 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll 2014-08-03 22:14 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll 2014-08-03 22:14 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll 2014-08-03 22:14 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll 2014-08-03 22:14 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll 2014-08-03 22:14 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll 2014-08-03 22:14 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe 2014-08-03 22:14 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-27 20:04 - 2014-08-27 20:03 - 00029572 _____ () C:\Users\Anki\Desktop\FRST.txt 2014-08-27 20:03 - 2014-08-27 20:03 - 00000000 ____D () C:\FRST 2014-08-27 20:02 - 2014-08-27 20:02 - 02103296 _____ (Farbar) C:\Users\Anki\Desktop\FRST64.exe 2014-08-27 20:01 - 2014-08-27 20:01 - 00000470 _____ () C:\Users\Anki\Desktop\defogger_disable.log 2014-08-27 20:01 - 2014-08-27 20:01 - 00000000 _____ () C:\Users\Anki\defogger_reenable 2014-08-27 20:01 - 2011-09-28 15:36 - 00000000 ____D () C:\Users\Anki 2014-08-27 20:00 - 2014-08-27 20:00 - 00050477 _____ () C:\Users\Anki\Desktop\Defogger.exe 2014-08-27 19:57 - 2011-09-29 21:37 - 00000000 ____D () C:\Users\Anki\Documents\Outlook-Dateien 2014-08-27 19:47 - 2012-04-08 16:49 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-08-27 19:44 - 2011-09-28 15:35 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-08-27 19:44 - 2011-09-28 15:33 - 01587057 _____ () C:\Windows\WindowsUpdate.log 2014-08-27 18:51 - 2011-10-02 13:50 - 00000000 ____D () C:\ProgramData\Kodak 2014-08-27 16:40 - 2014-04-22 11:53 - 00000000 ____D () C:\Users\Anki\Documents\Citavi 4 2014-08-27 16:31 - 2012-08-29 17:13 - 00000000 ____D () C:\Users\Anki\Desktop\Places 2014-08-27 16:26 - 2014-04-22 11:01 - 00000000 ____D () C:\Users\Anki\AppData\Roaming\Opera Software 2014-08-27 16:26 - 2014-04-22 11:01 - 00000000 ____D () C:\Users\Anki\AppData\Local\Opera Software 2014-08-27 16:26 - 2014-04-22 10:57 - 00000000 ____D () C:\Program Files (x86)\Opera 2014-08-27 16:24 - 2012-01-15 20:57 - 00000000 ____D () C:\Users\Anki\AppData\Roaming\IrfanView 2014-08-27 15:18 - 2011-04-11 19:26 - 00703176 _____ () C:\Windows\system32\perfh007.dat 2014-08-27 15:18 - 2011-04-11 19:26 - 00150784 _____ () C:\Windows\system32\perfc007.dat 2014-08-27 15:18 - 2009-07-14 07:13 - 01629212 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-08-27 15:18 - 2009-07-14 06:45 - 00016752 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-08-27 15:18 - 2009-07-14 06:45 - 00016752 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-08-27 15:17 - 2013-11-18 18:24 - 00000000 ____D () C:\Users\Anki\AppData\Local\Akamai 2014-08-27 15:17 - 2012-01-30 20:29 - 00000000 ___RD () C:\Users\Anki\Dropbox 2014-08-27 15:16 - 2012-01-29 20:26 - 00000000 ____D () C:\Users\Anki\AppData\Roaming\Dropbox 2014-08-27 15:15 - 2011-09-28 15:35 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-08-27 15:11 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-08-27 15:11 - 2009-07-14 06:51 - 00182643 _____ () C:\Windows\setupact.log 2014-08-26 18:19 - 2014-08-26 18:19 - 00000000 ____D () C:\Users\Anki\AppData\Local\SWDS 2014-08-26 18:19 - 2014-06-23 13:06 - 00000000 ____D () C:\Windows\SysWOW64\mjcm 2014-08-26 18:19 - 2014-06-23 13:06 - 00000000 ____D () C:\Windows\system32\tprb 2014-08-26 18:19 - 2013-06-13 18:53 - 00000000 ____D () C:\Windows\SysWOW64\WNLT 2014-08-26 18:19 - 2013-06-13 18:53 - 00000000 ____D () C:\Windows\SysWOW64\ARFC 2014-08-23 12:00 - 2010-11-21 05:47 - 00679244 _____ () C:\Windows\PFRO.log 2014-08-22 20:59 - 2011-09-29 21:16 - 00000000 ____D () C:\Users\Anki\AppData\Local\MediaMonkey 2014-08-22 20:55 - 2014-08-22 20:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2014-08-22 20:55 - 2014-08-22 20:55 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-08-22 20:55 - 2014-08-22 20:55 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-08-22 17:43 - 2011-12-14 21:32 - 00000000 ____D () C:\Users\Anki\AppData\Local\CrashDumps 2014-08-22 14:54 - 2013-01-06 13:10 - 00820736 ___SH () C:\Users\Anki\Desktop\Thumbs.db 2014-08-22 14:30 - 2014-04-06 11:59 - 00000000 ____D () C:\ProgramData\Package Cache 2014-08-22 14:30 - 2013-12-17 20:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2014-08-22 14:30 - 2013-12-17 20:53 - 00000000 ____D () C:\Program Files (x86)\Avira 2014-08-22 12:06 - 2013-05-24 09:48 - 00000000 ____D () C:\Users\Anki\AppData\Local\.elfohilfe 2014-08-22 12:05 - 2013-04-30 16:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElsterFormular 2014-08-22 11:06 - 2014-08-22 11:06 - 00003156 _____ () C:\Windows\System32\Tasks\{C2521FB9-C902-451C-8B9B-F5D6B38D32A7} 2014-08-21 11:53 - 2014-06-30 13:42 - 02919728 _____ () C:\Windows\system32\dmwu.exe 2014-08-21 11:50 - 2013-06-13 18:53 - 00033792 _____ (IncrediMail, Ltd.) C:\Windows\system32\ImHttpComm.dll 2014-08-17 11:18 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-08-17 11:11 - 2011-09-29 16:11 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-08-17 11:05 - 2013-12-16 19:26 - 00000000 ____D () C:\Windows\system32\MRT 2014-08-17 11:03 - 2012-05-26 07:06 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-08-16 10:21 - 2014-08-16 10:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garmin 2014-08-16 10:21 - 2014-04-06 11:59 - 00003556 _____ () C:\Windows\System32\Tasks\GarminUpdaterTask 2014-08-16 10:21 - 2014-04-06 11:59 - 00000000 ____D () C:\ProgramData\Garmin 2014-08-16 10:21 - 2014-04-06 11:59 - 00000000 ____D () C:\Program Files (x86)\Garmin 2014-08-16 10:13 - 2012-01-29 20:26 - 00000000 ____D () C:\Users\Anki\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2014-08-05 22:27 - 2011-09-29 21:30 - 00000000 ____D () C:\Users\Anki\AppData\Roaming\Skype 2014-08-05 11:40 - 2014-08-05 11:40 - 00000000 ____D () C:\Users\Anki\AppData\Local\Skype 2014-08-05 11:40 - 2014-08-05 11:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype 2014-08-05 11:40 - 2011-09-29 21:30 - 00000000 ____D () C:\ProgramData\Skype 2014-08-05 10:54 - 2013-08-17 10:11 - 00000000 ____D () C:\ProgramData\Avira 2014-08-01 01:41 - 2014-08-16 10:26 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-08-01 01:16 - 2014-08-16 10:26 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-07-29 22:24 - 2011-10-07 20:15 - 00000000 ____D () C:\Users\Anki\AppData\Roaming\vlc 2014-07-29 11:55 - 2011-12-09 19:09 - 00000000 ____D () C:\Users\Anki\AppData\Roaming\dvdcss 2014-07-28 18:37 - 2011-09-28 15:53 - 00000000 ____D () C:\Windows\System32\Tasks\Fujitsu Some content of TEMP: ==================== C:\Users\Anki\AppData\Local\Temp\avgnt.exe C:\Users\Anki\AppData\Local\Temp\DataCard_Setup64.exe C:\Users\Anki\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmphmnrxj.dll C:\Users\Anki\AppData\Local\Temp\iv_uninstall.exe C:\Users\Anki\AppData\Local\Temp\ose00000.exe C:\Users\Anki\AppData\Local\Temp\ResetDevice.exe C:\Users\Anki\AppData\Local\Temp\_TinDel.exe C:\Users\Anki\AppData\Local\Temp\{0B91DAAF-B0BA-425B-9465-83A597143326}-33.0.1750.154_33.0.1750.146_chrome_updater.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-08-27 10:13 ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-08-2014 Ran by Anki at 2014-08-27 20:04:32 Running from C:\Users\Anki\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859} AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated) Adobe Reader XI (11.0.08) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated) aioscnnr (x32 Version: 7.3.4.0 - Your Company Name) Hidden AIS Connect (HKLM-x32\...\AIS Connect) (Version: 1.1.1.6 - Fujitsu Technology Solutions GmbH) AIS Connect (x32 Version: 1.1.1.6 - Fujitsu Technology Solutions GmbH) Hidden Akamai NetSession Interface (HKCU\...\Akamai) (Version: - Akamai Technologies, Inc) ANT Drivers Installer x64 (Version: 2.3.4 - Garmin Ltd or its subsidiaries) Hidden Anytime USB Charge Utility (HKLM-x32\...\{549BF60D-FDDA-4E4C-ABE3-9E897BC09E79}) (Version: 1.00.00.001 - FUJITSU LIMITED) Avira (HKLM-x32\...\{e67154a7-9cc5-4167-b782-f3982bc6c70d}) (Version: 1.1.19.30000 - Avira Operations GmbH & Co. KG) Avira (x32 Version: 1.1.19.30000 - Avira Operations GmbH & Co. KG) Hidden Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.6.552 - Avira) C4USelfUpdater (x32 Version: 1.00.0000 - Your Company Name) Hidden CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.4.0.3018 - CDBurnerXP) center (x32 Version: 6.2.5.0 - Eastman Kodak Company) Hidden Cisco AnyConnect Secure Mobility Client (HKLM-x32\...\Cisco AnyConnect Secure Mobility Client) (Version: 3.1.00495 - Cisco Systems, Inc.) Cisco AnyConnect Secure Mobility Client (x32 Version: 3.1.00495 - Cisco Systems, Inc.) Hidden Citavi 4 (HKLM-x32\...\{CC0A85B2-734A-45B3-B678-05F6A6499AC7}) (Version: 4.3.0.15 - Swiss Academic Software) Control ActiveX de Windows Live Mesh para conexiones remotas (HKLM-x32\...\{04668DF2-D32F-4555-9C7E-35523DCD6544}) (Version: 15.4.5722.2 - Microsoft Corporation) Contrôle ActiveX Windows Live Mesh pour connexions à distance (HKLM-x32\...\{55D003F4-9599-44BF-BA9E-95D060730DD3}) (Version: 15.4.5722.2 - Microsoft Corporation) Creative Centrale (HKLM-x32\...\Creative Centrale) (Version: 1.18.03 - Creative Technology Ltd.) Creative Centrale (x32 Version: 1.18.03 - Creative Technology Ltd.) Hidden Creative Software Update (x32 Version: 1.03.01 - Creative Technology Ltd.) Hidden Creative ZEN Style Series Dokumentation (HKLM-x32\...\ZENSTYLESERIESUG) (Version: - Creative Technology Ltd.) CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.0.1908.7636 - CyberLink Corp.) CyberLink YouCam (x32 Version: 3.0.1908.7636 - CyberLink Corp.) Hidden D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.41.3.0173 - DT Soft Ltd) Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{132D27B8-C656-44BD-8C16-73C54EA8A85F}) (Version: - Microsoft) DeskUpdate 4.11 (HKLM-x32\...\DeskUpdate_is1) (Version: 4.11.0074 - Fujitsu Technology Solutions) Dropbox (HKCU\...\Dropbox) (Version: 2.10.28 - Dropbox, Inc.) Elevated Installer (x32 Version: 3.2.17.0 - Garmin Ltd or its subsidiaries) Hidden ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 15.2.20140326 - Landesfinanzdirektion Thüringen) essentials (x32 Version: 6.0.14.0 - Eastman Kodak Company) Hidden FileZilla Client 3.5.3 (HKLM-x32\...\FileZilla Client) (Version: 3.5.3 - FileZilla Project) FJ Camera (HKLM-x32\...\{399C37FB-08AF-493B-BFED-20FBD85EDF7F}) (Version: 5.8.52016.0 - Sonix) Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 5.4.3.920 - Foxit Corporation) Fujitsu Display Manager (HKLM-x32\...\InstallShield_{4108974B-DE87-4AD4-9167-930C62C45691}) (Version: - ) Fujitsu Display Manager (Version: 7.01.20.212 - FUJITSU LIMITED) Hidden Fujitsu Hotkey Utility (HKLM-x32\...\InstallShield_{C8E4B31D-337C-483D-822D-16F11441669B}) (Version: 3.70.0.0 - FUJITSU LIMITED) Fujitsu Hotkey Utility (x32 Version: 3.70.0.0 - FUJITSU LIMITED) Hidden Fujitsu MobilityCenter Extension Utility (HKLM-x32\...\InstallShield_{EC314CDF-3521-482B-A21C-65AC95664814}) (Version: 3.01.00.001 - FUJITSU LIMITED) Fujitsu MobilityCenter Extension Utility (Version: 3.01.00.001 - FUJITSU LIMITED) Hidden Fujitsu System Extension Utility (HKLM-x32\...\InstallShield_{E8A5B78F-4456-4511-AB3D-E7BFFB974A7A}) (Version: 3.3.0.0 - FUJITSU LIMITED) Fujitsu System Extension Utility (Version: 3.3.0.0 - FUJITSU LIMITED) Hidden Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Garmin Express (HKLM-x32\...\{b43ffffb-1adc-4bcb-b277-7844ebff94da}) (Version: 3.2.17.0 - Garmin Ltd or its subsidiaries) Garmin Express (x32 Version: 3.2.17.0 - Garmin Ltd or its subsidiaries) Hidden Garmin Express Tray (x32 Version: 3.2.17.0 - Garmin Ltd or its subsidiaries) Hidden GO Contact Sync Mod (HKLM-x32\...\{2F5870AB-B4E4-4959-B8CE-1C9E0A273D67}) (Version: 3.5.5 - WebGear, Create Software, Stru.be, saller.NET) Google Calendar Sync (HKLM-x32\...\Google Calendar Sync) (Version: - ) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 36.0.1985.143 - Google Inc.) Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.) Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden HP Deskjet 3070 B611 series - Grundlegende Software für das Gerät (HKLM\...\{479B309B-E6B4-4947-8B83-472CF4272582}) (Version: 23.0.504.0 - Hewlett-Packard Co.) HP Deskjet 3070 B611 series Hilfe (HKLM-x32\...\{9F20CE56-3828-432D-A3C5-3EC6A2ED93C6}) (Version: 140.0.2.2 - Hewlett Packard) IB Updater Service (HKLM-x32\...\WNLT) (Version: 5.1.3.1 - ) <==== ATTENTION Intel PROSet Wireless (Version: - ) Hidden Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation) Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2372 - Intel Corporation) Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\...\{7CE8BE79-ABC3-4B2C-9543-28ED2B0A9EA8}) (Version: 1.0.0.0454 - Intel Corporation) Intel(R) PROSet/Wireless WiFi Software (HKLM\...\{1927E640-A2C6-4BA7-8F43-FFD2AE3DFCF3}) (Version: 14.0.2000 - Intel Corporation) Intel(R) WiDi (HKLM-x32\...\{25680C01-6753-4FE9-A891-7857F26457C1}) (Version: 2.1.35.0 - Intel Corporation) Intel(R) Wireless Display (HKLM\...\{28EF7372-9087-4AC3-9B9F-D9751FCDF830}) (Version: - ) Java 7 Update 17 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217017FF}) (Version: 7.0.170 - Oracle) Java Auto Updater (x32 Version: 2.1.9.0 - Sun Microsystems, Inc.) Hidden Java(TM) 7 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417000FF}) (Version: 7.0.0 - Oracle) JDownloader 0.9 (HKLM-x32\...\5513-1208-7298-9440) (Version: 0.9 - AppWork GmbH) Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Kodak AIO Printer (Version: 7.0.3.0 - Eastman Kodak Company) Hidden KODAK All-in-One Software (HKLM-x32\...\{E0F274B7-592B-4669-8FB8-8D9825A09858}) (Version: 7.6.12.20 - Eastman Kodak Company) LifeBook Application Panel (HKLM-x32\...\InstallShield_{6226477E-444F-4DFE-BA19-9F4F7D4565BC}) (Version: 8.2.1.0 - FUJITSU LIMITED) LifeBook Application Panel (Version: 8.2.1.0 - FUJITSU LIMITED) Hidden Light Image Resizer 4.3.2.2 (HKLM-x32\...\{EBE030DD-D404-4D92-85E9-8C3624820808}_is1) (Version: 4.3.2.2 - ObviousIdea) MediaMonkey 3.2 (HKLM-x32\...\MediaMonkey_is1) (Version: 3.2 - Ventis Media Inc.) Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation) Microsoft Office Professional Plus 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation) Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden Microsoft_VC100_CRT_SP1_x64 (Version: 10.0.40219.1 - Nokia) Hidden Microsoft_VC100_CRT_SP1_x86 (x32 Version: 10.0.40219.1 - Nokia) Hidden Mobile Partner (HKLM-x32\...\Mobile Partner) (Version: 11.302.06.03.545 - Huawei Technologies Co.,Ltd) Mozilla Firefox 31.0 (x86 de) (HKCU\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla) Mozilla Firefox 7.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 7.0 (x86 de)) (Version: 7.0 - Mozilla) MSVC80_x64_v2 (Version: 1.0.3.0 - Nokia) Hidden MSVC80_x86_v2 (x32 Version: 1.0.3.0 - Nokia) Hidden MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) NVIDIA Control Panel 265.77 (Version: 265.77 - NVIDIA Corporation) Hidden NVIDIA Graphics Driver 265.77 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 265.77 - NVIDIA Corporation) NVIDIA Install Application (Version: 2.265.28.0 - NVIDIA Corporation) Hidden ocr (x32 Version: 6.2.3.50 - Eastman Kodak Company) Hidden PC Connectivity Solution (HKLM-x32\...\{A2AA4204-C05A-4013-888A-AD153139297F}) (Version: 11.5.29.0 - Nokia) PDF Split And Merge Basic (HKLM\...\{C91B24F6-1629-11E2-B696-21676188709B}) (Version: 2.2.2 - Andrea Vacondio) PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.4.1 - Frank Heindörfer, Philip Chinery) Plugfree NETWORK (HKLM\...\{7BA64D21-EE46-4a9a-8145-52B0175C3F86}) (Version: 5.4.0.1 - FUJITSU LIMITED) Plugfree NETWORK (Version: 5.4.001 - FUJITSU LIMITED) Hidden Power Saving Utility (HKLM-x32\...\{49A588CF-5FD4-4774-BFBF-0764287DE82B}) (Version: 32.01.10.009 - FUJITSU LIMITED) PreReq (x32 Version: 6.2.4.0 - Eastman Kodak Company) Hidden PrintProjects (HKLM-x32\...\PrintProjects) (Version: 1.0.0.9282 - RocketLife Inc.) PrivDog (HKLM-x32\...\PrivDog) (Version: 1.5.0.14 - privdog.com) Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6263 - Realtek Semiconductor Corp.) Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30120 - Realtek Semiconductor Corp.) Secure Download Manager (HKLM-x32\...\{E98D115E-D621-4723-8AF0-147BADA9A466}) (Version: 3.1.40 - Kivuto Solutions Inc.) Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft) Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) Hidden Skype™ 6.18 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.) SweetIM for Messenger 3.6 (HKLM-x32\...\{0965F857-DAAD-4F93-8054-0E2EC3C8C5B0}) (Version: 3.6.0008 - SweetIM Technologies Ltd.) <==== ATTENTION SweetPacks Toolbar for Internet Explorer 4.6 (HKLM-x32\...\{4183178B-4D4E-48A7-9257-454BA90A760E}) (Version: 4.6.0002 - SweetIM Technologies Ltd.) <==== ATTENTION Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 14.0.16.0 - Synaptics Incorporated) Trillian (HKLM-x32\...