| |
| |||||||
Log-Analyse und Auswertung: Win7-64Bit - Browser, Netzwerkeinstellungen, Proxy wird immer automatisch aktiviert 127.0.0.1:49273Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
17.09.2014, 22:14
| #1 |
 |  Win7-64Bit - Browser, Netzwerkeinstellungen, Proxy wird immer automatisch aktiviert 127.0.0.1:49273 Hallo und zuerst mal danke für die Möglichkeit hier Hilfe zu bekommen. Seit ein paar Tagen habe ich bemerkt, dass der Aufruf verschiedener Internetseiten sehr lange dauert und manche Seiten überhaupt nicht geöffnet werden. Heute wollte ich zwecks Verlängerung meines Abos im Forum von Norton etwas nachsehen und habe dort statt der Loginseite des Forums die Meldung bekommen, dass mein Browser auf eine andere Seite als die offizielle Norton Seite umgeleitet werden solle und daher kein Login möglich sei... Ein Scan mit Norton Internet Security ergab nichts aber in den Erweiterten Einstellungen meines Browsers (Chrome) habe ich bemerkt, dass Proxyeinstellungen aktiviert waren. Im Lauf des Abends hat sich dann gezeigt, dass sich diese nicht dauerhaft deaktivieren lassen. Spätestens nach dem Neustart des Browsers sind sie wieder da. Für http: und für secure: sind immer 127.0.0.1 und Port 49273 eingetragen. Ein Scan mit Ad-Aware hat einen Fund ergeben (Log siehe unten) Vorab schon mal vielen Dank und sorry für die angehängten Logs - der Beitrag war sonst zu lang. Grüße Volker |
|
17.09.2014, 22:21
| #2 |
| | Win7-64Bit - Browser, Netzwerkeinstellungen, Proxy wird immer automatisch aktiviert 127.0.0.1:49273 Defogger Log
__________________Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 22:11 on 17/09/2014 (VOW)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-09-2014
Ran by VOW (administrator) on VOW-PC on 17-09-2014 22:41:44
Running from C:\Users\VOW\Desktop
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
() C:\Program Files (x86)\Ashampoo\Ashampoo Core Tuner 2\ACT2Service.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(DATA BECKER GmbH & Co KG) C:\Program Files (x86)\Common Files\DATA BECKER Shared\DBService.exe
(mst software GmbH, Germany) D:\Programme\Ashampoo WinOptimizer 10\DfSdkS64.exe
(Garmin Ltd or its subsidiaries) D:\Programme\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
() C:\Windows\SysWOW64\XSrvSetup.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareService.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.5.0.19\nis.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
() C:\Program Files (x86)\ASRock Utility\AXTU\Bin\AsrXTU.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.5.0.19\nis.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdcBase.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareTray.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler.exe
() C:\Program Files (x86)\Synology Data Replicator 3\SynoDrServicex64.exe
(Apple Inc.) D:\Programme\iCloud\ApplePhotoStreams.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
(Apple Inc.) D:\Programme\iCloud\iCloudServices.exe
() C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
() C:\Users\VOW\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Program Files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe
(Garmin Ltd or its subsidiaries) D:\Programme\Garmin\Express Tray\ExpressTray.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPoint\SetPoint.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(InstallShield Software Corporation) C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler64.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
(Samsung Electronics.) C:\Program Files (x86)\Samsung SSD Magician\Samsung Magician.exe
() C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\BrccMCtl.exe
(Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TimounterMonitor.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(FNet Co., Ltd.) C:\Program Files (x86)\XFastUSB\XFastUsb.exe
(TODO: <公司名>) C:\Program Files (x86)\Perixx Gaming mouse\SE61T-UserTools.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Apple Inc.) D:\Programme\iCloud\APSDaemon.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
() C:\Program Files (x86)\RocketTab\Client.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\WMPSideShowGadget.exe
() C:\Program Files\ASRock Utility\XFast RAM\asrRd.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(LookThisUp) C:\Users\VOW\AppData\Roaming\LookThisUp\LookThisUp.exe
() C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Google Inc.) C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
(Google Inc.) C:\Users\VOW\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\VOW\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\VOW\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\VOW\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\VOW\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\VOW\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\VOW\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [104008 2010-11-16] (Logitech Inc.)
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [403656 2012-04-27] (Acronis)
HKLM\...\Run: [Windows Mobile-based device management] => C:\Windows\WindowsMobile\wmdcBase.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13307496 2011-10-17] (Realtek Semiconductor)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareTray.exe [8886592 2014-08-27] ()
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [374784 2014-01-09] (shbox.de)
HKLM-x32\...\Run: [ISUSScheduler] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [81920 2005-02-17] (InstallShield Software Corporation)
HKLM-x32\...\Run: [ArcSoft Connection Service] => C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [ATICustomerCare] => C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe [311296 2010-03-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2621440 2010-02-09] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [5993136 2012-04-27] (Acronis)
HKLM-x32\...\Run: [Name of App] => C:\Program Files (x86)\SAMSUNG\FW LiveUpdate\FWManager.exe [692307 2011-11-23] ( )
HKLM-x32\...\Run: [AcronisTimounterMonitor] => C:\Program Files (x86)\Acronis\TrueImageHome\TimounterMonitor.exe [1173680 2012-04-27] (Acronis)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-06] (Apple Inc.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-01-26] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)
HKLM-x32\...\Run: [XFastUSB] => C:\Program Files (x86)\XFastUSB\XFastUsb.exe [5019360 2012-10-16] (FNet Co., Ltd.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SE61T-UserTools] => C:\Program Files (x86)\Perixx Gaming mouse\SE61T-UserTools.exe [754176 2013-10-08] (TODO: <公司名>)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKLM\...\Policies\Explorer: [NoViewContextMenu] 0
HKU\.DEFAULT\...\Run: [GarminExpressTrayApp] => D:\Programme\Garmin\Express Tray\ExpressTray.exe [688984 2014-07-23] (Garmin Ltd or its subsidiaries)
HKU\S-1-5-21-3018767705-964232526-3307114488-1001\...\Run: [ISUSPM Startup] => C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
HKU\S-1-5-21-3018767705-964232526-3307114488-1001\...\Run: [ApplePhotoStreams] => D:\Programme\iCloud\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-3018767705-964232526-3307114488-1001\...\Run: [PureSync] => "C:\Program Files (x86)\PureSync\PureSyncTray.exe"
HKU\S-1-5-21-3018767705-964232526-3307114488-1001\...\Run: [ASRockXTU] => [X]
HKU\S-1-5-21-3018767705-964232526-3307114488-1001\...\Run: [Google Update] => C:\Users\VOW\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-10-17] (Google Inc.)
HKU\S-1-5-21-3018767705-964232526-3307114488-1001\...\Run: [iCloudServices] => D:\Programme\iCloud\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-3018767705-964232526-3307114488-1001\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-11-09] (Google Inc.)
HKU\S-1-5-21-3018767705-964232526-3307114488-1001\...\Run: [Amazon Cloud Player] => C:\Users\VOW\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3168576 2014-03-07] ()
HKU\S-1-5-21-3018767705-964232526-3307114488-1001\...\Run: [GarminExpressTrayApp] => D:\Programme\Garmin\Express Tray\ExpressTray.exe [688984 2014-07-23] (Garmin Ltd or its subsidiaries)
HKU\S-1-5-21-3018767705-964232526-3307114488-1001\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [3666224 2013-09-20] (Safer-Networking Ltd.)
HKU\S-1-5-21-3018767705-964232526-3307114488-1001\...\Run: [LookThisUp] => C:\Users\VOW\AppData\Roaming\LookThisUp\LookThisUp.exe [1848976 2014-09-17] (LookThisUp)
HKU\S-1-5-21-3018767705-964232526-3307114488-1001\...\Run: [InetStat] => C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe [700430 2014-09-17] ()
HKU\S-1-5-21-3018767705-964232526-3307114488-1001\...\Policies\Explorer: [NofolderOptions] 0
HKU\S-1-5-21-3018767705-964232526-3307114488-1001\...\MountPoints2: {4bc6fbdb-17fe-11e2-86e0-806e6f6e6963} - F:\ASRSetup.exe
HKU\S-1-5-21-3018767705-964232526-3307114488-1001\...\MountPoints2: {e54503ee-3e56-11e1-a5ea-1c6f652450ab} - Q:\KODAK_Camera_Setup_App.exe
HKU\S-1-5-21-3018767705-964232526-3307114488-1001\...\MountPoints2: {e5450424-3e56-11e1-a5ea-1c6f652450ab} - Q:\KODAK_Camera_Setup_App.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Logitech SetPoint.lnk
ShortcutTarget: Logitech SetPoint.lnk -> C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
Startup: C:\Users\VOW\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\VOW\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Magician.lnk
ShortcutTarget: Samsung Magician.lnk -> C:\Windows\System32\schtasks.exe (Microsoft Corporation)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:49273;https=127.0.0.1:49273
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=1d55a34c-41e3-7bb2-c576-39761563b71c&searchtype=ds&q={searchTerms}&installDate=14/09/2013
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.snapdo.com/?publisher=snapdoocyb&dpid=snapdoocyb&co=de&userid=1d55a34c-41e3-7bb2-c576-39761563b71c&searchtype=hp&installdate=14/09/2013
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xF53C4A75345ACA01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=1d55a34c-41e3-7bb2-c576-39761563b71c&searchtype=ds&q={searchTerms}&installDate=14/09/2013
SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=1d55a34c-41e3-7bb2-c576-39761563b71c&searchtype=ds&q={searchTerms}&installDate=14/09/2013
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=1d55a34c-41e3-7bb2-c576-39761563b71c&searchtype=ds&q={searchTerms}&installDate=14/09/2013
SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2475029
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL =
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL =
BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine64\21.5.0.19\coIEPlg.dll (Symantec Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> No File
BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine\21.5.0.19\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\21.5.0.19\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: No Name -> {9cf699ca-2174-4ed8-bec1-ba82095edce0} -> No File
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Free Download Manager -> {CC59E0F9-7E43-44FA-9FAA-8377850BF205} -> D:\Programme\Free Download Manager\iefdm2.dll (FreeDownloadManager.ORG)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.5.0.19\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - No Name - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - No File
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\21.5.0.19\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU - No Name - {043C5167-00BB-4324-AF7E-62013FAEDACF} - No File
Toolbar: HKCU - No Name - {A1E75A0E-4397-4BA8-BB50-E19FB66890F4} - No File
Toolbar: HKCU - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.5.0.19\coIEPlg.dll (Symantec Corporation)
DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default
FF NewTab: about:blank
FF SelectedSearchEngine: MyAshampoo Customized Web Search
FF Homepage: hxxp://search.conduit.com/?ctid=CT2475029&SearchSource=13
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @garmin.com/GpsControl -> C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @pages.tvunetworks.com/WebPlayer -> C:\Program Files (x86)\TVUPlayer\npTVUAx.dll No File
FF Plugin-x32: @protectdisc.com/NPPDLicenseHelper -> C:\Program Files (x86)\ProtectDisc\License Helper\NPPDLicenseHelper.dll ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 -> D:\Programme\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\VOW\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\VOW\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF user.js: detected! => C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\user.js
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npnul32.dll (mozilla.org)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPPDLicenseHelper.dll ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\searchplugins\conduit.xml
FF SearchPlugin: C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\searchplugins\Web Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Conduit Engine - C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\Extensions\engine@conduit.com [2011-01-14]
FF Extension: No Name - C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\Extensions\staged [2013-09-14]
FF Extension: vShare - C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\Extensions\vshare@toolbar [2010-11-27]
FF Extension: DVDVideoSoftTB Toolbar - C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\Extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [2010-09-07]
FF Extension: MyAshampoo Community Toolbar - C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\Extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} [2011-01-14]
FF Extension: Free YouTube Download (Free Studio) Menu - C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2013-10-29]
FF Extension: DealPly Shopping - C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\Extensions\{e53a26f5-7199-4a5b-86f5-d2e86854b979} [2013-09-02]
FF Extension: QuickStores-Toolbar - C:\Program Files (x86)\Mozilla Firefox\extensions\quickstores@quickstores.de [2010-12-04]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} [2010-03-21]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} [2010-04-09]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010-04-18]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [2010-09-15]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2010-12-13]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011-05-13]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [2011-10-12]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} [2011-12-12]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} [2012-05-12]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2012-07-14]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA} [2012-08-15]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2012-10-12]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2012-11-15]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.3.0.12\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.3.0.12\coFFPlgn [2014-09-17]
FF HKLM-x32\...\Firefox\Extensions: [12x3q@3244516.com] - C:\Program Files (x86)\Better-Surf\ff
FF Extension: Better-Surf - C:\Program Files (x86)\Better-Surf\ff [2013-11-25]
FF HKLM-x32\...\Firefox\Extensions: [ext@WebexpEnhancedV1alpha299.net] - C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha299\ff
FF Extension: Webexp Enhanced - C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha299\ff [2013-12-20]
FF HKLM-x32\...\Firefox\Extensions: [ext@VideoPlayerV3beta736.net] - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta736\ff
FF Extension: Video Player - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta736\ff [2014-01-10]
FF HKLM-x32\...\Firefox\Extensions: [ext@MediaPlayerV1alpha86.net] - C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha86\ff
FF Extension: Media Player - C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha86\ff [2014-01-29]
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.3.0.12\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.3.0.12\IPSFF [2014-06-01]
FF Extension: Free Download Manager plugin - C:\ProgramData\Free Download Manager\Firefox\Extensions\1.6.0.1 [2014-02-08]
Chrome:
=======
CHR HomePage: Default -> hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=1d55a34c-41e3-7bb2-c576-39761563b71c&searchtype=hp&installDate=14/09/2013
CHR StartupUrls: Default -> "hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=1d55a34c-41e3-7bb2-c576-39761563b71c&searchtype=hp&installDate=14/09/2013", "hxxp://www.franken-trekking.de/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\VOW\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\VOW\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-06-30]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\VOW\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-08-27]
CHR Extension: (YouTube) - C:\Users\VOW\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-10-17]
CHR Extension: (Battlefield Heroes) - C:\Users\VOW\AppData\Local\Google\Chrome\User Data\Default\Extensions\cehdakiococlfmjcbebbkjkfjhbieknh [2013-05-30]
CHR Extension: (SAS Zombie Assault 3) - C:\Users\VOW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ckmedboncpahmbhnpaamimdohjfpphea [2012-11-04]
CHR Extension: (Google-Suche) - C:\Users\VOW\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-10-17]
CHR Extension: (Google Wallet) - C:\Users\VOW\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-02]
CHR Extension: (Google Mail) - C:\Users\VOW\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-10-17]
CHR HKCU\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\VOW\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2013-06-29]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2013-09-14]
CHR HKLM-x32\...\Chrome\Extension: [dedmngkbaffkenlfdcbganndoghblmap] - C:\Program Files (x86)\BetterSurf\ch\Chrome.crx [2013-09-14]
CHR HKLM-x32\...\Chrome\Extension: [fnjbmmemklcjgepojigaapkoodmkgbae] - C:\Program Files (x86)\DivX\DivX Plus Web Player\google_chrome\wpa\wpa.crx [2013-09-14]
CHR HKLM-x32\...\Chrome\Extension: [hihneggbbhdjkjbckjdpjjnflgpghbjf] - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta736\ch\VideoPlayerV3beta736.crx [2014-01-07]
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\21.5.0.19\Exts\Chrome.crx [2014-08-06]
CHR HKLM-x32\...\Chrome\Extension: [mmifolfpllfdhilecpdpmemhelmanajl] - C:\Program Files (x86)\BetterSurf\BetterSurfPlus\ch\BetterSurfPlus.crx [2014-08-06]
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\google_chrome\html5video\html5video.crx [2014-08-06]
CHR HKLM-x32\...\Chrome\Extension: [oklkhfliakifhfhfippeiajfknhfdbdo] - C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha299\ch\WebexpEnhancedV1alpha299.crx [2013-12-19]
CHR HKLM-x32\...\Chrome\Extension: [poheodfamflhhhdcmjfeggbgigeefaco] - C:\Program Files (x86)\Better-Surf\ch\Chrome.crx [2013-12-19]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKCU\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 ACT2_Service; C:\Program Files (x86)\Ashampoo\Ashampoo Core Tuner 2\ACT2Service.exe [1420184 2011-08-09] ()
R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [File not signed]
R2 DBService; C:\Program Files (x86)\Common Files\DATA BECKER Shared\DBService.exe [187456 2009-11-08] (DATA BECKER GmbH & Co KG) [File not signed]
R2 DfSdkS; D:\Programme\Ashampoo WinOptimizer 10\DfsdkS64.exe [544768 2009-08-24] (mst software GmbH, Germany) [File not signed]
S2 ES lite Service; C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE [68136 2009-08-24] ()
R2 Fabs; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [1858048 2012-01-23] (MAGIX AG) [File not signed]
S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2702848 2011-04-26] (MAGIX®) [File not signed]
R2 Garmin Core Update Service; D:\Programme\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [438616 2014-07-23] (Garmin Ltd or its subsidiaries)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 JMB36X; C:\Windows\SysWOW64\XSrvSetup.exe [72304 2010-01-19] ()
R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareService.exe [706864 2014-08-27] ()
R2 MSSQL$SQLEXPRESS; c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [57617752 2009-03-30] (Microsoft Corporation)
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\21.5.0.19\NIS.exe [276376 2014-07-31] (Symantec Corporation)
R2 OS Selector; C:\Program Files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe [2155848 2011-11-15] ()
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75136 2013-05-30] ()
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [117264 2009-10-20] (CACE Technologies, Inc.)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)
S4 SQLAgent$SQLEXPRESS; c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [427880 2009-03-30] (Microsoft Corporation)
R2 SynoDrService; C:\Program Files (x86)\Synology Data Replicator 3\SynoDrServicex64.exe [381312 2013-04-24] () [File not signed]
R2 UsbClientService; C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe [248704 2013-04-30] () [File not signed]
S3 WO_LiveService; D:\Programme\Ashampoo WinOptimizer 10\LiveTunerService.exe [885096 2013-05-15] ()
S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe /launchService [X]
S3 STSService; "C:\Program Files (x86)\SoundTaxi Media Suite\STSService.exe" [X]
S2 WajamUpdaterV3; "C:\Program Files (x86)\Wajam\Updater\WajamUpdaterV3.exe" [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 ACT2PM; C:\Program Files (x86)\Ashampoo\Ashampoo Core Tuner 2\ACT2ProcessMonitor64.sys [15160 2011-06-10] ()
R0 asahci64; C:\Windows\System32\DRIVERS\asahci64.sys [49760 2011-09-21] (Asmedia Technology)
R0 AsrRamDisk; C:\Windows\System32\DRIVERS\AsrRamDisk.sys [31016 2012-01-13] (ASRock Inc.)
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [211456 2010-11-27] () [File not signed]
R1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.3.0.12\Definitions\BASHDefs\20140912.003\BHDrvx64.sys [1586904 2014-09-13] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1505000.013\ccSetx64.sys [162392 2014-02-21] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [487216 2014-09-09] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142640 2014-09-09] (Symantec Corporation)
S3 FNETTBOH_305; C:\Windows\System32\drivers\FNETTBOH_305.SYS [32320 2014-09-07] (FNet Co., Ltd.)
R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [15936 2012-10-16] (FNet Co., Ltd.)
U5 FontCache3.0.0.0; C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [42856 2010-11-05] (Microsoft Corporation)
R1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.3.0.12\Definitions\IPSDefs\20140916.001\IDSvia64.sys [633560 2014-08-29] (Symantec Corporation)
S3 leafnets; C:\Windows\System32\DRIVERS\leafnets.sys [29696 2011-05-26] (Leaf Networks)
R3 libusb0; C:\Windows\System32\drivers\libusb0.sys [44480 2013-09-23] (hxxp://libusb-win32.sourceforge.net)
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [35328 2010-11-27] () [File not signed]
S2 lirsgt; C:\Windows\SysWOW64\DRIVERS\lirsgt.sys [18048 2010-11-27] () [File not signed]
R2 LiveTunerPM; D:\Programme\Ashampoo WinOptimizer 10\LiveTunerProcessMonitor64.sys [12824 2011-03-08] ()
R3 NAVENG; C:\Program Files (x86)\Norton Internet Security\NortonData\21.3.0.12\Definitions\VirusDefs\20140916.033\ENG64.SYS [129752 2014-08-21] (Symantec Corporation)
R3 NAVEX15; C:\Program Files (x86)\Norton Internet Security\NortonData\21.3.0.12\Definitions\VirusDefs\20140916.033\EX64.SYS [2137304 2014-08-21] (Symantec Corporation)
R2 NPF; C:\Windows\system32\drivers\npf.sys [35344 2013-01-03] (CACE Technologies, Inc.)
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [19912 2009-12-21] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [13264 2009-12-21] ()
R0 sfdrv01a; C:\Windows\System32\drivers\sfdrv01a.sys [77432 2009-02-03] (Protection Technology (StarForce))
S3 SndTAudio; C:\Windows\System32\drivers\SndTAudio.sys [33336 2010-02-18] (Windows (R) Codename Longhorn DDK provider)
R1 SRTSP; C:\Windows\System32\Drivers\NISx64\1505000.013\SRTSP64.SYS [875736 2014-02-13] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1505000.013\SRTSPX64.SYS [36952 2013-10-30] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1505000.013\SYMDS64.SYS [493656 2013-10-30] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1505000.013\SYMEFA64.SYS [1148120 2014-03-04] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-06-01] (Symantec Corporation)
R1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [78936 2013-10-30] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1505000.013\Ironx64.SYS [264280 2013-10-30] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1505000.013\SYMNETS.SYS [593112 2014-02-18] (Symantec Corporation)
R3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [389240 2014-07-10] (BitDefender S.R.L.)
S3 V0260VID; C:\Windows\System32\DRIVERS\V0260Vid.sys [189664 2007-07-18] (Creative Technology Ltd.)
S3 AIDA64Driver; \??\C:\Users\VOW\AppData\Local\Temp\Rar$EX01.439\kerneld.x64 [X]
S2 AODDriver4.01; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [X]
S2 AODDriver4.1; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [X]
R3 AxtuDrv; \??\C:\Windows\SysWOW64\Drivers\AxtuDrv.sys [X]
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
S3 Fwleaf; system32\DRIVERS\fwleaf.sys [X]
S3 SliceDisk5; \??\C:\Program Files\A-FF Find and Mount\slicedisk-x64.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 WPRO_41_1742; system32\drivers\WPRO_41_1742.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-17 22:41 - 2014-09-17 22:41 - 00042436 _____ () C:\Users\VOW\Desktop\FRST.txt
2014-09-17 22:41 - 2014-09-17 22:41 - 00000000 ____D () C:\FRST
2014-09-17 22:38 - 2014-09-17 22:38 - 00000477 _____ () C:\Users\VOW\Desktop\Ad-Aware_Report_Full_Manual_2014-09-17T22-37-25.374734.xml
2014-09-17 22:10 - 2014-09-17 22:11 - 00000468 _____ () C:\Users\VOW\Desktop\defogger_disable.log
2014-09-17 22:10 - 2014-09-17 22:10 - 00000000 _____ () C:\Users\VOW\defogger_reenable
2014-09-17 21:56 - 2014-09-17 21:55 - 00380416 _____ () C:\Users\VOW\Desktop\Gmer-19357.exe
2014-09-17 21:55 - 2014-09-17 21:55 - 02105856 _____ (Farbar) C:\Users\VOW\Desktop\FRST64.exe
2014-09-17 21:53 - 2014-09-17 21:53 - 00050477 _____ () C:\Users\VOW\Desktop\Defogger.exe
2014-09-17 21:51 - 2014-09-17 21:51 - 00000000 ____D () C:\Users\VOW\Desktop\Outdoor
2014-09-17 21:51 - 2014-09-17 21:51 - 00000000 ____D () C:\Users\VOW\Desktop\Copter
2014-09-17 21:16 - 2014-09-17 21:16 - 00000000 ____D () C:\Users\VOW\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\InetStat
2014-09-17 21:16 - 2014-09-17 21:16 - 00000000 ____D () C:\Users\VOW\AppData\Roaming\InetStat
2014-09-17 21:16 - 2014-09-17 21:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InetStat
2014-09-17 21:15 - 2014-09-17 21:15 - 00000000 ____D () C:\Users\VOW\AppData\Roaming\LookThisUp
2014-09-12 19:23 - 2014-09-12 19:23 - 00000000 ____D () C:\Users\VOW\AppData\Roaming\Lavasoft
2014-09-12 18:53 - 2014-09-17 18:32 - 00002337 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2014-09-12 18:53 - 2014-09-12 18:53 - 00000000 ____D () C:\Users\VOW\AppData\Roaming\LavasoftStatistics
2014-09-12 18:53 - 2014-09-12 18:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
2014-09-12 18:49 - 2014-09-12 18:49 - 00000000 ____D () C:\Program Files\Lavasoft
2014-09-12 18:47 - 2014-09-12 18:47 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft
2014-09-12 18:45 - 2014-09-12 18:45 - 00000000 ____D () C:\ProgramData\Lavasoft
2014-09-12 18:42 - 2014-08-20 19:17 - 00019800 _____ () C:\Windows\system32\roboot64.exe
2014-09-10 21:16 - 2014-09-10 21:16 - 00000000 ____D () C:\Users\VOW\AppData\Local\Adobe
2014-09-09 21:13 - 2014-08-19 20:05 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-09 21:13 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-09-09 21:13 - 2014-08-19 00:29 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-09 21:13 - 2014-08-19 00:29 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-09 21:13 - 2014-08-19 00:15 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-09 21:13 - 2014-08-19 00:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-09 21:13 - 2014-08-19 00:14 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-09 21:13 - 2014-08-19 00:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-09 21:13 - 2014-08-19 00:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-09 21:13 - 2014-08-19 00:05 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-09 21:13 - 2014-08-19 00:03 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-09 21:13 - 2014-08-19 00:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-09 21:13 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-09-09 21:13 - 2014-08-18 23:51 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-09 21:13 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-09-09 21:13 - 2014-08-18 23:45 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-09 21:13 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-09-09 21:13 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-09-09 21:13 - 2014-08-18 23:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-09 21:13 - 2014-08-18 23:39 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-09 21:13 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-09 21:13 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-09-09 21:13 - 2014-08-18 23:38 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-09 21:13 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-09-09 21:13 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-09-09 21:13 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-09-09 21:13 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-09-09 21:13 - 2014-08-18 23:25 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-09 21:13 - 2014-08-18 23:25 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-09 21:13 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-09-09 21:13 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-09-09 21:13 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-09-09 21:13 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-09 21:13 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-09 21:12 - 2014-08-19 01:01 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-09 21:12 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-09 21:12 - 2014-08-19 00:20 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-09 21:12 - 2014-08-19 00:19 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-09 21:12 - 2014-08-19 00:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-09 21:12 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-09-09 21:12 - 2014-08-19 00:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-09 21:12 - 2014-08-18 23:56 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-09 21:12 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-09-09 21:12 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-09 21:12 - 2014-08-18 23:23 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-09 21:12 - 2014-08-18 23:23 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-09 21:12 - 2014-08-18 23:16 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-09 21:12 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-09 21:12 - 2014-08-18 23:15 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-09 21:12 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-09 21:12 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-09-09 21:12 - 2014-08-18 22:55 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-09 21:12 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-09 21:12 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-09 21:12 - 2014-08-18 22:38 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-09 21:12 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-09-09 21:10 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-09 21:10 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2014-09-09 19:30 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-09 19:30 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-09 19:30 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-09 19:30 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-09-09 19:30 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-09 19:30 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-09 19:30 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-09-09 19:30 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-09-09 19:30 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-09-09 19:30 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-09 19:30 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-09-09 19:20 - 2014-09-17 18:32 - 00003018 _____ () C:\Windows\System32\Tasks\asrRd
2014-09-07 10:01 - 2014-09-07 10:01 - 00000000 ____D () C:\Users\VOW\AppData\Local\RocketTab
2014-09-05 20:48 - 2014-09-05 19:41 - 00675988 _____ () C:\Users\VOW\Desktop\Minecraft.exe
2014-09-05 20:43 - 2014-09-17 18:46 - 00000000 ____D () C:\Program Files (x86)\RocketTab
2014-09-05 20:43 - 2014-09-05 20:43 - 00004132 _____ () C:\Windows\System32\Tasks\RocketTab Update Task
2014-09-05 20:43 - 2014-09-05 20:43 - 00003346 _____ () C:\Windows\System32\Tasks\RocketTab
2014-09-01 21:39 - 2014-09-01 21:39 - 00000000 ____D () C:\Users\VOW\AppData\Local\SearchProtect
2014-09-01 09:34 - 2014-09-01 09:34 - 00000891 _____ () C:\Users\Public\Desktop\MAGIX Video deluxe 2015 Plus.lnk
2014-09-01 09:34 - 2014-09-01 09:34 - 00000000 ____D () C:\Users\VOW\AppData\Local\Magix
2014-09-01 09:34 - 2014-09-01 09:34 - 00000000 ____D () C:\Program Files\Common Files\MAGIX Shared
2014-09-01 09:09 - 2014-09-05 13:31 - 00000026 _____ () C:\Windows\Zone.Identifier
2014-09-01 08:39 - 2014-09-01 08:39 - 00000000 ____D () C:\Amazon MP3
2014-08-28 06:35 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 06:35 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-28 06:35 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-26 16:12 - 2014-04-13 10:15 - 834916622 _____ () C:\Users\VOW\Desktop\Copter_Flug3_remix_dashware_120414.mp4