\Trillian) (Version: - Cerulean Studios, LLC) Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version: - Microsoft) Update for Microsoft Excel 2010 (KB2837600) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{4ACD847E-547D-493F-9A86-F73EAE1B5174}) (Version: - Microsoft) Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version: - Microsoft) Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version: - Microsoft) Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version: - Microsoft) Update for Microsoft InfoPath 2010 (KB2817396) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{39767ECA-1731-45DB-AB5B-6BF40E151D66}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2494150) (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{3FCFD88F-4D13-4F38-8625-ABABEA7F61EA}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2687502) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUS_{7DE7DF97-82FE-4B3A-AB8D-1621F9CC464A}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2825635) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{F1A20C69-9FE5-40FD-9CD5-84EABC2EF64A}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{BA610006-2C39-4419-9834-CF61AB24810A}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2837581) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{334FB202-28D7-4BA4-8BC9-4FE4AB233EA0}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2837606) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{B0D672F7-883E-4279-8E75-D97A5445AB46}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0410-0000-0000000FF1CE}_Office14.PROPLUS_{4B93560B-F33D-4A67-A224-F5E1C329BD22}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2878252) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{B0DB9F71-E0F7-4FE6-8925-35B860CAC0C4}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUS_{EAD7BEF9-B28C-425F-B2C5-538CB27EF013}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUS_{089DBFD7-8211-43B2-AAAE-5BDD8C23E3A8}) (Version: - Microsoft) Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft) Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft) Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version: - Microsoft) Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUS_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version: - Microsoft) Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{2BA40F82-F3A4-441C-BF1A-ED4C42FF4872}) (Version: - Microsoft) Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUS_{40EC8FB1-5202-469D-9232-C28FB1C6FC64}) (Version: - Microsoft) Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft) Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft) Update for Microsoft Visio 2010 (KB2880526) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{7B29D8B8-6A87-496C-A65E-B935E740448A}) (Version: - Microsoft) Update for Microsoft Visio Viewer 2010 (KB2837587) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{38CF30E4-3348-4BD1-A859-B630C355A56F}) (Version: - Microsoft) Update for Microsoft Word 2010 (KB2880529) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{B9B89E01-5B6B-4F73-BC34-B2C0D8ACB4CD}) (Version: - Microsoft) VLC media player 2.0.5 (HKLM-x32\...\VLC media player) (Version: 2.0.5 - VideoLAN) Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation) Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (HKLM-x32\...\{C32CE55C-12BA-4951-8797-0967FDEF556F}) (Version: 15.4.5722.2 - Microsoft Corporation) Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation) Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation) Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{C63A1E60-B6A4-440B-89A5-1FC6E4AC1C94}) (Version: 15.4.5722.2 - Microsoft Corporation) Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows-Treiberpaket - Dynastream Innovations, Inc. ANT LibUSB Drivers (04/11/2012 1.2.40.201) (HKLM\...\F9D2A789F9CFF8CEC36B544F53877C80F1F73C46) (Version: 04/11/2012 1.2.40.201 - Dynastream Innovations, Inc.) Windows-Treiberpaket - Silicon Labs Software (DSI_SiUSBXp_3_1) USB (02/06/2007 3.1) (HKLM\...\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software) WinRAR 4.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.01.0 - win.rar GmbH) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) CustomCLSID: HKU\S-1-5-21-2552170177-1754437681-1621803140-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Anki\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2552170177-1754437681-1621803140-1001_Classes\CLSID\{6A221957-2D85-42A7-8E19-BE33950D1DEB}\localserver32 -> D:\Downloads\AutoCAD 2014\acad.exe No File CustomCLSID: HKU\S-1-5-21-2552170177-1754437681-1621803140-1001_Classes\CLSID\{7DE1BE5C-CEBA-4F1D-ACBC-9CE11EE9A2A1}\localserver32 -> D:\Downloads\AutoCAD 2014\acad.exe /Automation No File CustomCLSID: HKU\S-1-5-21-2552170177-1754437681-1621803140-1001_Classes\CLSID\{BD0DEB94-63DB-4392-9420-6EEE05094B1F}\localserver32 -> D:\Downloads\AutoCAD 2014\acad.exe /Automation No File CustomCLSID: HKU\S-1-5-21-2552170177-1754437681-1621803140-1001_Classes\CLSID\{E2C40589-DE61-11ce-BAE0-0020AF6D7005}\InprocServer32 -> D:\Downloads\AutoCAD 2014\de-DE\acadficn.dll No File CustomCLSID: HKU\S-1-5-21-2552170177-1754437681-1621803140-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Anki\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2552170177-1754437681-1621803140-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Anki\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2552170177-1754437681-1621803140-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Anki\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2552170177-1754437681-1621803140-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Anki\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2552170177-1754437681-1621803140-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Anki\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2552170177-1754437681-1621803140-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Anki\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2552170177-1754437681-1621803140-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Anki\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2552170177-1754437681-1621803140-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Anki\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) ==================== Restore Points ========================= ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {3DF457EB-81C6-4AC1-A197-2907417642A7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-09-28] (Google Inc.) Task: {546F11D4-CE8D-4ED3-B365-A5E5AAE4259C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-09-28] (Google Inc.) Task: {68A264C7-0F09-4C9F-BE84-4D38F646CBBA} - System32\Tasks\{5BA03B81-B37C-4905-BA8B-1A317C913EF9} => D:\Downloads\sipgate_1369977_X-Lite-www.sipgate.de_1.0.0.5.exe Task: {862DDDA0-58C9-4E7C-BB17-94605BD27984} - System32\Tasks\GarminUpdaterTask => C:\Program Files (x86)\Garmin\Express Self Updater\ExpressSelfUpdater.exe [2014-08-07] () Task: {B7E95CE9-0F91-492B-B543-70AA7A21E971} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-09] (Adobe Systems Incorporated) Task: {BE4D2A4A-3798-4206-BF94-5A6CDD51115C} - System32\Tasks\KMS Activation for Office => C:\Windows\KMSAct.exe Task: {C17573CC-C672-4958-9B59-23D55B559BF0} - System32\Tasks\{FA8B4E04-64F7-4B01-A9C0-6747991D9807} => D:\Downloads\FoxitReader502.0718_enu_Setup.exe Task: {DB69FFC8-0A30-4DBC-8C1D-964A4783A404} - System32\Tasks\{6F9FBDFA-BC78-455B-8F43-E6B4CB09030E} => D:\Downloads\FoxitReader502.0718_enu_Setup.exe Task: {F39BFBD1-F51F-412C-9C0A-898BF638383D} - System32\Tasks\Fujitsu\DeskUpdate => c:\Fujitsu\Programs\DeskUpdate\ducmd.exe [2010-10-13] (Fujitsu Technology Solutions) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= 2011-01-05 21:53 - 2011-01-05 21:53 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\Libeay32.dll 2014-06-30 13:42 - 2014-08-21 11:53 - 02919728 _____ () C:\Windows\system32\dmwu.exe 2010-01-02 16:42 - 2010-01-02 16:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll 2011-10-03 20:32 - 2011-05-28 22:05 - 00164864 _____ () C:\Program Files\WinRAR\rarext.dll 2014-08-21 11:53 - 2014-08-21 11:53 - 00730928 _____ () C:\Windows\SysWOW64\mjcm\dnkt.exe 2014-08-21 11:53 - 2014-08-21 11:53 - 00852784 _____ () C:\Windows\System32\tprb\dnkt.exe 2014-08-21 11:53 - 2014-08-21 11:53 - 02236720 _____ () C:\Windows\System32\tprb\5131\nsib.dll 2011-05-02 02:21 - 2011-04-15 03:16 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll 2011-01-05 21:53 - 2011-01-05 21:53 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\LIBEAY32.dll 2012-08-03 21:53 - 2012-08-03 21:53 - 00062968 _____ () C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll 2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF 2014-08-04 14:20 - 2014-08-04 14:20 - 00139056 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll 2014-08-04 14:20 - 2014-08-04 14:20 - 00067832 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.AvConnectorNative.dll 2014-08-21 11:53 - 2014-08-21 11:53 - 01774896 _____ () C:\Windows\SysWOW64\mjcm\5131\nsib.dll 2014-08-27 15:16 - 2014-08-27 15:16 - 00043008 _____ () c:\users\anki\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmphmnrxj.dll 2013-08-23 21:01 - 2013-08-23 21:01 - 25100288 _____ () C:\Users\Anki\AppData\Roaming\Dropbox\bin\libcef.dll 2014-08-05 10:54 - 2014-08-04 14:20 - 00052472 _____ () C:\Users\Anki\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll 2011-09-29 00:20 - 2010-11-17 22:54 - 00004096 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll 2014-07-30 09:32 - 2014-07-30 09:33 - 03800688 _____ () D:\Programme\Mozilla\mozjs.dll 2014-04-22 11:23 - 2013-07-17 23:56 - 00430080 _____ () C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox\components\FirefoxPickerCommunication.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (whitelisted) ============= (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== MSCONFIG/TASK MANAGER disabled items ========= (Currently there is no automatic fix for this section.) ==================== Faulty Device Manager Devices ============= Name: Bluetooth-Peripheriegerät Description: Bluetooth-Peripheriegerät Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64 Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64 Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: Cisco Systems Service: vpnva Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. Name: Bluetooth-Peripheriegerät Description: Bluetooth-Peripheriegerät Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. ==================== Event log errors: ========================= Application errors: ================== Error: (08/27/2014 08:04:55 PM) (Source: MsiInstaller) (EventID: 11310) (User: Ankis-Laptop) Description: Produkt: Akamai NetSession Interface -- Fehler 1310. Fehler beim Schreiben in die Datei: C:\Users\Anki\AppData\Local\Akamai\admintool.exe. Systemfehler 0. Stellen Sie sicher, dass Sie auf das Verzeichnis zugreifen können. Error: (08/27/2014 08:04:32 PM) (Source: MsiInstaller) (EventID: 11310) (User: Ankis-Laptop) Description: Produkt: Akamai NetSession Interface -- Fehler 1310. Fehler beim Schreiben in die Datei: C:\Users\Anki\AppData\Local\Akamai\admintool.exe. Systemfehler 0. Stellen Sie sicher, dass Sie auf das Verzeichnis zugreifen können. Error: (08/27/2014 03:17:30 PM) (Source: MsiInstaller) (EventID: 11310) (User: Ankis-Laptop) Description: Produkt: Akamai NetSession Interface -- Fehler 1310. Fehler beim Schreiben in die Datei: C:\Users\Anki\AppData\Local\Akamai\admintool.exe. Systemfehler 0. Stellen Sie sicher, dass Sie auf das Verzeichnis zugreifen können. Error: (08/27/2014 03:16:58 PM) (Source: MsiInstaller) (EventID: 11310) (User: Ankis-Laptop) Description: Produkt: Akamai NetSession Interface -- Fehler 1310. Fehler beim Schreiben in die Datei: C:\Users\Anki\AppData\Local\Akamai\admintool.exe. Systemfehler 0. Stellen Sie sicher, dass Sie auf das Verzeichnis zugreifen können. Error: (08/27/2014 03:11:42 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (08/27/2014 10:07:58 AM) (Source: MsiInstaller) (EventID: 11310) (User: Ankis-Laptop) Description: Produkt: Akamai NetSession Interface -- Fehler 1310. Fehler beim Schreiben in die Datei: C:\Users\Anki\AppData\Local\Akamai\admintool.exe. Systemfehler 0. Stellen Sie sicher, dass Sie auf das Verzeichnis zugreifen können. Error: (08/27/2014 10:07:34 AM) (Source: MsiInstaller) (EventID: 11310) (User: Ankis-Laptop) Description: Produkt: Akamai NetSession Interface -- Fehler 1310. Fehler beim Schreiben in die Datei: C:\Users\Anki\AppData\Local\Akamai\admintool.exe. Systemfehler 0. Stellen Sie sicher, dass Sie auf das Verzeichnis zugreifen können. Error: (08/27/2014 09:11:41 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (08/26/2014 06:19:22 PM) (Source: MsiInstaller) (EventID: 11310) (User: Ankis-Laptop) Description: Produkt: Akamai NetSession Interface -- Fehler 1310. Fehler beim Schreiben in die Datei: C:\Users\Anki\AppData\Local\Akamai\admintool.exe. Systemfehler 0. Stellen Sie sicher, dass Sie auf das Verzeichnis zugreifen können. Error: (08/26/2014 06:18:33 PM) (Source: MsiInstaller) (EventID: 11310) (User: Ankis-Laptop) Description: Produkt: Akamai NetSession Interface -- Fehler 1310. Fehler beim Schreiben in die Datei: C:\Users\Anki\AppData\Local\Akamai\admintool.exe. Systemfehler 0. Stellen Sie sicher, dass Sie auf das Verzeichnis zugreifen können. System errors: ============= Error: (08/27/2014 07:00:43 PM) (Source: volsnap) (EventID: 36) (User: ) Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte. Error: (08/27/2014 04:58:09 PM) (Source: volsnap) (EventID: 36) (User: ) Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte. Error: (08/27/2014 03:12:36 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT) Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC) Error: (08/27/2014 09:17:28 AM) (Source: volsnap) (EventID: 36) (User: ) Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte. Error: (08/27/2014 09:13:01 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT) Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC) Error: (08/27/2014 09:12:42 AM) (Source: iaStor) (EventID: 9) (User: ) Description: Das Gerät \Device\Ide\iaStor0 hat innerhalb der Fehlerwartezeit nicht geantwortet. Error: (08/27/2014 09:12:30 AM) (Source: iaStor) (EventID: 9) (User: ) Description: Das Gerät \Device\Ide\iaStor0 hat innerhalb der Fehlerwartezeit nicht geantwortet. Error: (08/25/2014 09:32:33 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT) Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC) Error: (08/23/2014 00:01:23 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT) Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC) Error: (08/22/2014 08:56:36 PM) (Source: volsnap) (EventID: 36) (User: ) Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte. Microsoft Office Sessions: ========================= Error: (08/27/2014 08:04:55 PM) (Source: MsiInstaller) (EventID: 11310) (User: Ankis-Laptop) Description: Produkt: Akamai NetSession Interface -- Fehler 1310. Fehler beim Schreiben in die Datei: C:\Users\Anki\AppData\Local\Akamai\admintool.exe. Systemfehler 0. Stellen Sie sicher, dass Sie auf das Verzeichnis zugreifen können.(NULL)(NULL)(NULL)(NULL)(NULL) Error: (08/27/2014 08:04:32 PM) (Source: MsiInstaller) (EventID: 11310) (User: Ankis-Laptop) Description: Produkt: Akamai NetSession Interface -- Fehler 1310. Fehler beim Schreiben in die Datei: C:\Users\Anki\AppData\Local\Akamai\admintool.exe. Systemfehler 0. Stellen Sie sicher, dass Sie auf das Verzeichnis zugreifen können.(NULL)(NULL)(NULL)(NULL)(NULL) Error: (08/27/2014 03:17:30 PM) (Source: MsiInstaller) (EventID: 11310) (User: Ankis-Laptop) Description: Produkt: Akamai NetSession Interface -- Fehler 1310. Fehler beim Schreiben in die Datei: C:\Users\Anki\AppData\Local\Akamai\admintool.exe. Systemfehler 0. Stellen Sie sicher, dass Sie auf das Verzeichnis zugreifen können.(NULL)(NULL)(NULL)(NULL)(NULL) Error: (08/27/2014 03:16:58 PM) (Source: MsiInstaller) (EventID: 11310) (User: Ankis-Laptop) Description: Produkt: Akamai NetSession Interface -- Fehler 1310. Fehler beim Schreiben in die Datei: C:\Users\Anki\AppData\Local\Akamai\admintool.exe. Systemfehler 0. Stellen Sie sicher, dass Sie auf das Verzeichnis zugreifen können.(NULL)(NULL)(NULL)(NULL)(NULL) Error: (08/27/2014 03:11:42 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (08/27/2014 10:07:58 AM) (Source: MsiInstaller) (EventID: 11310) (User: Ankis-Laptop) Description: Produkt: Akamai NetSession Interface -- Fehler 1310. Fehler beim Schreiben in die Datei: C:\Users\Anki\AppData\Local\Akamai\admintool.exe. Systemfehler 0. Stellen Sie sicher, dass Sie auf das Verzeichnis zugreifen können.(NULL)(NULL)(NULL)(NULL)(NULL) Error: (08/27/2014 10:07:34 AM) (Source: MsiInstaller) (EventID: 11310) (User: Ankis-Laptop) Description: Produkt: Akamai NetSession Interface -- Fehler 1310. Fehler beim Schreiben in die Datei: C:\Users\Anki\AppData\Local\Akamai\admintool.exe. Systemfehler 0. Stellen Sie sicher, dass Sie auf das Verzeichnis zugreifen können.(NULL)(NULL)(NULL)(NULL)(NULL) Error: (08/27/2014 09:11:41 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (08/26/2014 06:19:22 PM) (Source: MsiInstaller) (EventID: 11310) (User: Ankis-Laptop) Description: Produkt: Akamai NetSession Interface -- Fehler 1310. Fehler beim Schreiben in die Datei: C:\Users\Anki\AppData\Local\Akamai\admintool.exe. Systemfehler 0. Stellen Sie sicher, dass Sie auf das Verzeichnis zugreifen können.(NULL)(NULL)(NULL)(NULL)(NULL) Error: (08/26/2014 06:18:33 PM) (Source: MsiInstaller) (EventID: 11310) (User: Ankis-Laptop) Description: Produkt: Akamai NetSession Interface -- Fehler 1310. Fehler beim Schreiben in die Datei: C:\Users\Anki\AppData\Local\Akamai\admintool.exe. Systemfehler 0. Stellen Sie sicher, dass Sie auf das Verzeichnis zugreifen können.