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-17 22:41 - 2014-09-17 22:41 - 00042436 _____ () C:\Users\VOW\Desktop\FRST.txt
2014-09-17 22:41 - 2014-09-17 22:41 - 00000000 ____D () C:\FRST
2014-09-17 22:38 - 2014-09-17 22:38 - 00000477 _____ () C:\Users\VOW\Desktop\Ad-Aware_Report_Full_Manual_2014-09-17T22-37-25.374734.xml
2014-09-17 22:26 - 2012-04-01 08:31 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-17 22:11 - 2014-09-17 22:10 - 00000468 _____ () C:\Users\VOW\Desktop\defogger_disable.log
2014-09-17 22:10 - 2014-09-17 22:10 - 00000000 _____ () C:\Users\VOW\defogger_reenable
2014-09-17 22:10 - 2009-10-31 16:10 - 00000000 ____D () C:\Users\VOW
2014-09-17 22:06 - 2012-10-17 18:57 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3018767705-964232526-3307114488-1001UA.job
2014-09-17 22:06 - 2009-10-31 17:55 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-17 21:55 - 2014-09-17 21:56 - 00380416 _____ () C:\Users\VOW\Desktop\Gmer-19357.exe
2014-09-17 21:55 - 2014-09-17 21:55 - 02105856 _____ (Farbar) C:\Users\VOW\Desktop\FRST64.exe
2014-09-17 21:53 - 2014-09-17 21:53 - 00050477 _____ () C:\Users\VOW\Desktop\Defogger.exe
2014-09-17 21:51 - 2014-09-17 21:51 - 00000000 ____D () C:\Users\VOW\Desktop\Outdoor
2014-09-17 21:51 - 2014-09-17 21:51 - 00000000 ____D () C:\Users\VOW\Desktop\Copter
2014-09-17 21:16 - 2014-09-17 21:16 - 00000000 ____D () C:\Users\VOW\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\InetStat
2014-09-17 21:16 - 2014-09-17 21:16 - 00000000 ____D () C:\Users\VOW\AppData\Roaming\InetStat
2014-09-17 21:16 - 2014-09-17 21:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InetStat
2014-09-17 21:15 - 2014-09-17 21:15 - 00000000 ____D () C:\Users\VOW\AppData\Roaming\LookThisUp
2014-09-17 21:06 - 2012-10-17 18:57 - 00001060 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3018767705-964232526-3307114488-1001Core.job
2014-09-17 18:46 - 2014-09-05 20:43 - 00000000 ____D () C:\Program Files (x86)\RocketTab
2014-09-17 18:39 - 2009-07-14 06:45 - 00022864 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-17 18:39 - 2009-07-14 06:45 - 00022864 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-17 18:38 - 2009-07-14 19:58 - 00767720 _____ () C:\Windows\system32\perfh007.dat
2014-09-17 18:38 - 2009-07-14 19:58 - 00175704 _____ () C:\Windows\system32\perfc007.dat
2014-09-17 18:38 - 2009-07-14 07:13 - 01813706 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-17 18:36 - 2010-06-06 17:28 - 00003914 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{74AA5567-A267-4A41-8611-8F0F98C5D7DA}
2014-09-17 18:36 - 2009-10-31 16:04 - 01828315 _____ () C:\Windows\WindowsUpdate.log
2014-09-17 18:34 - 2013-05-12 20:55 - 00002471 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-09-17 18:33 - 2012-10-16 22:45 - 00002952 _____ () C:\Windows\System32\Tasks\AsrXTU
2014-09-17 18:32 - 2014-09-12 18:53 - 00002337 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2014-09-17 18:32 - 2014-09-09 19:20 - 00003018 _____ () C:\Windows\System32\Tasks\asrRd
2014-09-17 18:32 - 2014-05-04 19:34 - 00000354 _____ () C:\Windows\Tasks\DriverToolkit Autorun.job
2014-09-17 18:32 - 2013-09-11 06:26 - 00000073 _____ () C:\service.log
2014-09-17 18:32 - 2013-08-16 19:06 - 00030855 _____ () C:\Windows\setupact.log
2014-09-17 18:32 - 2011-08-28 16:47 - 00000416 _____ () C:\Windows\Tasks\DriverCure Startup.job
2014-09-17 18:32 - 2010-07-27 21:49 - 00025640 _____ (Windows (R) Server 2003 DDK provider) C:\Windows\gdrv.sys
2014-09-17 18:32 - 2009-11-29 19:25 - 00000000 ____D () C:\Users\VOW\AppData\Local\FreePDF_XP
2014-09-17 18:32 - 2009-10-31 17:55 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-17 18:32 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-14 16:04 - 2012-05-26 18:13 - 00000000 ____D () C:\Users\VOW\AppData\Roaming\.minecraft
2014-09-13 11:20 - 2010-07-14 05:38 - 00000472 ____H () C:\Windows\Tasks\Norton Security Scan for VOW.job
2014-09-13 09:45 - 2013-08-24 09:43 - 00000000 ____D () C:\Program Files (x86)\File Type Assistant
2014-09-13 02:05 - 2009-11-28 09:37 - 00000000 ____D () C:\Users\VOW\AppData\Roaming\Desktopicon
2014-09-12 19:23 - 2014-09-12 19:23 - 00000000 ____D () C:\Users\VOW\AppData\Roaming\Lavasoft
2014-09-12 18:53 - 2014-09-12 18:53 - 00000000 ____D () C:\Users\VOW\AppData\Roaming\LavasoftStatistics
2014-09-12 18:53 - 2014-09-12 18:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
2014-09-12 18:49 - 2014-09-12 18:49 - 00000000 ____D () C:\Program Files\Lavasoft
2014-09-12 18:47 - 2014-09-12 18:47 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft
2014-09-12 18:45 - 2014-09-12 18:45 - 00000000 ____D () C:\ProgramData\Lavasoft
2014-09-10 21:16 - 2014-09-10 21:16 - 00000000 ____D () C:\Users\VOW\AppData\Local\Adobe
2014-09-10 19:26 - 2012-04-01 08:31 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-10 19:26 - 2012-04-01 08:30 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-10 19:26 - 2011-06-10 22:05 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-10 19:10 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-09 21:12 - 2013-08-16 23:02 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-09 21:12 - 2010-12-17 19:26 - 01787050 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-09-09 21:10 - 2014-05-09 21:25 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-09 21:10 - 2009-10-31 16:18 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-09 20:18 - 2014-02-22 14:12 - 00000000 ____D () C:\Users\VOW\AppData\Local\Amazon Cloud Player
2014-09-07 10:01 - 2014-09-07 10:01 - 00000000 ____D () C:\Users\VOW\AppData\Local\RocketTab
2014-09-07 09:52 - 2012-10-20 15:19 - 00032320 _____ (FNet Co., Ltd.) C:\Windows\system32\Drivers\FNETTBOH_305.SYS
2014-09-05 20:49 - 2010-03-06 14:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\gMapMaker
2014-09-05 20:43 - 2014-09-05 20:43 - 00004132 _____ () C:\Windows\System32\Tasks\RocketTab Update Task
2014-09-05 20:43 - 2014-09-05 20:43 - 00003346 _____ () C:\Windows\System32\Tasks\RocketTab
2014-09-05 19:41 - 2014-09-05 20:48 - 00675988 _____ () C:\Users\VOW\Desktop\Minecraft.exe
2014-09-05 18:00 - 2011-08-18 09:47 - 00000000 ____D () C:\Program Files (x86)\PowerArchiver
2014-09-05 13:31 - 2014-09-01 09:09 - 00000026 _____ () C:\Windows\Zone.Identifier
2014-09-05 04:10 - 2014-09-09 19:30 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-05 04:05 - 2014-09-09 19:30 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-04 08:39 - 2013-08-21 18:04 - 00341636 _____ () C:\Windows\PFRO.log
2014-09-03 19:21 - 2009-07-14 06:45 - 00513544 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-01 21:39 - 2014-09-01 21:39 - 00000000 ____D () C:\Users\VOW\AppData\Local\SearchProtect
2014-09-01 09:37 - 2009-10-31 16:58 - 00148448 _____ () C:\Users\VOW\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-01 09:36 - 2009-11-09 21:11 - 00000000 ____D () C:\Users\VOW\AppData\Local\CrashDumps
2014-09-01 09:34 - 2014-09-01 09:34 - 00000891 _____ () C:\Users\Public\Desktop\MAGIX Video deluxe 2015 Plus.lnk
2014-09-01 09:34 - 2014-09-01 09:34 - 00000000 ____D () C:\Users\VOW\AppData\Local\Magix
2014-09-01 09:34 - 2014-09-01 09:34 - 00000000 ____D () C:\Program Files\Common Files\MAGIX Shared
2014-09-01 09:34 - 2011-11-25 19:06 - 00000000 ____D () C:\Users\VOW\AppData\Roaming\MAGIX
2014-09-01 09:34 - 2011-11-25 19:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MAGIX
2014-09-01 09:34 - 2011-11-25 19:05 - 00000000 ____D () C:\ProgramData\MAGIX
2014-09-01 09:33 - 2012-09-17 18:45 - 00000000 ____D () C:\ProgramData\simplitec
2014-09-01 09:33 - 2011-11-25 19:05 - 00000000 ____D () C:\Program Files (x86)\MAGIX
2014-09-01 09:31 - 2014-03-26 19:06 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-09-01 09:20 - 2014-05-13 20:06 - 00000000 ____D () C:\ProgramData\Package Cache
2014-09-01 08:39 - 2014-09-01 08:39 - 00000000 ____D () C:\Amazon MP3
2014-08-28 21:41 - 2010-12-04 14:27 - 00040211 _____ () C:\Windows\cdplayer.ini
2014-08-28 21:19 - 2010-12-04 10:36 - 00000000 ____D () C:\Program Files (x86)\Audiograbber
2014-08-27 02:44 - 2011-08-28 16:47 - 00000400 _____ () C:\Windows\Tasks\DriverCure.job
2014-08-23 04:07 - 2014-08-28 06:35 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-08-28 06:35 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-08-28 06:35 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-22 16:15 - 2014-02-01 11:30 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-08-21 19:08 - 2013-06-29 14:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2014-08-20 19:41 - 2011-01-20 21:38 - 00000000 ____D () C:\Program Files (x86)\Brother
2014-08-20 19:17 - 2014-09-12 18:42 - 00019800 _____ () C:\Windows\system32\roboot64.exe
2014-08-19 20:05 - 2014-09-09 21:13 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-19 20:03 - 2014-08-02 17:17 - 00000000 ____D () C:\Users\VOW\Desktop\Ebermannstadt
2014-08-19 19:39 - 2014-09-09 21:13 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-19 01:01 - 2014-09-09 21:12 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-19 00:29 - 2014-09-09 21:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-19 00:29 - 2014-09-09 21:13 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-19 00:26 - 2014-09-09 21:12 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-19 00:20 - 2014-09-09 21:12 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-19 00:19 - 2014-09-09 21:12 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-19 00:15 - 2014-09-09 21:13 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-19 00:15 - 2014-09-09 21:13 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-19 00:14 - 2014-09-09 21:13 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-19 00:14 - 2014-09-09 21:12 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-19 00:08 - 2014-09-09 21:13 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-19 00:08 - 2014-09-09 21:13 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-19 00:08 - 2014-09-09 21:12 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-19 00:05 - 2014-09-09 21:13 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-19 00:03 - 2014-09-09 21:13 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-19 00:03 - 2014-09-09 21:13 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-19 00:03 - 2014-09-09 21:12 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-18 23:57 - 2014-09-09 21:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-18 23:56 - 2014-09-09 21:12 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-18 23:51 - 2014-09-09 21:13 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-18 23:46 - 2014-09-09 21:13 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-18 23:45 - 2014-09-09 21:13 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-18 23:45 - 2014-09-09 21:13 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-18 23:44 - 2014-09-09 21:13 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-18 23:44 - 2014-09-09 21:12 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-18 23:42 - 2014-09-09 21:12 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-18 23:40 - 2014-09-09 21:13 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-18 23:39 - 2014-09-09 21:13 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-18 23:39 - 2014-09-09 21:13 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-18 23:39 - 2014-09-09 21:13 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-18 23:38 - 2014-09-09 21:13 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-18 23:37 - 2014-09-09 21:13 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-18 23:36 - 2014-09-09 21:13 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-18 23:35 - 2014-09-09 21:13 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-18 23:28 - 2013-12-09 19:08 - 00000000 ____D () C:\Program Files (x86)\Samsung SSD Magician
2014-08-18 23:27 - 2014-09-09 21:13 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-18 23:25 - 2014-09-09 21:13 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-18 23:25 - 2014-09-09 21:13 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-18 23:23 - 2014-09-09 21:12 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-18 23:23 - 2014-09-09 21:12 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-18 23:22 - 2014-09-09 21:13 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-18 23:19 - 2014-09-09 21:13 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-18 23:17 - 2014-09-09 21:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-18 23:17 - 2014-09-09 21:13 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-18 23:16 - 2014-09-09 21:12 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-18 23:15 - 2014-09-09 21:12 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-18 23:15 - 2014-09-09 21:12 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-18 23:09 - 2014-09-09 21:13 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-18 23:08 - 2014-09-09 21:12 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-18 23:07 - 2014-09-09 21:12 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-18 22:55 - 2014-09-09 21:12 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-18 22:46 - 2014-09-09 21:12 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-18 22:38 - 2014-09-09 21:12 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-18 22:38 - 2014-09-09 21:12 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-18 22:36 - 2014-09-09 21:12 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
Some content of TEMP:
====================
C:\Users\VOW\AppData\Local\Temp\setup_292.exe
C:\Users\VOW\AppData\Local\Temp\System.Data.SQLite.dll
C:\Users\VOW\AppData\Local\Temp\System.Data.SQLite25985.dll
C:\Users\VOW\AppData\Local\Temp\System.Data.SQLite32856.dll
C:\Users\VOW\AppData\Local\Temp\System.Data.SQLite50334.dll
C:\Users\VOW\AppData\Local\Temp\System.Data.SQLite63985.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-09-17 18:54
==================== End Of Log ============================
--- --- --- --- --- --- --- --- --- |
|
17.09.2014, 22:25
| #3 |
| | Win7-64Bit - Browser, Netzwerkeinstellungen, Proxy wird immer automatisch aktiviert 127.0.0.1:49273 Addition Log
__________________Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-09-2014
Ran by VOW at 2014-09-17 22:42:05
Running from C:\Users\VOW\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Ad-Aware Antivirus (Disabled - Out of date) {D87B6541-12A1-DAEA-0033-9B8057AAB996}
AV: Norton Internet Security (Enabled - Up to date) {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}
AS: Norton Internet Security (Enabled - Up to date) {631E4324-D31C-783F-EC5C-35AD42B18466}
AS: Ad-Aware Antivirus (Disabled - Out of date) {631A84A5-349B-D564-3A83-A0F22C2DF32B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
FW: Norton Internet Security (Enabled) {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}
FW: Ad-Aware Firewall (Disabled) {E040E464-58CE-DBB2-2B6C-32B5A979FEED}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version: - Microsoft)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Acronis Drive Monitor (HKLM-x32\...\{706AE61D-40A4-4F50-8359-FE8F6F7FA461}) (Version: 1.0.566 - Acronis)
Acronis*Disk*Director*11*Home (HKLM-x32\...\{8EFB7927-48AD-4E6D-91B7-6B2BD6C3F380}) (Version: 11.0.2343 - Acronis)
Acronis*True*Image*Home 2012 (HKLM-x32\...\{C1FDF2F0-2136-42D8-8A64-2B45BBF2C19E}Visible) (Version: 15.0.7119 - Acronis)
Acronis*True*Image*Home 2012 (x32 Version: 15.0.7119 - Acronis) Hidden
Ad-Aware Antivirus (HKLM\...\{E39A80AE-0CC0-43EE-AB6B-BE11DC4F969F}_AdAwareUpdater) (Version: 11.3.6321.0 - Lavasoft)
AdAwareInstaller (Version: 11.3.6321.0 - Lavasoft) Hidden
AdAwareUpdater (Version: 11.3.6321.0 - Lavasoft) Hidden
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.6 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.6.3.633 - Adobe Systems, Inc.)
Adobe SVG Viewer 3.0 (HKLM-x32\...\Adobe SVG Viewer) (Version: 3.0 - )
ALL16820x Utility (HKLM-x32\...\{BE6DF37F-8D64-4CAA-8028-3671FDAA94DF}) (Version: 3.0.902 - ALLNET GmbH)
Amazon Cloud Player (HKCU\...\Amazon Amazon Cloud Player) (Version: 2.4.0.26 - Amazon Services LLC)
AMD Accelerated Video Transcoding (Version: 12.5.100.21219 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.1084.4 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{5E03A267-415E-5383-FA8F-3CE4145663B9}) (Version: 8.0.903.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - ATI Technologies Inc.) Hidden
AMD Media Foundation Decoders (Version: 1.0.71219.1540 - Advanced Micro Devices, Inc.) Hidden
ANT Drivers Installer x64 (Version: 2.3.4 - Garmin Ltd or its subsidiaries) Hidden
AntimalwareEngine (Version: 3.0.0.56 - Lavasoft) Hidden
Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ArcSoft MediaImpression (HKLM-x32\...\{2C39F7CF-E022-4C0D-B1BA-AF6DDD931054}) (Version: 1.2.28.448 - ArcSoft)
Ashampoo Burning Studio 10 v.10.0.15 (HKLM-x32\...\Ashampoo Burning Studio 10_is1) (Version: 10.0.15 - Ashampoo GmbH & Co. KG)
Ashampoo Burning Studio 11 v.11.0.4 (HKLM-x32\...\Ashampoo Burning Studio 11_is1) (Version: 11.0.4 - Ashampoo GmbH & Co. KG)
Ashampoo Core Tuner 2 2.0.0 (HKLM-x32\...\Ashampoo Core Tuner 2_is1) (Version: 2.0.0 - Ashampoo GmbH & Co. KG)
Ashampoo Photo Commander 9 v.9.4.3 (HKLM-x32\...\{C92AB6F1-6A1B-F954-7C68-B44BA8E357A4}_is1) (Version: 9.4.3 - Ashampoo GmbH & Co. KG)
Ashampoo WinOptimizer 10 v.10.2.5 (HKLM-x32\...\{4209F371-88D4-AB00-ED2B-D6520C84D9D5}_is1) (Version: 10.02.05 - Ashampoo GmbH & Co. KG)
Ashampoo WinOptimizer 8 v.8.13 (HKLM-x32\...\Ashampoo WinOptimizer 8_is1) (Version: 8.1.3 - Ashampoo GmbH & Co. KG)
Asmedia ASM106x SATA Host Controller Driver (HKLM-x32\...\{61942EF5-2CD8-47D4-869C-2E9A8BB085F1}) (Version: 1.3.1.000 - Asmedia Technology)
ASRock eXtreme Tuner v0.1.181 (HKLM-x32\...\ASRock eXtreme Tuner_is1) (Version: - )
ASRock XFast RAM v2.0.9 (HKLM\...\ASRock XFast RAM_is1) (Version: - ASRock Inc.)
ATI Catalyst Registration (x32 Version: 3.00.0000 - ATI Technologies Inc.) Hidden
Audiograbber 1.83 SE (HKLM-x32\...\Audiograbber) (Version: 1.83 SE - Audiograbber)
Audiograbber MP3-Plugin (HKLM-x32\...\Audiograbber-Lame) (Version: 1.0 - AG)
Auslogics DiskDefrag (HKLM-x32\...\{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1) (Version: 4.5.0.0 - Auslogics Labs Pty Ltd)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Brother MFL-Pro Suite DCP-J315W (HKLM-x32\...\{FB83EAC4-E3F6-4666-B45B-44522F2344B6}) (Version: 1.0.3.0 - Brother Industries, Ltd.)
BrowserSafeguard with RocketTab (HKLM-x32\...\RocketTab) (Version: - BrowserSafeguard with RocketTab) <==== ATTENTION
Canon MP Navigator EX 2.0 (HKLM-x32\...\MP Navigator EX 2.0) (Version: - )
CanoScan LiDE 200 Scanner Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ4807) (Version: - )
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center (x32 Version: 2012.1219.1521.27485 - Ihr Firmenname) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
CDDRV_Installer (Version: 4.60 - Logitech) Hidden
CDex extraction audio (HKLM-x32\...\CDex) (Version: - )
cGPSmapper Free 0100d (HKLM-x32\...\cGPSmapper Free_is1) (Version: - cGPSmapper)
CHIRP (HKLM-x32\...\CHIRP) (Version: - )
com! Update Pack Builder 5.0.7 (HKLM-x32\...\com! Update Pack Builder_is1) (Version: - com! - Das Computer Magazin)
Creative Live! Cam Vista IM Driver (1.11.02.00) (HKLM\...\Creative VF0260) (Version: - )
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DashWare (HKLM-x32\...\{C4080529-15B7-42FF-9928-FDC1FAED4954}) (Version: 1.5.0 - DashWare)
DirectX for Managed Code Update (Summer 2004) (x32 Version: 9.02.2904 - Microsoft) Hidden
DJI driver version 2.02 (HKLM-x32\...\{EDFDE5EE-84C7-4936-804C-6563943E5754}_is1) (Version: 2.02 - DJI)
DJI iOSD Assistant version 4.0 (HKLM-x32\...\{8CA48822-4CC7-40FE-9F4E-1BDC314F58F3}_is1) (Version: 4.0 - DJI)
DJI NAZAM Assistant version 2.20 (HKLM-x32\...\{407BF034-D1D3-4397-8887-72FE329100D8}_is1) (Version: 2.20 - DJI)
DJI NAZAM Lite Assistant version 1.00 (HKLM-x32\...\{FAA11C1F-4F7C-4A00-A153-DF51CC892FF8}_is1) (Version: 1.00 - DJI)
EA Download Manager (x32 Version: 4.0.0.396 - Electronic Arts) Hidden
EasyBCD 1.7.2 (HKLM-x32\...\EasyBCD) (Version: 1.7.2 - NeoSmart Technologies)
EasySaver B9.1214.1 (HKLM-x32\...\{07300F01-89CA-4CF8-92BD-2A605EB83C95}) (Version: 1.00.0000 - Gigabyte)
Elevated Installer (x32 Version: 3.2.16.0 - Garmin Ltd or its subsidiaries) Hidden
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 15.2.20140326 - Landesfinanzdirektion Thüringen)
erLT (x32 Version: 1.20.0137 - Logitech, Inc.) Hidden
File Type Assistant (HKLM-x32\...\Trusted Software Assistant_is1) (Version: 2014.5.6.0 - ) <==== ATTENTION
FileZilla Client 3.5.1 (HKLM-x32\...\FileZilla Client) (Version: 3.5.1 - FileZilla Project)
Firebird SQL Server - MAGIX Edition (HKLM-x32\...\{39AB2E37-1A55-4292-A5D3-971E9F70D0F8}) (Version: 2.1.32.0 - MAGIX AG)
Free Download Manager 3.9.2 (HKLM-x32\...\Free Download Manager_is1) (Version: - FreeDownloadManager.ORG)
Free Sound Recorder v9.4.1 (HKLM-x32\...\Free Sound Recorder_is1) (Version: - Copyright(C) 2005-2013 FreeSoundRecorder Technologies, Inc.)
Free YouTube Download version 3.2.34.430 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.34.430 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.12.43.806 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.43.806 - DVDVideoSoft Ltd.)
FreePDF (Remove only) (HKLM-x32\...\FreePDF_XP) (Version: - )
FRITZBox Anrufmonitor (HKLM-x32\...\{4D4C7CA5-3912-40A3-94BF-9B8089188A7A}) (Version: 1.0.1 - Bernhard Elbl)
FW LiveUpdate (HKLM-x32\...\{11F5D779-7BD9-465A-BBC4-10701386BCB9}) (Version: 2.0.7.2 - SAMSUNG)
GameMaker-Studio 1.1 (HKCU\...\GameMaker-Studio11) (Version: - YoYo Games Ltd.)
Garmin BaseCamp (HKLM-x32\...\{EBAC8FD4-28EC-46F7-BF9E-89D6E6673001}) (Version: 4.2.5 - Garmin Ltd or its subsidiaries)
Garmin Communicator Plugin (HKLM-x32\...\{15F4085A-BC98-4590-AFFD-03BBBE49524E}) (Version: 2.9.1 - Garmin Ltd or its subsidiaries)
Garmin Express (HKLM-x32\...\{817c6bb8-ea2d-4e12-abbc-e33c3de43f64}) (Version: 3.2.16.0 - Garmin Ltd or its subsidiaries)
Garmin Express (x32 Version: 3.2.16.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin Express Tray (x32 Version: 3.2.16.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin MapSource (HKLM-x32\...\{58FA5D40-E35A-47ED-8AFA-68CCC758559E}) (Version: 6.15.11 - Garmin Ltd or its subsidiaries)
Garmin Trip and Waypoint Manager v5 (HKLM-x32\...\{414A373B-59DF-4102-94CA-9FE9A74CBDDA}) (Version: 5.0.0.0 - Garmin Ltd or its subsidiaries)
Garmin USB Drivers (HKLM-x32\...\{3D5D6CFC-3097-425A-8D8F-7EAF5D57641D}) (Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)
Garmin WebUpdater (HKLM-x32\...\{E0783143-EAE2-4047-A8D6-E155523C594C}) (Version: 2.4.2 - Garmin Ltd or its subsidiaries)
Gigabyte Raid Configurer (HKLM-x32\...\{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}) (Version: 1.17.59.0 - GIGABYTE Technologies, Inc.)
Google Chrome (HKCU\...\Google Chrome) (Version: 37.0.2062.120 - Google Inc.)
Google Drive (HKLM-x32\...\{C6640705-7479-4EE5-BC86-879F05F65E74}) (Version: 1.17.7290.4094 - Google, Inc.)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google SketchUp 8 (HKLM-x32\...\{4BA6784F-3B10-473A-B9F5-33A36AC354D5}) (Version: 3.0.14358 - Google, Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
GPL Ghostscript 8.70 (HKLM-x32\...\GPL Ghostscript 8.70) (Version: - )
GSNMTOOL (HKLM-x32\...\GSNMTOOL ) (Version: - )
Hotfix für Microsoft Visual Basic 2008 Express Edition mit SP1 - DEU (KB945282) (HKLM-x32\...\{8F714418-F3C3-3BF0-B548-E4BDA7AD41DE}.KB945282) (Version: 1 - Microsoft Corporation)
Hotfix für Microsoft Visual Basic 2008 Express Edition mit SP1 - DEU (KB946040) (HKLM-x32\...\{8F714418-F3C3-3BF0-B548-E4BDA7AD41DE}.KB946040) (Version: 1 - Microsoft Corporation)
Hotfix für Microsoft Visual Basic 2008 Express Edition mit SP1 - DEU (KB946308) (HKLM-x32\...\{8F714418-F3C3-3BF0-B548-E4BDA7AD41DE}.KB946308) (Version: 1 - Microsoft Corporation)
Hotfix für Microsoft Visual Basic 2008 Express Edition mit SP1 - DEU (KB946344) (HKLM-x32\...\{8F714418-F3C3-3BF0-B548-E4BDA7AD41DE}.KB946344) (Version: 1 - Microsoft Corporation)
Hotfix für Microsoft Visual Basic 2008 Express Edition mit SP1 - DEU (KB947540) (HKLM-x32\...\{8F714418-F3C3-3BF0-B548-E4BDA7AD41DE}.KB947540) (Version: 1 - Microsoft Corporation)
Hotfix für Microsoft Visual Basic 2008 Express Edition mit SP1 - DEU (KB947789) (HKLM-x32\...\{8F714418-F3C3-3BF0-B548-E4BDA7AD41DE}.KB947789) (Version: 1 - Microsoft Corporation)
Hotfix für Microsoft Visual Basic 2008 Express Edition mit SP1 - DEU (KB948127) (HKLM-x32\...\{8F714418-F3C3-3BF0-B548-E4BDA7AD41DE}.KB948127) (Version: 1 - Microsoft Corporation)
Hotfix für Microsoft Visual Basic 2008 Express Edition mit SP1 - DEU (KB951708) (HKLM-x32\...\{8F714418-F3C3-3BF0-B548-E4BDA7AD41DE}.KB951708) (Version: 1 - Microsoft Corporation)
iCloud (HKLM\...\{81E20D41-C277-4526-934D-F2380AF91B78}) (Version: 3.1.0.40 - Apple Inc.)
InetStat (HKCU\...\InetStat) (Version: 0.5b - InetStat)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.2.1410 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.0.0.1032 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.3.214 - Intel Corporation)
Jasc Paint Shop Pro 8 (HKLM-x32\...\{81A34902-9D0B-4920-A25C-4CDC5D14B328}) (Version: 8.03.0000 - Ihr Firmenname)
Jasc Paint Shop Pro 8.10 Update Patch (HKLM-x32\...\Jasc Paint Shop Pro 8.10 Update Patch) (Version: - )
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) Hidden
KhalInstallWrapper (Version: 2.00.0000 - Logitech) Hidden
Logitech Gaming Software 7.00 (HKLM\...\{690285C2-2481-44FB-8402-162EA970A6DD}) (Version: 7.00.291 - Logitech Inc.)
Logitech SetPoint (HKLM-x32\...\{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}) (Version: 4.80 - Logitech)
LookThisUp (HKLM\...\LookThisUp) (Version: 1.0.2 - LookThisUp)
Magical Jelly Bean KeyFinder (HKLM-x32\...\KeyFinder_is1) (Version: 2.0.9.8 - Magical Jelly Bean)
MAGIX Content und Soundpools (HKLM-x32\...\MAGIX_GlobalContent) (Version: 1.0.0.0 - MAGIX AG)
MAGIX Music Maker 2014 Premium Soundpools (Version: 1.0.0.0 - MAGIX AG) Hidden
MAGIX Music Maker 2014 Soundpools (Version: 1.0.0.0 - MAGIX AG) Hidden
MAGIX Screenshare (HKLM-x32\...\MAGIX_MSI_PCVisit) (Version: 4.3.6.1987 - MAGIX AG)
MAGIX Screenshare (x32 Version: 4.3.6.1987 - MAGIX AG) Hidden
MAGIX Speed burnR (MSI) (HKLM-x32\...\MX.{1B46FA48-1BEA-4398-BF8A-0F606A9EA782}) (Version: 7.0.2.6 - MAGIX Software GmbH)
MAGIX Speed burnR (MSI) (Version: 7.0.2.6 - MAGIX Software GmbH) Hidden
MAGIX Video deluxe 2013 Plus (HKLM-x32\...\MAGIX_{2B9CA7F6-64A9-4346-9238-CDC3604A8D66}) (Version: 12.0.0.30 - MAGIX AG)
MAGIX Video deluxe 2013 Plus (Version: 12.0.0.30 - MAGIX AG) Hidden
MAGIX Video deluxe 2013 Plus (Video Plugins) (HKLM-x32\...\MAGIX_{6171316C-9234-4FD5-B566-A31DFDCE9784}) (Version: 1.0.0.0 - MAGIX AG)
MAGIX Video deluxe 2013 Plus (Video Plugins) (Version: 1.0.0.0 - MAGIX AG) Hidden
MAGIX Video deluxe 2015 Plus (HKLM\...\MX.{B50BBED4-5101-45A1-BA9D-93AEF3A638E3}) (Version: 14.0.0.159 - MAGIX Software GmbH)
MAGIX Video deluxe 2015 Plus (Version: 14.0.0.159 - MAGIX Software GmbH) Hidden
MAGIX Videoton Cleaning Lab Download-Version (HKLM-x32\...\MAGIX_MSI_Videoton_Cleaning_Lab) (Version: 1.0.0.0 - MAGIX AG)
MAGIX Videoton Cleaning Lab Download-Version (x32 Version: 1.0.0.0 - MAGIX AG) Hidden
MAGIX Web Designer 9 Premium (HKLM\...\MX.{B497E1E1-E2E9-4B93-B242-86087EDEDF92}) (Version: 9.0.1.27343 - MAGIX AG)
MAGIX Web Designer 9 Premium (Version: 9.0.1.27343 - MAGIX AG) Hidden
MAGIX Web Designer MX (HKLM-x32\...\MAGIX_{F29400C2-C498-47A2-815C-B8998E377DB6}) (Version: 8.0.2.21761 - MAGIX AG)
MAGIX Web Designer MX (Version: 8.0.2.21761 - MAGIX AG) Hidden
MAGIX Web Designer MX Premium (HKLM-x32\...\MAGIX_{739FE2DC-0C7E-4A1C-AC6E-46348169E27E}) (Version: 8.0.2.21761 - MAGIX AG)
MAGIX Web Designer MX Premium (Version: 8.0.2.21761 - MAGIX AG) Hidden
MAGIX Web Designer MX Premium Content Pack (Version: 1.1.0.0 - MAGIX AG) Hidden
Media Player (HKLM-x32\...\MediaPlayerV1alpha86) (Version: 1.1 - Media Player) <==== ATTENTION
Microsoft .NET Framework 4 Multi-Targeting Pack (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (x32 Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Expression Blend 3 SDK (HKLM-x32\...\{B006B9E9-41DD-4479-9177-3743A53B7735}) (Version: 1.0.1343.0 - Microsoft Corporation)
Microsoft Expression Blend 4 (HKLM-x32\...\Blend_4.0.20901.0) (Version: 4.0.20901.0 - Microsoft Corporation)
Microsoft Expression Blend 4 (x32 Version: 4.0.20901.0 - Microsoft Corporation) Hidden
Microsoft Expression Blend 4 Add-in for Adobe FXG Import (HKLM-x32\...\{9219F0C5-4320-43D3-8A23-F8B4C6F02DEE}) (Version: 1.0.10901.0 - Microsoft Corporation)
Microsoft Expression Blend SDK for .NET 4 (HKLM-x32\...\{0536BCDF-7EF6-48F6-8765-A3C065A065A5}) (Version: 2.0.20621.0 - Microsoft Corporation)
Microsoft Expression Blend SDK for Silverlight 4 (HKLM-x32\...\{B0682940-6FFB-4850-80BA-B2FEF0D64BA8}) (Version: 2.0.20621.0 - Microsoft Corporation)
Microsoft Expression Blend SDK for Windows Phone 7 (HKLM-x32\...\{1762BA00-6EBE-4430-9FBB-16F516B4A46D}) (Version: 2.0.20901.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{F2508213-9989-4E85-A078-72BE483917EF}) (Version: 3.5.88.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)
Microsoft Help Viewer 1.0 (HKLM\...\Microsoft Help Viewer 1.0) (Version: 1.0.30319 - Microsoft Corporation)
Microsoft Help Viewer 1.0 (Version: 1.0.30319 - Microsoft Corporation) Hidden
Microsoft Help Viewer 1.0 Language Pack - DEU (HKLM\...\Microsoft Help Viewer 1.0 Language Pack - DEU) (Version: 1.0.30319 - Microsoft Corporation)
Microsoft Help Viewer 1.0 Language Pack - DEU (Version: 1.0.30319 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Silverlight 3 SDK (HKLM-x32\...\{2012098D-EEE9-4769-8DD3-B038050854D4}) (Version: 3.0.40818.0 - Microsoft Corporation)
Microsoft Silverlight 4 SDK - Deutsch (HKLM-x32\...\{803910CC-3A39-45E3-A594-0D5512A60A86}) (Version: 4.0.50826.0 - Microsoft Corporation)
Microsoft Silverlight Tools for Visual Studio 2010 (HKLM-x32\...\{558358E5-E4F3-4374-BA1D-26FF39EF87D9}) (Version: 10.0.30319.400 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server 2008 (64-bit) (HKLM\...\Microsoft SQL Server 10 Release) (Version: - Microsoft Corporation)
Microsoft SQL Server 2008 (64-bit) (Version: - Microsoft Corporation) Hidden
Microsoft SQL Server 2008 Browser (HKLM-x32\...\{4AF2248C-B3DF-46FB-9596-87F5DB193689}) (Version: 10.1.2531.0 - Microsoft Corporation)
Microsoft SQL Server 2008 Common Files (Version: 10.0.1600.22 - Microsoft Corporation) Hidden
Microsoft SQL Server 2008 Common Files (Version: 10.1.2531.0 - Microsoft Corporation) Hidden
Microsoft SQL Server 2008 Database Engine Services (Version: 10.1.2531.0 - Microsoft Corporation) Hidden
Microsoft SQL Server 2008 Database Engine Shared (Version: 10.1.2531.0 - Microsoft Corporation) Hidden
Microsoft SQL Server 2008 Native Client (HKLM\...\{8325FD0C-2FDB-46C3-921A-3A78385EA972}) (Version: 10.1.2531.0 - Microsoft Corporation)
Microsoft SQL Server 2008 R2 Management Objects (HKLM-x32\...\{A106D33E-6B43-42C0-9BFC-D03303261FA7}) (Version: 10.50.1447.4 - Microsoft Corporation)
Microsoft SQL Server 2008 RsFx Driver (Version: 10.1.2531.0 - Microsoft Corporation) Hidden
Microsoft SQL Server Compact 3.5 SP1 Design Tools (Deutsch) (HKLM-x32\...\{738B0934-6676-44F6-AB52-32F4E60DCA7F}) (Version: 3.5.5692.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 DEU (HKLM-x32\...\{0125D081-30D0-4A97-82A8-C28D444B6256}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 x64 DEU (HKLM\...\{C3EAE456-7E7A-451F-80EF-F34C7A13C558}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server System CLR Types (HKLM-x32\...\{5A08C9D1-37AD-4A8D-90D3-33F92C578AA5}) (Version: 10.50.1447.4 - Microsoft Corporation)
Microsoft SQL Server VSS Writer (HKLM\...\{28D06854-572C-4A65-83E5-F8CAF26B9FDC}) (Version: 10.1.2531.0 - Microsoft Corporation)
Microsoft Visual Basic 2008 Express Edition mit SP1 - DEU (HKLM-x32\...\Microsoft Visual Basic 2008 Express Edition with SP1 - DEU) (Version: - Microsoft Corporation)
Microsoft Visual Basic 2008 Express Edition with SP1 - DEU (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{4FFA2088-8317-3B14-93CD-4C699DB37843}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974 (HKLM-x32\...\{B7E38540-E355-3503-AFD7-635B2F2F76E1}) (Version: 9.0.30729.4974 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Runtime - 10.0.30319 (HKLM\...\{94D70749-4281-39AC-AD90-B56A0E0A402E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{90ffcee5-8608-4e94-8c18-a4feb4f83fb8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft XNA Framework Redistributable 3.1 (HKLM-x32\...\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation)
Microsoft_VC100_CRT_SP1_x64 (Version: 10.0.40219.1 - Nokia) Hidden
Microsoft_VC100_CRT_SP1_x86 (x32 Version: 10.0.40219.1 - Nokia) Hidden
MozBackup 1.5.1 (HKLM-x32\...\MozBackup) (Version: - Pavel Cvrcek)
Mozilla Firefox (3.5.7) (HKLM-x32\...\Mozilla Firefox (3.5.7)) (Version: 3.5.7 (de) - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 24.6.0 - Mozilla)
Mozilla Thunderbird 24.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.6.0 (x86 de)) (Version: 24.6.0 - Mozilla)
mp3-2-wav converter 1.14 (HKLM-x32\...\mp3-2-wav) (Version: - )
Mp3tag v2.58 (HKLM-x32\...\Mp3tag) (Version: v2.58 - Florian Heidenreich)
MSVC80_x64_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC80_x86_v2 (x32 Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden
MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM-x32\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
MyFreeCodec (HKCU\...\MyFreeCodec) (Version: - )
Network Print Monitor for Windows 2000/XP/2003/Vista (HKLM-x32\...\Network Print Monitor) (Version: - )
Nokia Connectivity Cable Driver (HKLM-x32\...\{29373274-977E-413C-A4DE-DC0F8E80C429}) (Version: 7.1.172.0 - Nokia)
Norton Internet Security (HKLM-x32\...\NIS) (Version: 21.5.0.19 - Symantec Corporation)
Norton Security Scan (HKLM-x32\...\NSS) (Version: 4.1.0.28 - Symantec Corporation)
NVIDIA PhysX (HKLM-x32\...\{B83FC356-B7C0-441F-8A4D-D71E088E7974}) (Version: 9.09.0428 - NVIDIA Corporation)
Origin (HKLM-x32\...\Origin) (Version: 8.2.3.2458 - Electronic Arts, Inc.)