(NULL)(NULL)(NULL)(NULL)(NULL) ==================== Memory info =========================== Processor: Intel(R) Core(TM) i5-2410M CPU @ 2.30GHz Percentage of memory in use: 33% Total physical RAM: 8104.62 MB Available physical RAM: 5366.88 MB Total Pagefile: 16207.42 MB Available Pagefile: 13157.21 MB Total Virtual: 8192 MB Available Virtual: 8191.83 MB ==================== Drives ================================ Drive c: (System) (Fixed) (Total:50 GB) (Free:4.06 GB) NTFS Drive d: (Data) (Fixed) (Total:628.01 GB) (Free:572.44 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 698.6 GB) (Disk ID: F1E2CB29) Partition 1: (Active) - (Size=2.1 GB) - (Type=27) Partition 2: (Not Active) - (Size=696.6 GB) - (Type=OF Extended) ==================== End Of Log ============================ Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net Rootkit scan 2014-08-27 20:29:31 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 TOSHIBA_ rev.GT00 698,64GB Running: Gmer-19357.exe; Driver: C:\Users\Anki\AppData\Local\Temp\kwtyqpow.sys ---- Kernel code sections - GMER 2.1 ---- INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff800033f3000 18 bytes [00, 00, 66, 00, 4D, 6D, 52, ...] INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 547 fffff800033f3013 44 bytes {ADC AL, [RAX+0x50fffffa]; RCL [RDX], CL; CMP DL, 0xff; CALL QWORD [RAX-0x7fecca5d]} ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe[1372] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000753b1465 2 bytes [3B, 75] .text C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe[1372] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000753b14bb 2 bytes [3B, 75] .text ... * 2 .text C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[1804] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000753b1465 2 bytes [3B, 75] .text C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[1804] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000753b14bb 2 bytes [3B, 75] .text ... * 2 .text D:\Programme\Kodak\AiO\Center\EKAiOHostService.exe[2548] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000753b1465 2 bytes [3B, 75] .text D:\Programme\Kodak\AiO\Center\EKAiOHostService.exe[2548] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000753b14bb 2 bytes [3B, 75] .text ... * 2 .text D:\Programme\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[2596] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000753b1465 2 bytes [3B, 75] .text D:\Programme\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[2596] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000753b14bb 2 bytes [3B, 75] .text ... * 2 .text C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[2096] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000753b1465 2 bytes [3B, 75] .text C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[2096] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000753b14bb 2 bytes [3B, 75] .text ... * 2 .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[1280] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000753b1465 2 bytes [3B, 75] .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[1280] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000753b14bb 2 bytes [3B, 75] .text ... * 2 .text C:\Windows\SysWOW64\mjcm\dnkt.exe[2724] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000753b1465 2 bytes [3B, 75] .text C:\Windows\SysWOW64\mjcm\dnkt.exe[2724] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000753b14bb 2 bytes [3B, 75] .text ... * 2 .text C:\Users\Anki\AppData\Roaming\Dropbox\bin\Dropbox.exe[4556] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 69 00000000753b1465 2 bytes [3B, 75] .text C:\Users\Anki\AppData\Roaming\Dropbox\bin\Dropbox.exe[4556] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 155 00000000753b14bb 2 bytes [3B, 75] .text ... * 2 .text C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe[5040] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000753b1465 2 bytes [3B, 75] .text C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe[5040] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000753b14bb 2 bytes [3B, 75] .text ... * 2 .text C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe[5348] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000753b1465 2 bytes [3B, 75] .text C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe[5348] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000753b14bb 2 bytes [3B, 75] .text ... * 2 .text D:\Programme\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe[5448] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000753b1465 2 bytes [3B, 75] .text D:\Programme\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe[5448] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000753b14bb 2 bytes [3B, 75] .text ... * 2 .text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5548] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000753b1465 2 bytes [3B, 75] .text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5548] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000753b14bb 2 bytes [3B, 75] .text ... * 2 .text C:\Users\Anki\AppData\Local\Akamai\netsession_win.exe[3204] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000753b1465 2 bytes [3B, 75] .text C:\Users\Anki\AppData\Local\Akamai\netsession_win.exe[3204] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000753b14bb 2 bytes [3B, 75] .text ... * 2 .text C:\Users\Anki\AppData\Local\Akamai\netsession_win.exe[1964] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000753b1465 2 bytes [3B, 75] .text C:\Users\Anki\AppData\Local\Akamai\netsession_win.exe[1964] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000753b14bb 2 bytes [3B, 75] .text ... * 2 ---- Processes - GMER 2.1 ---- Library C:\Users\Anki\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll (*** suspicious ***) @ C:\Users\Anki\AppData\Roaming\Dropbox\bin\Dropbox.exe [4556](2014-08-15 18:46:08) 0000000003d30000 Library c:\users\anki\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmphmnrxj.dll (*** suspicious ***) @ C:\Users\Anki\AppData\Roaming\Dropbox\bin\Dropbox.exe [4556](2014-08-27 13:16:25) 00000000026e0000 Library C:\Users\Anki\AppData\Roaming\Dropbox\bin\libcef.dll (*** suspicious ***) @ C:\Users\Anki\AppData\Roaming\Dropbox\bin\Dropbox.exe [4556](2013-08-23 19:01:44) 000000005eea0000 Library C:\Users\Anki\AppData\Roaming\Dropbox\bin\icudt.dll (*** suspicious ***) @ C:\Users\Anki\AppData\Roaming\Dropbox\bin\Dropbox.exe [4556] (ICU Data DLL/The ICU Project)(2013-08-23 19:01:42) 000000005e0b0000 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00150079fe36 Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\bc7737325f68 Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\bc7737325f68@6c23b99bd157 0x2D 0xE4 0xB6 0xCC ... Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\bc7737325f68@002547dfedea 0x7F 0xBD 0x56 0x2E ... Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\bc7737325f68@c81479c57959 0x97 0xE4 0x13 0x14 ... Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\bc7737325f68@18879609750f 0x40 0xB6 0x87 0x69 ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00150079fe36 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\bc7737325f68 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\bc7737325f68@6c23b99bd157 0x2D 0xE4 0xB6 0xCC ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\bc7737325f68@002547dfedea 0x7F 0xBD 0x56 0x2E ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\bc7737325f68@c81479c57959 0x97 0xE4 0x13 0x14 ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\bc7737325f68@18879609750f 0x40 0xB6 0x87 0x69 ... ---- EOF - GMER 2.1 ---- Danke vorab für die Hilfe. Viele Grüße Sandra |
27.08.2014, 19:51 | #2 |
/// the machine /// TB-Ausbilder | viel Werbung,unglaublich langsamer Rechner hi,
__________________Adware & Co. deinstallieren
Scan mit Combofix
__________________ |
28.08.2014, 09:14 | #3 |
| viel Werbung,unglaublich langsamer RechnerCode:
ATTFilter ComboFix 14-08-28.01 - Anki 28.08.2014 9:57.1.4 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.8105.5199 [GMT 2:00] ausgeführt von:: c:\users\Anki\Desktop\ComboFix.exe AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859} SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\Roaming c:\users\Anki\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\chrome.manifest c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\funmoods.css c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\funmoods.xul c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\arwDwn.gif c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\ae.png c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\bg.png c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\ch.png c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\cn.png c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\cz.png c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\de.png c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\eg.png c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\en.png c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\es.png c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\fr.png c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\gr.png c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\he.png c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\il.png c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\it.png c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\ja.png c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\jp.png c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\nl.png c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\no.png c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\pl.png c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\pt.png c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\ro.png c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\ru.png c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\sa.png c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\se.png c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\sv.png c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\tr.png c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\ua.png c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\us.png c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\help_16.gif c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\home.gif c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\logo.png c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\privecy_16_hot.gif c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\imgs\tellafriend.gif c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\loader.xul c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\mtstart.js c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\tmplt.js c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\content\uninsthk.js c:\users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\extensions\ffxtlbr@funmoods.com\install.rdf c:\windows\SysWow64\drivers\10CF_FUJITSU_FTS_LIFEBOOK AH531 GFO_PI_FUJITSU_FJNBB10_Default System BIOS_FUJ - 1_1.16_Intel(R) HD Graphics Family_NVIDIA GeForce GT 525M .MRK . . ((((((((((((((((((((((( Dateien erstellt von 2014-07-28 bis 2014-08-28 )))))))))))))))))))))))))))))) . . 2014-08-28 07:38 . 2014-08-28 07:38 -------- d-----w- c:\program files (x86)\VS Revo Group 2014-08-28 07:35 . 2014-08-28 07:35 -------- d-sh--w- c:\users\Anki\AppData\Local\EmieUserList 2014-08-28 07:35 . 2014-08-28 07:35 -------- d-sh--w- c:\users\Anki\AppData\Local\EmieSiteList 2014-08-27 18:03 . 2014-08-27 18:05 -------- d-----w- C:\FRST 2014-08-22 18:55 . 2014-08-22 18:55 -------- d-----w- c:\program files\Microsoft Silverlight 2014-08-22 18:55 . 2014-08-22 18:55 -------- d-----w- c:\program files (x86)\Microsoft Silverlight 2014-08-16 12:27 . 2014-03-09 21:48 171160 ----a-w- c:\windows\system32\infocardapi.dll 2014-08-16 12:27 . 2014-03-09 21:48 1389208 ----a-w- c:\windows\system32\icardagt.exe 2014-08-16 12:27 . 2014-03-09 21:47 99480 ----a-w- c:\windows\SysWow64\infocardapi.dll 2014-08-16 12:27 . 2014-03-09 21:47 619672 ----a-w- c:\windows\SysWow64\icardagt.exe 2014-08-16 12:27 . 2014-06-30 22:24 8856 ----a-w- c:\windows\system32\icardres.dll 2014-08-16 12:27 . 2014-06-30 22:14 8856 ----a-w- c:\windows\SysWow64\icardres.dll 2014-08-16 12:27 . 2014-06-06 06:16 35480 ----a-w- c:\windows\SysWow64\TsWpfWrp.exe 2014-08-16 12:27 . 2014-06-06 06:12 35480 ----a-w- c:\windows\system32\TsWpfWrp.exe 2014-08-16 08:27 . 2014-07-16 03:23 2048 ----a-w- c:\windows\system32\tzres.dll 2014-08-16 08:27 . 2014-07-16 02:46 2048 ----a-w- c:\windows\SysWow64\tzres.dll 2014-08-16 08:23 . 2014-07-14 02:02 1216000 ----a-w- c:\windows\system32\rpcrt4.dll 2014-08-16 08:23 . 2014-07-14 01:40 664064 ----a-w- c:\windows\SysWow64\rpcrt4.dll 2014-08-05 09:40 . 2014-08-05 09:40 -------- d-----w- c:\users\Anki\AppData\Local\Skype 2014-08-05 09:40 . 2014-08-05 09:40 -------- d-----w- c:\program files (x86)\Common Files\Skype 2014-08-03 20:15 . 2014-05-14 16:23 44512 ----a-w- c:\windows\system32\wups2.dll 2014-08-03 20:15 . 2014-05-14 16:23 58336 ----a-w- c:\windows\system32\wuauclt.exe 2014-08-03 20:15 . 2014-05-14 16:23 2477536 ----a-w- c:\windows\system32\wuaueng.dll 2014-08-03 20:15 . 2014-05-14 16:21 2620928 ----a-w- c:\windows\system32\wucltux.dll 2014-08-03 20:14 . 2014-05-14 16:23 38880 ----a-w- c:\windows\system32\wups.dll 2014-08-03 20:14 . 2014-05-14 16:23 36320 ----a-w- c:\windows\SysWow64\wups.dll 2014-08-03 20:14 . 2014-05-14 16:23 700384 ----a-w- c:\windows\system32\wuapi.dll 2014-08-03 20:14 . 2014-05-14 16:23 581600 ----a-w- c:\windows\SysWow64\wuapi.dll 2014-08-03 20:14 . 2014-05-14 16:20 97792 ----a-w- c:\windows\system32\wudriver.dll 2014-08-03 20:14 . 2014-05-14 16:17 92672 ----a-w- c:\windows\SysWow64\wudriver.dll 2014-08-03 20:14 . 2014-05-14 07:23 198600 ----a-w- c:\windows\system32\wuwebv.dll 2014-08-03 20:14 . 2014-05-14 07:23 179656 ----a-w- c:\windows\SysWow64\wuwebv.dll 2014-08-03 20:14 . 2014-05-14 07:20 36864 ----a-w- c:\windows\system32\wuapp.exe 2014-08-03 20:14 . 2014-05-14 07:17 33792 ----a-w- c:\windows\SysWow64\wuapp.exe . . . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2014-08-21 09:53 . 2014-06-30 11:42 2919728 ----a-w- c:\windows\system32\ddddeeee.exe 2014-08-17 09:03 . 2012-05-26 05:06 99218768 ----a-w- c:\windows\system32\MRT.exe 2014-08-04 15:19 . 2010-06-24 18:33 23256 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2014-07-15 12:03 . 2013-12-17 18:53 42040 ----a-w- c:\windows\system32\drivers\avnetflt.sys 2014-07-09 07:15 . 2012-04-08 14:49 699056 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2014-07-09 07:15 . 2011-09-28 16:11 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2014-07-09 07:15 . 2014-07-09 07:15 11204096 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe 2014-06-24 12:55 . 2013-12-17 18:53 117712 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2014-06-18 02:18 . 2014-07-09 17:22 692736 ----a-w- c:\windows\system32\osk.exe 2014-06-18 01:51 . 2014-07-09 17:22 646144 ----a-w- c:\windows\SysWow64\osk.exe 2014-06-18 01:10 . 2014-07-09 17:22 3157504 ----a-w- c:\windows\system32\win32k.sys 2014-06-06 10:10 . 2014-07-09 17:22 624128 ----a-w- c:\windows\system32\qedit.dll 2014-06-06 09:44 . 2014-07-09 17:22 509440 ----a-w- c:\windows\SysWow64\qedit.dll 2014-06-05 14:45 . 2014-07-09 17:22 1460736 ----a-w- c:\windows\system32\lsasrv.dll 2014-06-05 14:26 . 2014-07-09 17:22 22016 ----a-w- c:\windows\SysWow64\secur32.dll 2014-06-05 14:25 . 2014-07-09 17:22 96768 ----a-w- c:\windows\SysWow64\sspicli.dll 2014-05-30 08:08 . 2014-07-09 17:22 210944 ----a-w- c:\windows\system32\wdigest.dll 2014-05-30 08:08 . 2014-07-09 17:22 86528 ----a-w- c:\windows\system32\TSpkg.dll 2014-05-30 08:08 . 2014-07-09 17:22 340992 ----a-w- c:\windows\system32\schannel.dll 2014-05-30 08:08 . 2014-07-09 17:22 314880 ----a-w- c:\windows\system32\msv1_0.dll 2014-05-30 08:08 . 2014-07-09 17:22 307200 ----a-w- c:\windows\system32\ncrypt.dll 2014-05-30 08:08 . 2014-07-09 17:22 728064 ----a-w- c:\windows\system32\kerberos.dll 2014-05-30 08:08 . 2014-07-09 17:22 22016 ----a-w- c:\windows\system32\credssp.dll . . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2014-06-24 22:04 131480 ----a-w- c:\users\Anki\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2014-06-24 22:04 131480 ----a-w- c:\users\Anki\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2014-06-24 22:04 131480 ----a-w- c:\users\Anki\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584] "SoftAuto.exe"="c:\program files (x86)\Creative\Software Update 3\SoftAuto.exe" [2008-08-13 405504] "swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-09-28 39408] "Akamai NetSession Interface"="c:\users\Anki\AppData\Local\Akamai\netsession_win.exe" [2013-06-05 4489472] "GarminExpressTrayApp"="c:\program files (x86)\Garmin\Express Tray\ExpressTray.exe" [2014-08-07 688984] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "IndicatorUtility"="c:\program files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe" [2010-09-30 48752] "snp2uvc"="c:\windows\vsnp2uvc.exe" [2009-08-13 662016] "DeskUpdateNotifier"="c:\fujitsu\Programs\DeskUpdate\DeskUpdateNotifier.exe" [2010-10-13 97560] "UCam_Menu"="c:\program files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504] "YouCam Mirror Tray icon"="c:\program files (x86)\CyberLink\YouCam\YouCamTray.exe" [2009-07-08 162912] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904] "Cisco AnyConnect Secure Mobility Agent for Windows"="c:\program files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" [2012-08-03 685048] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848] "avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-08-05 751184] "Avira Systray"="c:\program files (x86)\Avira\My Avira\Avira.OE.Systray.exe" [2014-08-04 161584] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "GarminExpressTrayApp"="c:\program files (x86)\Garmin\Express Tray\ExpressTray.exe" [2014-08-07 688984] . c:\users\Anki\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dropbox.lnk - c:\users\Anki\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-8-15 36414752] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Google Calendar Sync.lnk - c:\program files (x86)\Google\Google Calendar Sync\GoogleCalendarSync.exe [2011-4-8 542264] . c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ LaunchCenter.lnk - c:\program files\Fujitsu\LaunchCenter\LaunchCenter.exe [2011-4-12 375296] newreminderdialog.lnk - c:\program files\Fujitsu\FujitsuRecovery\NewReminderDialog.exe [2011-9-29 931096] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "Userinit"="userinit.exe" . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) "AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x] R2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;d:\programme\Kodak\AiO\Center\EKAiOHostService.exe;d:\programme\Kodak\AiO\Center\EKAiOHostService.exe [x] R2 Kodak AiO Status Monitor Service;Kodak AiO Status Monitor Service;d:\programme\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe;d:\programme\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe [x] R3 acsock;acsock;c:\windows\system32\DRIVERS\acsock64.sys;c:\windows\SYSNATIVE\DRIVERS\acsock64.sys [x] R3 btmaudio;Intel Bluetooth Audio Service;c:\windows\system32\drivers\btmaud.sys;c:\windows\SYSNATIVE\drivers\btmaud.sys [x] R3 CTUPnPSv;Creative Centrale Media Server;c:\program files (x86)\Creative\Creative Centrale\CTUPnPSv.exe;c:\program files (x86)\Creative\Creative Centrale\CTUPnPSv.exe [x] R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x] R3 FlexNet Licensing Service 64;FlexNet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [x] R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys;c:\windows\SYSNATIVE\DRIVERS\ewusbdev.sys [x] R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x] R3 intaud_WaveExtensible;Intel WiDi Audio Device;c:\windows\system32\drivers\intelaud.sys;c:\windows\SYSNATIVE\drivers\intelaud.sys [x] R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x] R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x] S0 FBIOSDRV;Fujitsu BIOS Driver;c:\windows\System32\Drivers\FBIOSDRV.sys;c:\windows\SYSNATIVE\Drivers\FBIOSDRV.sys [x] S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x] S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x] S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x] S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x] S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [x] S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe [x] S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe [x] S2 Garmin Core Update Service;Garmin Core Update Service;c:\program files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe;c:\program files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [x] S2 PFNService;PFNService;c:\program files\Fujitsu\Plugfree NETWORK\PFNService.exe;c:\program files\Fujitsu\Plugfree NETWORK\PFNService.exe [x] S2 PowerSavingUtilityService;PowerSavingUtilityService;c:\program files\Fujitsu\PSUtility\PSUService.exe;c:\program files\Fujitsu\PSUtility\PSUService.exe [x] S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x] S2 vpnagent;Cisco AnyConnect Secure Mobility Agent;c:\program files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe;c:\program files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe [x] S3 Bluetooth Media Service;Bluetooth Media Service;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe [x] S3 btmaux;Intel Bluetooth Auxiliary Service;c:\windows\system32\DRIVERS\btmaux.sys;c:\windows\SYSNATIVE\DRIVERS\btmaux.sys [x] S3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys;c:\windows\SYSNATIVE\DRIVERS\btmhsf.sys [x] S3 FUJ02E3;Fujitsu FUJ02E3 Device Driver;c:\windows\system32\drivers\FUJ02E3.sys;c:\windows\SYSNATIVE\drivers\FUJ02E3.sys [x] S3 iBtFltCoex;iBtFltCoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys;c:\windows\SYSNATIVE\DRIVERS\iBtFltCoex.sys [x] S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x] S3 iwdbus;IWD Bus Enumerator;c:\windows\system32\DRIVERS\iwdbus.sys;c:\windows\SYSNATIVE\DRIVERS\iwdbus.sys [x] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x] . . --- Andere Dienste/Treiber im Speicher --- . *NewlyCreated* - WS2IFSL . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2014-08-16 08:37 1104200 ----a-w- c:\program files (x86)\Google\Chrome\Application\36.0.1985.143\Installer\chrmstp.exe . Inhalt des "geplante Tasks" Ordners . 2014-08-28 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-08 07:15] . 2014-08-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-28 13:35] . 2014-08-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-28 13:35] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2014-06-24 22:04 164760 ----a-w- c:\users\Anki\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2014-06-24 22:04 164760 ----a-w- c:\users\Anki\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2014-06-24 22:04 164760 ----a-w- c:\users\Anki\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2014-06-24 22:04 164760 ----a-w- c:\users\Anki\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BTMTrayAgent"="c:\program files (x86)\Intel\Bluetooth\btmshell.dll" [2010-11-03 10228224] "LoadFUJ02E3"="c:\program files\Fujitsu\FUJ02E3\FUJ02E3.exe" [2010-06-08 45680] "FDM7"="c:\program files\Fujitsu\FDM7\FdmDaemon.exe" [2009-11-26 164712] "PSUTility"="c:\program files\Fujitsu\PSUtility\TrayManager.exe" [2010-11-13 199528] "PfNet"="c:\program files\Fujitsu\Plugfree NETWORK\PfNet.exe" [2010-10-07 6311424] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-12-07 11663464] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-04-20 168216] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-20 392472] "Persistence"="c:\windows\system32\igfxpers.exe" [2011-04-20 416024] "IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2011-01-05 1933584] "snp2uvc"="c:\windows\vsnp2uvc.exe" [2009-08-13 662016] "LoadFujitsuQuickTouch"="c:\program files\Fujitsu\Application Panel\QuickTouch.exe" [2010-07-16 162416] "LoadBtnHnd"="c:\program files\Fujitsu\Application Panel\BtnHnd.exe" [2010-07-09 21616] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"=c:\windows\System32\nvinitx.dll . ------- Zusätzlicher Suchlauf ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.google.com/ mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = <local> IE: &Citavi Picker... - file://c:\program files (x86)\Internet Explorer\Citavi Picker\ShowContextMenu.html IE: An OneNote s&enden - d:\progra~1\OFFICE~1\Office14\ONBttnIE.dll/105 IE: Nach Microsoft E&xcel exportieren - d:\progra~1\OFFICE~1\Office14\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.2.1 TCP: Interfaces\{8B3FB879-A879-4DA2-A511-75640B25BE91}: NameServer = 144.41.2.20,144.41.5.20 . - - - - Entfernte verwaiste Registrierungseinträge - - - - . Toolbar-Locked - (no file) Wow6432Node-HKCU-Run-XSC SIP Client - d:\programme\sipgate X-Lite\sipgateXLite.exe Wow6432Node-HKLM-Run-BCSSync - d:\programme\Office 2010\Office14\BCSSync.exe Wow6432Node-HKLM-Run-EKStatusMonitor - d:\programme\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe Wow6432Node-HKLM-Run-Conime - c:\windows\system32\conime.exe Wow6432Node-HKU-Default-RunOnce-KodakHomeCenter - d:\programme\Kodak\AiO\Center\AiOHomeCenter.exe c:\users\Anki\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk - d:\programme\Office 2010\Office14\ONENOTEM.EXE /tsr HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start Toolbar-Locked - (no file) HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe HKLM-Run-CIS_{81EFDD93-DBBE-415B-BE6E-49B9664E3E82} - c:\programdata\cis2271.exe AddRemove-DAEMON Tools Lite - d:\programme\DAEMON Tools Lite\uninst.exe AddRemove-MediaMonkey_is1 - d:\programme\MediaMonkey\unins000.exe AddRemove-Mozilla Firefox 7.0 (x86 de) - d:\programme\Mozilla\uninstall\helper.exe AddRemove-VLC media player - d:\programme\VLC\uninstall.exe AddRemove-{EBE030DD-D404-4D92-85E9-8C3624820808}_is1 - d:\programme\Image Resizer 4\unins000.exe AddRemove-Mozilla Firefox 31.0 (x86 de) - d:\programme\Mozilla\uninstall\helper.exe . . . --------------------- Gesperrte Registrierungsschluessel --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*] @="?????????????????? v1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID] @="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*] @="?????????????????? v2" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID] @="{9BE31822-FDAD-461B-AD51-BE1D1C159921}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Key"="ActionsPane3" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Weitere laufende Prozesse ------------------------ . c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe c:\program files (x86)\Creative\Shared Files\CTDevSrv.exe c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe . ************************************************************************** . Zeit der Fertigstellung: 2014-08-28 10:10:02 - PC wurde neu gestartet ComboFix-quarantined-files.txt 2014-08-28 08:10 . Vor Suchlauf: 3.844.415.488 Bytes frei Nach Suchlauf: 5.642.412.032 Bytes frei . - - End Of File - - 608ECAF70312FE4988D236EBCC3ACE8B |
29.08.2014, 07:57 | #4 |
/// the machine /// TB-Ausbilder | viel Werbung,unglaublich langsamer Rechner Downloade Dir bitte Malwarebytes Anti-Malware
Downloade Dir bitte AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
29.08.2014, 09:04 | #5 |
| viel Werbung,unglaublich langsamer RechnerCode:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Protection, 29.08.2014 09:15:38, SYSTEM, ANKIS-LAPTOP, Protection, Malware Protection, Starting, Protection, 29.08.2014 09:15:38, SYSTEM, ANKIS-LAPTOP, Protection, Malware Protection, Started, Protection, 29.08.2014 09:15:38, SYSTEM, ANKIS-LAPTOP, Protection, Malicious Website Protection, Starting, Protection, 29.08.2014 09:16:05, SYSTEM, ANKIS-LAPTOP, Protection, Malicious Website Protection, Started, Update, 29.08.2014 09:17:05, SYSTEM, ANKIS-LAPTOP, Manual, Rootkit Database, 2014.2.20.1, 2014.8.21.1, Update, 29.08.2014 09:17:13, SYSTEM, ANKIS-LAPTOP, Manual, Malware Database, 2014.3.4.9, 2014.8.29.2, Protection, 29.08.2014 09:17:18, SYSTEM, ANKIS-LAPTOP, Protection, Refresh, Starting, Protection, 29.08.2014 09:17:18, SYSTEM, ANKIS-LAPTOP, Protection, Malicious Website Protection, Stopping, Protection, 29.08.2014 09:17:18, SYSTEM, ANKIS-LAPTOP, Protection, Malicious Website Protection, Stopped, Protection, 29.08.2014 09:17:22, SYSTEM, ANKIS-LAPTOP, Protection, Refresh, Success, Protection, 29.08.2014 09:17:22, SYSTEM, ANKIS-LAPTOP, Protection, Malicious Website Protection, Starting, Protection, 29.08.2014 09:17:22, SYSTEM, ANKIS-LAPTOP, Protection, Malicious Website Protection, Started, Protection, 29.08.2014 09:38:03, SYSTEM, ANKIS-LAPTOP, Protection, Malware Protection, Starting, Protection, 29.08.2014 09:38:03, SYSTEM, ANKIS-LAPTOP, Protection, Malware Protection, Started, Protection, 29.08.2014 09:38:03, SYSTEM, ANKIS-LAPTOP, Protection, Malicious Website Protection, Starting, Protection, 29.08.2014 09:39:28, SYSTEM, ANKIS-LAPTOP, Protection, Malicious Website Protection, Started, (end) Code:
ATTFilter # AdwCleaner v3.308 - Bericht erstellt am 29/08/2014 um 09:47:33 # Aktualisiert 20/08/2014 von Xplode # Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits) # Benutzername : Anki - ANKIS-LAPTOP # Gestartet von : C:\Users\Anki\Downloads\adwcleaner_3.308.exe # Option : Löschen ***** [ Dienste ] ***** ***** [ Dateien / Ordner ] ***** Ordner Gelöscht : C:\ProgramData\Partner Ordner Gelöscht : C:\ProgramData\Tarma Installer Ordner Gelöscht : C:\Program Files (x86)\SweetIM Ordner Gelöscht : C:\Users\Anki\AppData\Local\PackageAware Ordner Gelöscht : C:\Users\Anki\AppData\Roaming\pdfforge Ordner Gelöscht : C:\Users\Anki\AppData\Roaming\Systweak Datei Gelöscht : C:\Windows\System32\roboot64.exe Datei Gelöscht : C:\Users\Anki\AppData\LocalLow\SkwConfig.bin Datei Gelöscht : C:\Users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\searchplugins\MyStart.xml Datei Gelöscht : C:\Users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\user.js ***** [ Tasks ] ***** ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BundleSweetIMSetup_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BundleSweetIMSetup_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetim_rasapi32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetim_rasmancs Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetpacksupdatemanager_rasapi32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetPacksUpdateManager_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_mp3directcut_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_mp3directcut_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5} Schlüssel Gelöscht : HKCU\Software\Conduit Schlüssel Gelöscht : HKCU\Software\IM Schlüssel Gelöscht : HKCU\Software\ImInstaller Schlüssel Gelöscht : HKCU\Software\OCS Schlüssel Gelöscht : HKCU\Software\powerpack Schlüssel Gelöscht : HKCU\Software\Softonic Schlüssel Gelöscht : HKCU\Software\systweak Schlüssel Gelöscht : HKLM\SOFTWARE\systweak Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4 ***** [ Browser ] ***** -\\ Internet Explorer v11.0.9600.17239 -\\ Mozilla Firefox v7.0 (de) [ Datei : C:\Users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\prefs.js ] Zeile gelöscht : user_pref("extensions.funmoods_i.aflt", "ddrnw"); Zeile gelöscht : user_pref("extensions.funmoods_i.dfltLng", ""); Zeile gelöscht : user_pref("extensions.funmoods_i.dfltSrch", true); Zeile gelöscht : user_pref("extensions.funmoods_i.dnsErr", true); Zeile gelöscht : user_pref("extensions.funmoods_i.excTlbr", false); Zeile gelöscht : user_pref("extensions.funmoods_i.hmpg", true); Zeile gelöscht : user_pref("extensions.funmoods_i.hmpgUrl", "hxxp://start.funmoods.com/?f=1&a=ddrnw"); Zeile gelöscht : user_pref("extensions.funmoods_i.id", "9c42c511000000000000bc7737325f65"); Zeile gelöscht : user_pref("extensions.funmoods_i.instlDay", "15445"); Zeile gelöscht : user_pref("extensions.funmoods_i.instlRef", ""); Zeile gelöscht : user_pref("extensions.funmoods_i.newTab", true); Zeile gelöscht : user_pref("extensions.funmoods_i.newTabUrl", "hxxp://start.funmoods.com/?f=2&a=ddrnw"); Zeile gelöscht : user_pref("extensions.funmoods_i.prdct", "funmoods"); Zeile gelöscht : user_pref("extensions.funmoods_i.prtnrId", "funmoods"); Zeile gelöscht : user_pref("extensions.funmoods_i.smplGrp", "none"); Zeile gelöscht : user_pref("extensions.funmoods_i.srchPrvdr", "Search"); Zeile gelöscht : user_pref("extensions.funmoods_i.tlbrId", "base"); Zeile gelöscht : user_pref("extensions.funmoods_i.tlbrSrchUrl", "hxxp://start.funmoods.com/results.php?f=3&a=ddrnw&q="); Zeile gelöscht : user_pref("extensions.funmoods_i.vrsn", "1.5.11.16"); Zeile gelöscht : user_pref("extensions.funmoods_i.vrsnTs", "1.5.11.1614:53:48"); Zeile gelöscht : user_pref("extensions.funmoods_i.vrsni", "1.5.11.16"); Zeile gelöscht : user_pref("extensions.trusted-ads.ExLst", "{\"u\":{\"v\":\"1.96\",\"d\":\"082614\"},\"h\":{\"gazeta.ru\":{\"p\":[{\"e\":\"/.*/\",\"r\":[\"/ads\\\\.adfox\\\\.ru/i\"]}]},\"nickjr.com\":{\"p\":[{\"e\":\"[...] Zeile gelöscht : user_pref("extensions.trusted-ads.list_api", "{\"r\":[\"hxxp://a1supplements.com/\",\"hxxp://aactionair.net/\",\"hxxp://abcnews.go.com/\",\"hxxp://advanceautoparts.com/\",\"hxxp://afasterpc.com/\",\"h[...] Zeile gelöscht : user_pref("extensions.trusted-ads.serpInject", "{\"u\":{\"v\":\"2.72\",\"d\":\"061714\"},\"l\":\"hxxp://search.adtrustmedia.com/search_safecontent.php\",\"e\":[{\"u\":\"hxxp://ads.adtrustmedia.com/con[...] Zeile gelöscht : user_pref("extensions.trusted-ads.serp_mywebsearch", "\"%2F*!%20serp-mywebsearch%20-%20v0.1.10%20-%202014-04-07%2018%3A21%3A58%20*%2F%0D%0Avar%20u%20%3D%20%7B%7D%3B%0A%0Avar%20Util%20%3D%20%7B%0A%09de[...] -\\ Google Chrome v36.0.1985.143 [ Datei : C:\Users\Anki\AppData\Local\Google\Chrome\User Data\Default\preferences ] Gelöscht [Startup_urls] : hxxp://start.funmoods.com/?f=1&a=ddrnw Gelöscht [Homepage] : hxxp://start.funmoods.com/?f=1&a=ddrnw ************************* AdwCleaner[R0].txt - [7106 octets] - [29/08/2014 09:45:03] AdwCleaner[S0].txt - [6674 octets] - [29/08/2014 09:47:33] ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [6734 octets] ########## Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.1.4 (04.06.2014:1) OS: Windows 7 Home Premium x64 Ran by Anki on 29.08.2014 at 9:54:31,43 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-2552170177-1754437681-1621803140-1001\Software\sweetim Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{08DCE5A1-D006-4F5F-8452-0AC58EBE6DDC} ~~~ Files ~~~ Folders Successfully deleted: [Folder] "C:\ProgramData\adtrustmedia" Successfully deleted: [Folder] "C:\ProgramData\apn" Successfully deleted: [Folder] "C:\ProgramData\boost_interprocess" Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{081C19B1-D336-45D7-A046-1B488883E2CC} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{105E5F31-BB30-4182-AAE6-B7CF59CC0B52} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{1103765F-B371-43A2-94F5-64AE6CA4C925} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{13672639-274C-4024-8EB6-36C1FAB410BB} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{1636A8AF-D149-4622-8D1A-49CA74B25825} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{1D9CEAE4-A41A-4B89-9812-08B3B50A5C1D} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{222EAA5E-5ACA-48DA-9E1A-4033EDBE0396} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{25C172FE-EF22-4394-957E-6B988A714470} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{27750EA2-DCBF-4524-8142-E3963C8258C1} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{2A2C6A3A-A85F-4F7B-8B28-EC2D9B50F519} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{2AC8C915-B154-4B7D-BF2D-47849E9463FD} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{32FC699A-4B2D-49EA-82F0-0FB6676996BD} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{33A0D904-2025-417E-8464-4B082D80D97B} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{388D92CB-A5AA-4E36-BD13-B680070E8776} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{39030C0F-B693-464F-B964-3B9A0C5644F9} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{3F6D5D08-9D78-4E2E-8743-BE4B807C4F19} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{4591FDC8-E352-41DB-8B14-97884E283934} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{45CAA931-B5D6-40C0-AF1B-6B350336E1DB} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{460293DE-97AA-40E5-9E07-B2085D63EE2F} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{464BC885-C6F3-4A8F-BD0A-9E9490080A67} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{4732FA39-C995-4155-9A8C-C3A19F98A4BB} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{52B3CE6C-6CB7-45B2-A454-D8D77948038D} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{5AFB52FA-AD18-4579-828F-8BD5074EAC44} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{602D803D-77C9-40B6-BEE8-8D75F6062D58} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{68791A2F-5707-42D8-BA4B-42EF95401EFF} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{6CD7C00D-1606-4429-B5A8-9F6C7437F2B6} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{7044D55D-7684-418E-B6E5-63FF76765038} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{7932F0FF-05F1-4070-AA3E-690A10E2AD0A} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{7FF96484-97B5-4FC1-A3A8-E4D5A7ED6A20} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{82CEB602-BFD5-42B3-AF6E-431281A2286A} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{850A2E5F-2603-441B-AC95-577468611061} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{8F34BCD0-312E-4276-B1BC-221CB3B4CDDB} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{93FFD9E7-3E12-4324-8ADD-A5009BA812D8} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{9404509B-9D8E-4963-B5A8-D999053BB612} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{999FA8DA-D0B6-4F3D-B3EF-882992FB7DA7} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{9C5B2ECD-EEF7-48D9-A3B0-4B90FBE76858} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{9CFA2197-F2BE-4BAA-BCDD-957068A5AA71} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{A22A90FB-9D18-4033-8E75-A34533A1B151} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{A4E28735-EE6A-4F30-AB03-CE73E9093EA0} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{A5B76133-E0E7-41E7-ABA2-66143D90B6E1} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{AAC8B777-1B3A-4A26-8637-0087E53C079B} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{B25746D0-5B66-4131-B9C7-749F07276E9C} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{B9AEDF53-E16D-4AA3-8BFF-3F4D6B8721CB} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{CC73AC66-D213-4F97-9919-178FA9E4C25F} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{CD47FBB5-5A50-4A18-907E-A2A5ECA05DC2} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{D3ADE49A-EC4A-454A-81E2-773DB5E9D600} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{D5F6409A-9A46-4D8E-9AD4-A3773887EAC9} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{E1D13C27-1AA8-4735-8B68-688E76685F45} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{E24868A3-309C-4E27-B387-208CD0C89120} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{E5E26B05-C3BB-4E7E-8BC6-0D2D2A858DE0} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{E62C89E3-7ECC-4E30-81D0-0D1E3A86E78D} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{ED35E94B-E3C0-46A4-8EB3-16F335F6CE24} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{F2C3932C-F850-402F-829D-B00294C96047} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{F9A2E16D-E516-4500-8D45-920EBD302BCE} Successfully