Paint.NET v3.5.10 (HKLM\...\{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}) (Version: 3.60.0 - dotPDN LLC)
Partition Wizard Home Edition 4.2.2 (HKLM-x32\...\{AA468551-1794-42FE-B504-C41D75EEBDF2}_is1) (Version: - MT Solution Ltd.)
PatchBeam v1.10 (HKLM-x32\...\PatchBeam_is1) (Version: 1.10 - ConeXware, Inc.)
PC Connectivity Solution (HKLM-x32\...\{6D01D1B1-17BD-4F10-BB11-F08F0C47D42B}) (Version: 12.0.109.0 - Nokia)
PerformanceTest v7.0 (64-bit) (HKLM\...\PerformanceTest 7_is1) (Version: 7.0 - Passmark Software)
Perixx Gaming mouse version 1.0.6 (HKLM-x32\...\{2F606408-495F-4772-A3A7-BE0A31C4B261}_is1) (Version: 1.0.6 - )
PixiePack Codec Pack (HKLM-x32\...\{A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2}) (Version: 1.1.1200.0 - None)
Pixum Fotobuch (HKLM-x32\...\Pixum Fotobuch) (Version: - )
PL-2303 Vista Driver Installer (HKLM-x32\...\{EEC010D0-1252-4E1D-BAD9-F1B8F414535C}) (Version: 3.2.0.0 - Prolific)
Plus Pack für Acronis True Image Home 2012 (HKLM-x32\...\{7DA0FBA4-BA6E-4F15-909E-796C28B41C10}) (Version: 15.0.7119 - Acronis)
PowerArchiver 2010 (HKLM-x32\...\{2417A012-73B3-4926-95D0-FE0A97B5BCC0}) (Version: 11.71.04 - ConeXware, Inc.)
Protect Disc License Helper 1.0.118 (HKLM-x32\...\Protect Disc License Helper) (Version: 1.0.118 - Protect Disc)
ProtectDisc Driver, Version 11 (HKLM-x32\...\ProtectDisc Driver 11) (Version: 11.0.0.14 - ProtectDisc Software GmbH)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.990 - Even Balance, Inc.)
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
RAIDar 4.3.4 (HKLM-x32\...\1381-5408-0515-7060) (Version: 4.3.4 - Netgear Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.48.823.2011 - Realtek)
Realtek HDMI Audio Driver for ATI (HKLM-x32\...\{5449FB4F-1802-4D5B-A6D8-087DB1142147}) (Version: 6.0.1.6034 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6482 - Realtek Semiconductor Corp.)
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version: - )
Remote Control USB Driver (HKLM-x32\...\{8471021C-F529-43DE-84DF-3612E10F58C4}) (Version: 2.3.2.317 - )
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.0.34.1 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.34.1 - Renesas Electronics Corporation) Hidden
Samsung Magician (HKLM-x32\...\{29AE3F9F-7158-4ca7-B1ED-28A73ECDB215}_is1) (Version: 4.4.0 - Samsung Electronics)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.29.0 - SAMSUNG Electronics Co., Ltd.)
Service Pack 1 für SQL Server 2008 (KB 968369) (64-bit) (HKLM\...\KB968369) (Version: 10.1.2531.0 - Microsoft Corporation)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.2.25 - Safer-Networking Ltd.)
Sql Server Customer Experience Improvement Program (Version: 10.1.2531.0 - Microsoft Corporation) Hidden
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synology Assistant (remove only) (HKLM-x32\...\Synology Assistant) (Version: - )
Synology Data Replicator 3 (HKLM-x32\...\{8E310838-457C-4269-B177-3EFB300CBDDC}) (Version: 1.0.0.0 - Synology Inc.)
System Requirements Lab (HKLM-x32\...\SystemRequirementsLab) (Version: - )
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)
TeamViewer 6 (HKLM-x32\...\TeamViewer 6) (Version: 6.0.11117 - TeamViewer GmbH)
Text-To-Speech-Runtime (HKLM-x32\...\{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}) (Version: 1.0.0.0 - Magix Development GmbH)
Torchlight (HKLM-x32\...\{4F64A46D-67F7-4497-AEA2-313D4305A5F6}) (Version: 1.15 - JoWooD)
TreeSize Free V3.0.1 (HKLM-x32\...\TreeSize Free_is1) (Version: 3.0.1 - JAM Software)
UBCD4Win 3.60 (HKLM-x32\...\UBCD4Win_is1) (Version: - UBCD4Win Team - Benjamin Burrows)
Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
Uninstall 1.0.0.1 (HKLM-x32\...\Uninstall_is1) (Version: - )
Unterstützungsdateien für Microsoft SQL Server 2008-Setup (HKLM\...\{6AF73222-EE90-434C-AE7E-B96F70A68D89}) (Version: 10.1.2731.0 - Microsoft Corporation)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
Video Player (HKLM-x32\...\Video Player) (Version: 1.1 - Video Player) <==== ATTENTION
Vita 2 (Version: 1.0.0.0 - MAGIX AG) Hidden
Vita 2 Zusatzcontent (Version: 1.0.0.0 - MAGIX AG) Hidden
Vita Drum Engine (Version: 1.0.0.0 - MAGIX AG) Hidden
Vita Electric Piano (Version: 1.0.1.0 - MAGIX AG) Hidden
Vita Jazz Drums (Version: 1.0.0.0 - MAGIX AG) Hidden
Vita Pop Brass (Version: 1.0.0.0 - MAGIX AG) Hidden
Vita Power Guitar (Version: 1.0.0.0 - MAGIX AG) Hidden
Vita Vintage Organ (Version: 1.0.0.0 - MAGIX AG) Hidden
VLC media player 2.1.0 (HKLM-x32\...\VLC media player) (Version: 2.1.0 - VideoLAN)
Wav2MP3 Wizard v3.2 (Build 354) (HKLM-x32\...\Wav2MP3 Wizard_is1) (Version: 3.2.354 - Discovery Open-Source Development Group)
Web Designer Premium 9 Update (Version: 9.2.7.30974 - MAGIX AG) Hidden
Web Designer Premium MX Update (Version: 8.1.4.24749 - MAGIX AG) Hidden
WEB.DE Club SmartFax (HKLM-x32\...\WEB.DE Club SmartFax) (Version: 2.00.223 - WEB.DE GmbH)
Webexp Enhanced (HKLM-x32\...\Webexp Enhanced) (Version: 1.1 - Webexp Enhanced) <==== ATTENTION
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (04/19/2012 2.3.1.0) (HKLM\...\98157A226B40B173301B0F53C8E98C47805D5152) (Version: 04/19/2012 2.3.1.0 - Garmin)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM-x32\...\{586509F0-350D-48B5-B763-9CC2F8D96C4C}) (Version: 14.0.8117.416 - Microsoft Corporation)
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
Windows-Treiberpaket - dji-innovations inc. (usbser) Ports (12/06/2012 5.1.2600.5512) (HKLM\...\F731C4A8B354FB9B7579C5D98402D2F988E8B95C) (Version: 12/06/2012 5.1.2600.5512 - dji-innovations inc.)
Windows-Treiberpaket - Dynastream Innovations, Inc. ANT LibUSB Drivers (04/11/2012 1.2.40.201) (HKLM\...\F9D2A789F9CFF8CEC36B544F53877C80F1F73C46) (Version: 04/11/2012 1.2.40.201 - Dynastream Innovations, Inc.)
Windows-Treiberpaket - Nokia pccsmcfd LegacyDriver (05/31/2012 7.1.2.0) (HKLM\...\62BBD193ADFDBB228C7E1ADB56463F5732FF7F6F) (Version: 05/31/2012 7.1.2.0 - Nokia)
Windows-Treiberpaket - Silicon Laboratories (silabenm) Ports (10/18/2013 6.6.1.0) (HKLM\...\F92C2D6CB4EA0EE558BDF5F8BDD69083DFC62179) (Version: 10/18/2013 6.6.1.0 - Silicon Laboratories)
Windows-Treiberpaket - Silicon Labs Software (DSI_SiUSBXp_3_1) USB (02/06/2007 3.1) (HKLM\...\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software)
WinPcap 4.1.1 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.1753 - CACE Technologies)
WinRAR (HKLM\...\WinRAR archiver) (Version: - )
World of Tanks (HKLM-x32\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C812}_is1) (Version: - Wargaming.net)
WPF Toolkit February 2010 (Version 3.5.50211.1) (HKLM-x32\...\{5EE6E987-1B79-4A93-832B-27472C7D1579}) (Version: 3.5.50211.1 - Microsoft Corporation)
XFastUSB (HKLM-x32\...\XFastUSB) (Version: 3.02.28 - ASRock Inc.)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-3018767705-964232526-3307114488-1001_Classes\CLSID\{25815CC0-43F4-3C75-8C3A-A139D9ADE740}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3018767705-964232526-3307114488-1001_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\VOW\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-3018767705-964232526-3307114488-1001_Classes\CLSID\{62d22145-abd6-440b-a417-a93d3ce16bf3}\InprocServer32 -> C:\Windows\system32\dfshim.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3018767705-964232526-3307114488-1001_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\VOW\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3018767705-964232526-3307114488-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\VOW\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3018767705-964232526-3307114488-1001_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\VOW\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File
==================== Restore Points =========================
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2011-04-15 20:24 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {035ADAE0-10DA-4318-A5AB-C9B401E205AA} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {0440B2DB-D2E9-4AB5-971F-C45FA45395F4} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\21.5.0.19\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {26D89AA5-B257-4E07-AAC7-61CE9C7533B8} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-10] (Adobe Systems Incorporated)
Task: {3C12F13B-8C99-4105-ABF5-2467FEE4E598} - System32\Tasks\AsrXTU => C:\Program Files (x86)\ASRock Utility\AXTU\Bin\AsrXTU.exe [2012-02-23] ()
Task: {44541AC7-0164-4A5F-A0AE-058C69D66C47} - System32\Tasks\asrRd => C:\Program Files\ASRock Utility\XFast RAM\asrRd.exe [2012-01-13] ()
Task: {48873227-A10F-4B0C-A7B0-2DA259A97B87} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2009-10-31] (Google Inc.)
Task: {53A9FD18-D3D0-444C-BBEB-DD32075336AB} - System32\Tasks\RocketTab Update Task => C:\Program Files (x86)\RocketTab\uninstall.exe <==== ATTENTION
Task: {619FD727-654D-4ADD-A953-1FF2F05B824C} - System32\Tasks\Amazon Music Helper => C:\Users\VOW\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [2014-03-07] ()
Task: {690651B2-740A-4505-83C8-9F6236658735} - System32\Tasks\RocketTab => C:\Windows\system32\cmd.exe [2010-11-20] (Microsoft Corporation) <==== ATTENTION
Task: {7477A708-5B86-4EA9-8E3F-418095ABE885} - System32\Tasks\SamsungMagician => C:\Program Files (x86)\Samsung SSD Magician\Samsung Magician.exe [2014-05-19] (Samsung Electronics.)
Task: {7ABC4418-3B07-48A7-87C2-D8C304B0C012} - System32\Tasks\DriverCure Startup => C:\Program Files (x86)\ParetoLogic\DriverCure\DriverCure.exe
Task: {7DE1AE74-C0E3-4E6B-86C3-4AD202F10730} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2009-10-31] (Google Inc.)
Task: {7E08383D-1584-4083-981C-67C4E5D75FBA} - System32\Tasks\ProgramUpdateCheck => C:\Program Files (x86)\File Type Assistant\TSAssist.exe [2014-05-06] (FTA ApS) <==== ATTENTION
Task: {7EBA0F54-503E-4AB8-855E-4D5238051BE3} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3018767705-964232526-3307114488-1001Core => C:\Users\VOW\AppData\Local\Google\Update\GoogleUpdate.exe [2012-10-17] (Google Inc.)
Task: {96134EDD-D6AA-4F90-B226-88B13C64FDB4} - System32\Tasks\ProgramRefresh-ATFST => C:\Program Files (x86)\File Type Assistant\tsasetup.exe [2014-05-10] ( ) <==== ATTENTION
Task: {A06AC93E-9EA7-4090-9283-15E1AC3B393B} - System32\Tasks\{EC6BCA6B-0843-45B8-AC84-0B992E1DEAC8} => N:\SETUP.EXE
Task: {A08A7FFA-6D20-4D4D-9184-E9FED4A15403} - \DealPlyUpdate No Task File <==== ATTENTION
Task: {BB6FD564-D130-4419-B8A3-035C15B13382} - System32\Tasks\{843564D1-F4BC-47C1-BF53-D46DF501C7DC} => N:\SETUP.EXE
Task: {BE404DB5-5B3F-4D3E-B4A1-08F3AD6F4984} - System32\Tasks\GarminUpdaterTask => D:\Programme\Garmin\Express Self Updater\ExpressSelfUpdater.exe [2014-07-23] ()
Task: {BFA4C86E-0DBC-4C2F-AAC3-738CFE29CD55} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\21.5.0.19\WSCStub.exe [2014-07-31] (Symantec Corporation)
Task: {CA104384-7424-43DA-B909-965CB39CA183} - System32\Tasks\DriverCure => C:\Program Files (x86)\ParetoLogic\DriverCure\DriverCure.exe
Task: {D1E94FE4-59F4-4342-84C5-6E0D3233E4E7} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: {E3192682-DD22-4C0A-9A5E-992B9AB8E8C3} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3018767705-964232526-3307114488-1001UA => C:\Users\VOW\AppData\Local\Google\Update\GoogleUpdate.exe [2012-10-17] (Google Inc.)
Task: {E4B731E5-AE75-4605-A639-DADD5D72E48D} - System32\Tasks\DriverToolkit Autorun => C:\Program Files (x86)\DriverToolkit\DriverToolkit.exe
Task: {EB3215C6-7EF2-4629-A4EC-CC385A61069B} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\21.5.0.19\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {F14DB1CE-1206-4C45-81A8-2D48699FD7D8} - System32\Tasks\{585C14B9-FC74-4437-8183-DF2D20D4C6A9} => N:\SETUP.EXE
Task: {F513B898-108A-4520-9962-DE5AB27E2571} - System32\Tasks\Norton Security Scan for VOW => C:\Program Files (x86)\Norton Security Scan\Engine\4.1.0.28\Nss.exe [2014-01-27] (Symantec Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\DriverCure Startup.job => C:\Program Files (x86)\ParetoLogic\DriverCure\DriverCure.exe
Task: C:\Windows\Tasks\DriverCure.job => C:\Program Files (x86)\ParetoLogic\DriverCure\DriverCure.exe
Task: C:\Windows\Tasks\DriverToolkit Autorun.job => C:\Program Files (x86)\DriverToolkit\DriverToolkit.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3018767705-964232526-3307114488-1001Core.job => C:\Users\VOW\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3018767705-964232526-3307114488-1001UA.job => C:\Users\VOW\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Norton Security Scan for VOW.job => C:\PROGRA~2\Norton Security Scan\Engine\4.1.0.28\Nss.exe
==================== Loaded Modules (whitelisted) =============
2009-11-29 19:15 - 2005-03-12 03:07 - 00087040 _____ () C:\Windows\System32\redmonnt.dll
2011-08-20 09:55 - 2011-08-09 14:35 - 01420184 _____ () C:\Program Files (x86)\Ashampoo\Ashampoo Core Tuner 2\ACT2Service.exe
2010-07-27 21:47 - 2010-01-19 04:31 - 00072304 ____N () C:\Windows\SysWOW64\XSrvSetup.exe
2014-08-27 12:32 - 2014-08-27 12:32 - 00706864 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareService.exe
2014-08-27 12:53 - 2014-08-27 12:53 - 00103768 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\boost_thread-vc100-mt-1_55.dll
2014-08-27 12:53 - 2014-08-27 12:53 - 00024408 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\boost_system-vc100-mt-1_55.dll
2014-08-27 12:53 - 2014-08-27 12:53 - 00033624 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\boost_chrono-vc100-mt-1_55.dll
2014-08-27 12:53 - 2014-08-27 12:53 - 00055648 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\boost_date_time-vc100-mt-1_55.dll
2014-08-27 12:53 - 2014-08-27 12:53 - 00123744 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\boost_filesystem-vc100-mt-1_55.dll
2014-08-27 12:52 - 2014-08-27 12:52 - 11947856 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareServiceKernel.dll
2014-08-27 12:53 - 2014-08-27 12:53 - 03396400 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\RCF.dll
2014-08-27 12:53 - 2014-08-27 12:53 - 00788824 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\boost_regex-vc100-mt-1_55.dll
2014-08-27 12:52 - 2014-08-27 12:52 - 00734536 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareActivation.dll
2014-08-27 12:52 - 2014-08-27 12:52 - 02167640 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareApplicationUpdater.dll
2014-08-27 12:52 - 2014-08-27 12:52 - 00813896 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareGamingMode.dll
2014-08-27 12:52 - 2014-08-27 12:52 - 00098624 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareReset.dll
2014-08-27 12:53 - 2014-08-27 12:53 - 00120128 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareTime.dll
2014-08-27 12:52 - 2014-08-27 12:52 - 00943960 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareDefinitionsUpdater.dll
2014-08-27 12:52 - 2014-08-27 12:52 - 00869224 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareDefinitionsUpdaterScheduler.dll
2014-08-27 12:52 - 2014-08-27 12:52 - 01105224 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareIgnoreList.dll
2014-08-27 12:52 - 2014-08-27 12:52 - 00247624 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareQuarantine.dll
2014-08-27 12:52 - 2014-08-27 12:52 - 00988504 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareAntiMalwareEngine.dll
2014-08-27 12:52 - 2014-08-27 12:52 - 00212824 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareAntiRootkitEngine.dll
2014-08-27 12:52 - 2014-08-27 12:52 - 01172816 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareScannerHistory.dll
2014-08-27 12:52 - 2014-08-27 12:52 - 01277248 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareScanner.dll
2014-08-27 12:53 - 2014-08-27 12:53 - 00035160 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\boost_timer-vc100-mt-1_55.dll
2014-08-27 12:52 - 2014-08-27 12:52 - 00975192 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareScannerScheduler.dll
2014-08-27 12:52 - 2014-08-27 12:52 - 01109336 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareRealTimeProtection.dll
2014-08-27 12:52 - 2014-08-27 12:52 - 00229200 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareIncompatibles.dll
2014-08-27 12:52 - 2014-08-27 12:52 - 00891720 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareAntiSpam.dll
2014-08-27 12:52 - 2014-08-27 12:52 - 00843088 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareAntiPhishing.dll
2014-08-27 12:52 - 2014-08-27 12:52 - 03090768 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareParentalControl.dll
2014-08-27 12:53 - 2014-08-27 12:53 - 02624848 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareWebProtection.dll
2014-08-27 12:52 - 2014-08-27 12:52 - 01067344 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareEmailProtection.dll
2014-08-27 12:52 - 2014-08-27 12:52 - 01290584 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareNetworkProtection.dll
2014-08-27 12:52 - 2014-08-27 12:52 - 01004352 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwarePromo.dll
2014-08-27 12:52 - 2014-08-27 12:52 - 00343880 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareFeedback.dll
2014-08-27 12:53 - 2014-08-27 12:53 - 02787160 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareThreatWorkAlliance.dll
2014-08-27 12:52 - 2014-08-27 12:52 - 01238848 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwarePinCode.dll
2014-08-27 12:52 - 2014-08-27 12:52 - 01004864 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareNotice.dll
2014-08-27 12:52 - 2014-08-27 12:52 - 00928072 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareAvcEngine.dll
2014-08-27 12:53 - 2014-08-27 12:53 - 00154944 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\SecurityCenter.dll
2013-05-30 15:09 - 2013-05-30 15:09 - 00075136 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2010-01-02 16:42 - 2010-01-02 16:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2010-01-10 13:38 - 2009-12-12 16:12 - 00166400 _____ () C:\Program Files\WinRAR\rarext.dll
2012-10-16 22:44 - 2012-02-23 11:38 - 08241960 _____ () C:\Program Files (x86)\ASRock Utility\AXTU\Bin\AsrXTU.exe
2011-01-20 21:39 - 2005-04-22 06:36 - 00143360 ____R () C:\Windows\system32\BrSNMP64.dll
2012-03-19 22:09 - 2012-03-19 22:09 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-08-27 12:53 - 2014-08-27 12:53 - 08886592 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareTray.exe
2014-08-27 12:53 - 2014-08-27 12:53 - 00500056 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\boost_locale-vc100-mt-1_55.dll
2014-08-27 12:53 - 2014-08-27 12:53 - 02101568 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\HtmlFramework.dll
2014-08-27 12:53 - 2014-08-27 12:53 - 00066872 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\DllStorage.dll
2014-08-27 12:53 - 2014-08-27 12:53 - 00832848 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\AdAwareTrayDefaultSkin.dll
2014-08-27 12:53 - 2014-08-27 12:53 - 00811328 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.3.6321.0\Localization.dll
2013-04-24 14:01 - 2013-04-24 14:01 - 00381312 _____ () C:\Program Files (x86)\Synology Data Replicator 3\SynoDrServicex64.exe
2013-04-30 05:47 - 2013-04-30 05:47 - 00248704 _____ () C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
2014-02-22 14:12 - 2014-03-07 22:39 - 03168576 _____ () C:\Users\VOW\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe
2011-11-15 18:44 - 2011-11-15 18:44 - 02155848 _____ () C:\Program Files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe
2014-01-16 22:37 - 2009-07-20 13:35 - 00018960 _____ () C:\Program Files\Logitech\SetPoint\khalwrapper.dll
2014-01-16 22:37 - 2009-07-20 05:00 - 00077824 _____ () C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe
2014-09-05 20:43 - 2014-09-05 20:43 - 01420512 _____ () C:\Program Files (x86)\RocketTab\Client.exe
2012-10-16 22:44 - 2012-01-13 15:47 - 01448744 _____ () C:\Program Files\ASRock Utility\XFast RAM\asrRd.exe
2014-09-17 21:16 - 2014-09-17 21:16 - 00700430 _____ () C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe
2014-02-06 01:52 - 2014-02-06 01:52 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-02-06 01:52 - 2014-02-06 01:52 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2011-08-28 23:19 - 2011-08-28 23:19 - 00093696 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll
2014-02-01 11:30 - 2012-08-23 11:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-02-01 11:30 - 2013-05-16 11:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-02-01 11:30 - 2013-05-16 11:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-02-01 11:30 - 2013-05-16 11:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-02-01 11:30 - 2012-04-03 18:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2012-10-16 22:44 - 2010-09-20 18:52 - 00094208 _____ () C:\Program Files (x86)\ASRock Utility\AXTU\Bin\IccLibDll.DLL
2012-04-27 18:33 - 2012-04-27 18:33 - 00435552 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\Common\ulxmlrpcpp.dll
2013-09-14 02:51 - 2013-09-14 02:51 - 00087952 _____ () D:\Programme\iCloud\zlib1.dll
2013-09-14 02:50 - 2013-09-14 02:50 - 01242952 _____ () D:\Programme\iCloud\libxml2.dll
2013-12-09 19:08 - 2014-05-06 11:24 - 00013824 _____ () C:\Program Files (x86)\Samsung SSD Magician\SAMSUNG_SSD.dll
2013-12-09 19:08 - 2014-05-19 20:20 - 00103424 _____ () C:\Program Files (x86)\Samsung SSD Magician\PAL.dll
2013-12-09 19:08 - 2014-05-19 20:20 - 00039424 _____ () C:\Program Files (x86)\Samsung SSD Magician\SATA.dll
2013-12-09 19:08 - 2014-05-19 20:19 - 00038400 _____ () C:\Program Files (x86)\Samsung SSD Magician\SAT.dll
2013-12-09 19:08 - 2014-05-19 20:20 - 00031232 _____ () C:\Program Files (x86)\Samsung SSD Magician\SMINI.dll
2013-12-09 19:08 - 2014-05-19 20:19 - 00029696 _____ () C:\Program Files (x86)\Samsung SSD Magician\SAS.dll
2011-01-20 21:38 - 2009-02-27 17:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2012-04-27 22:21 - 2012-04-27 22:21 - 13005104 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\Common\ti_managers.dll
2014-01-15 22:46 - 2013-09-13 20:50 - 00042496 _____ () C:\Program Files (x86)\Perixx Gaming mouse\KBGetKey.dll
2014-09-10 18:28 - 2014-09-10 18:28 - 00172032 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\325add5e2c085d0ffc12dc9b24a7d149\IsdiInterop.ni.dll
2012-10-16 22:35 - 2011-11-29 20:00 - 00059392 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2014-09-12 23:08 - 2014-09-04 05:01 - 01098056 _____ () C:\Users\VOW\AppData\Local\Google\Chrome\Application\37.0.2062.120\libglesv2.dll
2014-09-12 23:08 - 2014-09-04 05:01 - 00174408 _____ () C:\Users\VOW\AppData\Local\Google\Chrome\Application\37.0.2062.120\libegl.dll
2014-09-12 23:08 - 2014-09-04 05:01 - 08577864 _____ () C:\Users\VOW\AppData\Local\Google\Chrome\Application\37.0.2062.120\pdf.dll
2014-09-12 23:08 - 2014-09-04 05:01 - 00331592 _____ () C:\Users\VOW\AppData\Local\Google\Chrome\Application\37.0.2062.120\ppGoogleNaClPluginChrome.dll
2014-09-12 23:08 - 2014-09-04 05:01 - 01660232 _____ () C:\Users\VOW\AppData\Local\Google\Chrome\Application\37.0.2062.120\ffmpegsumo.dll
2014-09-12 23:08 - 2014-09-04 05:01 - 14891848 _____ () C:\Users\VOW\AppData\Local\Google\Chrome\Application\37.0.2062.120\PepperFlash\pepflashplayer.dll
2012-04-27 19:09 - 2012-04-27 19:09 - 00018784 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\ti_managers_proxy_stub.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\TEMP:5F64C164
AlternateDataStreams: C:\ProgramData\TEMP:9A870F8B
AlternateDataStreams: C:\ProgramData\TEMP:F35A93AD
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\startupfolder: C:^Users^VOW^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^CurseClientStartup.ccip => C:\Windows\pss\CurseClientStartup.ccip.Startup
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
==================== Faulty Device Manager Devices =============
Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: AODDriver4.01
Description: AODDriver4.01
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: AODDriver4.01
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Event log errors: =========================
Application errors:
==================
Error: (09/10/2014 06:36:42 PM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_64) - 1>Failed to compile: Microsoft.SqlServer.Management.SmoMetadataProvider, Version=10.0.0.0, Culture=neutral, PublicKeyToken=89845dcd8080cc91 . Error code = 0x80070002
Error: (09/10/2014 06:36:41 PM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_64) - 1>Failed to compile: Microsoft.SqlServer.Management.SmoMetadataProvider, Version=10.0.0.0, Culture=neutral, PublicKeyToken=89845dcd8080cc91 . Error code = 0x80070002
Error: (09/01/2014 10:00:24 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Videodeluxe.exe, Version 12.0.0.30 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1e60
Startzeit: 01cfc5b9c4d0eaec
Endzeit: 0
Anwendungspfad: C:\Program Files (x86)\MAGIX\Video deluxe 2013 Plus\Videodeluxe.exe
Berichts-ID:
Error: (09/01/2014 09:36:56 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: TreeSizeFree.exe, Version: 3.0.1.200, Zeitstempel: 0x533d1885
Name des fehlerhaften Moduls: rtl150.bpl, Version: 15.0.3953.35171, Zeitstempel: 0x4cca139f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000a116
ID des fehlerhaften Prozesses: 0x2540
Startzeit der fehlerhaften Anwendung: 0xTreeSizeFree.exe0
Pfad der fehlerhaften Anwendung: TreeSizeFree.exe1
Pfad des fehlerhaften Moduls: TreeSizeFree.exe2
Berichtskennung: TreeSizeFree.exe3
Error: (09/01/2014 09:20:12 AM) (Source: MsiInstaller) (EventID: 11327) (User: VOW-PC)
Description: Produkt: MAGIX Video deluxe 2015 Plus -- Fehler 1327. Ungültiges Laufwerk: D:\
Error: (09/01/2014 09:20:10 AM) (Source: MsiInstaller) (EventID: 11327) (User: VOW-PC)
Description: Produkt: MAGIX Speed burnR (MSI) -- Fehler 1327. Ungültiges Laufwerk: D:\
Error: (09/01/2014 08:47:29 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Videodeluxe.exe, Version: 12.0.0.30, Zeitstempel: 0x50224eca
Name des fehlerhaften Moduls: dbghelp.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b7bc
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0004b4cf
ID des fehlerhaften Prozesses: 0x1f28
Startzeit der fehlerhaften Anwendung: 0xVideodeluxe.exe0
Pfad der fehlerhaften Anwendung: Videodeluxe.exe1
Pfad des fehlerhaften Moduls: Videodeluxe.exe2
Berichtskennung: Videodeluxe.exe3
Error: (09/01/2014 08:42:06 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Videodeluxe.exe, Version: 12.0.0.30, Zeitstempel: 0x50224eca
Name des fehlerhaften Moduls: dbghelp.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b7bc
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0004b4cf
ID des fehlerhaften Prozesses: 0x1550
Startzeit der fehlerhaften Anwendung: 0xVideodeluxe.exe0
Pfad der fehlerhaften Anwendung: Videodeluxe.exe1
Pfad des fehlerhaften Moduls: Videodeluxe.exe2
Berichtskennung: Videodeluxe.exe3
Error: (09/01/2014 08:39:39 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Videodeluxe.exe, Version: 12.0.0.30, Zeitstempel: 0x50224eca
Name des fehlerhaften Moduls: dbghelp.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b7bc
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0004b4cf
ID des fehlerhaften Prozesses: 0x19ac
Startzeit der fehlerhaften Anwendung: 0xVideodeluxe.exe0
Pfad der fehlerhaften Anwendung: Videodeluxe.exe1
Pfad des fehlerhaften Moduls: Videodeluxe.exe2
Berichtskennung: Videodeluxe.exe3
Error: (09/01/2014 08:39:29 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Videodeluxe.exe, Version: 12.0.0.30, Zeitstempel: 0x50224eca
Name des fehlerhaften Moduls: dbghelp.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b7bc
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0004b4cf
ID des fehlerhaften Prozesses: 0x1d58
Startzeit der fehlerhaften Anwendung: 0xVideodeluxe.exe0
Pfad der fehlerhaften Anwendung: Videodeluxe.exe1
Pfad des fehlerhaften Moduls: Videodeluxe.exe2
Berichtskennung: Videodeluxe.exe3
System errors:
=============
Error: (09/17/2014 06:32:37 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "WajamUpdaterV3" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (09/17/2014 06:32:34 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%577
Error: (09/17/2014 06:32:31 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "atksgt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%577
Error: (09/17/2014 06:32:23 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "AODDriver4.1" wurde aufgrund folgenden Fehlers nicht gestartet:
%%3
Error: (09/17/2014 06:32:23 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "AODDriver4.01" wurde aufgrund folgenden Fehlers nicht gestartet:
%%3
Error: (09/17/2014 06:32:23 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "AMD FUEL Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (09/14/2014 03:45:31 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 70. Der interne Fehlerstatus lautet: 105.
Error: (09/14/2014 03:42:08 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "WajamUpdaterV3" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (09/14/2014 03:42:06 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Ashampoo LiveTuner ProcessMonitor Driver" wurde aufgrund folgenden Fehlers nicht gestartet:
%%3
Error: (09/14/2014 03:42:06 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%577
Microsoft Office Sessions:
=========================
CodeIntegrity Errors:
===================================
Date: 2014-09-17 18:32:34.364
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-09-17 18:32:34.238
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-09-17 18:32:31.825
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-09-17 18:32:31.700
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-09-14 15:42:06.693
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-09-14 15:42:06.567
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-09-14 15:42:06.287
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-09-14 15:42:06.166
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-09-13 09:42:06.436
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-09-13 09:42:06.307
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-3570K CPU @ 3.40GHz
Percentage of memory in use: 35%
Total physical RAM: 16279.06 MB
Available physical RAM: 10485.01 MB
Total Pagefile: 16477.24 MB
Available Pagefile: 11392.65 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive c: (System) (Fixed) (Total:238.47 GB) (Free:143.94 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Eigene Dateien) (Fixed) (Total:100.6 GB) (Free:31.04 GB) NTFS
Drive e: (Themen) (Fixed) (Total:100.66 GB) (Free:59.46 GB) NTFS
Drive g: (Audio1) (Fixed) (Total:200 GB) (Free:5.27 GB) NTFS
Drive h: (Audio2) (Fixed) (Total:200 GB) (Free:93.18 GB) NTFS
Drive i: (Fotos bis 2008_neu) (Fixed) (Total:50 GB) (Free:15.58 GB) NTFS
Drive j: (Fotos ab 2009_neu) (Fixed) (Total:80 GB) (Free:15.1 GB) NTFS
Drive k: () (Fixed) (Total:200.25 GB) (Free:32.99 GB) NTFS
Drive n: (YT-Rohdaten) (Fixed) (Total:247.84 GB) (Free:133.68 GB) NTFS
Drive o: (Videobearbeitung) (Fixed) (Total:100.39 GB) (Free:4.48 GB) NTFS
Drive p: (Copter) (Fixed) (Total:384.64 GB) (Free:282.34 GB) NTFS
Drive q: (YT-Rohdaten2) (Fixed) (Total:140.04 GB) (Free:66.49 GB) NTFS
Drive r: (Homepage) (Fixed) (Total:29.29 GB) (Free:16.69 GB) NTFS
Drive s: (Free) (Fixed) (Total:29.29 GB) (Free:12.45 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 238.5 GB) (Disk ID: 5215BE9E)
Partition 1: (Active) - (Size=238.5 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 931.5 GB) (Disk ID: 19ECAC3F)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=OF Extended)
========================================================
Disk: 2 (Size: 931.5 GB) (Disk ID: 00000001)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=05)
Partition 2: (Active) - (Size=50 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=80 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-09-17 22:51:22
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 SAMSUNG_ rev.CXM0 238,47GB
Running: Gmer-19357.exe; Driver: C:\Users\VOW\AppData\Local\Temp\ufddypow.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff800047f1000 8 bytes [00, 00, 0C, 02, 46, 4D, 66, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 544 fffff800047f1010 3 bytes [45, 63, 70]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1648] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074c21465 2 bytes [C2, 74]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1648] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074c214bb 2 bytes [C2, 74]
.text ... * 2
.text C:\Program Files (x86)\Ashampoo\Ashampoo Core Tuner 2\ACT2Service.exe[1888] C:\Windows\syswow64\PSAPI.dll!GetModuleInformation + 69 0000000074c21465 2 bytes [C2, 74]
.text C:\Program Files (x86)\Ashampoo\Ashampoo Core Tuner 2\ACT2Service.exe[1888] C:\Windows\syswow64\PSAPI.dll!GetModuleInformation + 155 0000000074c214bb 2 bytes [C2, 74]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe[2160] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000074c21465 2 bytes [C2, 74]
.text C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe[2160] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 0000000074c214bb 2 bytes [C2, 74]
.text ... * 2
.text D:\Programme\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[2804] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074c21465 2 bytes [C2, 74]
.text D:\Programme\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[2804] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074c214bb 2 bytes [C2, 74]
.text ... * 2
.text C:\Windows\SysWOW64\PnkBstrA.exe[2560] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322 0000000071121a22 2 bytes [12, 71]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2560] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496 0000000071121ad0 2 bytes [12, 71]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2560] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552 0000000071121b08 2 bytes [12, 71]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2560] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730 0000000071121bba 2 bytes [12, 71]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2560] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762 0000000071121bda 2 bytes [12, 71]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2596] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000074c21465 2 bytes [C2, 74]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2596] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 0000000074c214bb 2 bytes [C2, 74]
.text ... * 2
.text C:\Program Files (x86)\ASRock Utility\AXTU\Bin\AsrXTU.exe[3808] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074c21465 2 bytes [C2, 74]
.text C:\Program Files (x86)\ASRock Utility\AXTU\Bin\AsrXTU.exe[3808] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074c214bb 2 bytes [C2, 74]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[4476] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074c21465 2 bytes [C2, 74]
.text C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[4476] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074c214bb 2 bytes [C2, 74]
.text ... * 2
.text D:\Programme\iCloud\ApplePhotoStreams.exe[4792] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074c21465 2 bytes [C2, 74]
.text D:\Programme\iCloud\ApplePhotoStreams.exe[4792] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074c214bb 2 bytes [C2, 74]
.text ... * 2
.text C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[4428] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074c21465 2 bytes [C2, 74]
.text C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[4428] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074c214bb 2 bytes [C2, 74]
.text ... * 2
.text C:\Users\VOW\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe[4932] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074c21465 2 bytes [C2, 74]
.text C:\Users\VOW\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe[4932] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074c214bb 2 bytes [C2, 74]
.text ... * 2
.text C:\Program Files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe[4364] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000074c21465 2 bytes [C2, 74]
.text C:\Program Files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe[4364] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 0000000074c214bb 2 bytes [C2, 74]
.text ... * 2
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5532] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074c21465 2 bytes [C2, 74]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5532] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074c214bb 2 bytes [C2, 74]
.text ... * 2
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[5616] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074c21465 2 bytes [C2, 74]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[5616] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074c214bb 2 bytes [C2, 74]
.text ... * 2
.text C:\Program Files (x86)\Samsung SSD Magician\Samsung Magician.exe[5644] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074c21465 2 bytes [C2, 74]
.text C:\Program Files (x86)\Samsung SSD Magician\Samsung Magician.exe[5644] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074c214bb 2 bytes [C2, 74]
.text ... * 2
.text C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe[6068] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000074c21465 2 bytes [C2, 74]
.text C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe[6068] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 0000000074c214bb 2 bytes [C2, 74]
.text ... * 2
.text C:\Program Files (x86)\Perixx Gaming mouse\SE61T-UserTools.exe[6408] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074c21465 2 bytes [C2, 74]
.text C:\Program Files (x86)\Perixx Gaming mouse\SE61T-UserTools.exe[6408] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074c214bb 2 bytes [C2, 74]
.text ... * 2
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6436] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000074c21465 2 bytes [C2, 74]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6436] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 0000000074c214bb 2 bytes [C2, 74]
.text ... * 2
.text D:\Programme\iCloud\APSDaemon.exe[6804] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074c21465 2 bytes [C2, 74]
.text D:\Programme\iCloud\APSDaemon.exe[6804] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074c214bb 2 bytes [C2, 74]
.text ... * 2
.text C:\Program Files (x86)\RocketTab\Client.exe[6528] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074c21465 2 bytes [C2, 74]
.text C:\Program Files (x86)\RocketTab\Client.exe[6528] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074c214bb 2 bytes [C2, 74]
.text ... * 2
.text C:\Program Files (x86)\Browny02\BrYNSvc.exe[4964] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074c21465 2 bytes [C2, 74]
.text C:\Program Files (x86)\Browny02\BrYNSvc.exe[4964] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074c214bb 2 bytes [C2, 74]
.text ... * 2
.text C:\Program Files (x86)\Windows Media Player\wmplayer.exe[9632] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074c21465 2 bytes [C2, 74]
.text C:\Program Files (x86)\Windows Media Player\wmplayer.exe[9632] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074c214bb 2 bytes [C2, 74]
.text ... * 2
.text C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe[8012] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection 0000000076fcfc80 5 bytes JMP 00000001003b012a
.text C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe[8012] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 0000000076fcfcb0 5 bytes JMP 00000001003b0bc2
.text C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe[8012] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 0000000076fcfe14 5 bytes JMP 00000001003b0048
.text C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe[8012] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent 0000000076fcfea8 5 bytes JMP 00000001003b0594
.text C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe[8012] C:\Windows\SysWOW64\ntdll.dll!NtQueueApcThread 0000000076fcff24 5 bytes JMP 00000001003b0e68
.text C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe[8012] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread 0000000076fd0004 5 bytes JMP 00000001003b0758
.text C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe[8012] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000076fd0038 5 bytes JMP 00000001003b0ca4
.text C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe[8012] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread 0000000076fd0068 5 bytes JMP 00000001003b0d86
.text C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe[8012] C:\Windows\SysWOW64\ntdll.dll!NtTerminateThread 0000000076fd0084 5 bytes JMP 0000000100020050
.text C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe[8012] C:\Windows\SysWOW64\ntdll.dll!NtAlertResumeThread 0000000076fd02e8 5 bytes JMP 00000001003b020c
.text C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe[8012] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant 0000000076fd079c 5 bytes JMP 00000001003b03d0
.text C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe[8012] C:\Windows\SysWOW64\ntdll.dll!NtCreateSymbolicLinkObject 0000000076fd088c 5 bytes JMP 00000001003b09fe
.text C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe[8012] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx 0000000076fd08a4 2 bytes JMP 00000001003b091c
.text C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe[8012] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx + 3 0000000076fd08a7 2 bytes [3E, 89]
.text C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe[8012] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver 0000000076fd0df4 5 bytes JMP 00000001003b0676
.text C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe[8012] C:\Windows\SysWOW64\ntdll.dll!NtQueueApcThreadEx 0000000076fd15d4 5 bytes JMP 00000001003b02ee
.text C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe[8012] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000076fd1920 5 bytes JMP 00000001003b083a
.text C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe[8012] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation 0000000076fd1be4 5 bytes JMP 00000001003b0ae0
.text C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe[8012] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread 0000000076fd1d70 5 bytes JMP 00000001003b04b2
.text C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe[8012] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity + 206 0000000075e1524f 7 bytes JMP 00000001003c02f4
.text C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe[8012] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA + 380 0000000075e153d0 7 bytes JMP 00000001003c05a0
.text C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe[8012] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 149 0000000075e15677 7 bytes JMP 00000001003c03d8
.text C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe[8012] C:\Windows\SysWOW64\sechost.dll!CreateServiceA + 542 0000000075e1589a 7 bytes JMP 00000001003c0048
.text C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe[8012] C:\Windows\SysWOW64\sechost.dll!CreateServiceW + 382 0000000075e15a1d 7 bytes JMP 00000001003c0768
.text C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe[8012] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigW + 370 0000000075e15c9b 7 bytes JMP 00000001003c04bc
.text C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe[8012] C:\Windows\SysWOW64\sechost.dll!ControlServiceExA + 231 0000000075e15d87 7 bytes JMP 00000001003c0684
.text C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe[8012] C:\Windows\SysWOW64\sechost.dll!I_ScBroadcastServiceControlMessage + 123 0000000075e17240 7 bytes JMP 00000001003c0210
.text C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe[8012] C:\Windows\syswow64\USER32.dll!RecordShutdownReason + 882 0000000074da1492 7 bytes JMP 00000001003c0af2
.text C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe[8012] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074c21465 2 bytes [C2, 74]
.text C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe[8012] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074c214bb 2 bytes [C2, 74]
.text ... * 2
.text C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe[2556] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074c21465 2 bytes [C2, 74]
.text C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe[2556] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074c214bb 2 bytes [C2, 74]
.text ... * 2
---- Processes - GMER 2.1 ----
Process C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe (*** suspicious ***) @ C:\Users\VOW\AppData\Roaming\InetStat\inetstat.exe [8012](2014-09-17 19:16:24) 0000000000400000
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\000b0d60c3f5
Reg HKLM\SYSTEM\CurrentControlSet\services\eventlog\Application@Sources MSDMine?DfSdk?Df?DfS?Df?Df?DfSdk
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\000b0d60c3f5 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\eventlog\Application@Sources MSDMine?DfSdk?Df?DfS?Df?Df?DfSdk
---- EOF - GMER 2.1 ----
Code:
ATTFilter <?xml version="1.0"?>
-<Summary>
<ScanInfo EndTime="20140917T203725.374734" StartTime="20140917T190915.374734" ScanType="Full" ScanMode="Manual"/>
-<InfectedObjects>
<InfectedObject ThreatName="Adware.WebCake.C" ThreatType="Virus" ObjectStatus="Moved" InnerObject="" ParentContainers="" ObjectPath="C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch" ObjectType="File"/>
</InfectedObjects>
</Summary>
|
|
18.09.2014, 04:49
| #4 |
| /// the machine /// TB-Ausbilder    | Win7-64Bit - Browser, Netzwerkeinstellungen, Proxy wird immer automatisch aktiviert 127.0.0.1:49273 hi, Adware & Co. deinstallieren
Scan mit Combofix
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
18.09.2014, 06:04
| #5 |
| | Win7-64Bit - Browser, Netzwerkeinstellungen, Proxy wird immer automatisch aktiviert 127.0.0.1:49273 Hallo Schrauber, danke, dass du dich meines Problems so schnell angenommen hast. 1) Ad-Aware & Co habe ich deinstalliert 2) Revo habe ich installiert und entsprechend deiner Vorgabe alles mit ATTENTION deinstalliert (hat 5 Einträge betroffen) Dabei habe ich festgestellt, dass mein System scheinbar keine Wiederherstellungspunkte mehr anlegen kann. 3) Combofix installiert und ausgeführt Log nachfolgend: Code:
ATTFilter ComboFix 14-09-16.01 - VOW 18.09.2014 6:41.1.4 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.49.1031.18.16279.12562 [GMT 2:00]
ausgeführt von:: c:\users\VOW\Desktop\ComboFix.exe
AV: Norton Internet Security *Disabled/Updated* {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}
FW: Norton Internet Security *Enabled* {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}
SP: Norton Internet Security *Enabled/Updated* {631E4324-D31C-783F-EC5C-35AD42B18466}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Images
c:\program files (x86)\MediaPlayerV1
c:\program files (x86)\MediaPlayerV1\MediaPlayerV1alpha86\ch\MediaPlayerV1alpha86.crx
c:\program files (x86)\MediaPlayerV1\MediaPlayerV1alpha86\ff\chrome.manifest
c:\program files (x86)\MediaPlayerV1\MediaPlayerV1alpha86\ff\chrome\content\ffMediaPlayerV1alpha86.js
c:\program files (x86)\MediaPlayerV1\MediaPlayerV1alpha86\ff\chrome\content\ffMediaPlayerV1alpha86ffaction.js
c:\program files (x86)\MediaPlayerV1\MediaPlayerV1alpha86\ff\chrome\content\icons\default\MediaPlayerV1alpha86_32.png
c:\program files (x86)\MediaPlayerV1\MediaPlayerV1alpha86\ff\chrome\content\icons\Thumbs.db
c:\program files (x86)\MediaPlayerV1\MediaPlayerV1alpha86\ff\chrome\content\overlay.xul
c:\program files (x86)\MediaPlayerV1\MediaPlayerV1alpha86\ff\install.rdf
c:\program files (x86)\VideoPlayerV3
c:\program files (x86)\VideoPlayerV3\VideoPlayerV3beta736\ch\VideoPlayerV3beta736.crx
c:\program files (x86)\VideoPlayerV3\VideoPlayerV3beta736\ff\chrome.manifest
c:\program files (x86)\VideoPlayerV3\VideoPlayerV3beta736\ff\chrome\content\ffVideoPlayerV3beta736.js
c:\program files (x86)\VideoPlayerV3\VideoPlayerV3beta736\ff\chrome\content\ffVideoPlayerV3beta736ffaction.js
c:\program files (x86)\VideoPlayerV3\VideoPlayerV3beta736\ff\chrome\content\icons\default\VideoPlayerV3beta736_32.png
c:\program files (x86)\VideoPlayerV3\VideoPlayerV3beta736\ff\chrome\content\icons\Thumbs.db
c:\program files (x86)\VideoPlayerV3\VideoPlayerV3beta736\ff\chrome\content\overlay.xul
c:\program files (x86)\VideoPlayerV3\VideoPlayerV3beta736\ff\install.rdf
c:\program files (x86)\WebexpEnhancedV1
c:\users\VOW\4.0
c:\users\VOW\AppData\Local\assembly\tmp
c:\users\VOW\AppData\Roaming\Desktopicon
c:\users\VOW\AppData\Roaming\Local
c:\users\VOW\AppData\Roaming\Local\Temp\DDM\Settings\.ddr
c:\users\VOW\AppData\Roaming\Local\Temp\DDM\Settings\0.ddi
c:\users\VOW\AppData\Roaming\Local\Temp\DDM\Settings\1.ddi
c:\users\VOW\AppData\Roaming\Local\Temp\DDM\Settings\2.ddi
c:\users\VOW\AppData\Roaming\Local\Temp\DDM\Settings\Inception_Trailer_592.divx.ddr
c:\users\VOW\AppData\Roaming\Local\Temp\DDM\Settings\jahrestart_jrnf7_merkel.m4v.ddr
c:\users\VOW\AppData\Roaming\Local\Temp\DDM\Settings\settings.ddi
c:\users\VOW\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\.ddp
c:\users\VOW\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Inception_Trailer_592.divx
c:\users\VOW\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\jahrestart_jrnf7_merkel.m4v
c:\windows\jestertb.dll
c:\windows\SwSys1.bmp
c:\windows\SwSys2.bmp
c:\windows\wininit.ini
.
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_ACEDRV11
-------\Service_acedrv11
-------\Service_WajamUpdaterV3
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-08-18 bis 2014-09-18 ))))))))))))))))))))))))))))))
.
.
2014-09-18 04:20 . 2014-09-18 04:20 -------- d-----w- c:\program files (x86)\VS Revo Group
2014-09-17 20:41 . 2014-09-17 20:42 -------- d-----w- C:\FRST
2014-09-17 19:16 . 2014-09-17 21:41 -------- d-----w- c:\users\VOW\AppData\Roaming\InetStat
2014-09-17 19:15 . 2014-09-18 04:35 -------- d-----w- c:\users\VOW\AppData\Roaming\LookThisUp
2014-09-12 16:53 . 2014-09-12 16:53 -------- d-----w- c:\users\VOW\AppData\Roaming\LavasoftStatistics
2014-09-12 16:42 . 2014-08-20 17:17 19800 ----a-w- c:\windows\system32\roboot64.exe
2014-09-12 09:43 . 2014-09-12 09:43 227728 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\nppdf32.dll
2014-09-12 09:43 . 2014-09-12 09:43 227728 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\nppdf32.dll
2014-09-10 19:16 . 2014-09-10 19:16 -------- d-----w- c:\users\VOW\AppData\Local\Adobe
2014-09-09 19:12 . 2014-08-18 23:01 23591424 ----a-w- c:\windows\system32\mshtml.dll
2014-09-09 19:10 . 2014-06-27 02:08 2777088 ----a-w- c:\windows\system32\msmpeg2vdec.dll
2014-09-09 19:10 . 2014-06-27 01:45 2285056 ----a-w- c:\windows\SysWow64\msmpeg2vdec.dll
2014-09-09 17:30 . 2014-08-01 11:53 1031168 ----a-w- c:\windows\system32\TSWorkspace.dll
2014-09-09 17:30 . 2014-08-01 11:35 793600 ----a-w- c:\windows\SysWow64\TSWorkspace.dll
2014-09-09 17:30 . 2014-06-24 03:29 2565120 ----a-w- c:\windows\system32\d3d10warp.dll
2014-09-09 17:30 . 2014-06-24 02:59 1987584 ----a-w- c:\windows\SysWow64\d3d10warp.dll
2014-09-09 17:30 . 2014-07-07 02:06 728064 ----a-w- c:\windows\system32\kerberos.dll
2014-09-09 17:30 . 2014-07-07 02:06 1460736 ----a-w- c:\windows\system32\lsasrv.dll
2014-09-09 17:30 . 2014-07-07 01:40 22016 ----a-w- c:\windows\SysWow64\secur32.dll
2014-09-09 17:30 . 2014-07-07 01:40 550912 ----a-w- c:\windows\SysWow64\kerberos.dll
2014-09-09 17:30 . 2014-07-07 01:39 96768 ----a-w- c:\windows\SysWow64\sspicli.dll
2014-09-09 17:30 . 2014-09-05 02:10 578048 ----a-w- c:\windows\system32\aepdu.dll
2014-09-09 17:30 . 2014-09-05 02:05 424448 ----a-w- c:\windows\system32\aeinv.dll
2014-09-07 08:01 . 2014-09-18 04:25 -------- d-----w- c:\users\VOW\AppData\Local\RocketTab
2014-09-01 19:39 . 2014-09-01 19:39 -------- d-----w- c:\users\VOW\AppData\Local\SearchProtect
2014-09-01 07:34 . 2014-09-01 07:34 -------- d-----w- c:\users\VOW\AppData\Local\Magix
2014-09-01 07:34 . 2014-09-01 07:34 -------- d-----w- c:\program files\Common Files\MAGIX Shared
2014-09-01 07:34 . 2014-09-01 07:34 -------- d-----w- c:\program files (x86)\Common Files\MAGIX Shared
2014-09-01 07:09 . 2014-09-01 07:09 -------- d-----w- C:\MAGIX Downloads
2014-09-01 06:39 . 2014-09-01 06:39 -------- d-----w- C:\Amazon MP3
2014-08-28 04:35 . 2014-08-23 02:07 404480 ----a-w- c:\windows\system32\gdi32.dll
2014-08-28 04:35 . 2014-08-23 01:45 311808 ----a-w- c:\windows\SysWow64\gdi32.dll
2014-08-28 04:35 . 2014-08-23 00:59 3163648 ----a-w- c:\windows\system32\win32k.sys
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-09-18 04:45 . 2010-07-27 19:49 25640 ----a-w- c:\windows\gdrv.sys
2014-09-10 17:26 . 2012-04-01 06:30 701104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-09-10 17:26 . 2011-06-10 20:05 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-09-09 19:10 . 2009-10-31 14:18 101694776 ----a-w- c:\windows\system32\MRT.exe
2014-09-07 07:52 . 2012-10-20 13:19 32320 ----a-w- c:\windows\system32\drivers\FNETTBOH_305.SYS
2014-08-30 01:23 . 2011-03-28 16:36 23256 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2014-08-10 06:56 . 2014-08-10 06:56 98216 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-07-25 00:35 . 2014-07-25 00:35 875688 ----a-w- c:\windows\SysWow64\msvcr120_clr0400.dll
2014-07-24 21:47 . 2014-07-24 21:47 869544 ----a-w- c:\windows\system32\msvcr120_clr0400.dll
2014-07-16 03:23 . 2014-08-14 19:25 2048 ----a-w- c:\windows\system32\tzres.dll
2014-07-16 02:46 . 2014-08-14 19:25 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2014-07-14 02:02 . 2014-08-14 19:22 1216000 ----a-w- c:\windows\system32\rpcrt4.dll
2014-07-14 01:40 . 2014-08-14 19:22 664064 ----a-w- c:\windows\SysWow64\rpcrt4.dll
2014-07-09 02:03 . 2014-08-14 19:27 7168 ----a-w- c:\windows\system32\KBDYAK.DLL
2014-07-09 02:03 . 2014-08-14 19:27 7168 ----a-w- c:\windows\system32\KBDTAT.DLL
2014-07-09 02:03 . 2014-08-14 19:27 7168 ----a-w- c:\windows\system32\KBDRU1.DLL
2014-07-09 02:03 . 2014-08-14 19:27 6656 ----a-w- c:\windows\system32\KBDRU.DLL
2014-07-09 02:03 . 2014-08-14 19:27 7168 ----a-w- c:\windows\system32\KBDBASH.DLL
2014-07-09 01:31 . 2014-08-14 19:27 7168 ----a-w- c:\windows\SysWow64\KBDYAK.DLL
2014-07-09 01:31 . 2014-08-14 19:27 6656 ----a-w- c:\windows\SysWow64\KBDBASH.DLL
2014-06-30 22:24 . 2014-08-14 20:14 8856 ----a-w- c:\windows\system32\icardres.dll
2014-06-30 22:14 . 2014-08-14 20:14 8856 ----a-w- c:\windows\SysWow64\icardres.dll
2014-06-25 02:05 . 2014-08-14 19:25 14175744 ----a-w- c:\windows\system32\shell32.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2014-08-07 10:51 297128 ----a-w- c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ApplePhotoStreams"="d:\programme\iCloud\ApplePhotoStreams.exe" [2013-11-20 59720]
"iCloudServices"="d:\programme\iCloud\iCloudServices.exe" [2013-11-20 59720]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-11-09 39408]
"Amazon Cloud Player"="c:\users\VOW\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe" [2014-03-07 3168576]
"GarminExpressTrayApp"="d:\programme\Garmin\Express Tray\ExpressTray.exe" [2014-07-23 688984]
"LookThisUp"="c:\users\VOW\AppData\Roaming\LookThisUp\LookThisUp.exe" [2014-09-17 1848976]
"InetStat"="c:\users\VOW\AppData\Roaming\InetStat\inetstat.exe" [2014-09-17 700430]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"FreePDF Assistant"="c:\program files (x86)\FreePDF_XP\fpassist.exe" [2014-01-09 374784]
"ISUSScheduler"="c:\program files (x86)\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-17 81920]
"ArcSoft Connection Service"="c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
"ATICustomerCare"="c:\program files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-03-04 311296]
"ControlCenter3"="c:\program files (x86)\Brother\ControlCenter3\brctrcen.exe" [2008-12-24 114688]
"BrStsMon00"="c:\program files (x86)\Browny02\Brother\BrStMonW.exe" [2010-02-09 2621440]
"TrueImageMonitor.exe"="c:\program files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe" [2012-04-27 5993136]
"Name of App"="c:\program files (x86)\SAMSUNG\FW LiveUpdate\FWManager.exe" [2011-11-23 692307]
"AcronisTimounterMonitor"="c:\program files (x86)\Acronis\TrueImageHome\TimounterMonitor.exe" [2012-04-27 1173680]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-02-05 43848]
"USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-01-26 291608]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-11-29 284440]
"XFastUSB"="c:\program files (x86)\XFastUSB\XFastUsb.exe" [2012-10-16 5019360]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-12-19 642808]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-08-21 959176]
"SE61T-UserTools"="c:\program files (x86)\Perixx Gaming mouse\SE61T-UserTools.exe" [2013-10-08 754176]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2014-01-17 421888]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-07-25 256896]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"GarminExpressTrayApp"="d:\programme\Garmin\Express Tray\ExpressTray.exe" [2014-07-23 688984]
.