deleted: [Empty Folder] C:\Users\Anki\appdata\local\{FCB0C8A4-82CE-4CB8-94DE-3FA8E8849D78} ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 29.08.2014 at 10:01:18,33 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-08-2014 Ran by Anki (administrator) on ANKIS-LAPTOP on 29-08-2014 10:03:51 Running from C:\Users\Anki\Desktop Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTDevSrv.exe (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (FUJITSU LIMITED) C:\Program Files\Fujitsu\Plugfree NETWORK\PFNService.exe (FUJITSU LIMITED) C:\Program Files\Fujitsu\PSUtility\PSUService.exe (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (FUJITSU LIMITED) C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe (FUJITSU LIMITED) C:\Program Files\Fujitsu\FDM7\FdmDaemon.exe (FUJITSU LIMITED) C:\Program Files\Fujitsu\PSUtility\TrayManager.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Sonix) C:\Windows\vsnp2uvc.exe (FUJITSU LIMITED) C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe (FUJITSU LIMITED) C:\Program Files\Fujitsu\Application Panel\BtnHnd.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Creative Technology Ltd) C:\Program Files (x86)\Creative\Software Update 3\SoftAuto.exe (Akamai Technologies, Inc.) C:\Users\Anki\AppData\Local\Akamai\netsession_win.exe (Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe (Google) C:\Program Files (x86)\Google\Google Calendar Sync\GoogleCalendarSync.exe (FUJITSU LIMITED) C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe (Dropbox, Inc.) C:\Users\Anki\AppData\Roaming\Dropbox\bin\Dropbox.exe (Fujitsu Technology Solutions) C:\Fujitsu\Programs\DeskUpdate\DeskUpdateNotifier.exe (CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamTray.exe (Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe (Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe (Akamai Technologies, Inc.) C:\Users\Anki\AppData\Local\Akamai\netsession_win.exe (FUJITSU LIMITED) C:\Program Files\Fujitsu\Plugfree NETWORK\PFNetDm.exe (FUJITSU LIMITED) C:\Program Files\Fujitsu\Plugfree NETWORK\PFNTray.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1886504 2009-11-19] (Synaptics Incorporated) HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp HKLM\...\Run: [LoadFUJ02E3] => C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe [45680 2010-06-08] (FUJITSU LIMITED) HKLM\...\Run: [FDM7] => C:\Program Files\Fujitsu\FDM7\FdmDaemon.exe [164712 2009-11-26] (FUJITSU LIMITED) HKLM\...\Run: [PSUTility] => C:\Program Files\Fujitsu\PSUtility\TrayManager.exe [199528 2010-11-13] (FUJITSU LIMITED) HKLM\...\Run: [PfNet] => C:\Program Files\Fujitsu\Plugfree NETWORK\PfNet.exe [6311424 2010-10-08] (FUJITSU LIMITED) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11663464 2010-12-07] (Realtek Semiconductor) HKLM\...\Run: [IntelWireless] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1933584 2011-01-05] (Intel(R) Corporation) HKLM\...\Run: [snp2uvc] => C:\Windows\vsnp2uvc.exe [662016 2009-08-13] (Sonix) HKLM\...\Run: [LoadFujitsuQuickTouch] => C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe [162416 2010-07-16] (FUJITSU LIMITED) HKLM\...\Run: [LoadBtnHnd] => C:\Program Files\Fujitsu\Application Panel\BtnHnd.exe [21616 2010-07-09] (FUJITSU LIMITED) HKLM\...\Run: [CIS_{81EFDD93-DBBE-415B-BE6E-49B9664E3E82}] => "C:\ProgramData\cis2271.exe" --PostUninstall {81EFDD93-DBBE-415B-BE6E-49B9664E3E82} HKLM-x32\...\Run: [IndicatorUtility] => C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe [48752 2010-09-30] (FUJITSU LIMITED) HKLM-x32\...\Run: [snp2uvc] => C:\Windows\vsnp2uvc.exe [662016 2009-08-13] (Sonix) HKLM-x32\...\Run: [DeskUpdateNotifier] => c:\Fujitsu\Programs\DeskUpdate\DeskUpdateNotifier.exe [97560 2010-10-13] (Fujitsu Technology Solutions) HKLM-x32\...\Run: [UCam_Menu] => C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.) HKLM-x32\...\Run: [YouCam Mirror Tray icon] => C:\Program Files (x86)\CyberLink\YouCam\YouCamTray.exe [162912 2009-07-08] (CyberLink Corp.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [685048 2012-08-03] (Cisco Systems, Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-05] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [161584 2014-08-04] (Avira Operations GmbH & Co. KG) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\.DEFAULT\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-08-07] (Garmin Ltd or its subsidiaries) HKU\S-1-5-21-2552170177-1754437681-1621803140-1001\...\Run: [SoftAuto.exe] => C:\Program Files (x86)\Creative\Software Update 3\SoftAuto.exe [405504 2008-08-13] (Creative Technology Ltd) HKU\S-1-5-21-2552170177-1754437681-1621803140-1001\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2011-09-28] (Google Inc.) HKU\S-1-5-21-2552170177-1754437681-1621803140-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Anki\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.) HKU\S-1-5-21-2552170177-1754437681-1621803140-1001\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-08-07] (Garmin Ltd or its subsidiaries) HKU\S-1-5-21-2552170177-1754437681-1621803140-1001\...\Policies\Explorer: [] AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [226920 2010-11-17] (NVIDIA Corporation) AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [192616 2010-11-17] (NVIDIA Corporation) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Google Calendar Sync.lnk ShortcutTarget: Google Calendar Sync.lnk -> C:\Program Files (x86)\Google\Google Calendar Sync\GoogleCalendarSync.exe (Google) Startup: C:\Users\Anki\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Anki\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LaunchCenter.lnk ShortcutTarget: LaunchCenter.lnk -> C:\Program Files\Fujitsu\LaunchCenter\LaunchCenter.exe (Fujitsu Technology Solutions) Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\newreminderdialog.lnk ShortcutTarget: newreminderdialog.lnk -> C:\Program Files\Fujitsu\FujitsuRecovery\NewReminderDialog.exe (Fujitsu Technology Solutions) Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LaunchCenter.lnk ShortcutTarget: LaunchCenter.lnk -> C:\Program Files\Fujitsu\LaunchCenter\LaunchCenter.exe (Fujitsu Technology Solutions) Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\newreminderdialog.lnk ShortcutTarget: newreminderdialog.lnk -> C:\Program Files\Fujitsu\FujitsuRecovery\NewReminderDialog.exe (Fujitsu Technology Solutions) ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 1 (GFS Unread Stub) -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => D:\PROGRA~1\OFFICE~1\Office14\GROOVEEX.DLL No File ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 2 (GFS Stub) -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => D:\PROGRA~1\OFFICE~1\Office14\GROOVEEX.DLL No File ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 2.5 (GFS Unread Folder) -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => D:\PROGRA~1\OFFICE~1\Office14\GROOVEEX.DLL No File ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 3 (GFS Folder) -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => D:\PROGRA~1\OFFICE~1\Office14\GROOVEEX.DLL No File ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 4 (GFS Unread Mark) -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => D:\PROGRA~1\OFFICE~1\Office14\GROOVEEX.DLL No File ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=FTSG&bmod=FTSG StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe BHO: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL No File BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> D:\Programme\java\bin\jp2ssv.dll No File BHO-x32: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation) BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> D:\PROGRA~1\OFFICE~1\Office14\GROOVEEX.DLL No File BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> D:\PROGRA~1\OFFICE~1\Office14\URLREDIR.DLL No File BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) ShellExecuteHooks-x32: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - D:\PROGRA~1\OFFICE~1\Office14\GROOVEEX.DLL No File [ ] Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 Tcpip\..\Interfaces\{8B3FB879-A879-4DA2-A511-75640B25BE91}: [NameServer] 144.41.2.20,144.41.5.20 FireFox: ======== FF ProfilePath: C:\Users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default FF Homepage: hxxp://www.google.de/ FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll () FF Plugin: @java.com/JavaPlugin -> D:\Programme\java\bin\new_plugin\npjp2.dll No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL No File FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll () FF Plugin-x32: @java.com/DTPlugin,version=10.17.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.17.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> D:\PROGRA~1\OFFICE~1\Office14\NPAUTHZ.DLL No File FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> D:\PROGRA~1\OFFICE~1\Office14\NPSPWRAP.DLL No File FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.0.5 -> D:\Programme\VLC\npvlc.dll No File FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Extension: Avira Browser Safety - C:\Users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\Extensions\abs@avira.com [2014-08-19] FF Extension: Garmin Communicator - C:\Users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2014-04-06] FF Extension: Adblock Plus - C:\Users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-09-28] FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2014-04-22] FF StartMenuInternet: FIREFOX.EXE - D:\Programme\Mozilla\firefox.exe Chrome: ======= CHR HomePage: Default -> hxxp://www.google.com/ CHR DefaultSearchProvider: Default -> Search CHR DefaultSearchURL: Default -> hxxp://start.funmoods.com/results.php?f=4&a=ddrnw&q={searchTerms} CHR DefaultSuggestURL: Default -> CHR Profile: C:\Users\Anki\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Wallet) - C:\Users\Anki\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-29] CHR Extension: (Citavi Picker) - C:\Users\Anki\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohgndokldibnndfnjnagojmheejlengn [2014-08-29] CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - C:\Program Files (x86)\Citavi 4\Pickers\Chrome\ChromePicker.crx [2014-02-07] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-05] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-05] (Avira Operations GmbH & Co. KG) U4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1021520 2014-08-05] (Avira Operations GmbH & Co. KG) R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [149296 2014-08-04] (Avira Operations GmbH & Co. KG) R2 Bluetooth Device Monitor; C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe [897088 2010-11-03] (Intel Corporation) [File not signed] R3 Bluetooth Media Service; C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe [1298496 2010-11-03] (Intel Corporation) [File not signed] R2 Bluetooth OBEX Service; C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe [983104 2010-11-03] (Intel Corporation) [File not signed] R2 CTDevice_Srv; C:\Program Files (x86)\Creative\Shared Files\CTDevSrv.exe [61440 2007-04-02] (Creative Technology Ltd) [File not signed] S3 CTUPnPSv; C:\Program Files (x86)\Creative\Creative Centrale\CTUPnPSv.exe [64000 2008-05-21] (Creative Technology Ltd) [File not signed] R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [438616 2014-08-07] (Garmin Ltd or its subsidiaries) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-01-05] () R2 PFNService; C:\Program Files\Fujitsu\Plugfree NETWORK\PFNService.exe [331776 2010-10-08] (FUJITSU LIMITED) [File not signed] R2 PowerSavingUtilityService; C:\Program Files\Fujitsu\PSUtility\PSUService.exe [63336 2010-06-18] (FUJITSU LIMITED) S2 SkypeUpdate; D:\Programme\Skype\Updater\Updater.exe [172192 2013-10-23] (Skype Technologies) S2 Kodak AiO Network Discovery Service; D:\Programme\Kodak\AiO\Center\EKAiOHostService.exe [X] S2 Kodak AiO Status Monitor Service; "D:\Programme\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe" [X] S3 Microsoft SharePoint Workspace Audit Service; "D:\Programme\Office 2010\Office14\GROOVE.EXE" /auditservice [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) U5 AppMgmt; C:\Windows\system32\svchost.exe [27648 2011-03-01] (Microsoft Corporation) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-06-24] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-05-22] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-09] (Avira Operations GmbH & Co. KG) U4 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [42040 2014-07-15] (Avira Operations GmbH & Co. KG) R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [270912 2011-09-29] (DT Soft Ltd) R0 FBIOSDRV; C:\Windows\System32\Drivers\FBIOSDRV.sys [21104 2009-06-24] (FUJITSU LIMITED) R3 FUJ02B1; C:\Windows\System32\DRIVERS\FUJ02B1.sys [7808 2006-11-01] (FUJITSU LIMITED) R3 FUJ02E3; C:\Windows\system32\drivers\FUJ02E3.sys [7296 2006-11-01] (FUJITSU LIMITED) S3 hwusbdev; C:\Windows\System32\DRIVERS\ewusbdev.sys [113792 2009-06-22] (Huawei Technologies Co., Ltd.) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-08-29] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation) R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1801216 2010-10-09] () S3 catchme; \??\C:\ComboFix\catchme.