c:\users\VOW\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2009-2-26 97680]
Samsung Magician.lnk - c:\windows\system32\schtasks.exe /run /tn SamsungMagician [2011-6-24 285696]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2014-1-16 1207312]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLUA"= 0 (0x0)
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoFileAssociate"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
R2 AODDriver4.01;AODDriver4.01;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]
R2 AODDriver4.1;AODDriver4.1;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 ES lite Service;ES lite Service for program management.;c:\program files (x86)\Gigabyte\EasySaver\ESSVR.EXE;c:\program files (x86)\Gigabyte\EasySaver\ESSVR.EXE [x]
R2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [x]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
R3 AIDA64Driver;FinalWire AIDA64 Kernel Driver;c:\users\VOW\AppData\Local\Temp\Rar$EX01.439\kerneld.x64;c:\users\VOW\AppData\Local\Temp\Rar$EX01.439\kerneld.x64 [x]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys;c:\windows\SYSNATIVE\Drivers\ssadadb.sys [x]
R3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys;c:\windows\SYSNATIVE\drivers\dgderdrv.sys [x]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [x]
R3 FNETTBOH_305;FNETTBOH_305;c:\windows\system32\drivers\FNETTBOH_305.SYS;c:\windows\SYSNATIVE\drivers\FNETTBOH_305.SYS [x]
R3 Fwleaf;NETGEAR Firewall Driver;c:\windows\system32\DRIVERS\fwleaf.sys;c:\windows\SYSNATIVE\DRIVERS\fwleaf.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 leafnets;Leaf Networks Adapter;c:\windows\system32\DRIVERS\leafnets.sys;c:\windows\SYSNATIVE\DRIVERS\leafnets.sys [x]
R3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys;c:\windows\SYSNATIVE\drivers\LGVirHid.sys [x]
R3 nmwcdnsux64;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsux64.sys;c:\windows\SYSNATIVE\drivers\nmwcdnsux64.sys [x]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
R3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys;c:\windows\SYSNATIVE\pwdrvio.sys [x]
R3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys;c:\windows\SYSNATIVE\pwdspio.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 silabenm;Silicon Labs CP210x USB to UART Bridge Serial Port Enumerator Driver;c:\windows\system32\DRIVERS\silabenm.sys;c:\windows\SYSNATIVE\DRIVERS\silabenm.sys [x]
R3 silabser;Silicon Labs CP210x USB to UART Bridge Driver;c:\windows\system32\DRIVERS\silabser.sys;c:\windows\SYSNATIVE\DRIVERS\silabser.sys [x]
R3 SliceDisk5;SliceDisk5;c:\program files\A-FF Find and Mount\slicedisk-x64.sys;c:\program files\A-FF Find and Mount\slicedisk-x64.sys [x]
R3 SndTAudio;SndTAudio;c:\windows\system32\drivers\SndTAudio.sys;c:\windows\SYSNATIVE\drivers\SndTAudio.sys [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssadbus.sys [x]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdfl.sys [x]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdm.sys [x]
R3 STSService;STSService;c:\program files (x86)\SoundTaxi Media Suite\STSService.exe;c:\program files (x86)\SoundTaxi Media Suite\STSService.exe [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 V0260VID;Live! Cam Vista IM;c:\windows\system32\DRIVERS\V0260Vid.sys;c:\windows\SYSNATIVE\DRIVERS\V0260Vid.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R3 WO_LiveService;Ashampoo LiveTuner Service;d:\programme\Ashampoo WinOptimizer 10\LiveTunerService.exe;d:\programme\Ashampoo WinOptimizer 10\LiveTunerService.exe [x]
R3 WPRO_41_1742;WinPcap Packet Driver (WPRO_41_1742);c:\windows\system32\drivers\WPRO_41_1742.sys;c:\windows\SYSNATIVE\drivers\WPRO_41_1742.sys [x]
R4 MSSQLServerADHelper100;SQL Server Hilfsdienst für Active Directory;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [x]
R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys;c:\windows\SYSNATIVE\DRIVERS\RsFx0103.sys [x]
R4 SQLAgent$SQLEXPRESS;SQL Server-Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE;c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [x]
S0 asahci64;asahci64;c:\windows\system32\DRIVERS\asahci64.sys;c:\windows\SYSNATIVE\DRIVERS\asahci64.sys [x]
S0 AsrRamDisk;AsrRamDisk;c:\windows\system32\DRIVERS\AsrRamDisk.sys;c:\windows\SYSNATIVE\DRIVERS\AsrRamDisk.sys [x]
S0 fltsrv;Acronis Storage Filter Management;c:\windows\system32\DRIVERS\fltsrv.sys;c:\windows\SYSNATIVE\DRIVERS\fltsrv.sys [x]
S0 iusb3hcs;Intel(R) USB 3.0 Hostcontroller-Switchtreiber;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\System32\drivers\sfdrv01a.sys;c:\windows\SYSNATIVE\drivers\sfdrv01a.sys [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1505000.013\SYMDS64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1505000.013\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1505000.013\SYMEFA64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1505000.013\SYMEFA64.SYS [x]
S0 vididr;Acronis Virtual Disk;c:\windows\system32\DRIVERS\vididr.sys;c:\windows\SYSNATIVE\DRIVERS\vididr.sys [x]
S0 vidsflt67;Acronis Disk Storage Filter (67);c:\windows\system32\DRIVERS\vsflt67.sys;c:\windows\SYSNATIVE\DRIVERS\vsflt67.sys [x]
S1 BHDrvx64;BHDrvx64;c:\program files (x86)\Norton Internet Security\NortonData\21.3.0.12\Definitions\BASHDefs\20140912.003\BHDrvx64.sys;c:\program files (x86)\Norton Internet Security\NortonData\21.3.0.12\Definitions\BASHDefs\20140912.003\BHDrvx64.sys [x]
S1 ccSet_NIS;NIS Settings Manager;c:\windows\system32\drivers\NISx64\1505000.013\ccSetx64.sys;c:\windows\SYSNATIVE\drivers\NISx64\1505000.013\ccSetx64.sys [x]
S1 FNETURPX;FNETURPX;c:\windows\system32\drivers\FNETURPX.SYS;c:\windows\SYSNATIVE\drivers\FNETURPX.SYS [x]
S1 IDSVia64;IDSVia64;c:\program files (x86)\Norton Internet Security\NortonData\21.3.0.12\Definitions\IPSDefs\20140917.001\IDSvia64.sys;c:\program files (x86)\Norton Internet Security\NortonData\21.3.0.12\Definitions\IPSDefs\20140917.001\IDSvia64.sys [x]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1505000.013\Ironx64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1505000.013\Ironx64.SYS [x]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1505000.013\SYMNETS.SYS;c:\windows\SYSNATIVE\Drivers\NISx64\1505000.013\SYMNETS.SYS [x]
S2 ACT2_Service;Ashampoo Core Tuner 2 Service;c:\program files (x86)\Ashampoo\Ashampoo Core Tuner 2\ACT2Service.exe;c:\program files (x86)\Ashampoo\Ashampoo Core Tuner 2\ACT2Service.exe [x]
S2 ACT2PM;Ashampoo CoreTuner 2 ProcessMonitor Driver;c:\program files (x86)\Ashampoo\Ashampoo Core Tuner 2\ACT2ProcessMonitor64.sys;c:\program files (x86)\Ashampoo\Ashampoo Core Tuner 2\ACT2ProcessMonitor64.sys [x]
S2 afcdpsrv;Acronis Nonstop Backup Service;c:\program files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe;c:\program files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 DBService;DATA BECKER Update Service;c:\program files (x86)\Common Files\DATA BECKER Shared\DBService.exe;c:\program files (x86)\Common Files\DATA BECKER Shared\DBService.exe [x]
S2 DfSdkS;Defragmentation-Service;d:\programme\Ashampoo WinOptimizer 10\DfsdkS64.exe;d:\programme\Ashampoo WinOptimizer 10\DfsdkS64.exe [x]
S2 Garmin Core Update Service;Garmin Core Update Service;d:\programme\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe;d:\programme\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [x]
S2 JMB36X;JMB36X;c:\windows\SysWOW64\XSrvSetup.exe;c:\windows\SysWOW64\XSrvSetup.exe [x]
S2 LiveTunerPM;Ashampoo LiveTuner ProcessMonitor Driver;d:\programme\Ashampoo WinOptimizer 10\LiveTunerProcessMonitor64.sys;d:\programme\Ashampoo WinOptimizer 10\LiveTunerProcessMonitor64.sys [x]
S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\21.5.0.19\NIS.exe;c:\program files (x86)\Norton Internet Security\Engine\21.5.0.19\NIS.exe [x]
S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys;c:\windows\SYSNATIVE\drivers\npf.sys [x]
S2 OS Selector;Acronis OS Selector Activator;c:\program files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe;c:\program files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe [x]
S2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
S2 syncagentsrv;Acronis Sync Agent Service;c:\program files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe;c:\program files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe [x]
S2 SynoDrService;SynoDrService;c:\program files (x86)\Synology Data Replicator 3\SynoDrServicex64.exe;c:\program files (x86)\Synology Data Replicator 3\SynoDrServicex64.exe [x]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [x]
S2 UsbClientService;UsbClientService;c:\program files (x86)\Synology\Assistant\UsbClientService.exe;c:\program files (x86)\Synology\Assistant\UsbClientService.exe [x]
S3 afcdp;afcdp;c:\windows\system32\DRIVERS\afcdp.sys;c:\windows\SYSNATIVE\DRIVERS\afcdp.sys [x]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64.sys [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 AxtuDrv;AxtuDrv;c:\windows\SysWOW64\Drivers\AxtuDrv.sys;c:\windows\SysWOW64\Drivers\AxtuDrv.sys [x]
S3 BrYNSvc;BrYNSvc;c:\program files (x86)\Browny02\BrYNSvc.exe;c:\program files (x86)\Browny02\BrYNSvc.exe [x]
S3 busenum;Synology Virtual USB Hub;c:\windows\system32\DRIVERS\busenum.sys;c:\windows\SYSNATIVE\DRIVERS\busenum.sys [x]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x]
S3 iusb3hub;Intel(R) USB 3.0-Hubtreiber;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible-Hostcontrollertreiber;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys;c:\windows\SYSNATIVE\drivers\LGBusEnum.sys [x]
S3 libusb0;libusb-win32 - Kernel Driver 04/08/2011 1.2.4.0;c:\windows\system32\drivers\libusb0.sys;c:\windows\SYSNATIVE\drivers\libusb0.sys [x]
S3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys;c:\windows\SYSNATIVE\drivers\MBfilt64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2}]
2010-02-16 18:02 114688 ----a-w- c:\program files (x86)\PixiePack Codec Pack\InstallerHelper.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-09-18 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-01 17:26]
.
2014-09-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-10-31 15:55]
.
2014-09-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-10-31 15:55]
.
2014-09-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3018767705-964232526-3307114488-1001Core.job
- c:\users\VOW\AppData\Local\Google\Update\GoogleUpdate.exe [2012-10-17 16:57]
.
2014-09-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3018767705-964232526-3307114488-1001UA.job
- c:\users\VOW\AppData\Local\Google\Update\GoogleUpdate.exe [2012-10-17 16:57]
.
2014-09-13 c:\windows\Tasks\Norton Security Scan for VOW.job
- c:\progra~2\Norton Security Scan\Engine\4.1.0.28\Nss.exe [2014-04-06 06:04]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2014-01-22 21:51 357432 ----a-w- c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2014-08-08 08:34 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2014-08-08 08:34 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2014-08-08 08:34 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2014-08-08 08:34 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2014-08-08 08:34 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Launch LCore"="c:\program files\Logitech Gaming Software\LCore.exe" [2010-11-16 104008]
"Acronis Scheduler2 Service"="c:\program files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe" [2012-04-27 403656]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdcBase.exe" [2007-05-31 660360]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-10-17 13307496]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-03-19 170264]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-03-19 398616]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-03-19 439064]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://feed.snapdo.com/?publisher=snapdoocyb&dpid=snapdoocyb&co=de&userid=1d55a34c-41e3-7bb2-c576-39761563b71c&searchtype=hp&installdate=14/09/2013
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <-loopback>
uInternet Settings,ProxyServer = http=127.0.0.1:49501;https=127.0.0.1:49501
uSearchAssistant = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=1d55a34c-41e3-7bb2-c576-39761563b71c&searchtype=ds&q={searchTerms}&installDate=14/09/2013
IE: Alles mit FDM herunterladen - file://d:\programme\Free Download Manager\dlall.htm
IE: Auswahl mit FDM herunterladen - file://d:\programme\Free Download Manager\dlselected.htm
IE: Datei mit FDM herunterladen - file://d:\programme\Free Download Manager\dllink.htm
IE: Free YouTube Download - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm
IE: Free YouTube to MP3 Converter - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Videos mit FDM herunterladen - file://d:\programme\Free Download Manager\dlfvideo.htm
IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
Trusted Zone: clonewarsadventures.com
Trusted Zone: elsteronline.de\www
Trusted Zone: freerealms.com
Trusted Zone: homeserver.com\wirth
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2475029&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - MyAshampoo Customized Web Search
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT2475029&SearchSource=13
FF - user.js: browser.blink_allowed - true
FF - user.js: network.prefetch-next - true
FF - user.js: nglayout.initialpaint.delay - 250
FF - user.js: layout.spellcheckDefault - 1
FF - user.js: browser.urlbar.autoFill - false
FF - user.js: browser.search.openintab - false
FF - user.js: browser.tabs.closeButtons - 1
FF - user.js: browser.tabs.opentabfor.middleclick - true
FF - user.js: browser.tabs.tabMinWidth - 100
FF - user.js: browser.urlbar.hideGoButton - false
FF - user.js: extensions.delta.tlbrSrchUrl -
FF - user.js: extensions.delta.id - f69128b0000000000000bc5ff4492ea1
FF - user.js: extensions.delta.appId - {C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
FF - user.js: extensions.delta.instlDay - 15940
FF - user.js: extensions.delta.vrsn - 1.8.24.6
FF - user.js: extensions.delta.vrsni - 1.8.24.6
FF - user.js: extensions.delta.vrsnTs - 1.8.24.617:18
FF - user.js: extensions.delta.prtnrId - delta
FF - user.js: extensions.delta.prdct - delta
FF - user.js: extensions.delta.aflt - babsst
FF - user.js: extensions.delta.smplGrp - none
FF - user.js: extensions.delta.tlbrId - base
FF - user.js: extensions.delta.instlRef - sst
FF - user.js: extensions.delta.dfltLng - de
FF - user.js: extensions.delta.excTlbr - false
FF - user.js: extensions.delta.ffxUnstlRst - true
FF - user.js: extensions.delta.admin - false
FF - user.js: extensions.delta_i.babTrack - affID=121151&tsp=4983
FF - user.js: extensions.delta_i.babExt -
FF - user.js: extensions.delta_i.srcExt - ss
FF - user.js: extensions.delta.autoRvrt - false
FF - user.js: extensions.delta.rvrt - false
FF - user.js: extensions.delta.newTab - false
FF - user.js: extensions.autoDisableScopes - 0
FF - user.js: extensions.shownSelectionUI - true
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{9cf699ca-2174-4ed8-bec1-ba82095edce0} - (no file)
Wow6432Node-HKCU-Run-ISUSPM Startup - c:\progra~2\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
Wow6432Node-HKCU-Run-PureSync - c:\program files (x86)\PureSync\PureSyncTray.exe
Wow6432Node-HKCU-Run-ASRockXTU - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
WebBrowser-{A1E75A0E-4397-4BA8-BB50-E19FB66890F4} - (no file)
ShellIconOverlayIdentifiers- - (no file)
ShellIconOverlayIdentifiers- - (no file)
ShellIconOverlayIdentifiers- - (no file)
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-cGPSmapper Free_is1 - c:\osm\cGPSmapper\unins000.exe
AddRemove-GSNMTOOL - c:\program files (x86)\GSNMTOOL\uninstall.exe
AddRemove-Microsoft Visual Basic 2008 Express Edition with SP1 - DEU - o:\programme\VB2008Express\Microsoft Visual Basic 2008 Express Edition with SP1 - DEU\setup.exe
AddRemove-Uninstall_is1 - c:\program files (x86)\Common Files\DVDVideoSoft\unins000.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\21.5.0.19\NIS.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\21.5.0.19\diMaster.dll\" /prefetch:1"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\AIDA64Driver]
"ImagePath"="\??\c:\users\VOW\AppData\Local\Temp\Rar$EX01.439\kerneld.x64"
"ImagePath"="\SystemRoot\System32\Drivers\NISx64\1505000.013\SYMNETS.SYS"
"TrustedImagePaths"="c:\program files (x86)\Norton Internet Security\Engine\21.5.0.19;c:\program files (x86)\Norton Internet Security\Engine64\21.5.0.19"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3018767705-964232526-3307114488-1001\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:d6,e3,f3,76,21,83,df,a4,62,50,c2,ae,50,3f,ae,aa,be,c1,30,f0,7d,aa,89,
2a,bc,23,6d,2a,80,2c,4e,f0,d6,97,73,f4,d2,72,e0,df,b7,52,6a,6f,25,53,94,9b,\
"??"=hex:41,e0,42,8c,cf,55,c7,95,2b,14,4d,f8,66,7b,0c,1b
.
[HKEY_USERS\S-1-5-21-3018767705-964232526-3307114488-1001\Software\SecuROM\License information*]
"datasecu"=hex:b9,6a,41,8c,08,f2,fa,be,cc,ad,04,b2,e3,3a,25,2b,15,ca,73,af,37,
f5,05,e3,14,db,00,9e,32,da,f6,18,f0,96,93,7c,4f,ef,9a,89,1f,67,88,dd,65,a7,\
"rkeysecu"=hex:cb,bd,f2,61,5a,4e,c6,95,f2,29,8b,82,ba,6b,3d,44
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_152_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_152_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_152_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_152_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_152.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.15"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_152.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_152.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_152.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Windows CE Services]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\ASRock Utility\AXTU\Bin\AsrXTU.exe
c:\program files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler.exe
c:\program files (x86)\Samsung SSD Magician\Samsung Magician.exe
c:\program files\Logitech\SetPoint\x86\SetPoint32.exe
c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
c:\program files (x86)\Brother\ControlCenter3\brccMCtl.exe
d:\programme\iCloud\APSDaemon.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-09-18 06:47:44 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2014-09-18 04:47
.
Vor Suchlauf: 26 Verzeichnis(se), 154.871.083.008 Bytes frei
Nach Suchlauf: 32 Verzeichnis(se), 154.434.629.632 Bytes frei
.
- - End Of File - - B58576E102847C618A43242720A2D7EC
Beim Starten des PC´s erscheint immer ein DOS-Fenster und es wird versucht \rockettab\client.exe zu laden, was windows inzwischen mit einer Fehlermeldung quittiert, da diese Datei in den vorherigen SChritten gelöscht wurde. Die automatischen Proxyeinträge scheinen nicht mehr zu erfolgen. Grüße Volker |
|
18.09.2014, 16:19
| #6 |
| /// the machine /// TB-Ausbilder | Win7-64Bit - Browser, Netzwerkeinstellungen, Proxy wird immer automatisch aktiviert 127.0.0.1:49273 Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ --> Win7-64Bit - Browser, Netzwerkeinstellungen, Proxy wird immer automatisch aktiviert 127.0.0.1:49273 |
|
18.09.2014, 17:11
| #7 |
| | Win7-64Bit - Browser, Netzwerkeinstellungen, Proxy wird immer automatisch aktiviert 127.0.0.1:49273 So, hier die neuen Logs... MBAM: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 18.09.2014 Suchlauf-Zeit: 17:36:58 Logdatei: mbam_180914_1.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.09.18.04 Rootkit Datenbank: v2014.09.18.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: VOW Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 423551 Verstrichene Zeit: 5 Min, 0 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 30 PUP.Optional.Delta.A, HKLM\SOFTWARE\CLASSES\APPID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}, In Quarantäne, [6cb0529dff7c4ceace56922f46bc19e7], PUP.Optional.Delta.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}, In Quarantäne, [6cb0529dff7c4ceace56922f46bc19e7], PUP.Optional.Wajam.A, HKLM\SOFTWARE\CLASSES\APPID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}, In Quarantäne, [a07ce40bfd7e0c2a67966061887a38c8], PUP.Optional.Wajam.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}, In Quarantäne, [a07ce40bfd7e0c2a67966061887a38c8], PUP.Optional.WebCake.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{DF84E609-C3A4-49CB-A160-61767DAF8899}, In Quarantäne, [fa22b33c89f2a3938a9e368b35cd6898], PUP.Optional.GetNow.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}, In Quarantäne, [c755836c0b70cf673e01cdc12ad8e719], PUP.Optional.GetNow.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{237FDFDB-3722-470E-8BA8-90196DABE967}, In Quarantäne, [c755836c0b70cf673e01cdc12ad8e719], PUP.Optional.GetNow.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{237FDFDB-3722-470E-8BA8-90196DABE967}, In Quarantäne, [c755836c0b70cf673e01cdc12ad8e719], PUP.Optional.GetNow.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}, In Quarantäne, [c755836c0b70cf673e01cdc12ad8e719], PUP.Optional.Snapdo.T, HKU\S-1-5-21-3018767705-964232526-3307114488-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006ee092-9658-4fd6-bd8e-a21a348e59f5}, In Quarantäne, [72aaf7f8bebdc5710c91c4003cc62fd1], PUP.Optional.Snapdo.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006EE092-9658-4FD6-BD8E-A21A348E59F5}, In Quarantäne, [72aaf7f8bebdc5710c91c4003cc62fd1], PUP.Optional.DealPly.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{8C338DDB-19FC-4C1F-B74D-6931EE55F7A1}, In Quarantäne, [62bab03f7dfe81b5d0b99b26f30f4db3], PUP.Optional.DealPly.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{8C338DDB-19FC-4C1F-B74D-6931EE55F7A1}, In Quarantäne, [62bab03f7dfe81b5d0b99b26f30f4db3], PUP.Optional.DealPly.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{C536F080-57B7-46D6-8894-C647553F2889}, In Quarantäne, [918bea053645d1651f6c4081c73bfd03], Trojan.MSIL.Bladabindi, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\LookThisUp, In Quarantäne, [72aa22cd5e1d1d19ca57912f15ec7987], PUP.Optional.LookThisUp.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\LookThisUp, In Quarantäne, [72aa8d62abd0db5b2ee1cc3883807987], PUP.Optional.DataMangr.A, HKLM\SOFTWARE\WOW6432NODE\DataMngr, In Quarantäne, [b8642bc41665082e331553c758ab7987], PUP.Optional.MediaPlayerAlpha.A, HKLM\SOFTWARE\WOW6432NODE\MediaPlayerV1alpha86, In Quarantäne, [d349d718bcbfac8a0052171d877c54ac], PUP.Optional.BetterSurf.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\dedmngkbaffkenlfdcbganndoghblmap, In Quarantäne, [809cc6295724ac8afa100c1456ad5fa1], PUP.Optional.BetterSurf.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\mmifolfpllfdhilecpdpmemhelmanajl, In Quarantäne, [ad6f945b25568ea8c41df2287d869769], PUP.Optional.BetterSurf.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\poheodfamflhhhdcmjfeggbgigeefaco, In Quarantäne, [c8549659df9ca88ebb9b7ab113f0aa56], PUP.Optional.Wajam.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\NATIVEMESSAGINGHOSTS\com.wajam.chrome.messaging.host, In Quarantäne, [75a7925d4b30cc6af1690c24bc47f907], PUP.Optional.DataMngr.A, HKU\S-1-5-21-3018767705-964232526-3307114488-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DataMngr_Toolbar, In Quarantäne, [43d95f905526c17573d07fcec63ead53], PUP.Optional.RocketTab.A, HKU\S-1-5-21-3018767705-964232526-3307114488-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\RocketTabInstalled, In Quarantäne, [56c66b844932fb3bfb9fba4a946f3fc1], PUP.Optional.PriceGong.A, HKU\S-1-5-21-3018767705-964232526-3307114488-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\PriceGong, In Quarantäne, [ac70846bb4c7dd59a1de9c955ba828d8], PUP.Optional.DVDVideoSoftTB.A, HKU\S-1-5-21-3018767705-964232526-3307114488-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\nikpibnbobmbdbheedjfogjlikpgpnhp, In Quarantäne, [3be1b73886f51224d5a49b6759aad22e], PUP.Optional.InstallCore.A, HKU\S-1-5-21-3018767705-964232526-3307114488-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, In Quarantäne, [0a124aa585f681b55aadb384a0630000], PUP.Optional.InstallCore.A, HKU\S-1-5-21-3018767705-964232526-3307114488-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, In Quarantäne, [011b11def685d95daeb94b02a361fe02], PUP.Optional.LookThisUp.A, HKU\S-1-5-21-3018767705-964232526-3307114488-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\LOOKTHISUP, In Quarantäne, [f52719d6e89348ee828e6e9650b332ce], PUP.Optional.Softonic.A, HKU\S-1-5-21-3018767705-964232526-3307114488-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOFTONIC\Universal Downloader, In Quarantäne, [2bf1e40bdba02f072d08e244bc4740c0], Registrierungswerte: 6 PUP.Optional.BetterSurf.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|12x3q@3244516.com, C:\Program Files (x86)\Better-Surf\ff, In Quarantäne, [ef2d5798b5c6c175c6f03a34fa0a53ad] PUP.Optional.VideoPlayer.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|ext@VideoPlayerV3beta736.net, C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta736\ff, In Quarantäne, [38e456994239ce686724909a9e65e917] PUP.Optional.MediaPlayerAlpha.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|ext@MediaPlayerV1alpha86.net, C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha86\ff, In Quarantäne, [af6d30bf2d4e64d2143f2e0657ac39c7] PUP.Optional.InstallCore.A, HKU\S-1-5-21-3018767705-964232526-3307114488-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 0L1N1H2O1S, In Quarantäne, [011b11def685d95daeb94b02a361fe02] PUP.Optional.LookThisUp.A, HKU\S-1-5-21-3018767705-964232526-3307114488-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\LOOKTHISUP|Cohort, 20140917, In Quarantäne, [f52719d6e89348ee828e6e9650b332ce] PUP.Optional.RocketTab.A, HKU\S-1-5-21-3018767705-964232526-3307114488-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SEARCH EXTENSIONS|RocketTab, 1, In Quarantäne, [46d6856a5f1c66d09aff55affa090ef2] Registrierungsdaten: 5 PUP.Optional.SnapDo.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=1d55a34c-41e3-7bb2-c576-39761563b71c&searchtype=ds&q={searchTerms}&installDate=14/09/2013, Gut: (www.google.com), Schlecht: (hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=1d55a34c-41e3-7bb2-c576-39761563b71c&searchtype=ds&q={searchTerms}&installDate=14/09/2013),Ersetzt,[0a123bb4d9a271c5ca5eaf456d976799] PUP.Optional.Snapdo, HKU\S-1-5-21-3018767705-964232526-3307114488-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://feed.snapdo.com/?publisher=snapdoocyb&dpid=snapdoocyb&co=de&userid=1d55a34c-41e3-7bb2-c576-39761563b71c&searchtype=hp&installdate=14/09/2013, Gut: (www.google.com), Schlecht: (hxxp://feed.snapdo.com/?publisher=snapdoocyb&dpid=snapdoocyb&co=de&userid=1d55a34c-41e3-7bb2-c576-39761563b71c&searchtype=hp&installdate=14/09/2013),Ersetzt,[f428b53a0c6f40f6bbd4ca3327dd768a] PUP.Optional.Snapdo, HKU\S-1-5-21-3018767705-964232526-3307114488-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Default_Search_URL, hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=1d55a34c-41e3-7bb2-c576-39761563b71c&searchtype=ds&q={searchTerms}&installDate=14/09/2013, Gut: (www.google.com), Schlecht: (hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=1d55a34c-41e3-7bb2-c576-39761563b71c&searchtype=ds&q={searchTerms}&installDate=14/09/2013),Ersetzt,[35e7a54a2b501f17741c5f9ea46010f0] PUP.Optional.Snapdo, HKU\S-1-5-21-3018767705-964232526-3307114488-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|SearchAssistant, hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=1d55a34c-41e3-7bb2-c576-39761563b71c&searchtype=ds&q={searchTerms}&installDate=14/09/2013, Gut: (www.google.com), Schlecht: (hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=1d55a34c-41e3-7bb2-c576-39761563b71c&searchtype=ds&q={searchTerms}&installDate=14/09/2013),Ersetzt,[0c102cc3bebd2313e9a838c5986c7888] PUP.Optional.SnapDo.A, HKU\S-1-5-21-3018767705-964232526-3307114488-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=1d55a34c-41e3-7bb2-c576-39761563b71c&searchtype=ds&q={searchTerms}&installDate=14/09/2013, Gut: (www.google.com), Schlecht: (hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=1d55a34c-41e3-7bb2-c576-39761563b71c&searchtype=ds&q={searchTerms}&installDate=14/09/2013),Ersetzt,[29f3b43b7308e650e148c72df60eed13] Ordner: 22 PUP.Optional.LookThisUp.A, C:\Users\VOW\AppData\Roaming\LOOKTHISUP, In Quarantäne, [72aa8d62abd0db5b2ee1cc3883807987], PUP.Optional.SoftwareUpdater.A, C:\Users\VOW\AppData\Local\SWVUPDATER, In Quarantäne, [c15bf7f816653bfb72cc4ac59f641ae6], PUP.Optional.DealPly.A, C:\Users\VOW\AppData\Roaming\Dealply, In Quarantäne, [57c5a04fcfacce681f35805460a231cf], PUP.Optional.DealPly.A, C:\Users\VOW\AppData\Roaming\Dealply\UpdateProc, In Quarantäne, [57c5a04fcfacce681f35805460a231cf], PUP.Optional.OpenCandy, C:\Users\VOW\AppData\Roaming\OPENCANDY, In Quarantäne, [9e7e4fa0adcebc7a82084d873dc5936d], PUP.Optional.OpenCandy, C:\Users\VOW\AppData\Roaming\OPENCANDY\50CABE8F5C3F468F94448876142FFCB8, In Quarantäne, [9e7e4fa0adcebc7a82084d873dc5936d], PUP.Optional.BetterSurf, C:\Program Files (x86)\BETTER-SURF, In Quarantäne, [cf4de807d6a52f0779acb62005fdac54], PUP.Optional.BetterSurf, C:\Program Files (x86)\BETTER-SURF\ch, In Quarantäne, [cf4de807d6a52f0779acb62005fdac54], PUP.Optional.BetterSurf, C:\Program Files (x86)\BETTER-SURF\ff, In Quarantäne, [cf4de807d6a52f0779acb62005fdac54], PUP.Optional.BetterSurf, C:\Program Files (x86)\BETTER-SURF\ff\chrome, In Quarantäne, [cf4de807d6a52f0779acb62005fdac54], PUP.Optional.BetterSurf, C:\Program Files (x86)\BETTER-SURF\ff\chrome\content, In Quarantäne, [cf4de807d6a52f0779acb62005fdac54], PUP.Optional.BetterSurf, C:\Program Files (x86)\BETTER-SURF\ie, In Quarantäne, [cf4de807d6a52f0779acb62005fdac54], PUP.Optional.PriceGong.A, C:\Users\VOW\AppData\LocalLow\PRICEGONG, In Quarantäne, [61bb8c63b6c52214e424756303ff17e9], PUP.Optional.PriceGong.A, C:\Users\VOW\AppData\LocalLow\PRICEGONG\Data, In Quarantäne, [61bb8c63b6c52214e424756303ff17e9], PUP.Optional.DealPly.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\extensions\{E53A26F5-7199-4A5B-86F5-D2E86854B979}, In Quarantäne, [809c638ce695da5c19002dada260e41c], PUP.Optional.DealPly.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\extensions\{E53A26F5-7199-4A5B-86F5-D2E86854B979}\chrome, In Quarantäne, [809c638ce695da5c19002dada260e41c], PUP.Optional.DealPly.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\extensions\{E53A26F5-7199-4A5B-86F5-D2E86854B979}\chrome\content, In Quarantäne, [809c638ce695da5c19002dada260e41c], PUP.Optional.DealPly.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\extensions\{E53A26F5-7199-4A5B-86F5-D2E86854B979}\chrome\content\images, In Quarantäne, [809c638ce695da5c19002dada260e41c], PUP.Optional.DealPly.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\extensions\{E53A26F5-7199-4A5B-86F5-D2E86854B979}\defaults, In Quarantäne, [809c638ce695da5c19002dada260e41c], PUP.Optional.DealPly.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\extensions\{E53A26F5-7199-4A5B-86F5-D2E86854B979}\defaults\preferences, In Quarantäne, [809c638ce695da5c19002dada260e41c], PUP.Optional.SearchProtect.A, C:\Users\VOW\AppData\Local\SEARCHPROTECT, In Quarantäne, [f12bc926601b072f182b0ddd47bb718f], PUP.Optional.SearchProtect.A, C:\Users\VOW\AppData\Local\SEARCHPROTECT\Logs, In Quarantäne, [f12bc926601b072f182b0ddd47bb718f], Dateien: 84 PUP.Optional.GetNow.A, D:\VOW\Downloads\TECHLINE LCD-FUNKWECKER USER GUIDE PROVIDED THROUGH HANDBUCHERFURALLES.DE.EXE, In Quarantäne, [c755836c0b70cf673e01cdc12ad8e719], Trojan.MSIL.Bladabindi, C:\Users\VOW\AppData\Roaming\LookThisUp\LookThisUpUninstall.exe, In Quarantäne, [72aa22cd5e1d1d19ca57912f15ec7987], PUP.Optional.Linkury.A, C:\Users\VOW\AppData\Roaming\OpenCandy\50CABE8F5C3F468F94448876142FFCB8\Installer.exe, In Quarantäne, [a27a747b52290630a10be0dd7f85718f], PUP.Optional.LookThisUp.A, C:\Users\VOW\AppData\Roaming\LookThisUp\RootCert.cer, In Quarantäne, [72aa8d62abd0db5b2ee1cc3883807987], PUP.Optional.LookThisUp.A, C:\Users\VOW\AppData\Roaming\LookThisUp\LookThisUpUninstall.exe, In Quarantäne, [72aa8d62abd0db5b2ee1cc3883807987], PUP.Optional.LookThisUp.A, C:\Users\VOW\AppData\Roaming\LookThisUp\makecert.exe, In Quarantäne, [72aa8d62abd0db5b2ee1cc3883807987], PUP.Optional.LookThisUp.A, C:\Users\VOW\AppData\Roaming\LookThisUp\storage.bin, In Quarantäne, [72aa8d62abd0db5b2ee1cc3883807987], PUP.Optional.RocketTab.A, C:\Windows\System32\Tasks\ROCKETTAB, In Quarantäne, [ce4e26c9bdbee84e980438cca55eaa56], PUP.Optional.RocketTab.A, C:\Windows\System32\Tasks\ROCKETTAB UPDATE TASK, In Quarantäne, [bd5f8c63e398dc5a6c30d034ee151ce4], PUP.Optional.SoftwareUpdater.A, C:\Users\VOW\AppData\Local\SwvUpdater\Updater.xml, In Quarantäne, [c15bf7f816653bfb72cc4ac59f641ae6], PUP.Optional.SoftwareUpdater.A, C:\Users\VOW\AppData\Local\SwvUpdater\status.cfg, In Quarantäne, [c15bf7f816653bfb72cc4ac59f641ae6], PUP.Optional.Superfish.A, C:\Users\VOW\AppData\Local\Google\Chrome\User Data\Default\Local Storage\HTTP_WWW.SUPERFISH.COM_0.LOCALSTORAGE, In Quarantäne, [d04c1ed190eb56e08f8930efba4949b7], PUP.Optional.Superfish.A, C:\Users\VOW\AppData\Local\Google\Chrome\User Data\Default\Local Storage\HTTP_WWW.SUPERFISH.COM_0.LOCALSTORAGE-JOURNAL, In Quarantäne, [e03cb43b6615c57127f14fd04ab99b65], PUP.Optional.Conduit.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\searchplugins\conduit.xml, In Quarantäne, [8f8d509fa1da0234a9abc06c966dfb05], PUP.Optional.WebSearch.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\searchplugins\WEB SEARCH.XML, In Quarantäne, [fb213fb0b4c7c76f48ec3df0966db54b], PUP.Optional.DealPly.A, C:\Users\VOW\AppData\Roaming\Dealply\UpdateProc\config.dat, In Quarantäne, [57c5a04fcfacce681f35805460a231cf], PUP.Optional.DealPly.A, C:\Users\VOW\AppData\Roaming\Dealply\UpdateProc\STTL.DAT, In Quarantäne, [57c5a04fcfacce681f35805460a231cf], PUP.Optional.DealPly.A, C:\Users\VOW\AppData\Roaming\Dealply\UpdateProc\TTL.DAT, In Quarantäne, [57c5a04fcfacce681f35805460a231cf], PUP.Optional.BetterSurf, C:\Program Files (x86)\Better-Surf\ff\Better-Surf.xpi, In Quarantäne, [cf4de807d6a52f0779acb62005fdac54], PUP.Optional.BetterSurf, C:\Program Files (x86)\Better-Surf\ff\build.cmd, In Quarantäne, [cf4de807d6a52f0779acb62005fdac54], PUP.Optional.BetterSurf, C:\Program Files (x86)\Better-Surf\ff\chrome.manifest, In Quarantäne, [cf4de807d6a52f0779acb62005fdac54], PUP.Optional.BetterSurf, C:\Program Files (x86)\Better-Surf\ff\install.rdf, In Quarantäne, [cf4de807d6a52f0779acb62005fdac54], PUP.Optional.BetterSurf, C:\Program Files (x86)\Better-Surf\ff\chrome\content\firefox.js, In Quarantäne, [cf4de807d6a52f0779acb62005fdac54], PUP.Optional.BetterSurf, C:\Program Files (x86)\Better-Surf\ff\chrome\content\overlay.xul, In Quarantäne, [cf4de807d6a52f0779acb62005fdac54], PUP.Optional.PriceGong.A, C:\Users\VOW\AppData\LocalLow\PriceGong\Data\1.xml, In Quarantäne, [61bb8c63b6c52214e424756303ff17e9], PUP.Optional.PriceGong.A, C:\Users\VOW\AppData\LocalLow\PriceGong\Data\a.xml, In Quarantäne, [61bb8c63b6c52214e424756303ff17e9], PUP.Optional.PriceGong.A, C:\Users\VOW\AppData\LocalLow\PriceGong\Data\b.xml, In Quarantäne, [61bb8c63b6c52214e424756303ff17e9], PUP.Optional.PriceGong.A, C:\Users\VOW\AppData\LocalLow\PriceGong\Data\c.xml, In Quarantäne, [61bb8c63b6c52214e424756303ff17e9], PUP.Optional.PriceGong.A, C:\Users\VOW\AppData\LocalLow\PriceGong\Data\d.xml, In Quarantäne, [61bb8c63b6c52214e424756303ff17e9], PUP.Optional.PriceGong.A, C:\Users\VOW\AppData\LocalLow\PriceGong\Data\e.xml, In Quarantäne, [61bb8c63b6c52214e424756303ff17e9], PUP.Optional.PriceGong.A, C:\Users\VOW\AppData\LocalLow\PriceGong\Data\f.xml, In Quarantäne, [61bb8c63b6c52214e424756303ff17e9], PUP.Optional.PriceGong.A, C:\Users\VOW\AppData\LocalLow\PriceGong\Data\g.xml, In Quarantäne, [61bb8c63b6c52214e424756303ff17e9], PUP.Optional.PriceGong.A, C:\Users\VOW\AppData\LocalLow\PriceGong\Data\h.xml, In Quarantäne, [61bb8c63b6c52214e424756303ff17e9], PUP.Optional.PriceGong.A, C:\Users\VOW\AppData\LocalLow\PriceGong\Data\i.xml, In Quarantäne, [61bb8c63b6c52214e424756303ff17e9], PUP.Optional.PriceGong.A, C:\Users\VOW\AppData\LocalLow\PriceGong\Data\J.xml, In Quarantäne, [61bb8c63b6c52214e424756303ff17e9], PUP.Optional.PriceGong.A, C:\Users\VOW\AppData\LocalLow\PriceGong\Data\k.xml, In Quarantäne, [61bb8c63b6c52214e424756303ff17e9], PUP.Optional.PriceGong.A, C:\Users\VOW\AppData\LocalLow\PriceGong\Data\l.xml, In Quarantäne, [61bb8c63b6c52214e424756303ff17e9], PUP.Optional.PriceGong.A, C:\Users\VOW\AppData\LocalLow\PriceGong\Data\m.xml, In Quarantäne, [61bb8c63b6c52214e424756303ff17e9], PUP.Optional.PriceGong.A, C:\Users\VOW\AppData\LocalLow\PriceGong\Data\mru.xml, In Quarantäne, [61bb8c63b6c52214e424756303ff17e9], PUP.Optional.PriceGong.A, C:\Users\VOW\AppData\LocalLow\PriceGong\Data\n.xml, In Quarantäne, [61bb8c63b6c52214e424756303ff17e9], PUP.Optional.PriceGong.A, C:\Users\VOW\AppData\LocalLow\PriceGong\Data\o.xml, In Quarantäne, [61bb8c63b6c52214e424756303ff17e9], PUP.Optional.PriceGong.A, C:\Users\VOW\AppData\LocalLow\PriceGong\Data\p.xml, In Quarantäne, [61bb8c63b6c52214e424756303ff17e9], PUP.Optional.PriceGong.A, C:\Users\VOW\AppData\LocalLow\PriceGong\Data\q.xml, In Quarantäne, [61bb8c63b6c52214e424756303ff17e9], PUP.Optional.PriceGong.A, C:\Users\VOW\AppData\LocalLow\PriceGong\Data\r.xml, In Quarantäne, [61bb8c63b6c52214e424756303ff17e9], PUP.Optional.PriceGong.A, C:\Users\VOW\AppData\LocalLow\PriceGong\Data\s.xml, In Quarantäne, [61bb8c63b6c52214e424756303ff17e9], PUP.Optional.PriceGong.A, C:\Users\VOW\AppData\LocalLow\PriceGong\Data\t.xml, In Quarantäne, [61bb8c63b6c52214e424756303ff17e9], PUP.Optional.PriceGong.A, C:\Users\VOW\AppData\LocalLow\PriceGong\Data\u.xml, In Quarantäne, [61bb8c63b6c52214e424756303ff17e9], PUP.Optional.PriceGong.A, C:\Users\VOW\AppData\LocalLow\PriceGong\Data\v.xml, In Quarantäne, [61bb8c63b6c52214e424756303ff17e9], PUP.Optional.PriceGong.A, C:\Users\VOW\AppData\LocalLow\PriceGong\Data\w.xml, In Quarantäne, [61bb8c63b6c52214e424756303ff17e9], PUP.Optional.PriceGong.A, C:\Users\VOW\AppData\LocalLow\PriceGong\Data\x.xml, In Quarantäne, [61bb8c63b6c52214e424756303ff17e9], PUP.Optional.PriceGong.A, C:\Users\VOW\AppData\LocalLow\PriceGong\Data\y.xml, In Quarantäne, [61bb8c63b6c52214e424756303ff17e9], PUP.Optional.PriceGong.A, C:\Users\VOW\AppData\LocalLow\PriceGong\Data\z.xml, In Quarantäne, [61bb8c63b6c52214e424756303ff17e9], PUP.Optional.DealPly.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\extensions\{e53a26f5-7199-4a5b-86f5-d2e86854b979}\install.rdf, In Quarantäne, [809c638ce695da5c19002dada260e41c], PUP.Optional.DealPly.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\extensions\{e53a26f5-7199-4a5b-86f5-d2e86854b979}\chrome\content\images\icon32.png, In Quarantäne, [809c638ce695da5c19002dada260e41c], PUP.Optional.DealPly.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\extensions\{e53a26f5-7199-4a5b-86f5-d2e86854b979}\defaults\preferences\defaults.js, In Quarantäne, [809c638ce695da5c19002dada260e41c], PUP.Optional.Snapdo.A, C:\Users\VOW\AppData\Local\Google\Chrome\User Data\Default\Preferences, Gut: (), Schlecht: ( "homepage": "hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=1d55a34c-41e3-7bb2-c576-39761563b71c&searchtype=hp&installDate=14/09/2013",), Ersetzt,[5dbf915e93e80630bf0fff319372ab55] PUP.Optional.Snapdo.A, C:\Users\VOW\AppData\Local\Google\Chrome\User Data\Default\Preferences, Gut: (), Schlecht: ( "startup_urls": [ "hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=1d55a34c-41e3-7bb2-c576-39761563b71c&searchtype=hp&installDate=14/09/2013", "hxxp://www.franken-trekking.de/" ],), Ersetzt,[93892ac5a2d9f442a95c3ef4838202fe] PUP.Optional.Delta.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.admin", false);), Ersetzt,[9a82f2fd84f781b54df2121f0ef7b34d] PUP.Optional.Delta.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.aflt", "babsst");), Ersetzt,[34e8816e5e1da096023df0415baacf31] PUP.Optional.Delta.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");), Ersetzt,[08143db2106bf244f8476cc50afb7f81] PUP.Optional.Delta.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.autoRvrt", "false");), Ersetzt,[23f902eddc9fd06642fdd65b8184de22] PUP.Optional.Delta.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.dfltLng", "de");), Ersetzt,[6eae2bc4611aa09651eed0619075619f] PUP.Optional.Delta.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.excTlbr", false);), Ersetzt,[6cb0b13e463538fe40ffe44da461b749] PUP.Optional.Delta.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.ffxUnstlRst", true);), Ersetzt,[96867b74106b8ea861dea58cf70ef907] PUP.Optional.Delta.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.id", "f69128b0000000000000bc5ff4492ea1");), Ersetzt,[60bce20d0b70999d88b78ba610f5a060] PUP.Optional.Delta.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.instlDay", "15940");), Ersetzt,[ed2fe6097ffcf73f48f7a190dd289c64] PUP.Optional.Delta.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.instlRef", "sst");), Ersetzt,[e339e30ccdae96a01926161b4abb936d] PUP.Optional.Delta.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.newTab", false);), Ersetzt,[b765da15b5c6f73f2718bd748283b24e] PUP.Optional.Delta.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.prdct", "delta");), Ersetzt,[ac709758780390a676c98da4b154a65a] PUP.Optional.Delta.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.prtnrId", "delta");), Ersetzt,[b765727de99277bfa19e46ebe124fd03] PUP.Optional.Delta.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.rvrt", "false");), Ersetzt,[5cc037b8b9c285b11a25df5250b5e61a] PUP.Optional.Delta.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.smplGrp", "none");), Ersetzt,[c55715da2259ca6c94ab8da42fd635cb] PUP.Optional.Delta.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.tlbrId", "base");), Ersetzt,[809c09e6ef8c96a0df604ae7a3626799] PUP.Optional.Delta.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.tlbrSrchUrl", "");), Ersetzt,[83990ee1007b65d1053a9b96b253d729] PUP.Optional.Delta.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.vrsn", "1.8.24.6");), Ersetzt,[3ce002ed2655ac8a073871c0c54008f8] PUP.Optional.Delta.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.vrsnTs", "1.8.24.617:18:23");), Ersetzt,[af6dc42b4f2c181e0936d45d33d2de22] PUP.Optional.Delta.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.vrsni", "1.8.24.6");), Ersetzt,[190316d99cdfe74f2916b27f976ead53] PUP.Optional.Delta.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta_i.babExt", "");), Ersetzt,[6eae737c48338caa88b758d9e2239769] PUP.Optional.Delta.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta_i.babTrack", "affID=121151&tsp=4983");), Ersetzt,[c5578867027996a039066ec30104d12f] PUP.Optional.Delta.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta_i.srcExt", "ss");), Ersetzt,[78a4f6f9037839fd8db291a0fe0720e0] PUP.Optional.Conduit.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.startup.homepage", "hxxp://search.conduit.com/?ctid=CT2475029&SearchSource=13");), Ersetzt,[1804c32cc6b502340746e849cb3a03fd] PUP.Optional.Conduit.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2475029&SearchSource=3&q={searchTerms}");), Ersetzt,[1606816e32495bdb4e4c3cf5e81da957] PUP.Optional.Conduit.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\prefs.js, Gut: (), Schlecht: (user_pref("CT2269050.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&q=");), Ersetzt,[c656f8f754276ccafc9fa58ce71e57a9] PUP.Optional.Conduit.A, C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\prefs.js, Gut: (), Schlecht: (user_pref("CT2475029.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2475029&q=");), Ersetzt,[c15b25ca2259c76f3c5f969bd92c46ba] Physische Sektoren: 0 (No malicious items detected) (end) AdwCleaner: Code:
ATTFilter # AdwCleaner v3.310 - Bericht erstellt am 18/09/2014 um 17:55:59
# Aktualisiert 12/09/2014 von Xplode
# Betriebssystem : Windows 7 Ultimate Service Pack 1 (64 bits)
# Benutzername : VOW - VOW-PC
# Gestartet von : C:\Users\VOW\Desktop\AdwCleaner_3.310.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\apn
Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\ProgramData\DriverCure
Ordner Gelöscht : C:\ProgramData\simplitec
Ordner Gelöscht : C:\ProgramData\Tarma Installer
Ordner Gelöscht : C:\ProgramData\Trymedia
Ordner Gelöscht : C:\ProgramData\Uniblue
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InetStat
Ordner Gelöscht : C:\Windows\assembly\GAC_MSIL\QuickStoresToolbar
Ordner Gelöscht : C:\Users\VOW\AppData\Local\eSupport.com
Ordner Gelöscht : C:\Users\VOW\AppData\Local\FileTypeAssistant
Ordner Gelöscht : C:\Users\VOW\AppData\Local\RocketTab
Ordner Gelöscht : C:\Users\VOW\AppData\Roaming\DriverCure
Ordner Gelöscht : C:\Users\VOW\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\VOW\AppData\Roaming\InetStat
Ordner Gelöscht : C:\Users\VOW\AppData\Roaming\simplitec
Ordner Gelöscht : C:\Users\VOW\AppData\Roaming\widestream
Ordner Gelöscht : C:\Users\VOW\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\InetStat
Ordner Gelöscht : D:\VOW\Documents\widestream
Ordner Gelöscht : C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\Conduit
Ordner Gelöscht : C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\ConduitEngine
Ordner Gelöscht : C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\CT2269050
Ordner Gelöscht : C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\CT2475029
Ordner Gelöscht : C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\Extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
Ordner Gelöscht : C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\Extensions\{ACAA314B-EEBA-48E4-AD47-84E31C44796C}
Ordner Gelöscht : C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\Extensions\engine@conduit.com
Ordner Gelöscht : C:\Program Files (x86)\Mozilla Firefox\Extensions\quickstores@quickstores.de
Ordner Gelöscht : C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\Extensions\vshare@toolbar
Ordner Gelöscht : C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\Extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
Datei Gelöscht : C:\Windows\System32\roboot64.exe
Datei Gelöscht : C:\Users\VOW\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\eBay.lnk
Datei Gelöscht : C:\Users\VOW\AppData\Roaming\Microsoft\Windows\Start Menu\eBay.lnk
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\.autoreg
Datei Gelöscht : C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\searchplugins\Askcom.xml
Datei Gelöscht : C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\user.js
***** [ Tasks ] *****
Task Gelöscht : DealPlyUpdate
Task Gelöscht : RocketTab Update Task
Task Gelöscht : RocketTab
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk
Schlüssel Gelöscht : HKCU\Software\Classes\Applications\inetstat.exe
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [InetStat]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\NCTAudioCDGrabber2.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Conduit.Engine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\URLSearchHook.ToolbarURLSearchHook
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\URLSearchHook.ToolbarURLSearchHook.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\driverscanner_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\driverscanner_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Widestream6-setup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Widestream6-setup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\d0d7d8b634be41
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2269050
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2475029
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader66221_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader66221_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_drivereasy_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_drivereasy_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_orangenote_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_orangenote_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_slimdrivers_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_slimdrivers_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_stickies (1)_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_stickies (1)_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_stickies_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_stickies_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_tvuplayer[1]_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_tvuplayer[1]_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5EB0259D-AB79-4AE6-A6E6-24FFE21C3DA4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CADAF6BE-BF50-4669-8BFD-C27BD4E6181B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2BEF239C-752E-4001-8048-F256E0D8CD93}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{BEAA0C04-ED15-4C17-800B-28716025A4E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9CF699CA-2174-4ED8-BEC1-BA82095EDCE0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3B7599DF-3D5D-4EF5-BF51-9C2EDA788E83}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3B7599DF-3D5D-4EF5-BF51-9C2EDA788E83}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7F1796B2-BEC6-427B-B734-F9C75ED94A80}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7F1796B2-BEC6-427B-B734-F9C75ED94A80}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{A1E75A0E-4397-4BA8-BB50-E19FB66890F4}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1231839B-064E-4788-B865-465A1B5266FD}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{20ED5AF7-D9C4-409E-9EB3-D2A44A77FB6D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2BEF239C-752E-4001-8048-F256E0D8CD93}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2DAC2231-CC35-482B-97C5-CED1D4185080}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3F1CD84C-04A3-4EA0-9EA1-7D134FD66C82}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3F83A9CA-B5F0-44EC-9357-35BB3E84B07F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{47E520EA-CAD2-4F51-8F30-613B3A1C33EB}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{57C91446-8D81-4156-A70E-624551442DE9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{70AFB7B2-9FB5-4A70-905B-0E9576142E1D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{7AD65FD1-79E0-406D-B03C-DD7C14726D69}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{97DD820D-2E20-40AD-B01E-6730B2FCE630}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B177446D-54A4-4869-BABC-8566110B4BE0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D54C859C-6066-4F31-8FE0-2AAEDCAE67D7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D9D1DFC5-502D-43E4-B1BB-4D0B7841489A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E0B07188-A528-4F9E-B2F7-C7FDE8680AE4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F05B12E1-ADE8-4485-B45B-898748B53C37}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Bitberry
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\Delta
Schlüssel Gelöscht : HKCU\Software\InetStat
Schlüssel Gelöscht : HKCU\Software\Myfree Codec
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\ParetoLogic
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\Tune
Schlüssel Gelöscht : HKCU\Software\WideStream
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\adawarebp
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\lyrixeeker
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\MyAshampoo\toolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : HKLM\SOFTWARE\MediaPlayerV1
Schlüssel Gelöscht : HKLM\SOFTWARE\Myfree Codec
Schlüssel Gelöscht : HKLM\SOFTWARE\ParetoLogic
Schlüssel Gelöscht : HKLM\SOFTWARE\simplitec
Schlüssel Gelöscht : HKLM\SOFTWARE\systweak
Schlüssel Gelöscht : HKLM\SOFTWARE\Tune
Schlüssel Gelöscht : HKLM\SOFTWARE\Uniblue
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\InetStat
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17280
-\\ Mozilla Firefox v3.5.7 (de)
[ Datei : C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\prefs.js ]
Zeile gelöscht : user_pref("CT2269050..clientLogIsEnabled", false);
Zeile gelöscht : user_pref("CT2269050..clientLogServiceUrl", "hxxp://clientlog.users.tbccint.com/ClientDiagnostics.asmx/ReportDiagnosticsEvent");
Zeile gelöscht : user_pref("CT2269050..uninstallLogServiceUrl", "hxxp://uninstall.users.tbccint.com/Uninstall.asmx/RegisterToolbarUninstallation");
Zeile gelöscht : user_pref("CT2269050.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/default.aspx");
Zeile gelöscht : user_pref("CT2269050.CTID", "CT2269050");
Zeile gelöscht : user_pref("CT2269050.CurrentServerDate", "8-8-2014");
Zeile gelöscht : user_pref("CT2269050.DialogsAlignMode", "LTR");
Zeile gelöscht : user_pref("CT2269050.DownloadReferralCookieData", "");
Zeile gelöscht : user_pref("CT2269050.EMailNotifierPollDate", "Fri Aug 08 2014 19:35:53 GMT+0200");
Zeile gelöscht : user_pref("CT2269050.FirstServerDate", "29-10-2010");
Zeile gelöscht : user_pref("CT2269050.FirstTime", true);
Zeile gelöscht : user_pref("CT2269050.FirstTimeFF3", true);
Zeile gelöscht : user_pref("CT2269050.FirstTimeSettingsDone", true);
Zeile gelöscht : user_pref("CT2269050.FixPageNotFoundErrors", true);
Zeile gelöscht : user_pref("CT2269050.GroupingServerCheckInterval", 1440);
Zeile gelöscht : user_pref("CT2269050.GroupingServiceUrl", "hxxp://grouping.tbccint.com/");
Zeile gelöscht : user_pref("CT2269050.Initialize", true);
Zeile gelöscht : user_pref("CT2269050.InitializeCommonPrefs", true);
Zeile gelöscht : user_pref("CT2269050.InstallationAndCookieDataSentCount", 2);
Zeile gelöscht : user_pref("CT2269050.InstallationType", "UnknownIntegration");
Zeile gelöscht : user_pref("CT2269050.InstalledDate", "Fri Oct 29 2010 21:23:15 GMT+0200");
Zeile gelöscht : user_pref("CT2269050.InvalidateCache", false);
Zeile gelöscht : user_pref("CT2269050.IsGrouping", false);
Zeile gelöscht : user_pref("CT2269050.IsMulticommunity", false);
Zeile gelöscht : user_pref("CT2269050.IsOpenThankYouPage", false);
Zeile gelöscht : user_pref("CT2269050.IsOpenUninstallPage", false);
Zeile gelöscht : user_pref("CT2269050.LanguagePackLastCheckTime", "Fri Aug 08 2014 19:35:54 GMT+0200");
Zeile gelöscht : user_pref("CT2269050.LanguagePackReloadIntervalMM", 1440);
Zeile gelöscht : user_pref("CT2269050.LanguagePackServiceUrl", "hxxp://translation.users.tbccint.com/Translation.ashx");
Zeile gelöscht : user_pref("CT2269050.LastLogin_2.7.0.14", "Fri Oct 29 2010 21:23:16 GMT+0200");
Zeile gelöscht : user_pref("CT2269050.LastLogin_3.2.5.2", "Fri Aug 08 2014 19:35:54 GMT+0200");
Zeile gelöscht : user_pref("CT2269050.LatestVersion", "3.20.0.4");
Zeile gelöscht : user_pref("CT2269050.Locale", "en");
Zeile gelöscht : user_pref("CT2269050.LoginCache", 4);
Zeile gelöscht : user_pref("CT2269050.MCDetectTooltipHeight", "83");
Zeile gelöscht : user_pref("CT2269050.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Zeile gelöscht : user_pref("CT2269050.MCDetectTooltipWidth", "295");
Zeile gelöscht : user_pref("CT2269050.RadioIsPodcast", false);
Zeile gelöscht : user_pref("CT2269050.RadioLastCheckTime", "Fri Aug 08 2014 19:35:54 GMT+0200");
Zeile gelöscht : user_pref("CT2269050.RadioLastUpdateIPServer", "3");
Zeile gelöscht : user_pref("CT2269050.RadioLastUpdateServer", "129132338014870000");
Zeile gelöscht : user_pref("CT2269050.RadioMediaID", "12473383");
Zeile gelöscht : user_pref("CT2269050.RadioMediaType", "Media Player");
Zeile gelöscht : user_pref("CT2269050.RadioMenuSelectedID", "EBRadioMenu_CT226905012473383");
Zeile gelöscht : user_pref("CT2269050.RadioStationName", "Hotmix%20108");
Zeile gelöscht : user_pref("CT2269050.RadioStationURL", "hxxp://67.202.67.18:8082");
Zeile gelöscht : user_pref("CT2269050.SavedHomepage", "resource:/browserconfig.properties");
Zeile gelöscht : user_pref("CT2269050.SearchEngine", "Search||hxxp://search.conduit.com/Results.aspx?q=UCM_SEARCH_TERM&ctid=CT2269050&octid=EB_ORIGINAL_CTID&SearchSource=1&CUI=SB_CUI&UM=UM_ID");
Zeile gelöscht : user_pref("CT2269050.SearchFromAddressBarIsInit", true);
Zeile gelöscht : user_pref("CT2269050.SearchInNewTabEnabled", true);
Zeile gelöscht : user_pref("CT2269050.SearchInNewTabIntervalMM", 1440);
Zeile gelöscht : user_pref("CT2269050.SearchInNewTabLastCheckTime", "Fri Aug 08 2014 19:35:54 GMT+0200");
Zeile gelöscht : user_pref("CT2269050.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_TOOLBAR_ID&UM=UM_ID");
Zeile gelöscht : user_pref("CT2269050.SearchInNewTabUsageUrl", "hxxp://usage.hosting.toolbar.conduit-services.com/usage.ashx?ctid=EB_TOOLBAR_ID");
Zeile gelöscht : user_pref("CT2269050.SettingsCheckIntervalMin", 120);
Zeile gelöscht : user_pref("CT2269050.SettingsLastCheckTime", "Fri Aug 08 2014 19:35:53 GMT+0200");
Zeile gelöscht : user_pref("CT2269050.SettingsLastUpdate", "1405919504");
Zeile gelöscht : user_pref("CT2269050.ThirdPartyComponentsInterval", 504);
Zeile gelöscht : user_pref("CT2269050.ThirdPartyComponentsLastCheck", "Fri Aug 08 2014 19:35:53 GMT+0200");
Zeile gelöscht : user_pref("CT2269050.ThirdPartyComponentsLastUpdate", "1331805997");
Zeile gelöscht : user_pref("CT2269050.TrusteLinkUrl", "hxxp://trust.cpccint.com");
Zeile gelöscht : user_pref("CT2269050.UserID", "UN11829183264801135");
Zeile gelöscht : user_pref("CT2269050.ValidationData_Toolbar", 2);
Zeile gelöscht : user_pref("CT2269050.WeatherNetwork", "");
Zeile gelöscht : user_pref("CT2269050.WeatherPollDate", "Fri Aug 08 2014 19:35:55 GMT+0200");
Zeile gelöscht : user_pref("CT2269050.WeatherUnit", "C");
Zeile gelöscht : user_pref("CT2269050.alertChannelId", "666138");
Zeile gelöscht : user_pref("CT2269050.backendstorage.mam_gk_appsconfig", "7B2241707073436F6E66696775726174696F6E223A5B7B226964223A22436C61726974795F416374697665222C2275726C223A22687474703A2F2F73746F726167652E636F6E647[...]
Zeile gelöscht : user_pref("CT2269050.backendstorage.mam_gk_appsdefaultenabled", "66616C7365");
Zeile gelöscht : user_pref("CT2269050.backendstorage.mam_gk_appstate_clarity_active", "6F6E");
Zeile gelöscht : user_pref("CT2269050.backendstorage.mam_gk_appstate_couponbuddy", "6F6E");
Zeile gelöscht : user_pref("CT2269050.backendstorage.mam_gk_appstate_easytobook", "6F6E");
Zeile gelöscht : user_pref("CT2269050.backendstorage.mam_gk_appstate_easytobook_targeted", "6F6E");
Zeile gelöscht : user_pref("CT2269050.backendstorage.mam_gk_appstate_pricegong", "6F6E");
Zeile gelöscht : user_pref("CT2269050.backendstorage.mam_gk_appstate_windowshopper", "6F6E");
Zeile gelöscht : user_pref("CT2269050.backendstorage.mam_gk_appstatereporttime", "31343037353139333538313934");
Zeile gelöscht : user_pref("CT2269050.backendstorage.mam_gk_calledsetupservice", "31");
Zeile gelöscht : user_pref("CT2269050.backendstorage.mam_gk_currentversion", "312E31332E302E3137");
Zeile gelöscht : user_pref("CT2269050.backendstorage.mam_gk_eventscache", "7B2265333962343566642D376231392D343933662D393138382D663437303637373038353434223A7B22746F706963223A2273656E645573616765222C2264617461223A7B2263[...]
Zeile gelöscht : user_pref("CT2269050.backendstorage.mam_gk_existingusersrecoverydone", "31");
Zeile gelöscht : user_pref("CT2269050.backendstorage.mam_gk_first_time", "31");
Zeile gelöscht : user_pref("CT2269050.backendstorage.mam_gk_gadgetopen", "30");
Zeile gelöscht : user_pref("CT2269050.backendstorage.mam_gk_lastlogintime", "31343037353139333538373330");
Zeile gelöscht : user_pref("CT2269050.backendstorage.mam_gk_localization", "7B226469616C6F674F4B223A7B2254657874223A224F4B227D2C22646D626F7831223A7B2254657874223A22416E6765626F745C7530303061646573205461676573227D2C226[...]
Zeile gelöscht : user_pref("CT2269050.backendstorage.mam_gk_mamenabled", "66616C7365");
Zeile gelöscht : user_pref("CT2269050.backendstorage.mam_gk_new_welcome_experience", "31");
Zeile gelöscht : user_pref("CT2269050.backendstorage.mam_gk_settings1.13.0.17", "7B22537461747573223A22737563636565646564222C2244617461223A7B2263757272656E7444617465223A223230313430383038222C22696E74657276616C223A3234[...]