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-29 10:01 - 2014-08-29 10:01 - 00006919 _____ () C:\Users\Anki\Desktop\JRT.txt 2014-08-29 09:54 - 2014-08-29 09:54 - 01016261 _____ (Thisisu) C:\Users\Anki\Downloads\JRT.exe 2014-08-29 09:54 - 2014-08-29 09:54 - 00000000 ____D () C:\Windows\ERUNT 2014-08-29 09:52 - 2014-08-29 09:52 - 00006818 _____ () C:\Users\Anki\Desktop\AdwCleaner[S0].txt 2014-08-29 09:44 - 2014-08-29 09:47 - 00000000 ____D () C:\AdwCleaner 2014-08-29 09:44 - 2014-08-29 09:44 - 01364531 _____ () C:\Users\Anki\Downloads\adwcleaner_3.308.exe 2014-08-29 09:43 - 2014-08-29 09:43 - 00001706 _____ () C:\Users\Anki\Desktop\mbam.txt 2014-08-29 09:15 - 2014-08-29 09:50 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-08-29 09:15 - 2014-08-29 09:15 - 00001112 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-08-29 09:15 - 2014-08-29 09:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-08-29 09:15 - 2014-08-29 09:15 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-08-29 09:15 - 2014-08-29 09:15 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-08-29 09:15 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-08-29 09:15 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-08-29 09:15 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-08-29 09:14 - 2014-08-29 09:14 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Anki\Downloads\mbam-setup-2.0.2.1012.exe 2014-08-29 09:12 - 2014-08-29 09:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype 2014-08-28 10:11 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2014-08-28 10:11 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2014-08-28 10:11 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-08-28 10:10 - 2014-08-28 10:10 - 00030053 _____ () C:\ComboFix.txt 2014-08-28 09:56 - 2014-08-28 10:10 - 00000000 ____D () C:\Qoobox 2014-08-28 09:56 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-08-28 09:56 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-08-28 09:56 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-08-28 09:56 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-08-28 09:56 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-08-28 09:56 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe 2014-08-28 09:56 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe 2014-08-28 09:56 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe 2014-08-28 09:55 - 2014-08-28 10:08 - 00000000 ____D () C:\Windows\erdnt 2014-08-28 09:55 - 2014-08-28 09:55 - 05574834 ____R (Swearware) C:\Users\Anki\Desktop\ComboFix.exe 2014-08-28 09:38 - 2014-08-28 09:38 - 00001274 _____ () C:\Users\Anki\Desktop\Revo Uninstaller.lnk 2014-08-28 09:38 - 2014-08-28 09:38 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-08-28 09:37 - 2014-08-28 09:37 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Anki\Desktop\revosetup95.exe 2014-08-28 09:35 - 2014-08-28 09:35 - 00000000 __SHD () C:\Users\Anki\AppData\Local\EmieUserList 2014-08-28 09:35 - 2014-08-28 09:35 - 00000000 __SHD () C:\Users\Anki\AppData\Local\EmieSiteList 2014-08-27 20:29 - 2014-08-27 20:29 - 00015226 _____ () C:\Users\Anki\Desktop\Gmer.txt 2014-08-27 20:05 - 2014-08-27 20:05 - 00380416 _____ () C:\Users\Anki\Desktop\Gmer-19357.exe 2014-08-27 20:04 - 2014-08-27 20:05 - 00046734 _____ () C:\Users\Anki\Desktop\Addition.txt 2014-08-27 20:03 - 2014-08-29 10:03 - 00023734 _____ () C:\Users\Anki\Desktop\FRST.txt 2014-08-27 20:03 - 2014-08-29 10:03 - 00000000 ____D () C:\FRST 2014-08-27 20:02 - 2014-08-27 20:02 - 02103296 _____ (Farbar) C:\Users\Anki\Desktop\FRST64.exe 2014-08-27 20:01 - 2014-08-27 20:01 - 00000470 _____ () C:\Users\Anki\Desktop\defogger_disable.log 2014-08-27 20:01 - 2014-08-27 20:01 - 00000000 _____ () C:\Users\Anki\defogger_reenable 2014-08-27 20:00 - 2014-08-27 20:00 - 00050477 _____ () C:\Users\Anki\Desktop\Defogger.exe 2014-08-22 20:55 - 2014-08-22 20:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2014-08-22 20:55 - 2014-08-22 20:55 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-08-22 20:55 - 2014-08-22 20:55 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-08-22 11:06 - 2014-08-22 11:06 - 00003156 _____ () C:\Windows\System32\Tasks\{C2521FB9-C902-451C-8B9B-F5D6B38D32A7} 2014-08-16 14:27 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll 2014-08-16 14:27 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll 2014-08-16 14:27 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe 2014-08-16 14:27 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe 2014-08-16 14:27 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe 2014-08-16 14:27 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll 2014-08-16 14:27 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe 2014-08-16 14:27 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll 2014-08-16 10:27 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-08-16 10:27 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2014-08-16 10:26 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-08-16 10:26 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-08-16 10:26 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-08-16 10:26 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-08-16 10:26 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-08-16 10:26 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-08-16 10:26 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-08-16 10:26 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-08-16 10:26 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-08-16 10:26 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-08-16 10:26 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-08-16 10:26 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-08-16 10:26 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-08-16 10:26 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-08-16 10:26 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-08-16 10:26 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-08-16 10:26 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-08-16 10:26 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-08-16 10:26 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-08-16 10:26 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-08-16 10:26 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-08-16 10:26 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-08-16 10:26 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-08-16 10:26 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-08-16 10:26 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-08-16 10:26 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-08-16 10:26 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-08-16 10:26 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-08-16 10:26 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-08-16 10:26 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-08-16 10:26 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-08-16 10:26 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-08-16 10:26 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-08-16 10:26 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-08-16 10:26 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-08-16 10:26 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-08-16 10:26 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-08-16 10:26 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-08-16 10:26 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-08-16 10:26 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-08-16 10:26 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-08-16 10:26 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-08-16 10:26 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-08-16 10:26 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-08-16 10:26 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-08-16 10:26 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-08-16 10:26 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-08-16 10:26 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-08-16 10:26 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-08-16 10:26 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-08-16 10:26 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-08-16 10:26 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-08-16 10:26 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-08-16 10:26 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-08-16 10:26 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-08-16 10:26 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-08-16 10:26 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-08-16 10:26 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2014-08-16 10:26 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys 2014-08-16 10:26 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll 2014-08-16 10:26 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2014-08-16 10:26 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll 2014-08-16 10:26 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe 2014-08-16 10:26 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll 2014-08-16 10:26 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll 2014-08-16 10:26 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll 2014-08-16 10:23 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2014-08-16 10:23 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll 2014-08-16 10:21 - 2014-08-16 10:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garmin 2014-08-05 11:40 - 2014-08-05 11:40 - 00000000 ____D () C:\Users\Anki\AppData\Local\Skype 2014-08-03 22:15 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2014-08-03 22:15 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe 2014-08-03 22:15 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll 2014-08-03 22:15 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll 2014-08-03 22:14 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll 2014-08-03 22:14 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll 2014-08-03 22:14 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll 2014-08-03 22:14 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll 2014-08-03 22:14 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll 2014-08-03 22:14 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll 2014-08-03 22:14 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll 2014-08-03 22:14 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll 2014-08-03 22:14 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe 2014-08-03 22:14 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-29 10:04 - 2014-08-27 20:03 - 00023734 _____ () C:\Users\Anki\Desktop\FRST.txt 2014-08-29 10:03 - 2014-08-27 20:03 - 00000000 ____D () C:\FRST 2014-08-29 10:01 - 2014-08-29 10:01 - 00006919 _____ () C:\Users\Anki\Desktop\JRT.txt 2014-08-29 09:56 - 2009-07-14 06:45 - 00016752 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-08-29 09:56 - 2009-07-14 06:45 - 00016752 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-08-29 09:54 - 2014-08-29 09:54 - 01016261 _____ (Thisisu) C:\Users\Anki\Downloads\JRT.exe 2014-08-29 09:54 - 2014-08-29 09:54 - 00000000 ____D () C:\Windows\ERUNT 2014-08-29 09:52 - 2014-08-29 09:52 - 00006818 _____ () C:\Users\Anki\Desktop\AdwCleaner[S0].txt 2014-08-29 09:51 - 2012-01-30 20:29 - 00000000 ___RD () C:\Users\Anki\Dropbox 2014-08-29 09:51 - 2012-01-29 20:26 - 00000000 ____D () C:\Users\Anki\AppData\Roaming\Dropbox 2014-08-29 09:50 - 2014-08-29 09:15 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-08-29 09:48 - 2011-09-28 15:35 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-08-29 09:48 - 2011-09-28 15:33 - 01708241 _____ () C:\Windows\WindowsUpdate.log 2014-08-29 09:48 - 2010-11-21 05:47 - 00689868 _____ () C:\Windows\PFRO.log 2014-08-29 09:48 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-08-29 09:48 - 2009-07-14 06:51 - 00183035 _____ () C:\Windows\setupact.log 2014-08-29 09:47 - 2014-08-29 09:44 - 00000000 ____D () C:\AdwCleaner 2014-08-29 09:47 - 2012-04-08 16:49 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-08-29 09:44 - 2014-08-29 09:44 - 01364531 _____ () C:\Users\Anki\Downloads\adwcleaner_3.308.exe 2014-08-29 09:43 - 2014-08-29 09:43 - 00001706 _____ () C:\Users\Anki\Desktop\mbam.txt 2014-08-29 09:37 - 2009-07-14 06:45 - 00342488 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-08-29 09:36 - 2011-09-28 15:35 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-08-29 09:36 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\schemas 2014-08-29 09:27 - 2011-09-28 15:53 - 00000000 ____D () C:\Windows\System32\Tasks\Fujitsu 2014-08-29 09:15 - 2014-08-29 09:15 - 00001112 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-08-29 09:15 - 2014-08-29 09:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-08-29 09:15 - 2014-08-29 09:15 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-08-29 09:15 - 2014-08-29 09:15 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-08-29 09:14 - 2014-08-29 09:14 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Anki\Downloads\mbam-setup-2.0.2.1012.exe 2014-08-29 09:12 - 2014-08-29 09:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype 2014-08-29 09:12 - 2011-09-29 21:30 - 00000000 ____D () C:\ProgramData\Skype 2014-08-29 09:09 - 2013-11-18 18:24 - 00000000 ____D () C:\Users\Anki\AppData\Local\Akamai 2014-08-28 10:10 - 2014-08-28 10:10 - 00030053 _____ () C:\ComboFix.txt 2014-08-28 10:10 - 2014-08-28 09:56 - 00000000 ____D () C:\Qoobox 2014-08-28 10:10 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default 2014-08-28 10:08 - 2014-08-28 09:55 - 00000000 ____D () C:\Windows\erdnt 2014-08-28 10:05 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini 2014-08-28 09:55 - 2014-08-28 09:55 - 05574834 ____R (Swearware) C:\Users\Anki\Desktop\ComboFix.exe 2014-08-28 09:38 - 2014-08-28 09:38 - 00001274 _____ () C:\Users\Anki\Desktop\Revo Uninstaller.lnk 2014-08-28 09:38 - 2014-08-28 09:38 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-08-28 09:37 - 2014-08-28 09:37 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Anki\Desktop\revosetup95.exe 2014-08-28 09:35 - 2014-08-28 09:35 - 00000000 __SHD () C:\Users\Anki\AppData\Local\EmieUserList 2014-08-28 09:35 - 2014-08-28 09:35 - 00000000 __SHD () C:\Users\Anki\AppData\Local\EmieSiteList 2014-08-28 09:35 - 2011-09-28 17:04 - 00000000 ____D () C:\Users\Anki\AppData\Local\Google 2014-08-27 20:29 - 2014-08-27 20:29 - 00015226 _____ () C:\Users\Anki\Desktop\Gmer.txt 2014-08-27 20:05 - 2014-08-27 20:05 - 00380416 _____ () C:\Users\Anki\Desktop\Gmer-19357.exe 2014-08-27 20:05 - 2014-08-27 20:04 - 00046734 _____ () C:\Users\Anki\Desktop\Addition.txt 2014-08-27 20:02 - 2014-08-27 20:02 - 02103296 _____ (Farbar) C:\Users\Anki\Desktop\FRST64.exe 2014-08-27 20:01 - 2014-08-27 20:01 - 00000470 _____ () C:\Users\Anki\Desktop\defogger_disable.log 2014-08-27 20:01 - 2014-08-27 20:01 - 00000000 _____ () C:\Users\Anki\defogger_reenable 2014-08-27 20:01 - 2011-09-28 15:36 - 00000000 ____D () C:\Users\Anki 2014-08-27 20:00 - 2014-08-27 20:00 - 00050477 _____ () C:\Users\Anki\Desktop\Defogger.exe 2014-08-27 19:57 - 2011-09-29 21:37 - 00000000 ____D () C:\Users\Anki\Documents\Outlook-Dateien 2014-08-27 18:51 - 2011-10-02 13:50 - 00000000 ____D () C:\ProgramData\Kodak 2014-08-27 16:40 - 2014-04-22 11:53 - 00000000 ____D () C:\Users\Anki\Documents\Citavi 4 2014-08-27 16:31 - 2012-08-29 17:13 - 00000000 ____D () C:\Users\Anki\Desktop\Places 2014-08-27 16:26 - 2014-04-22 11:01 - 00000000 ____D () C:\Users\Anki\AppData\Roaming\Opera Software 2014-08-27 16:26 - 2014-04-22 11:01 - 00000000 ____D () C:\Users\Anki\AppData\Local\Opera Software 2014-08-27 16:26 - 2014-04-22 10:57 - 00000000 ____D () C:\Program Files (x86)\Opera 2014-08-27 16:24 - 2012-01-15 20:57 - 00000000 ____D () C:\Users\Anki\AppData\Roaming\IrfanView 2014-08-27 15:18 - 2011-04-11 19:26 - 00703176 _____ () C:\Windows\system32\perfh007.dat 2014-08-27 15:18 - 2011-04-11 19:26 - 00150784 _____ () C:\Windows\system32\perfc007.dat 2014-08-27 15:18 - 2009-07-14 07:13 - 01629212 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-08-23 04:07 - 2014-08-28 10:11 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2014-08-23 03:45 - 2014-08-28 10:11 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2014-08-23 02:59 - 2014-08-28 10:11 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-08-22 20:59 - 2011-09-29 21:16 - 00000000 ____D () C:\Users\Anki\AppData\Local\MediaMonkey 2014-08-22 20:55 - 2014-08-22 20:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2014-08-22 20:55 - 2014-08-22 20:55 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-08-22 20:55 - 2014-08-22 20:55 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-08-22 17:43 - 2011-12-14 21:32 - 00000000 ____D () C:\Users\Anki\AppData\Local\CrashDumps 2014-08-22 14:54 - 2013-01-06 13:10 - 00820736 ___SH () C:\Users\Anki\Desktop\Thumbs.db 2014-08-22 14:30 - 2014-04-06 11:59 - 00000000 ____D () C:\ProgramData\Package Cache 2014-08-22 14:30 - 2013-12-17 20:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2014-08-22 14:30 - 2013-12-17 20:53 - 00000000 ____D () C:\Program Files (x86)\Avira 2014-08-22 12:06 - 2013-05-24 09:48 - 00000000 ____D () C:\Users\Anki\AppData\Local\.elfohilfe 2014-08-22 12:05 - 2013-04-30 16:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElsterFormular 2014-08-22 11:06 - 2014-08-22 11:06 - 00003156 _____ () C:\Windows\System32\Tasks\{C2521FB9-C902-451C-8B9B-F5D6B38D32A7} 2014-08-21 11:53 - 2014-06-30 13:42 - 02919728 _____ () C:\Windows\system32\ddddeeee.exe 2014-08-17 11:18 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-08-17 11:11 - 2011-09-29 16:11 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-08-17 11:05 - 2013-12-16 19:26 - 00000000 ____D () C:\Windows\system32\MRT 2014-08-17 11:03 - 2012-05-26 07:06 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-08-16 10:21 - 2014-08-16 10:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garmin 2014-08-16 10:21 - 2014-04-06 11:59 - 00003556 _____ () C:\Windows\System32\Tasks\GarminUpdaterTask 2014-08-16 10:21 - 2014-04-06 11:59 - 00000000 ____D () C:\ProgramData\Garmin 2014-08-16 10:21 - 2014-04-06 11:59 - 00000000 ____D () C:\Program Files (x86)\Garmin 2014-08-16 10:13 - 2012-01-29 20:26 - 00000000 ____D () C:\Users\Anki\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2014-08-05 22:27 - 2011-09-29 21:30 - 00000000 ____D () C:\Users\Anki\AppData\Roaming\Skype 2014-08-05 11:40 - 2014-08-05 11:40 - 00000000 ____D () C:\Users\Anki\AppData\Local\Skype 2014-08-05 10:54 - 2013-08-17 10:11 - 00000000 ____D () C:\ProgramData\Avira 2014-08-01 01:41 - 2014-08-16 10:26 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-08-01 01:16 - 2014-08-16 10:26 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll Some content of TEMP: ==================== C:\Users\Anki\AppData\Local\Temp\avgnt.exe C:\Users\Anki\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmph82ob7.dll C:\Users\Anki\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-08-27 10:13 ==================== End Of Log ============================ |
30.08.2014, 06:49 | #6 |
/// the machine /// TB-Ausbilder | viel Werbung,unglaublich langsamer RechnerESET Online Scanner
Downloade Dir bitte SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ --> viel Werbung,unglaublich langsamer Rechner |
30.08.2014, 13:12 | #7 |
| viel Werbung,unglaublich langsamer Rechner Hi, eine log Datei von ESET war nicht möglich. Ich hab keine txt Datei im Ordner drin,bzw die Suche findet auch nichts. Deinstallieren kann ich das Programm auch nicht, weil es nicht auftaucht unter den Programmen Code:
ATTFilter Results of screen317's Security Check version 0.99.87 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Java 7 Update 17 Java version out of Date! Adobe Flash Player 14.0.0.145 Adobe Reader XI Mozilla Firefox 7.0 Firefox out of Date! Google Chrome 36.0.1985.125 Google Chrome 36.0.1985.143 ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbam.exe Avira Antivir avgnt.exe Avira Antivir avguard.exe Malwarebytes Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-08-2014 Ran by Anki (administrator) on ANKIS-LAPTOP on 30-08-2014 14:09:31 Running from C:\Users\Anki\Desktop Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTDevSrv.exe (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (FUJITSU LIMITED) C:\Program Files\Fujitsu\Plugfree NETWORK\PFNService.exe (FUJITSU LIMITED) C:\Program Files\Fujitsu\PSUtility\PSUService.exe (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (FUJITSU LIMITED) C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe (FUJITSU LIMITED) C:\Program Files\Fujitsu\FDM7\FdmDaemon.exe (FUJITSU LIMITED) C:\Program Files\Fujitsu\PSUtility\TrayManager.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Sonix) C:\Windows\vsnp2uvc.exe (FUJITSU LIMITED) C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe (FUJITSU LIMITED) C:\Program Files\Fujitsu\Application Panel\BtnHnd.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Creative Technology Ltd) C:\Program Files (x86)\Creative\Software Update 3\SoftAuto.exe (Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe (Google) C:\Program Files (x86)\Google\Google Calendar Sync\GoogleCalendarSync.exe (Dropbox, Inc.) C:\Users\Anki\AppData\Roaming\Dropbox\bin\Dropbox.exe (FUJITSU LIMITED) C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe (Fujitsu Technology Solutions) C:\Fujitsu\Programs\DeskUpdate\DeskUpdateNotifier.exe (CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamTray.exe (Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe (Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe (FUJITSU LIMITED) C:\Program Files\Fujitsu\Plugfree NETWORK\PFNetDm.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe (FUJITSU LIMITED) C:\Program Files\Fujitsu\Plugfree NETWORK\PFNTray.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe (Akamai Technologies, Inc.) C:\Users\Anki\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.) C:\Users\Anki\AppData\Local\Akamai\netsession_win.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1886504 2009-11-19] (Synaptics Incorporated) HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp HKLM\...\Run: [LoadFUJ02E3] => C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe [45680 2010-06-08] (FUJITSU LIMITED) HKLM\...\Run: [FDM7] => C:\Program Files\Fujitsu\FDM7\FdmDaemon.exe [164712 2009-11-26] (FUJITSU LIMITED) HKLM\...\Run: [PSUTility] => C:\Program Files\Fujitsu\PSUtility\TrayManager.exe [199528 2010-11-13] (FUJITSU LIMITED) HKLM\...\Run: [PfNet] => C:\Program Files\Fujitsu\Plugfree NETWORK\PfNet.exe [6311424 2010-10-08] (FUJITSU LIMITED) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11663464 2010-12-07] (Realtek Semiconductor) HKLM\...\Run: [IntelWireless] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1933584 2011-01-05] (Intel(R) Corporation) HKLM\...\Run: [snp2uvc] => C:\Windows\vsnp2uvc.exe [662016 2009-08-13] (Sonix) HKLM\...\Run: [LoadFujitsuQuickTouch] => C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe [162416 2010-07-16] (FUJITSU LIMITED) HKLM\...\Run: [LoadBtnHnd] => C:\Program Files\Fujitsu\Application Panel\BtnHnd.exe [21616 2010-07-09] (FUJITSU LIMITED) HKLM\...\Run: [CIS_{81EFDD93-DBBE-415B-BE6E-49B9664E3E82}] => "C:\ProgramData\cis2271.exe" --PostUninstall {81EFDD93-DBBE-415B-BE6E-49B9664E3E82} HKLM-x32\...\Run: [IndicatorUtility] => C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe [48752 2010-09-30] (FUJITSU LIMITED) HKLM-x32\...\Run: [snp2uvc] => C:\Windows\vsnp2uvc.exe [662016 2009-08-13] (Sonix) HKLM-x32\...\Run: [DeskUpdateNotifier] => c:\Fujitsu\Programs\DeskUpdate\DeskUpdateNotifier.exe [97560 2010-10-13] (Fujitsu Technology Solutions) HKLM-x32\...\Run: [UCam_Menu] => C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.) HKLM-x32\...\Run: [YouCam Mirror Tray icon] => C:\Program Files (x86)\CyberLink\YouCam\YouCamTray.exe [162912 2009-07-08] (CyberLink Corp.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [685048 2012-08-03] (Cisco Systems, Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-05] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [161584 2014-08-04] (Avira Operations GmbH & Co. KG) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\.DEFAULT\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-08-07] (Garmin Ltd or its subsidiaries) HKU\S-1-5-21-2552170177-1754437681-1621803140-1001\...\Run: [SoftAuto.exe] => C:\Program Files (x86)\Creative\Software Update 3\SoftAuto.exe [405504 2008-08-13] (Creative Technology Ltd) HKU\S-1-5-21-2552170177-1754437681-1621803140-1001\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2011-09-28] (Google Inc.) HKU\S-1-5-21-2552170177-1754437681-1621803140-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Anki\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.) HKU\S-1-5-21-2552170177-1754437681-1621803140-1001\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-08-07] (Garmin Ltd or its subsidiaries) HKU\S-1-5-21-2552170177-1754437681-1621803140-1001\...\Policies\Explorer: [] AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [226920 2010-11-17] (NVIDIA Corporation) AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [192616 2010-11-17] (NVIDIA Corporation) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Google Calendar Sync.lnk ShortcutTarget: Google Calendar Sync.lnk -> C:\Program Files (x86)\Google\Google Calendar Sync\GoogleCalendarSync.exe (Google) Startup: C:\Users\Anki\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Anki\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LaunchCenter.lnk ShortcutTarget: LaunchCenter.lnk -> C:\Program Files\Fujitsu\LaunchCenter\LaunchCenter.exe (Fujitsu Technology Solutions) Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\newreminderdialog.lnk ShortcutTarget: newreminderdialog.lnk -> C:\Program Files\Fujitsu\FujitsuRecovery\NewReminderDialog.exe (Fujitsu Technology Solutions) Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LaunchCenter.lnk ShortcutTarget: LaunchCenter.lnk -> C:\Program Files\Fujitsu\LaunchCenter\LaunchCenter.exe (Fujitsu Technology Solutions) Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\newreminderdialog.lnk ShortcutTarget: newreminderdialog.lnk -> C:\Program Files\Fujitsu\FujitsuRecovery\NewReminderDialog.exe (Fujitsu Technology Solutions) ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 1 (GFS Unread Stub) -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => D:\PROGRA~1\OFFICE~1\Office14\GROOVEEX.DLL No File ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 2 (GFS Stub) -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => D:\PROGRA~1\OFFICE~1\Office14\GROOVEEX.DLL No File ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 2.5 (GFS Unread Folder) -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => D:\PROGRA~1\OFFICE~1\Office14\GROOVEEX.DLL No File ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 3 (GFS Folder) -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => D:\PROGRA~1\OFFICE~1\Office14\GROOVEEX.DLL No File ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 4 (GFS Unread Mark) -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => D:\PROGRA~1\OFFICE~1\Office14\GROOVEEX.DLL No File ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=FTSG&bmod=FTSG StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe BHO: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL No File BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> D:\Programme\java\bin\jp2ssv.dll No File BHO-x32: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation) BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> D:\PROGRA~1\OFFICE~1\Office14\GROOVEEX.DLL No File BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> D:\PROGRA~1\OFFICE~1\Office14\URLREDIR.DLL No File BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) ShellExecuteHooks-x32: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - D:\PROGRA~1\OFFICE~1\Office14\GROOVEEX.DLL No File [ ] Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 Tcpip\..\Interfaces\{8B3FB879-A879-4DA2-A511-75640B25BE91}: [NameServer] 144.41.2.20,144.41.5.20 FireFox: ======== FF ProfilePath: C:\Users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default FF Homepage: hxxp://www.google.de/ FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll () FF Plugin: @java.com/JavaPlugin -> D:\Programme\java\bin\new_plugin\npjp2.dll No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL No File FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll () FF Plugin-x32: @java.com/DTPlugin,version=10.17.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.17.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> D:\PROGRA~1\OFFICE~1\Office14\NPAUTHZ.DLL No File FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> D:\PROGRA~1\OFFICE~1\Office14\NPSPWRAP.DLL No File FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.0.5 -> D:\Programme\VLC\npvlc.dll No File FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Extension: Avira Browser Safety - C:\Users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\Extensions\abs@avira.com [2014-08-19] FF Extension: Garmin Communicator - C:\Users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2014-04-06] FF Extension: Adblock Plus - C:\Users\Anki\AppData\Roaming\Mozilla\Firefox\Profiles\k8lly66o.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-09-28] FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2014-04-22] FF StartMenuInternet: FIREFOX.EXE - D:\Programme\Mozilla\firefox.exe Chrome: ======= CHR HomePage: Default -> hxxp://www.google.com/ CHR DefaultSearchProvider: Default -> Search CHR DefaultSearchURL: Default -> hxxp://start.funmoods.com/results.php?f=4&a=ddrnw&q={searchTerms} CHR DefaultSuggestURL: Default -> CHR Plugin: (Remoting Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\pdf.dll () CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\gcswf32.dll No File CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File CHR Plugin: (Java Deployment Toolkit 6.0.300.12) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File CHR Plugin: (Java(TM) Platform SE 6 U30) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll No File CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll No File CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Plugin: (Microsoft Office 2010) - D:\PROGRA~1\OFFICE~1\Office14\NPAUTHZ.DLL No File CHR Plugin: (Microsoft Office 2010) - D:\PROGRA~1\OFFICE~1\Office14\NPSPWRAP.DLL No File CHR Plugin: (Foxit Reader Plugin for Mozilla) - D:\Programme\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File CHR Plugin: (Default Plug-in) - default_plugin No File CHR Profile: C:\Users\Anki\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Wallet) - C:\Users\Anki\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-29] CHR Extension: (Citavi Picker) - C:\Users\Anki\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohgndokldibnndfnjnagojmheejlengn [2014-08-29] CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - C:\Program Files (x86)\Citavi 4\Pickers\Chrome\ChromePicker.crx [2014-02-07] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-05] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-05] (Avira Operations GmbH & Co. KG) U4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1021520 2014-08-05] (Avira Operations GmbH & Co. KG) R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [149296 2014-08-04] (Avira Operations GmbH & Co. KG) R2 Bluetooth Device Monitor; C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe [897088 2010-11-03] (Intel Corporation) [File not signed] R3 Bluetooth Media Service; C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe [1298496 2010-11-03] (Intel Corporation) [File not signed] R2 Bluetooth OBEX Service; C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe [983104 2010-11-03] (Intel Corporation) [File not signed] R2 CTDevice_Srv; C:\Program Files (x86)\Creative\Shared Files\CTDevSrv.exe [61440 2007-04-02] (Creative Technology Ltd) [File not signed] S3 CTUPnPSv; C:\Program Files (x86)\Creative\Creative Centrale\CTUPnPSv.exe [64000 2008-05-21] (Creative Technology Ltd) [File not signed] R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [438616 2014-08-07] (Garmin Ltd or its subsidiaries) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-01-05] () R2 PFNService; C:\Program Files\Fujitsu\Plugfree NETWORK\PFNService.exe [331776 2010-10-08] (FUJITSU LIMITED) [File not signed] R2 PowerSavingUtilityService; C:\Program Files\Fujitsu\PSUtility\PSUService.exe [63336 2010-06-18] (FUJITSU LIMITED) S2 SkypeUpdate; D:\Programme\Skype\Updater\Updater.exe [172192 2013-10-23] (Skype Technologies) S2 Kodak AiO Network Discovery Service; D:\Programme\Kodak\AiO\Center\EKAiOHostService.exe [X] S2 Kodak AiO Status Monitor Service; "D:\Programme\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe" [X] S3 Microsoft SharePoint Workspace Audit Service; "D:\Programme\Office 2010\Office14\GROOVE.EXE" /auditservice [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) U5 AppMgmt; C:\Windows\system32\svchost.exe [27648 2011-03-01] (Microsoft Corporation) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-06-24] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-05-22] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-09] (Avira Operations GmbH & Co. KG) U4 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [42040 2014-07-15] (Avira Operations GmbH & Co. KG) R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [270912 2011-09-29] (DT Soft Ltd) R0 FBIOSDRV; C:\Windows\System32\Drivers\FBIOSDRV.sys [21104 2009-06-24] (FUJITSU LIMITED) R3 FUJ02B1; C:\Windows\System32\DRIVERS\FUJ02B1.sys [7808 2006-11-01] (FUJITSU LIMITED) R3 FUJ02E3; C:\Windows\system32\drivers\FUJ02E3.sys [7296 2006-11-01] (FUJITSU LIMITED) S3 hwusbdev; C:\Windows\System32\DRIVERS\ewusbdev.sys [113792 2009-06-22] (Huawei Technologies Co., Ltd.) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-08-30] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation) R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1801216 2010-10-09] () S3 catchme; \??\C:\ComboFix\catchme.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-30 14:09 - 2014-08-30 14:09 - 00000000 ____D () C:\Users\Anki\Desktop\FRST-OlderVersion 2014-08-30 14:07 - 2014-08-30 14:07 - 00854417 _____ () C:\Users\Anki\Downloads\SecurityCheck.exe 2014-08-30 11:36 - 2014-08-30 11:36 - 02347384 _____ (ESET) C:\Users\Anki\Downloads\esetsmartinstaller_deu.exe 2014-08-30 11:36 - 2014-08-30 11:36 - 00000000 ____D () C:\Program Files (x86)\ESET 2014-08-29 10:01 - 2014-08-29 10:01 - 00006919 _____ () C:\Users\Anki\Desktop\JRT.txt 2014-08-29 09:54 - 2014-08-29 09:54 - 01016261 _____ (Thisisu) C:\Users\Anki\Downloads\JRT.exe 2014-08-29 09:54 - 2014-08-29 09:54 - 00000000 ____D () C:\Windows\ERUNT 2014-08-29 09:52 - 2014-08-29 09:52 - 00006818 _____ () C:\Users\Anki\Desktop\AdwCleaner[S0].txt 2014-08-29 09:44 - 2014-08-29 09:47 - 00000000 ____D () C:\AdwCleaner 2014-08-29 09:44 - 2014-08-29 09:44 - 01364531 _____ () C:\Users\Anki\Downloads\adwcleaner_3.308.exe 2014-08-29 09:43 - 2014-08-29 09:43 - 00001706 _____ () C:\Users\Anki\Desktop\mbam.txt 2014-08-29 09:15 - 2014-08-30 11:38 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-08-29 09:15 - 2014-08-29 09:15 - 00001112 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-08-29 09:15 - 2014-08-29 09:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-08-29 09:15 - 2014-08-29 09:15 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-08-29 09:15 - 2014-08-29 09:15 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-08-29 09:15 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-08-29 09:15 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-08-29 09:15 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-08-29 09:14 - 2014-08-29 09:14 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Anki\Downloads\mbam-setup-2.0.2.1012.exe 2014-08-29 09:12 - 2014-08-29 09:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype 2014-08-28 10:11 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2014-08-28 10:11 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2014-08-28 10:11 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-08-28 10:10 - 2014-08-28 10:10 - 00030053 _____ () C:\ComboFix.txt 2014-08-28 09:56 - 2014-08-28 10:10 - 00000000 ____D () C:\Qoobox 2014-08-28 09:56 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-08-28 09:56 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-08-28 09:56 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-08-28 09:56 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-08-28 09:56 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-08-28 09:56 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe 2014-08-28 09:56 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe 2014-08-28 09:56 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe 2014-08-28 09:55 - 2014-08-28 10:08 - 00000000 ____D () C:\Windows\erdnt 2014-08-28 09:55 - 2014-08-28 09:55 - 05574834 ____R (Swearware) C:\Users\Anki\Desktop\ComboFix.exe 2014-08-28 09:38 - 2014-08-28 09:38 - 00001274 _____ () C:\Users\Anki\Desktop\Revo Uninstaller.lnk 2014-08-28 09:38 - 2014-08-28 09:38 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-08-28 09:37 - 2014-08-28 09:37 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Anki\Desktop\revosetup95.exe 2014-08-28 09:35 - 2014-08-28 09:35 - 00000000 __SHD () C:\Users\Anki\AppData\Local\EmieUserList 2014-08-28 09:35 - 2014-08-28 09:35 - 00000000 __SHD () C:\Users\Anki\AppData\Local\EmieSiteList 2014-08-27 20:29 - 2014-08-27 20:29 - 00015226 _____ () C:\Users\Anki\Desktop\Gmer.txt 2014-08-27 20:05 - 2014-08-27 20:05 - 00380416 _____ () C:\Users\Anki\Desktop\Gmer-19357.exe 2014-08-27 20:04 - 2014-08-27 20:05 - 00046734 _____ () C:\Users\Anki\Desktop\Addition.txt 2014-08-27 20:03 - 2014-08-30 14:09 - 00025406 _____ () C:\Users\Anki\Desktop\FRST.txt 2014-08-27 20:03 - 2014-08-30 14:09 - 00000000 ____D () C:\FRST 2014-08-27 20:02 - 2014-08-30 14:09 - 02103808 _____ (Farbar) C:\Users\Anki\Desktop\FRST64.exe 2014-08-27 20:01 - 2014-08-27 20:01 - 00000470 _____ () C:\Users\Anki\Desktop\defogger_disable.log 2014-08-27 20:01 - 2014-08-27 20:01 - 00000000 _____ () C:\Users\Anki\defogger_reenable 2014-08-27 20:00 - 2014-08-27 20:00 - 00050477 _____ () C:\Users\Anki\Desktop\Defogger.exe 2014-08-22 20:55 - 2014-08-22 20:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2014-08-22 20:55 - 2014-08-22 20:55 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-08-22 20:55 - 2014-08-22 20:55 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-08-22 11:06 - 2014-08-22 11:06 - 00003156 _____ () C:\Windows\System32\Tasks\{C2521FB9-C902-451C-8B9B-F5D6B38D32A7} 2014-08-16 14:27 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll 2014-08-16 14:27 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll 2014-08-16 14:27 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe 2014-08-16 14:27 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe 2014-08-16 14:27 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe 2014-08-16 14:27 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll 2014-08-16 14:27 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe 2014-08-16 14:27 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll 2014-08-16 10:27 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-08-16 10:27 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2014-08-16 10:26 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-08-16 10:26 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-08-16 10:26 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-08-16 10:26 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-08-16 10:26 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-08-16 10:26 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-08-16 10:26 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-08-16 10:26 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-08-16 10:26 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-08-16 10:26 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-08-16 10:26 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-08-16 10:26 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-08-16 10:26 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-08-16 10:26 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-08-16 10:26 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-08-16 10:26 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-08-16 10:26 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-08-16 10:26 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-08-16 10:26 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-08-16 10:26 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-08-16 10:26 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-08-16 10:26 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-08-16 10:26 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-08-16 10:26 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-08-16 10:26 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-08-16 10:26 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-08-16 10:26 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-08-16 10:26 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-08-16 10:26 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-08-16 10:26 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-08-16 10:26 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-08-16 10:26 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-08-16 10:26 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-08-16 10:26 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-08-16 10:26 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-08-16 10:26 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-08-16 10:26 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-08-16 10:26 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-08-16 10:26 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-08-16 10:26 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-08-16 10:26 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-08-16 10:26 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-08-16 10:26 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-08-16 10:26 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-08-16 10:26 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-08-16 10:26 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-08-16 10:26 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-08-16 10:26 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-08-16 10:26 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-08-16 10:26 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-08-16 10:26 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-08-16 10:26 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-08-16 10:26 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-08-16 10:26 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-08-16 10:26 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-08-16 10:26 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-08-16 10:26 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-08-16 10:26 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2014-08-16 10:26 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys 2014-08-16 10:26 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll 2014-08-16 10:26 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2014-08-16 10:26 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll 2014-08-16 10:26 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe 2014-08-16 10:26 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll 2014-08-16 10:26 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll 2014-08-16 10:26 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll 2014-08-16 10:23 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2014-08-16 10:23 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll 2014-08-16 10:21 - 2014-08-16 10:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garmin 2014-08-05 11:40 - 2014-08-05 11:40 - 00000000 ____D () C:\Users\Anki\AppData\Local\Skype 2014-08-03 22:15 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2014-08-03 22:15 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe 2014-08-03 22:15 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll 2014-08-03 22:15 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll 2014-08-03 22:14 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll 2014-08-03 22:14 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll 2014-08-03 22:14 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll 2014-08-03 22:14 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll 2014-08-03 22:14 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll 2014-08-03 22:14 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll 2014-08-03 22:14 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll 2014-08-03 22:14 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll 2014-08-03 22:14 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe 2014-08-03 22:14 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-30 14:10 - 2014-08-27 20:03 - 00025406 _____ () C:\Users\Anki\Desktop\FRST.txt 2014-08-30 14:09 - 2014-08-30 14:09 - 00000000 ____D () C:\Users\Anki\Desktop\FRST-OlderVersion 2014-08-30 14:09 - 2014-08-27 20:03 - 00000000 ____D () C:\FRST 2014-08-30 14:09 - 2014-08-27 20:02 - 02103808 _____ (Farbar) C:\Users\Anki\Desktop\FRST64.exe 2014-08-30 14:07 - 2014-08-30 14:07 - 00854417 _____ () C:\Users\Anki\Downloads\SecurityCheck.exe 2014-08-30 13:47 - 2012-04-08 16:49 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-08-30 13:36 - 2011-09-28 15:35 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-08-30 12:22 - 2011-09-28 15:33 - 01731672 _____ () C:\Windows\WindowsUpdate.log 2014-08-30 11:38 - 2014-08-29 09:15 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-08-30 11:36 - 2014-08-30 11:36 - 02347384 _____ (ESET) C:\Users\Anki\Downloads\esetsmartinstaller_deu.exe 2014-08-30 11:36 - 2014-08-30 11:36 - 00000000 ____D () C:\Program Files (x86)\ESET 2014-08-30 11:34 - 2009-07-14 06:45 - 00016752 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-08-30 11:34 - 2009-07-14 06:45 - 00016752 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-08-30 11:29 - 2013-11-18 18:24 - 00000000 ____D () C:\Users\Anki\AppData\Local\Akamai 2014-08-30 11:28 - 2012-01-30 20:29 - 00000000 ___RD () C:\Users\Anki\Dropbox 2014-08-30 11:28 - 2012-01-29 20:26 - 00000000 ____D () C:\Users\Anki\AppData\Roaming\Dropbox 2014-08-30 11:27 - 2011-09-28 15:35 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-08-30 11:26 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-08-30 11:26 - 2009-07-14 06:51 - 00183091 _____ () C:\Windows\setupact.log 2014-08-29 10:01 - 2014-08-29 10:01 - 00006919 _____ () C:\Users\Anki\Desktop\JRT.txt 2014-08-29 09:54 - 2014-08-29 09:54 - 01016261 _____ (Thisisu) C:\Users\Anki\Downloads\JRT.exe 2014-08-29 09:54 - 2014-08-29 09:54 - 00000000 ____D () C:\Windows\ERUNT 2014-08-29 09:52 - 2014-08-29 09:52 - 00006818 _____ () C:\Users\Anki\Desktop\AdwCleaner[S0].txt 2014-08-29 09:48 - 2010-11-21 05:47 - 00689868 _____ () C:\Windows\PFRO.log 2014-08-29 09:47 - 2014-08-29 09:44 - 00000000 ____D () C:\AdwCleaner 2014-08-29 09:44 - 2014-08-29 09:44 - 01364531 _____ () C:\Users\Anki\Downloads\adwcleaner_3.308.exe 2014-08-29 09:43 - 2014-08-29 09:43 - 00001706 _____ () C:\Users\Anki\Desktop\mbam.txt 2014-08-29 09:37 - 2009-07-14 06:45 - 00342488 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-08-29 09:36 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\schemas 2014-08-29 09:27 - 2011-09-28 15:53 - 00000000 ____D () C:\Windows\System32\Tasks\Fujitsu 2014-08-29 09:15 - 2014-08-29 09:15 - 00001112 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-08-29 09:15 - 2014-08-29 09:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-08-29 09:15 - 2014-08-29 09:15 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-08-29 09:15 - 2014-08-29 09:15 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-08-29 09:14 - 2014-08-29 09:14 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Anki\Downloads\mbam-setup-2.0.2.1012.exe 2014-08-29 09:12 - 2014-08-29 09:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype 2014-08-29 09:12 - 2011-09-29 21:30 - 00000000 ____D () C:\ProgramData\Skype 2014-08-28 10:10 - 2014-08-28 10:10 - 00030053 _____ () C:\ComboFix.txt 2014-08-28 10:10 - 2014-08-28 09:56 - 00000000 ____D () C:\Qoobox 2014-08-28 10:10 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default 2014-08-28 10:08 - 2014-08-28 09:55 - 00000000 ____D () C:\Windows\erdnt 2014-08-28 10:05 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini 2014-08-28 09:55 - 2014-08-28 09:55 - 05574834 ____R (Swearware) C:\Users\Anki\Desktop\ComboFix.exe 2014-08-28 09:38 - 2014-08-28 09:38 - 00001274 _____ () C:\Users\Anki\Desktop\Revo Uninstaller.lnk 2014-08-28 09:38 - 2014-08-28 09:38 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-08-28 09:37 - 2014-08-28 09:37 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Anki\Desktop\revosetup95.exe 2014-08-28 09:35 - 2014-08-28 09:35 - 00000000 __SHD () C:\Users\Anki\AppData\Local\EmieUserList 2014-08-28 09:35 - 2014-08-28 09:35 - 00000000 __SHD () C:\Users\Anki\AppData\Local\EmieSiteList 2014-08-28 09:35 - 2011-09-28 17:04 - 00000000 ____D () C:\Users\Anki\AppData\Local\Google 2014-08-27 20:29 - 2014-08-27 20:29 - 00015226 _____ () C:\Users\Anki\Desktop\Gmer.txt 2014-08-27 20:05 - 2014-08-27 20:05 - 00380416 _____ () C:\Users\Anki\Desktop\Gmer-19357.exe 2014-08-27 20:05 - 2014-08-27 20:04 - 00046734 _____ () C:\Users\Anki\Desktop\Addition.txt 2014-08-27 20:01 - 2014-08-27 20:01 - 00000470 _____ () C:\Users\Anki\Desktop\defogger_disable.log 2014-08-27 20:01 - 2014-08-27 20:01 - 00000000 _____ () C:\Users\Anki\defogger_reenable 2014-08-27 20:01 - 2011-09-28 15:36 - 00000000 ____D () C:\Users\Anki 2014-08-27 20:00 - 2014-08-27 20:00 - 00050477 _____ () C:\Users\Anki\Desktop\Defogger.exe 2014-08-27 19:57 - 2011-09-29 21:37 - 00000000 ____D () C:\Users\Anki\Documents\Outlook-Dateien 2014-08-27 18:51 - 2011-10-02 13:50 - 00000000 ____D () C:\ProgramData\Kodak 2014-08-27 16:40 - 2014-04-22 11:53 - 00000000 ____D () C:\Users\Anki\Documents\Citavi 4 2014-08-27 16:31 - 2012-08-29 17:13 - 00000000 ____D () C:\Users\Anki\Desktop\Places 2014-08-27 16:26 - 2014-04-22 11:01 - 00000000 ____D () C:\Users\Anki\AppData\Roaming\Opera Software 2014-08-27 16:26 - 2014-04-22 11:01 - 00000000 ____D () C:\Users\Anki\AppData\Local\Opera Software 2014-08-27 16:26 - 2014-04-22 10:57 - 00000000 ____D () C:\Program Files (x86)\Opera 2014-08-27 16:24 - 2012-01-15 20:57 - 00000000 ____D () C:\Users\Anki\AppData\Roaming\IrfanView 2014-08-27 15:18 - 2011-04-11 19:26 - 00703176 _____ () C:\Windows\system32\perfh007.dat 2014-08-27 15:18 - 2011-04-11 19:26 - 00150784 _____ () C:\Windows\system32\perfc007.dat 2014-08-27 15:18 - 2009-07-14 07:13 - 01629212 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-08-23 04:07 - 2014-08-28 10:11 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2014-08-23 03:45 - 2014-08-28 10:11 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2014-08-23 02:59 - 2014-08-28 10:11 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-08-22 20:59 - 2011-09-29 21:16 - 00000000 ____D () C:\Users\Anki\AppData\Local\MediaMonkey 2014-08-22 20:55 - 2014-08-22 20:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2014-08-22 20:55 - 2014-08-22 20:55 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-08-22 20:55 - 2014-08-22 20:55 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-08-22 17:43 - 2011-12-14 21:32 - 00000000 ____D () C:\Users\Anki\AppData\Local\CrashDumps 2014-08-22 14:54 - 2013-01-06 13:10 - 00820736 ___SH () C:\Users\Anki\Desktop\Thumbs.db 2014-08-22 14:30 - 2014-04-06 11:59 - 00000000 ____D () C:\ProgramData\Package Cache 2014-08-22 14:30 - 2013-12-17 20:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2014-08-22 14:30 - 2013-12-17 20:53 - 00000000 ____D () C:\Program Files (x86)\Avira 2014-08-22 12:06 - 2013-05-24 09:48 - 00000000 ____D () C:\Users\Anki\AppData\Local\.elfohilfe 2014-08-22 12:05 - 2013-04-30 16:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElsterFormular 2014-08-22 11:06 - 2014-08-22 11:06 - 00003156 _____ () C:\Windows\System32\Tasks\{C2521FB9-C902-451C-8B9B-F5D6B38D32A7} 2014-08-21 11:53 - 2014-06-30 13:42 - 02919728 _____ () C:\Windows\system32\ddddeeee.exe 2014-08-17 11:18 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-08-17 11:11 - 2011-09-29 16:11 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-08-17 11:05 - 2013-12-16 19:26 - 00000000 ____D () C:\Windows\system32\MRT 2014-08-17 11:03 - 2012-05-26 07:06 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-08-16 10:21 - 2014-08-16 10:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garmin 2014-08-16 10:21 - 2014-04-06 11:59 - 00003556 _____ () C:\Windows\System32\Tasks\GarminUpdaterTask 2014-08-16 10:21 - 2014-04-06 11:59 - 00000000 ____D () C:\ProgramData\Garmin 2014-08-16 10:21 - 2014-04-06 11:59 - 00000000 ____D () C:\Program Files (x86)\Garmin 2014-08-16 10:13 - 2012-01-29 20:26 - 00000000 ____D () C:\Users\Anki\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2014-08-05 22:27 - 2011-09-29 21:30 - 00000000 ____D () C:\Users\Anki\AppData\Roaming\Skype 2014-08-05 11:40 - 2014-08-05 11:40 - 00000000 ____D () C:\Users\Anki\AppData\Local\Skype 2014-08-05 10:54 - 2013-08-17 10:11 - 00000000 ____D () C:\ProgramData\Avira 2014-08-01 01:41 - 2014-08-16 10:26 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-08-01 01:16 - 2014-08-16 10:26 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll Some content of TEMP: ==================== C:\Users\Anki\AppData\Local\Temp\avgnt.exe C:\Users\Anki\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpvkldu1.dll C:\Users\Anki\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-08-27 10:13 ==================== End Of Log ============================ |
30.08.2014, 15:43 | #8 |
/// the machine /// TB-Ausbilder | viel Werbung,unglaublich langsamer Rechner Java und Firefox updaten. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter CHR DefaultSearchURL: Default -> hxxp://start.funmoods.com/results.php?f=4&a=ddrnw&q={searchTerms} Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
31.08.2014, 20:42 | #9 |
| viel Werbung,unglaublich langsamer Rechner Hi, also die Fixlog Datei ist nicht mehr vorhanden... Und beim starten des Computers (was noch unglaublich lange dauert) fragen 2 Programme noch nach Berechtigungen - jucheck.exe - Oracle America - Akamai NetSession Beides kenn ich nicht. Wie werde ich die noch los? |
01.09.2014, 13:08 | #10 |
/// the machine /// TB-Ausbilder | viel Werbung,unglaublich langsamer Rechner beides ist aber legitim Wann genau ist er denn langsam?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
01.09.2014, 16:38 | #11 |
| viel Werbung,unglaublich langsamer Rechner Beim hochfahren.Kann man das beschleunigen? Oder liegt das jetzt am Alter des PCs? |
02.09.2014, 11:48 | #12 |
/// the machine /// TB-Ausbilder | viel Werbung,unglaublich langsamer Rechner Mach mal einen Clean Boot, ist er dann schneller?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
02.09.2014, 16:14 | #13 |
| viel Werbung,unglaublich langsamer Rechner Hey, joa könnte fast sein. Aber alles in allem ist jegliche werbung/fenster ect entfernt. Vielen Dank dafür |
03.09.2014, 10:00 | #14 | |
/// the machine /// TB-Ausbilder | viel Werbung,unglaublich langsamer RechnerZitat:
Wenn ja: Clean Boot rückgängig machen in den Einstellungen, aber nur einen Dienst wieder aktivieren, Rebooten, testen. Rechner immer noch schnell? Nächsten Dienst aktivieren, reboot, testen. Solnage bis Du weißt welcher Dienst da bremst.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
Themen zu viel Werbung,unglaublich langsamer Rechner |
4d36e972-e325-11ce-bfc1-08002be10318, akamai, antivir, antivirus, avira, browser, device driver, error, excel, fehler, flash player, google, home, homepage, langsamer rechner, mozilla, realtek, registry, rundll, scan, security, software, svchost.exe, system, viren, werbung, windows |