Zeile gelöscht : user_pref("CT2269050.backendstorage.mam_gk_showwelcomegadget", "74727565");
Zeile gelöscht : user_pref("CT2269050.backendstorage.mam_gk_stamp", "313130315F30");
Zeile gelöscht : user_pref("CT2269050.backendstorage.mam_gk_user_approval_interacted", "31");
Zeile gelöscht : user_pref("CT2269050.backendstorage.mam_gk_userborndate", "4E2F41");
Zeile gelöscht : user_pref("CT2269050.backendstorage.mam_gk_userid", "36313438623931362D396233352D343634612D613339392D663036626161386365613337");
Zeile gelöscht : user_pref("CT2269050.backendstorage.mam_gk_welcomedialogmode", "30");
Zeile gelöscht : user_pref("CT2269050.backendstorage.searchappstate", "32");
Zeile gelöscht : user_pref("CT2269050.backendstorage.searchapptracking", "31");
Zeile gelöscht : user_pref("CT2269050.clientLogIsEnabled", true);
Zeile gelöscht : user_pref("CT2269050.clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asmx/ReportDiagnosticsEvent");
Zeile gelöscht : user_pref("CT2269050.myStuffEnabled", true);
Zeile gelöscht : user_pref("CT2269050.myStuffPublihserMinWidth", 400);
Zeile gelöscht : user_pref("CT2269050.myStuffSearchUrl", "hxxp://appstrm.com/search?q=SEARCH_TERM&SearchSourceOrigin=29&ctid=EB_TOOLBAR_ID&octid=EB_ORIGINAL_CTID");
Zeile gelöscht : user_pref("CT2269050.myStuffServiceIntervalMM", 1440);
Zeile gelöscht : user_pref("CT2269050.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?ComponentId=EB_MY_STUFF_INSTANCE_GUID&lut=EB_MY_STUFF_LUT");
Zeile gelöscht : user_pref("CT2269050.toolbarAppMetaDataLastCheckTime", "Fri Aug 08 2014 19:35:54 GMT+0200");
Zeile gelöscht : user_pref("CT2269050.toolbarContextMenuLastCheckTime", "Fri Aug 08 2014 19:35:54 GMT+0200");
Zeile gelöscht : user_pref("CT2269050.uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/RegisterToolbarUninstallation");
Zeile gelöscht : user_pref("CT2475029..clientLogIsEnabled", false);
Zeile gelöscht : user_pref("CT2475029..clientLogServiceUrl", "hxxp://clientlog.users.tbccint.com/ClientDiagnostics.asmx/ReportDiagnosticsEvent");
Zeile gelöscht : user_pref("CT2475029..uninstallLogServiceUrl", "hxxp://uninstall.users.tbccint.com/Uninstall.asmx/RegisterToolbarUninstallation");
Zeile gelöscht : user_pref("CT2475029.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/default.aspx");
Zeile gelöscht : user_pref("CT2475029.CT2481020.CommunityChanged", true);
Zeile gelöscht : user_pref("CT2475029.CT2481024.CommunityChanged", true);
Zeile gelöscht : user_pref("CT2475029.CT2481025.CommunityChanged", true);
Zeile gelöscht : user_pref("CT2475029.CT2481029.CommunityChanged", true);
Zeile gelöscht : user_pref("CT2475029.CT2481031.CommunityChanged", true);
Zeile gelöscht : user_pref("CT2475029.CT2481032.CommunityChanged", true);
Zeile gelöscht : user_pref("CT2475029.CT2481033.CommunityChanged", true);
Zeile gelöscht : user_pref("CT2475029.CT2481034.CommunityChanged", true);
Zeile gelöscht : user_pref("CT2475029.CT2481035.CommunityChanged", true);
Zeile gelöscht : user_pref("CT2475029.CT2481037.CommunityChanged", true);
Zeile gelöscht : user_pref("CT2475029.CTID", "ct2481020");
Zeile gelöscht : user_pref("CT2475029.CommunitiesChangesLastCheckTime", "Fri Aug 08 2014 19:35:54 GMT+0200");
Zeile gelöscht : user_pref("CT2475029.CommunityChanged", true);
Zeile gelöscht : user_pref("CT2475029.CurrentServerDate", "8-8-2014");
Zeile gelöscht : user_pref("CT2475029.DialogsAlignMode", "LTR");
Zeile gelöscht : user_pref("CT2475029.DownloadDomainsCheckInterval", "168");
Zeile gelöscht : user_pref("CT2475029.DownloadDomainsListLastCheckTime", "Fri Aug 08 2014 19:35:54 GMT+0200");
Zeile gelöscht : user_pref("CT2475029.DownloadDomainsListLastServerUpdateTime", "1201069983");
Zeile gelöscht : user_pref("CT2475029.DownloadReferralCookieData", "");
Zeile gelöscht : user_pref("CT2475029.FeedPollDate129132307482029379", "Fri Aug 08 2014 19:35:54 GMT+0200");
Zeile gelöscht : user_pref("CT2475029.FeedPollDate129132307482029381", "Fri Aug 08 2014 19:35:55 GMT+0200");
Zeile gelöscht : user_pref("CT2475029.FeedPollDate129132307482029382", "Fri Aug 08 2014 19:35:55 GMT+0200");
Zeile gelöscht : user_pref("CT2475029.FeedPollDate129133095459686870", "Fri Aug 08 2014 19:35:54 GMT+0200");
Zeile gelöscht : user_pref("CT2475029.FeedPollDate129133095459686871", "Fri Aug 08 2014 19:35:55 GMT+0200");
Zeile gelöscht : user_pref("CT2475029.FeedPollDate129137437659687146", "Fri Aug 08 2014 19:35:54 GMT+0200");
Zeile gelöscht : user_pref("CT2475029.FeedPollDate129137437659687147", "Fri Aug 08 2014 19:35:54 GMT+0200");
Zeile gelöscht : user_pref("CT2475029.FeedPollDate129137437659687148", "Fri Aug 08 2014 19:35:54 GMT+0200");
Zeile gelöscht : user_pref("CT2475029.FirstServerDate", "8-8-2014");
Zeile gelöscht : user_pref("CT2475029.FirstTime", true);
Zeile gelöscht : user_pref("CT2475029.FirstTimeFF3", true);
Zeile gelöscht : user_pref("CT2475029.FixPageNotFoundErrors", true);
Zeile gelöscht : user_pref("CT2475029.GroupingLastCheckTime", "Fri Aug 08 2014 19:35:54 GMT+0200");
Zeile gelöscht : user_pref("CT2475029.GroupingLastErrorCode", "");
Zeile gelöscht : user_pref("CT2475029.GroupingLastResponse", true);
Zeile gelöscht : user_pref("CT2475029.GroupingLastServerUpdateTime", "130492722284630000");
Zeile gelöscht : user_pref("CT2475029.GroupingServerCheckInterval", 1440);
Zeile gelöscht : user_pref("CT2475029.GroupingServiceUrl", "hxxp://grouping.tbccint.com/");
Zeile gelöscht : user_pref("CT2475029.HasUserGlobalKeys", true);
Zeile gelöscht : user_pref("CT2475029.Initialize", true);
Zeile gelöscht : user_pref("CT2475029.InitializeCommonPrefs", true);
Zeile gelöscht : user_pref("CT2475029.InstallationAndCookieDataSentCount", 3);
Zeile gelöscht : user_pref("CT2475029.InstallationId", "MyAshampoo.exe");
Zeile gelöscht : user_pref("CT2475029.InstallationType", "ConduitIntegration");
Zeile gelöscht : user_pref("CT2475029.InstalledDate", "Fri Aug 08 2014 19:35:54 GMT+0200");
Zeile gelöscht : user_pref("CT2475029.IsGrouping", true);
Zeile gelöscht : user_pref("CT2475029.IsMulticommunity", true);
Zeile gelöscht : user_pref("CT2475029.IsOpenThankYouPage", false);
Zeile gelöscht : user_pref("CT2475029.IsOpenUninstallPage", true);
Zeile gelöscht : user_pref("CT2475029.LanguagePackLastCheckTime", "Fri Aug 08 2014 19:35:55 GMT+0200");
Zeile gelöscht : user_pref("CT2475029.LanguagePackReloadIntervalMM", 1440);
Zeile gelöscht : user_pref("CT2475029.LanguagePackServiceUrl", "hxxp://translation.users.tbccint.com/Translation.ashx");
Zeile gelöscht : user_pref("CT2475029.LastLogin_3.2.5.2", "Fri Aug 08 2014 19:35:54 GMT+0200");
Zeile gelöscht : user_pref("CT2475029.LatestVersion", "3.20.0.4");
Zeile gelöscht : user_pref("CT2475029.Locale", "en");
Zeile gelöscht : user_pref("CT2475029.MCDetectTooltipHeight", "83");
Zeile gelöscht : user_pref("CT2475029.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Zeile gelöscht : user_pref("CT2475029.MCDetectTooltipWidth", "295");
Zeile gelöscht : user_pref("CT2475029.SavedHomepage", "hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=1d55a34c-41e3-7bb2-c576-39761563b71c&searchtype=hp&installDate=14/09/2013");
Zeile gelöscht : user_pref("CT2475029.SearchFromAddressBarIsInit", true);
Zeile gelöscht : user_pref("CT2475029.SearchInNewTabEnabled", true);
Zeile gelöscht : user_pref("CT2475029.SearchInNewTabIntervalMM", 1440);
Zeile gelöscht : user_pref("CT2475029.SearchInNewTabLastCheckTime", "Fri Aug 08 2014 19:35:54 GMT+0200");
Zeile gelöscht : user_pref("CT2475029.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_TOOLBAR_ID&UM=UM_ID");
Zeile gelöscht : user_pref("CT2475029.SearchInNewTabUsageUrl", "hxxp://usage.hosting.toolbar.conduit-services.com/usage.ashx?ctid=EB_TOOLBAR_ID");
Zeile gelöscht : user_pref("CT2475029.ServiceMapLastCheckTime", "Fri Aug 08 2014 19:35:55 GMT+0200");
Zeile gelöscht : user_pref("CT2475029.SettingsLastCheckTime", "Fri Aug 08 2014 19:35:54 GMT+0200");
Zeile gelöscht : user_pref("CT2475029.SettingsLastUpdate", "1405919504");
Zeile gelöscht : user_pref("CT2475029.ThirdPartyComponentsInterval", 504);
Zeile gelöscht : user_pref("CT2475029.ThirdPartyComponentsLastCheck", "Fri Aug 08 2014 19:35:54 GMT+0200");
Zeile gelöscht : user_pref("CT2475029.ThirdPartyComponentsLastUpdate", "1331805997");
Zeile gelöscht : user_pref("CT2475029.TrusteLinkUrl", "hxxp://trust.cpccint.com");
Zeile gelöscht : user_pref("CT2475029.UserID", "UN95762016691967601");
Zeile gelöscht : user_pref("CT2475029.ct2481020.DialogsAlignMode", "LTR");
Zeile gelöscht : user_pref("CT2475029.ct2481020.LanguagePackLastCheckTime", "Fri Aug 08 2014 19:35:55 GMT+0200");
Zeile gelöscht : user_pref("CT2475029.ct2481020.Locale", "de");
Zeile gelöscht : user_pref("CT2475029.ct2481020.SearchInNewTabLastCheckTime", "Fri Aug 08 2014 19:35:55 GMT+0200");
Zeile gelöscht : user_pref("CT2475029.ct2481020.SettingsLastCheckTime", "Fri Aug 08 2014 19:35:55 GMT+0200");
Zeile gelöscht : user_pref("CT2475029.ct2481020.SettingsLastUpdate", "1405919504");
Zeile gelöscht : user_pref("CT2475029.ct2481020.ThirdPartyComponentsLastCheck", "Fri Aug 08 2014 19:35:54 GMT+0200");
Zeile gelöscht : user_pref("CT2475029.ct2481020.ThirdPartyComponentsLastUpdate", "1331806000");
Zeile gelöscht : user_pref("CT2475029.ct2481020.toolbarAppMetaDataLastCheckTime", "Fri Aug 08 2014 19:35:54 GMT+0200");
Zeile gelöscht : user_pref("CT2475029.ct2481020.toolbarContextMenuLastCheckTime", "Fri Aug 08 2014 19:35:55 GMT+0200");
Zeile gelöscht : user_pref("CT2475029.myStuffEnabled", true);
Zeile gelöscht : user_pref("CT2475029.myStuffPublihserMinWidth", 400);
Zeile gelöscht : user_pref("CT2475029.myStuffSearchUrl", "hxxp://appstrm.com/search?q=SEARCH_TERM&SearchSourceOrigin=29&ctid=EB_TOOLBAR_ID&octid=EB_ORIGINAL_CTID");
Zeile gelöscht : user_pref("CT2475029.myStuffServiceIntervalMM", 1440);
Zeile gelöscht : user_pref("CT2475029.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?ComponentId=EB_MY_STUFF_INSTANCE_GUID&lut=EB_MY_STUFF_LUT");
Zeile gelöscht : user_pref("CT2475029.testingCtid", "");
Zeile gelöscht : user_pref("CT2475029.toolbarAppMetaDataLastCheckTime", "Fri Aug 08 2014 19:35:55 GMT+0200");
Zeile gelöscht : user_pref("CT2475029.toolbarContextMenuLastCheckTime", "Fri Aug 08 2014 19:35:55 GMT+0200");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2269050/CT2269050", "\"0d20d3ba9b7579858ad68df425cfce053\"");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2475029/CT2475029", "\"bcc40e84cbf5c17ca239101d7b52255b3\"");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/ct2481020/CT2475029", "\"a9140e919af7dc01dcd38a1006fd9e653\"");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://alerts.tbccint.com/root/868510/864310/DE", "\"8d8d68af9a7552c213774a418eee735c\"");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2269050", "\"1365594729\"");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2475029", "\"1396366939\"");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=ct2481020", "\"1396366946\"");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&locale=EB_LOCALE&ctid=CT2475029", "SA8f/YRfs6V19wkAK/I6CA==");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&locale=EB_LOCALE&ctid=ct2481020", "SA8f/YRfs6V19wkAK/I6CA==");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&locale=de&ctid=ct2481020", "DhshrJ2tdqwMAo3KFinphw==");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&locale=en&ctid=CT2269050", "SA8f/YRfs6V19wkAK/I6CA==");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&locale=en&ctid=CT2475029", "SA8f/YRfs6V19wkAK/I6CA==");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&locale=EB_LOCALE&ctid=CT2475029", "B6IX5R5ADEz7jZ1dTY4lpQ==");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&locale=EB_LOCALE&ctid=ct2481020", "B6IX5R5ADEz7jZ1dTY4lpQ==");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&locale=de&ctid=ct2481020", "XL0dL/yJkxIYmHtckqc/jA==");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&locale=en&ctid=CT2269050", "B6IX5R5ADEz7jZ1dTY4lpQ==");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&locale=en&ctid=CT2475029", "B6IX5R5ADEz7jZ1dTY4lpQ==");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&locale=EB_LOCALE&ctid=CT2475029", "8Pf+ZNlIALQFEm53aS9FRw==");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&locale=EB_LOCALE&ctid=ct2481020", "8Pf+ZNlIALQFEm53aS9FRw==");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&locale=de&ctid=ct2481020", "KsDnK5UsRvSWKZIBX+/d5g==");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&locale=en&ctid=CT2269050", "8Pf+ZNlIALQFEm53aS9FRw==");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&locale=en&ctid=CT2475029", "8Pf+ZNlIALQFEm53aS9FRw==");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&locale=EB_LOCALE&ctid=CT2475029&UM=UM_UNINSTALL_ID", "Eqyi+rnB/8DP7DHXRtMrLg==");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&locale=EB_LOCALE&ctid=ct2481020&UM=UM_UNINSTALL_ID", "Eqyi+rnB/8DP7DHXRtMrLg==");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&locale=de&ctid=ct2481020&UM=UM_UNINSTALL_ID", "Uj+J/3qrFeStb0wXc5ZTHA==");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&locale=en&ctid=CT2269050&UM=UM_UNINSTALL_ID", "Eqyi+rnB/8DP7DHXRtMrLg==");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&locale=en&ctid=CT2475029&UM=UM_UNINSTALL_ID", "Eqyi+rnB/8DP7DHXRtMrLg==");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/toolbar/", "\"a238378f7d0708034a0defa297cb8b8b\"");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=de", "\"f0018126a2dd6fb51f9e7c612cc27d0e\"");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"96b780c3b31ea4474635d36b8db0b990\"");
Zeile gelöscht : user_pref("CommunityToolbar.EngineOwner", "CT2475029");
Zeile gelöscht : user_pref("CommunityToolbar.EngineOwnerGuid", "{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}");
Zeile gelöscht : user_pref("CommunityToolbar.EngineOwnerToolbarId", "myashampoo");
Zeile gelöscht : user_pref("CommunityToolbar.IsMyStuffImportedToEngine", true);
Zeile gelöscht : user_pref("CommunityToolbar.OriginalEngineOwner", "CT2475029");
Zeile gelöscht : user_pref("CommunityToolbar.OriginalEngineOwnerGuid", "{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}");
Zeile gelöscht : user_pref("CommunityToolbar.OriginalEngineOwnerToolbarId", "myashampoo");
Zeile gelöscht : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "chrome://browser-region/locale/region.properties");
Zeile gelöscht : user_pref("CommunityToolbar.ToolbarsList", "CT2269050,CT2475029,ConduitEngine");
Zeile gelöscht : user_pref("CommunityToolbar.ToolbarsList2", "CT2269050,CT2475029");
Zeile gelöscht : user_pref("CommunityToolbar.alert.alertInfoInterval", 60);
Zeile gelöscht : user_pref("CommunityToolbar.alert.alertInfoLastCheckTime", "Fri Aug 08 2014 19:35:53 GMT+0200");
Zeile gelöscht : user_pref("CommunityToolbar.alert.clientsServerUrl", "hxxp://alertsnotifications.ourtoolbar.com");
Zeile gelöscht : user_pref("CommunityToolbar.alert.locale", "en");
Zeile gelöscht : user_pref("CommunityToolbar.alert.loginIntervalMin", 1440);
Zeile gelöscht : user_pref("CommunityToolbar.alert.loginLastCheckTime", "Fri Aug 08 2014 19:35:53 GMT+0200");
Zeile gelöscht : user_pref("CommunityToolbar.alert.loginLastUpdateTime", "1401369664");
Zeile gelöscht : user_pref("CommunityToolbar.alert.messageShowTimeSec", 20);
Zeile gelöscht : user_pref("CommunityToolbar.alert.servicesServerUrl", "hxxp://alert.services.tbccint.com");
Zeile gelöscht : user_pref("CommunityToolbar.alert.showTrayIcon", false);
Zeile gelöscht : user_pref("CommunityToolbar.alert.userCloseIntervalMin", 300);
Zeile gelöscht : user_pref("CommunityToolbar.alert.userId", "85e44aca-b427-449f-8cf3-5abea9deeecd");
Zeile gelöscht : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Fri Oct 29 2010 21:23:16 GMT+0200");
Zeile gelöscht : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2475029");
Zeile gelöscht : user_pref("CommunityToolbar.twitter.user_1344951.LastCheckTime", "Fri Aug 08 2014 19:35:56 GMT+0200");
Zeile gelöscht : user_pref("CommunityToolbar.twitter.user_16887175.LastCheckTime", "Fri Aug 08 2014 19:35:56 GMT+0200");
Zeile gelöscht : user_pref("CommunityToolbar.twitter.user_17151925.LastCheckTime", "Fri Aug 08 2014 19:35:56 GMT+0200");
Zeile gelöscht : user_pref("CommunityToolbar.twitter.user_20536157.LastCheckTime", "Fri Aug 08 2014 19:35:56 GMT+0200");
Zeile gelöscht : user_pref("CommunityToolbar.twitter.user_30261067.LastCheckTime", "Fri Aug 08 2014 19:35:56 GMT+0200");
Zeile gelöscht : user_pref("CommunityToolbar.twitter.user_34655603.LastCheckTime", "Fri Aug 08 2014 19:35:56 GMT+0200");
Zeile gelöscht : user_pref("CommunityToolbar.twitter.user_759251.LastCheckTime", "Fri Aug 08 2014 19:35:56 GMT+0200");
Zeile gelöscht : user_pref("CommunityToolbar.twitter.user_816653.LastCheckTime", "Fri Aug 08 2014 19:35:56 GMT+0200");
Zeile gelöscht : user_pref("ConduitEngine.FirstTimeFF3", true);
Zeile gelöscht : user_pref("ConduitEngine.HasUserGlobalKeys", true);
Zeile gelöscht : user_pref("ConduitEngine.Initialize", true);
Zeile gelöscht : user_pref("ConduitEngine.InitializeCommonPrefs", true);
Zeile gelöscht : user_pref("ConduitEngine.IsMulticommunity", false);
Zeile gelöscht : user_pref("ConduitEngine.LanguagePackLastCheckTime", "Fri Aug 08 2014 19:35:58 GMT+0200");
Zeile gelöscht : user_pref("ConduitEngine.LastLogin_3.2.5.2", "Fri Aug 08 2014 19:35:58 GMT+0200");
Zeile gelöscht : user_pref("ConduitEngine.PublisherContainerWidth", 0);
Zeile gelöscht : user_pref("ConduitEngine.SettingsLastCheckTime", "Fri Aug 08 2014 19:35:55 GMT+0200");
Zeile gelöscht : user_pref("ConduitEngine.UserID", "UN70811686565273283");
Zeile gelöscht : user_pref("ConduitEngine.engineLocale", "de");
Zeile gelöscht : user_pref("ConduitEngine.enngineContextMenuLastCheckTime", "Fri Aug 08 2014 19:36:01 GMT+0200");
Zeile gelöscht : user_pref("ConduitEngine.initDone", true);
Zeile gelöscht : user_pref("browser.search.defaultthis.engineName", "MyAshampoo Customized Web Search");
Zeile gelöscht : user_pref("browser.search.selectedEngine", "MyAshampoo Customized Web Search");
Zeile gelöscht : user_pref("extensions.enabledItems", "12x3q@3244516.com:1.1,engine@conduit.com:3.2.5.2,{e53a26f5-7199-4a5b-86f5-d2e86854b979}:2.0,{872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.0.14,fdm_ffext@freedownload[...]
Zeile gelöscht : user_pref("extensions.vshare@toolbar.update.enabled", false);
Zeile gelöscht : user_pref("quickstores.toolbar.affid", "2002");
Zeile gelöscht : user_pref("quickstores.toolbar.guid", "{7BDA6B36-C7EF-2354-3123-C5AEAC61BA61}");
Zeile gelöscht : user_pref("vshare.install.date", "1407456000000");
Zeile gelöscht : user_pref("vshare.install.finished", "1.0.0");
Zeile gelöscht : user_pref("vshare.install.guid", "{bf33d8d7-6cf3-48c4-af04-416cc6f6ed72}");
Zeile gelöscht : user_pref("vshare.install.overlayVersion", 1);
-\\ Google Chrome v
[ Datei : C:\Users\VOW\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Gelöscht [Startup_urls] : hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=1d55a34c-41e3-7bb2-c576-39761563b71c&searchtype=hp&installDate=14/09/2013
Gelöscht [Homepage] : hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=1d55a34c-41e3-7bb2-c576-39761563b71c&searchtype=hp&installDate=14/09/2013
Gelöscht [Extension] : aaaaojmikegpiepcfdkkjaplodkpfmlo
Gelöscht [Extension] : booedmolknjekdopkepjjeckmjkdpfgl
Gelöscht [Extension] : bopakagnckmlgajfccecajhnimjiiedh
Gelöscht [Extension] : dedmngkbaffkenlfdcbganndoghblmap
Gelöscht [Extension] : ejnmnhkgiphcaeefbaooconkceehicfi
Gelöscht [Extension] : eooncjejnppfjjklapaamhcdmjbilmde
Gelöscht [Extension] : epojlgbehpaeekopencdagbdamnkppci
Gelöscht [Extension] : fjoijdanhaiflhibkljeklcghcmmfffh
Gelöscht [Extension] : flpcjncodpafbgdpnkljologafpionhb
Gelöscht [Extension] : jpmbfleldcgkldadpdinhjjopdfpjfjp
Gelöscht [Extension] : lgoiojnjnacbjngolldkokokgpcjbgjj
Gelöscht [Extension] : mkfokfffehpeedafpekjeddnmnjhmcmk
Gelöscht [Extension] : nikpibnbobmbdbheedjfogjlikpgpnhp
Gelöscht [Extension] : poheodfamflhhhdcmjfeggbgigeefaco
*************************
AdwCleaner[R0].txt - [44571 octets] - [18/09/2014 17:53:26]
AdwCleaner[S0].txt - [43439 octets] - [18/09/2014 17:55:59]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [43500 octets] ##########
JRT: Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.6 (09.18.2014:1)
OS: Windows 7 Ultimate x64
Ran by VOW on 18.09.2014 at 17:59:39,38
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3018767705-964232526-3307114488-1001\Software\sweetim
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\boost_interprocess"
Successfully deleted: [Folder] "C:\Users\VOW\AppData\Roaming\getrighttogo"
Successfully deleted: [Folder] "C:\Users\VOW\appdata\locallow\boost_interprocess"
Successfully deleted: [Folder] "C:\Users\VOW\appdata\locallow\myashampoo"
Successfully deleted: [Empty Folder] C:\Users\VOW\appdata\local\{261D0BE2-86B0-4B6C-A281-93F022ABCD87}
Successfully deleted: [Empty Folder] C:\Users\VOW\appdata\local\{3412CACA-D2F8-4D0B-98B3-390B66A197C0}
Successfully deleted: [Empty Folder] C:\Users\VOW\appdata\local\{3FFAB648-940D-4D5D-BB5F-1AFE4F04BEB7}
Successfully deleted: [Empty Folder] C:\Users\VOW\appdata\local\{56B83770-D2AB-4C17-9E23-4C1505A0728C}
Successfully deleted: [Empty Folder] C:\Users\VOW\appdata\local\{6FA9D701-A267-4B0E-A381-3F15AF147A14}
Successfully deleted: [Empty Folder] C:\Users\VOW\appdata\local\{9F5BBE95-7ED1-4507-BFDD-C48647AF4E7C}
Successfully deleted: [Empty Folder] C:\Users\VOW\appdata\local\{B726D8C1-747A-4DFA-9629-AE960AC48126}
~~~ FireFox
Successfully deleted: [Folder] C:\Users\VOW\AppData\Roaming\mozilla\firefox\profiles\c20vf9y6.default\extensions\staged
~~~ Chrome
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Policies\Google [Blacklisted Policy]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 18.09.2014 at 18:03:47,56
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
18.09.2014, 17:11
| #8 |
| | Win7-64Bit - Browser, Netzwerkeinstellungen, Proxy wird immer automatisch aktiviert 127.0.0.1:49273 und ein neues FRST-Log: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-09-2014
Ran by VOW (administrator) on VOW-PC on 18-09-2014 18:04:49
Running from C:\Users\VOW\Desktop
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
() C:\Program Files (x86)\Ashampoo\Ashampoo Core Tuner 2\ACT2Service.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(DATA BECKER GmbH & Co KG) C:\Program Files (x86)\Common Files\DATA BECKER Shared\DBService.exe
(mst software GmbH, Germany) D:\Programme\Ashampoo WinOptimizer 10\DfSdkS64.exe
(Garmin Ltd or its subsidiaries) D:\Programme\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
() C:\Windows\SysWOW64\XSrvSetup.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.5.0.19\nis.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
() C:\Program Files (x86)\Synology Data Replicator 3\SynoDrServicex64.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
() C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Program Files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.5.0.19\nis.exe
() C:\Program Files (x86)\ASRock Utility\AXTU\Bin\AsrXTU.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdcBase.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Apple Inc.) D:\Programme\iCloud\ApplePhotoStreams.exe
(Apple Inc.) D:\Programme\iCloud\iCloudServices.exe
() C:\Users\VOW\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe
(Garmin Ltd or its subsidiaries) D:\Programme\Garmin\Express Tray\ExpressTray.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPoint\SetPoint.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(InstallShield Software Corporation) C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
(Samsung Electronics.) C:\Program Files (x86)\Samsung SSD Magician\Samsung Magician.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
() C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe
(Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\BrccMCtl.exe
(Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TimounterMonitor.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(FNet Co., Ltd.) C:\Program Files (x86)\XFastUSB\XFastUsb.exe
(TODO: <公司名>) C:\Program Files (x86)\Perixx Gaming mouse\SE61T-UserTools.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Apple Inc.) D:\Programme\iCloud\APSDaemon.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler64.exe
() C:\Program Files\ASRock Utility\XFast RAM\asrRd.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\WMPSideShowGadget.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Google Inc.) C:\Users\VOW\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\VOW\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\VOW\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\VOW\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\VOW\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [104008 2010-11-16] (Logitech Inc.)
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [403656 2012-04-27] (Acronis)
HKLM\...\Run: [Windows Mobile-based device management] => C:\Windows\WindowsMobile\wmdcBase.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13307496 2011-10-17] (Realtek Semiconductor)
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [374784 2014-01-09] (shbox.de)
HKLM-x32\...\Run: [ISUSScheduler] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [81920 2005-02-17] (InstallShield Software Corporation)
HKLM-x32\...\Run: [ArcSoft Connection Service] => C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [ATICustomerCare] => C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe [311296 2010-03-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2621440 2010-02-09] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [5993136 2012-04-27] (Acronis)
HKLM-x32\...\Run: [Name of App] => C:\Program Files (x86)\SAMSUNG\FW LiveUpdate\FWManager.exe [692307 2011-11-23] ( )
HKLM-x32\...\Run: [AcronisTimounterMonitor] => C:\Program Files (x86)\Acronis\TrueImageHome\TimounterMonitor.exe [1173680 2012-04-27] (Acronis)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-06] (Apple Inc.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-01-26] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)
HKLM-x32\...\Run: [XFastUSB] => C:\Program Files (x86)\XFastUSB\XFastUsb.exe [5019360 2012-10-16] (FNet Co., Ltd.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SE61T-UserTools] => C:\Program Files (x86)\Perixx Gaming mouse\SE61T-UserTools.exe [754176 2013-10-08] (TODO: <公司名>)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\.DEFAULT\...\Run: [GarminExpressTrayApp] => D:\Programme\Garmin\Express Tray\ExpressTray.exe [688984 2014-07-23] (Garmin Ltd or its subsidiaries)
HKU\S-1-5-21-3018767705-964232526-3307114488-1001\...\Run: [ApplePhotoStreams] => D:\Programme\iCloud\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-3018767705-964232526-3307114488-1001\...\Run: [iCloudServices] => D:\Programme\iCloud\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-3018767705-964232526-3307114488-1001\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-11-09] (Google Inc.)
HKU\S-1-5-21-3018767705-964232526-3307114488-1001\...\Run: [Amazon Cloud Player] => C:\Users\VOW\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3168576 2014-03-07] ()
HKU\S-1-5-21-3018767705-964232526-3307114488-1001\...\Run: [GarminExpressTrayApp] => D:\Programme\Garmin\Express Tray\ExpressTray.exe [688984 2014-07-23] (Garmin Ltd or its subsidiaries)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Logitech SetPoint.lnk
ShortcutTarget: Logitech SetPoint.lnk -> C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
Startup: C:\Users\VOW\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\VOW\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Magician.lnk
ShortcutTarget: Samsung Magician.lnk -> C:\Windows\System32\schtasks.exe (Microsoft Corporation)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyServer: http=127.0.0.1:49501;https=127.0.0.1:49501
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xF53C4A75345ACA01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine64\21.5.0.19\coIEPlg.dll (Symantec Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> No File
BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine\21.5.0.19\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\21.5.0.19\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Free Download Manager -> {CC59E0F9-7E43-44FA-9FAA-8377850BF205} -> D:\Programme\Free Download Manager\iefdm2.dll (FreeDownloadManager.ORG)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.5.0.19\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\21.5.0.19\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.5.0.19\coIEPlg.dll (Symantec Corporation)
DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default
FF NewTab: about:blank
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @garmin.com/GpsControl -> C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @pages.tvunetworks.com/WebPlayer -> C:\Program Files (x86)\TVUPlayer\npTVUAx.dll No File
FF Plugin-x32: @protectdisc.com/NPPDLicenseHelper -> C:\Program Files (x86)\ProtectDisc\License Helper\NPPDLicenseHelper.dll ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 -> D:\Programme\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\VOW\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\VOW\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npnul32.dll (mozilla.org)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPPDLicenseHelper.dll ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} [2010-03-21]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} [2010-04-09]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010-04-18]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [2010-09-15]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2010-12-13]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011-05-13]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [2011-10-12]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} [2011-12-12]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} [2012-05-12]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2012-07-14]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA} [2012-08-15]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2012-10-12]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2012-11-15]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.3.0.12\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.3.0.12\coFFPlgn [2014-09-18]
FF Extension: No Name - C:\Program Files (x86)\Better-Surf\ff [Not Found]
FF Extension: No Name - C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\extensions\engine@conduit.com [Not Found]
FF Extension: No Name - C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\extensions\{e53a26f5-7199-4a5b-86f5-d2e86854b979} [Not Found]
FF Extension: No Name - C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [Not Found]
FF Extension: Free Download Manager plugin - C:\ProgramData\Free Download Manager\Firefox\Extensions\1.6.0.1 [2014-02-08]
FF Extension: No Name - C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [Not Found]
FF Extension: No Name - C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha86\ff [Not Found]
FF Extension: No Name - C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} [Not Found]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\quickstores@quickstores.de [Not Found]
FF Extension: No Name - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta736\ff [Not Found]
FF Extension: No Name - C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\extensions\vshare@toolbar [Not Found]
FF Extension: No Name - C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha299\ff [Not Found]
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.3.0.12\IPSFF [2014-06-01]
Chrome:
=======
CHR HomePage: Default -> hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=1d55a34c-41e3-7bb2-c576-39761563b71c&searchtype=hp&installDate=14/09/2013
CHR StartupUrls: Default -> "hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=1d55a34c-41e3-7bb2-c576-39761563b71c&searchtype=hp&installDate=14/09/2013", "hxxp://www.franken-trekking.de/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\VOW\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\VOW\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-06-30]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\VOW\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-08-27]
CHR Extension: (YouTube) - C:\Users\VOW\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-10-17]
CHR Extension: (Battlefield Heroes) - C:\Users\VOW\AppData\Local\Google\Chrome\User Data\Default\Extensions\cehdakiococlfmjcbebbkjkfjhbieknh [2013-05-30]
CHR Extension: (SAS Zombie Assault 3) - C:\Users\VOW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ckmedboncpahmbhnpaamimdohjfpphea [2012-11-04]
CHR Extension: (Google-Suche) - C:\Users\VOW\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-10-17]
CHR Extension: (Google Wallet) - C:\Users\VOW\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-02]
CHR Extension: (Google Mail) - C:\Users\VOW\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-10-17]
CHR HKCU\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\VOW\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2013-06-29]
CHR HKLM-x32\...\Chrome\Extension: [fnjbmmemklcjgepojigaapkoodmkgbae] - C:\Program Files (x86)\DivX\DivX Plus Web Player\google_chrome\wpa\wpa.crx [2013-06-29]
CHR HKLM-x32\...\Chrome\Extension: [hihneggbbhdjkjbckjdpjjnflgpghbjf] - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta736\ch\VideoPlayerV3beta736.crx [2013-06-29]
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\google_chrome\html5video\html5video.crx [2013-06-29]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 ACT2_Service; C:\Program Files (x86)\Ashampoo\Ashampoo Core Tuner 2\ACT2Service.exe [1420184 2011-08-09] ()
R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [File not signed]
R2 DBService; C:\Program Files (x86)\Common Files\DATA BECKER Shared\DBService.exe [187456 2009-11-08] (DATA BECKER GmbH & Co KG) [File not signed]
R2 DfSdkS; D:\Programme\Ashampoo WinOptimizer 10\DfsdkS64.exe [544768 2009-08-24] (mst software GmbH, Germany) [File not signed]
S2 ES lite Service; C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE [68136 2009-08-24] ()
R2 Fabs; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [1858048 2012-01-23] (MAGIX AG) [File not signed]
S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2702848 2011-04-26] (MAGIX®) [File not signed]
R2 Garmin Core Update Service; D:\Programme\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [438616 2014-07-23] (Garmin Ltd or its subsidiaries)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 JMB36X; C:\Windows\SysWOW64\XSrvSetup.exe [72304 2010-01-19] ()
R2 MSSQL$SQLEXPRESS; c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [57617752 2009-03-30] (Microsoft Corporation)
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\21.5.0.19\NIS.exe [276376 2014-07-31] (Symantec Corporation)
R2 OS Selector; C:\Program Files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe [2155848 2011-11-15] ()
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75136 2013-05-30] ()
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [117264 2009-10-20] (CACE Technologies, Inc.)
S4 SQLAgent$SQLEXPRESS; c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [427880 2009-03-30] (Microsoft Corporation)
R2 SynoDrService; C:\Program Files (x86)\Synology Data Replicator 3\SynoDrServicex64.exe [381312 2013-04-24] () [File not signed]
R2 UsbClientService; C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe [248704 2013-04-30] () [File not signed]
S3 WO_LiveService; D:\Programme\Ashampoo WinOptimizer 10\LiveTunerService.exe [885096 2013-05-15] ()
S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe /launchService [X]
S3 STSService; "C:\Program Files (x86)\SoundTaxi Media Suite\STSService.exe" [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 ACT2PM; C:\Program Files (x86)\Ashampoo\Ashampoo Core Tuner 2\ACT2ProcessMonitor64.sys [15160 2011-06-10] ()
R0 asahci64; C:\Windows\System32\DRIVERS\asahci64.sys [49760 2011-09-21] (Asmedia Technology)
R0 AsrRamDisk; C:\Windows\System32\DRIVERS\AsrRamDisk.sys [31016 2012-01-13] (ASRock Inc.)
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [211456 2010-11-27] () [File not signed]
R1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.3.0.12\Definitions\BASHDefs\20140912.003\BHDrvx64.sys [1586904 2014-09-13] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1505000.013\ccSetx64.sys [162392 2014-02-21] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [487216 2014-09-09] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142640 2014-09-09] (Symantec Corporation)
S3 FNETTBOH_305; C:\Windows\System32\drivers\FNETTBOH_305.SYS [32320 2014-09-07] (FNet Co., Ltd.)
R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [15936 2012-10-16] (FNet Co., Ltd.)
U5 FontCache3.0.0.0; C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [42856 2010-11-05] (Microsoft Corporation)
R1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.3.0.12\Definitions\IPSDefs\20140917.001\IDSvia64.sys [633560 2014-08-29] (Symantec Corporation)
S3 leafnets; C:\Windows\System32\DRIVERS\leafnets.sys [29696 2011-05-26] (Leaf Networks)
R3 libusb0; C:\Windows\System32\drivers\libusb0.sys [44480 2013-09-23] (hxxp://libusb-win32.sourceforge.net)
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [35328 2010-11-27] () [File not signed]
S2 lirsgt; C:\Windows\SysWOW64\DRIVERS\lirsgt.sys [18048 2010-11-27] () [File not signed]
R2 LiveTunerPM; D:\Programme\Ashampoo WinOptimizer 10\LiveTunerProcessMonitor64.sys [12824 2011-03-08] ()
R3 NAVENG; C:\Program Files (x86)\Norton Internet Security\NortonData\21.3.0.12\Definitions\VirusDefs\20140917.038\ENG64.SYS [129752 2014-08-21] (Symantec Corporation)
R3 NAVEX15; C:\Program Files (x86)\Norton Internet Security\NortonData\21.3.0.12\Definitions\VirusDefs\20140917.038\EX64.SYS [2137304 2014-08-21] (Symantec Corporation)
R2 NPF; C:\Windows\system32\drivers\npf.sys [35344 2013-01-03] (CACE Technologies, Inc.)
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [19912 2009-12-21] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [13264 2009-12-21] ()
R0 sfdrv01a; C:\Windows\System32\drivers\sfdrv01a.sys [77432 2009-02-03] (Protection Technology (StarForce))
S3 SndTAudio; C:\Windows\System32\drivers\SndTAudio.sys [33336 2010-02-18] (Windows (R) Codename Longhorn DDK provider)
R3 SRTSP; C:\Windows\System32\Drivers\NISx64\1505000.013\SRTSP64.SYS [875736 2014-02-13] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1505000.013\SRTSPX64.SYS [36952 2013-10-30] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1505000.013\SYMDS64.SYS [493656 2013-10-30] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1505000.013\SYMEFA64.SYS [1148120 2014-03-04] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-06-01] (Symantec Corporation)
R1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [78936 2013-10-30] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1505000.013\Ironx64.SYS [264280 2013-10-30] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1505000.013\SYMNETS.SYS [593112 2014-02-18] (Symantec Corporation)
S3 V0260VID; C:\Windows\System32\DRIVERS\V0260Vid.sys [189664 2007-07-18] (Creative Technology Ltd.)
S3 AIDA64Driver; \??\C:\Users\VOW\AppData\Local\Temp\Rar$EX01.439\kerneld.x64 [X]
S2 AODDriver4.01; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [X]
S2 AODDriver4.1; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [X]
R3 AxtuDrv; \??\C:\Windows\SysWOW64\Drivers\AxtuDrv.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
S3 Fwleaf; system32\DRIVERS\fwleaf.sys [X]
S3 SliceDisk5; \??\C:\Program Files\A-FF Find and Mount\slicedisk-x64.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 WPRO_41_1742; system32\drivers\WPRO_41_1742.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-18 18:04 - 2014-09-18 18:04 - 00034305 _____ () C:\Users\VOW\Desktop\FRST.txt
2014-09-18 18:03 - 2014-09-18 18:03 - 00002104 _____ () C:\Users\VOW\Desktop\JRT.txt
2014-09-18 17:59 - 2014-09-18 17:59 - 00000000 ____D () C:\Windows\ERUNT
2014-09-18 17:57 - 2014-09-18 17:57 - 00043689 _____ () C:\Users\VOW\Desktop\AdwCleaner[S0].txt
2014-09-18 17:53 - 2014-09-18 17:56 - 00000000 ____D () C:\AdwCleaner
2014-09-18 17:45 - 2014-09-18 17:45 - 00028283 _____ () C:\Users\VOW\Desktop\mbam_180914_1.txt
2014-09-18 17:43 - 2014-09-18 17:57 - 00003018 _____ () C:\Windows\System32\Tasks\asrRd
2014-09-18 17:35 - 2014-09-18 17:44 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-18 17:34 - 2014-09-18 17:34 - 00001108 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-18 17:34 - 2014-09-18 17:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-09-18 17:34 - 2014-09-18 17:34 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-18 17:34 - 2014-09-18 17:34 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-09-18 17:34 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-18 17:34 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-09-18 17:34 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-18 17:33 - 2014-09-18 17:33 - 01016830 _____ (Thisisu) C:\Users\VOW\Desktop\JRT.exe
2014-09-18 17:32 - 2014-09-18 17:32 - 01373475 _____ () C:\Users\VOW\Desktop\AdwCleaner_3.310.exe
2014-09-18 17:32 - 2014-09-18 17:31 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\VOW\Desktop\mbam-setup-2.0.2.1012.exe
2014-09-18 06:48 - 2014-09-18 06:48 - 00043286 _____ () C:\Users\VOW\Desktop\Combofix.txt
2014-09-18 06:47 - 2014-09-18 06:47 - 00043286 _____ () C:\ComboFix.txt
2014-09-18 06:40 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-09-18 06:40 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-09-18 06:40 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-09-18 06:40 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-09-18 06:40 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-09-18 06:40 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-09-18 06:40 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-09-18 06:40 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-09-18 06:39 - 2014-09-18 06:47 - 00000000 ____D () C:\Qoobox
2014-09-18 06:39 - 2014-09-18 06:46 - 00000000 ____D () C:\Windows\erdnt
2014-09-18 06:38 - 2014-09-18 06:37 - 05579386 ____R (Swearware) C:\Users\VOW\Desktop\ComboFix.exe
2014-09-18 06:20 - 2014-09-18 06:20 - 00001288 _____ () C:\Users\VOW\Desktop\Revo Uninstaller.lnk
2014-09-18 06:20 - 2014-09-18 06:20 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-09-18 06:18 - 2014-09-18 06:18 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\VOW\Desktop\revosetup95.exe
2014-09-17 23:13 - 2014-09-17 23:13 - 00037812 _____ () C:\Users\VOW\Desktop\Logfiles.zip
2014-09-17 22:51 - 2014-09-17 22:51 - 00021731 _____ () C:\Users\VOW\Desktop\Gmer.txt
2014-09-17 22:42 - 2014-09-17 22:42 - 00079142 _____ () C:\Users\VOW\Desktop\Addition_170914_1.txt
2014-09-17 22:41 - 2014-09-18 18:04 - 00000000 ____D () C:\FRST
2014-09-17 22:41 - 2014-09-17 22:42 - 00071690 _____ () C:\Users\VOW\Desktop\FRST_170914_1.txt
2014-09-17 22:38 - 2014-09-17 22:38 - 00000477 _____ () C:\Users\VOW\Desktop\Ad-Aware_Report_Full_Manual_2014-09-17T22-37-25.374734.xml
2014-09-17 22:10 - 2014-09-17 22:11 - 00000468 _____ () C:\Users\VOW\Desktop\defogger_disable.log
2014-09-17 22:10 - 2014-09-17 22:10 - 00000000 _____ () C:\Users\VOW\defogger_reenable
2014-09-17 21:56 - 2014-09-17 21:55 - 00380416 _____ () C:\Users\VOW\Desktop\Gmer-19357.exe
2014-09-17 21:55 - 2014-09-17 21:55 - 02105856 _____ (Farbar) C:\Users\VOW\Desktop\FRST64.exe
2014-09-17 21:53 - 2014-09-17 21:53 - 00050477 _____ () C:\Users\VOW\Desktop\Defogger.exe
2014-09-17 21:51 - 2014-09-17 21:51 - 00000000 ____D () C:\Users\VOW\Desktop\Outdoor
2014-09-17 21:51 - 2014-09-17 21:51 - 00000000 ____D () C:\Users\VOW\Desktop\Copter
2014-09-12 18:53 - 2014-09-12 18:53 - 00000000 ____D () C:\Users\VOW\AppData\Roaming\LavasoftStatistics
2014-09-10 21:16 - 2014-09-10 21:16 - 00000000 ____D () C:\Users\VOW\AppData\Local\Adobe
2014-09-09 21:13 - 2014-08-19 20:05 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-09 21:13 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-09-09 21:13 - 2014-08-19 00:29 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-09 21:13 - 2014-08-19 00:29 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-09 21:13 - 2014-08-19 00:15 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-09 21:13 - 2014-08-19 00:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-09 21:13 - 2014-08-19 00:14 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-09 21:13 - 2014-08-19 00:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-09 21:13 - 2014-08-19 00:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-09 21:13 - 2014-08-19 00:05 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-09 21:13 - 2014-08-19 00:03 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-09 21:13 - 2014-08-19 00:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-09 21:13 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-09-09 21:13 - 2014-08-18 23:51 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-09 21:13 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-09-09 21:13 - 2014-08-18 23:45 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-09 21:13 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-09-09 21:13 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-09-09 21:13 - 2014-08-18 23:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-09 21:13 - 2014-08-18 23:39 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-09 21:13 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-09 21:13 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-09-09 21:13 - 2014-08-18 23:38 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-09 21:13 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-09-09 21:13 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-09-09 21:13 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-09-09 21:13 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-09-09 21:13 - 2014-08-18 23:25 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-09 21:13 - 2014-08-18 23:25 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-09 21:13 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-09-09 21:13 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-09-09 21:13 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-09-09 21:13 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-09 21:13 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-09 21:12 - 2014-08-19 01:01 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-09 21:12 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-09 21:12 - 2014-08-19 00:20 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-09 21:12 - 2014-08-19 00:19 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-09 21:12 - 2014-08-19 00:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-09 21:12 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-09-09 21:12 - 2014-08-19 00:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-09 21:12 - 2014-08-18 23:56 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-09 21:12 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-09-09 21:12 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-09 21:12 - 2014-08-18 23:23 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-09 21:12 - 2014-08-18 23:23 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-09 21:12 - 2014-08-18 23:16 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-09 21:12 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-09 21:12 - 2014-08-18 23:15 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-09 21:12 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-09 21:12 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-09-09 21:12 - 2014-08-18 22:55 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-09 21:12 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-09 21:12 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-09 21:12 - 2014-08-18 22:38 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-09 21:12 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-09-09 21:10 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-09 21:10 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2014-09-09 19:30 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-09 19:30 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-09 19:30 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-09 19:30 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-09-09 19:30 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-09 19:30 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-09 19:30 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-09-09 19:30 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-09-09 19:30 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-09-09 19:30 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-09 19:30 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-09-05 20:48 - 2014-09-05 19:41 - 00675988 _____ () C:\Users\VOW\Desktop\Minecraft.exe
2014-09-01 09:34 - 2014-09-01 09:34 - 00000891 _____ () C:\Users\Public\Desktop\MAGIX Video deluxe 2015 Plus.lnk
2014-09-01 09:34 - 2014-09-01 09:34 - 00000000 ____D () C:\Users\VOW\AppData\Local\Magix
2014-09-01 09:34 - 2014-09-01 09:34 - 00000000 ____D () C:\Program Files\Common Files\MAGIX Shared
2014-09-01 09:09 - 2014-09-05 13:31 - 00000026 _____ () C:\Windows\Zone.Identifier
2014-09-01 08:39 - 2014-09-01 08:39 - 00000000 ____D () C:\Amazon MP3
2014-08-28 06:35 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 06:35 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-28 06:35 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-26 16:12 - 2014-04-13 10:15 - 834916622 _____ () C:\Users\VOW\Desktop\Copter_Flug3_remix_dashware_120414.mp4
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-18 18:04 - 2014-09-18 18:04 - 00034305 _____ () C:\Users\VOW\Desktop\FRST.txt
2014-09-18 18:04 - 2014-09-17 22:41 - 00000000 ____D () C:\FRST
2014-09-18 18:04 - 2009-07-14 06:45 - 00022864 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-18 18:04 - 2009-07-14 06:45 - 00022864 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-18 18:03 - 2014-09-18 18:03 - 00002104 _____ () C:\Users\VOW\Desktop\JRT.txt
2014-09-18 18:03 - 2009-07-14 19:58 - 00767720 _____ () C:\Windows\system32\perfh007.dat
2014-09-18 18:03 - 2009-07-14 19:58 - 00175704 _____ () C:\Windows\system32\perfc007.dat
2014-09-18 18:03 - 2009-07-14 07:13 - 01813706 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-18 17:59 - 2014-09-18 17:59 - 00000000 ____D () C:\Windows\ERUNT
2014-09-18 17:57 - 2014-09-18 17:57 - 00043689 _____ () C:\Users\VOW\Desktop\AdwCleaner[S0].txt
2014-09-18 17:57 - 2014-09-18 17:43 - 00003018 _____ () C:\Windows\System32\Tasks\asrRd
2014-09-18 17:57 - 2013-09-11 06:26 - 00000073 _____ () C:\service.log
2014-09-18 17:57 - 2013-08-21 18:04 - 00366384 _____ () C:\Windows\PFRO.log
2014-09-18 17:57 - 2013-08-16 19:06 - 00031191 _____ () C:\Windows\setupact.log
2014-09-18 17:57 - 2012-10-16 22:45 - 00002952 _____ () C:\Windows\System32\Tasks\AsrXTU
2014-09-18 17:57 - 2010-07-27 21:49 - 00025640 _____ (Windows (R) Server 2003 DDK provider) C:\Windows\gdrv.sys
2014-09-18 17:57 - 2009-11-29 19:25 - 00000000 ____D () C:\Users\VOW\AppData\Local\FreePDF_XP
2014-09-18 17:57 - 2009-10-31 17:55 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-18 17:57 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-18 17:56 - 2014-09-18 17:53 - 00000000 ____D () C:\AdwCleaner
2014-09-18 17:56 - 2009-10-31 16:20 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-18 17:56 - 2009-10-31 16:04 - 01900001 _____ () C:\Windows\WindowsUpdate.log
2014-09-18 17:45 - 2014-09-18 17:45 - 00028283 _____ () C:\Users\VOW\Desktop\mbam_180914_1.txt
2014-09-18 17:44 - 2014-09-18 17:35 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-18 17:37 - 2010-06-06 17:28 - 00003914 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{74AA5567-A267-4A41-8611-8F0F98C5D7DA}
2014-09-18 17:34 - 2014-09-18 17:34 - 00001108 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-18 17:34 - 2014-09-18 17:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-09-18 17:34 - 2014-09-18 17:34 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-18 17:34 - 2014-09-18 17:34 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-09-18 17:33 - 2014-09-18 17:33 - 01016830 _____ (Thisisu) C:\Users\VOW\Desktop\JRT.exe
2014-09-18 17:32 - 2014-09-18 17:32 - 01373475 _____ () C:\Users\VOW\Desktop\AdwCleaner_3.310.exe
2014-09-18 17:31 - 2014-09-18 17:32 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\VOW\Desktop\mbam-setup-2.0.2.1012.exe
2014-09-18 07:06 - 2012-10-17 18:57 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3018767705-964232526-3307114488-1001UA.job
2014-09-18 07:06 - 2009-10-31 17:55 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-18 07:01 - 2014-02-22 14:12 - 00000000 ____D () C:\Users\VOW\AppData\Local\Amazon Cloud Player
2014-09-18 06:48 - 2014-09-18 06:48 - 00043286 _____ () C:\Users\VOW\Desktop\Combofix.txt
2014-09-18 06:47 - 2014-09-18 06:47 - 00043286 _____ () C:\ComboFix.txt
2014-09-18 06:47 - 2014-09-18 06:39 - 00000000 ____D () C:\Qoobox
2014-09-18 06:46 - 2014-09-18 06:39 - 00000000 ____D () C:\Windows\erdnt
2014-09-18 06:46 - 2009-07-14 04:34 - 00000246 _____ () C:\Windows\system.ini
2014-09-18 06:45 - 2009-07-14 04:34 - 56623104 _____ () C:\Windows\system32\config\components.bak
2014-09-18 06:45 - 2009-07-14 04:34 - 43515904 _____ () C:\Windows\system32\config\system.bak
2014-09-18 06:45 - 2009-07-14 04:34 - 110100480 _____ () C:\Windows\system32\config\software.bak
2014-09-18 06:45 - 2009-07-14 04:34 - 03407872 _____ () C:\Windows\system32\config\default.bak
2014-09-18 06:45 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\security.bak
2014-09-18 06:45 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\sam.bak
2014-09-18 06:44 - 2009-10-31 16:10 - 00000000 ____D () C:\Users\VOW
2014-09-18 06:37 - 2014-09-18 06:38 - 05579386 ____R (Swearware) C:\Users\VOW\Desktop\ComboFix.exe
2014-09-18 06:36 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Public\Libraries
2014-09-18 06:35 - 2014-02-01 11:30 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-09-18 06:26 - 2012-04-01 08:31 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-18 06:20 - 2014-09-18 06:20 - 00001288 _____ () C:\Users\VOW\Desktop\Revo Uninstaller.lnk
2014-09-18 06:20 - 2014-09-18 06:20 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-09-18 06:18 - 2014-09-18 06:18 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\VOW\Desktop\revosetup95.exe
2014-09-18 06:13 - 2014-02-01 11:30 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-09-17 23:13 - 2014-09-17 23:13 - 00037812 _____ () C:\Users\VOW\Desktop\Logfiles.zip
2014-09-17 23:13 - 2011-08-18 09:47 - 00000000 ____D () C:\Program Files (x86)\PowerArchiver
2014-09-17 22:51 - 2014-09-17 22:51 - 00021731 _____ () C:\Users\VOW\Desktop\Gmer.txt
2014-09-17 22:42 - 2014-09-17 22:42 - 00079142 _____ () C:\Users\VOW\Desktop\Addition_170914_1.txt
2014-09-17 22:42 - 2014-09-17 22:41 - 00071690 _____ () C:\Users\VOW\Desktop\FRST_170914_1.txt
2014-09-17 22:38 - 2014-09-17 22:38 - 00000477 _____ () C:\Users\VOW\Desktop\Ad-Aware_Report_Full_Manual_2014-09-17T22-37-25.374734.xml
2014-09-17 22:11 - 2014-09-17 22:10 - 00000468 _____ () C:\Users\VOW\Desktop\defogger_disable.log
2014-09-17 22:10 - 2014-09-17 22:10 - 00000000 _____ () C:\Users\VOW\defogger_reenable
2014-09-17 21:55 - 2014-09-17 21:56 - 00380416 _____ () C:\Users\VOW\Desktop\Gmer-19357.exe
2014-09-17 21:55 - 2014-09-17 21:55 - 02105856 _____ (Farbar) C:\Users\VOW\Desktop\FRST64.exe
2014-09-17 21:53 - 2014-09-17 21:53 - 00050477 _____ () C:\Users\VOW\Desktop\Defogger.exe
2014-09-17 21:51 - 2014-09-17 21:51 - 00000000 ____D () C:\Users\VOW\Desktop\Outdoor
2014-09-17 21:51 - 2014-09-17 21:51 - 00000000 ____D () C:\Users\VOW\Desktop\Copter
2014-09-17 21:06 - 2012-10-17 18:57 - 00001060 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3018767705-964232526-3307114488-1001Core.job
2014-09-17 18:34 - 2013-05-12 20:55 - 00002471 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-09-14 16:04 - 2012-05-26 18:13 - 00000000 ____D () C:\Users\VOW\AppData\Roaming\.minecraft
2014-09-13 11:20 - 2010-07-14 05:38 - 00000472 ____H () C:\Windows\Tasks\Norton Security Scan for VOW.job
2014-09-12 18:53 - 2014-09-12 18:53 - 00000000 ____D () C:\Users\VOW\AppData\Roaming\LavasoftStatistics
2014-09-10 21:16 - 2014-09-10 21:16 - 00000000 ____D () C:\Users\VOW\AppData\Local\Adobe
2014-09-10 19:26 - 2012-04-01 08:31 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-10 19:26 - 2012-04-01 08:30 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-10 19:26 - 2011-06-10 22:05 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-10 19:10 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-09 21:12 - 2013-08-16 23:02 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-09 21:12 - 2010-12-17 19:26 - 01787050 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-09-09 21:10 - 2014-05-09 21:25 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-09 21:10 - 2009-10-31 16:18 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-07 09:52 - 2012-10-20 15:19 - 00032320 _____ (FNet Co., Ltd.) C:\Windows\system32\Drivers\FNETTBOH_305.SYS
2014-09-05 20:49 - 2010-03-06 14:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\gMapMaker
2014-09-05 19:41 - 2014-09-05 20:48 - 00675988 _____ () C:\Users\VOW\Desktop\Minecraft.exe
2014-09-05 13:31 - 2014-09-01 09:09 - 00000026 _____ () C:\Windows\Zone.Identifier
2014-09-05 04:10 - 2014-09-09 19:30 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-05 04:05 - 2014-09-09 19:30 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-03 19:21 - 2009-07-14 06:45 - 00513544 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-01 09:37 - 2009-10-31 16:58 - 00148448 _____ () C:\Users\VOW\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-01 09:36 - 2009-11-09 21:11 - 00000000 ____D () C:\Users\VOW\AppData\Local\CrashDumps
2014-09-01 09:34 - 2014-09-01 09:34 - 00000891 _____ () C:\Users\Public\Desktop\MAGIX Video deluxe 2015 Plus.lnk
2014-09-01 09:34 - 2014-09-01 09:34 - 00000000 ____D () C:\Users\VOW\AppData\Local\Magix
2014-09-01 09:34 - 2014-09-01 09:34 - 00000000 ____D () C:\Program Files\Common Files\MAGIX Shared
2014-09-01 09:34 - 2011-11-25 19:06 - 00000000 ____D () C:\Users\VOW\AppData\Roaming\MAGIX
2014-09-01 09:34 - 2011-11-25 19:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MAGIX
2014-09-01 09:34 - 2011-11-25 19:05 - 00000000 ____D () C:\ProgramData\MAGIX
2014-09-01 09:33 - 2011-11-25 19:05 - 00000000 ____D () C:\Program Files (x86)\MAGIX
2014-09-01 09:31 - 2014-03-26 19:06 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-09-01 09:20 - 2014-05-13 20:06 - 00000000 ____D () C:\ProgramData\Package Cache
2014-09-01 08:39 - 2014-09-01 08:39 - 00000000 ____D () C:\Amazon MP3
2014-08-28 21:41 - 2010-12-04 14:27 - 00040211 _____ () C:\Windows\cdplayer.ini
2014-08-28 21:19 - 2010-12-04 10:36 - 00000000 ____D () C:\Program Files (x86)\Audiograbber
2014-08-23 04:07 - 2014-08-28 06:35 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-08-28 06:35 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-08-28 06:35 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-21 19:08 - 2013-06-29 14:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2014-08-20 19:41 - 2011-01-20 21:38 - 00000000 ____D () C:\Program Files (x86)\Brother
2014-08-19 20:05 - 2014-09-09 21:13 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-19 20:03 - 2014-08-02 17:17 - 00000000 ____D () C:\Users\VOW\Desktop\Ebermannstadt
2014-08-19 19:39 - 2014-09-09 21:13 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-19 01:01 - 2014-09-09 21:12 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-19 00:29 - 2014-09-09 21:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-19 00:29 - 2014-09-09 21:13 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-19 00:26 - 2014-09-09 21:12 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-19 00:20 - 2014-09-09 21:12 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-19 00:19 - 2014-09-09 21:12 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-19 00:15 - 2014-09-09 21:13 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-19 00:15 - 2014-09-09 21:13 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-19 00:14 - 2014-09-09 21:13 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-19 00:14 - 2014-09-09 21:12 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-19 00:08 - 2014-09-09 21:13 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-19 00:08 - 2014-09-09 21:13 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-19 00:08 - 2014-09-09 21:12 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-19 00:05 - 2014-09-09 21:13 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-19 00:03 - 2014-09-09 21:13 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-19 00:03 - 2014-09-09 21:13 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-19 00:03 - 2014-09-09 21:12 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
Some content of TEMP:
====================
C:\Users\VOW\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-09-17 18:54
==================== End Of Log ============================
|
|
19.09.2014, 09:41
| #9 |
| /// the machine /// TB-Ausbilder | Win7-64Bit - Browser, Netzwerkeinstellungen, Proxy wird immer automatisch aktiviert 127.0.0.1:49273 Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter ProxyServer: http=127.0.0.1:49501;https=127.0.0.1:49501
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
19.09.2014, 18:46
| #10 |
| | Win7-64Bit - Browser, Netzwerkeinstellungen, Proxy wird immer automatisch aktiviert 127.0.0.1:49273 Hier zuerst mal die Fixlog.txt Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 12-09-2014
Ran by VOW at 2014-09-19 15:47:09 Run:1
Running from C:\Users\VOW\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
ProxyServer: http=127.0.0.1:49501;https=127.0.0.1:49501
*****************
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
==== End of Fixlog ====
Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=e01a3838bfd28749b28b8f6d50fe4510
# engine=20232
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-09-19 02:36:33
# local_time=2014-09-19 04:36:33 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Norton Internet Security'
# compatibility_mode=3597 16777213 100 100 165145 173733978 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 36709862 162767243 0 0
# scanned=338304
# found=3
# cleaned=0
# scan_time=2577
sh=50EBDF9F3F405578D69D40BA4770321F658A9BDD ft=1 fh=03f6e976ed0dd68e vn="Variante von Win64/Systweak.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\System32\roboot64.exe.vir"
sh=4B9B1607C28352F8FDE107E2E08AF260F0237A96 ft=1 fh=f338f095141cac61 vn="Variante von Win32/Toolbar.Conduit.I evtl. unerwünschte Anwendung" ac=I fn="D:\Programme\UBCD4Win\BartPE\PROGRAMS\ExpressBurn\expressburn.exe"
sh=4B9B1607C28352F8FDE107E2E08AF260F0237A96 ft=1 fh=f338f095141cac61 vn="Variante von Win32/Toolbar.Conduit.I evtl. unerwünschte Anwendung" ac=I fn="D:\Programme\UBCD4Win\plugin\CDBurning\ExpressBurn\expressburn.exe"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=e01a3838bfd28749b28b8f6d50fe4510
# engine=20232
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-09-19 04:06:33
# local_time=2014-09-19 06:06:33 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Norton Internet Security'
# compatibility_mode=3597 16777213 100 100 170545 173739378 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 36715262 162772643 0 0
# scanned=519851
# found=9
# cleaned=0
# scan_time=5295
sh=50EBDF9F3F405578D69D40BA4770321F658A9BDD ft=1 fh=03f6e976ed0dd68e vn="Variante von Win64/Systweak.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\System32\roboot64.exe.vir"
sh=4B9B1607C28352F8FDE107E2E08AF260F0237A96 ft=1 fh=f338f095141cac61 vn="Variante von Win32/Toolbar.Conduit.I evtl. unerwünschte Anwendung" ac=I fn="D:\Programme\UBCD4Win\BartPE\PROGRAMS\ExpressBurn\expressburn.exe"
sh=4B9B1607C28352F8FDE107E2E08AF260F0237A96 ft=1 fh=f338f095141cac61 vn="Variante von Win32/Toolbar.Conduit.I evtl. unerwünschte Anwendung" ac=I fn="D:\Programme\UBCD4Win\plugin\CDBurning\ExpressBurn\expressburn.exe"
sh=2EED5A01848421963D0AF56C8FB7D5006CA9E0A0 ft=1 fh=cd9a494e7fb35f6b vn="Variante von Win32/DownloadGuide.A evtl. unerwünschte Anwendung" ac=I fn="D:\VOW\Downloads\HijackThis-Downloader.exe"
sh=89794A52C3A44B7D84469082C9F3F37D5BE48136 ft=1 fh=3c2e80fd801fcc94 vn="Variante von Win32/AdWare.iBryte.BH Anwendung" ac=I fn="D:\VOW\Downloads\Setup (1).exe"
sh=7B7BE0077D4FA4CF413AB1085E71C8537D7432C7 ft=1 fh=c53d4a5dd351252f vn="Variante von Win32/AdWare.iBryte.BH Anwendung" ac=I fn="D:\VOW\Downloads\Setup (2).exe"
sh=14035F744780D3B1C0CEDF893025161EC54D573E ft=1 fh=38446179d28b71bd vn="Variante von Win32/AdWare.iBryte.BG Anwendung" ac=I fn="D:\VOW\Downloads\Setup.exe"
sh=89736ED1697CAD6AAB389D57512F4464BAADD2DF ft=1 fh=8037d3bdfa72eef4 vn="Variante von Win32/GetNow.B evtl. unerwünschte Anwendung" ac=I fn="D:\VOW\Downloads\TECHLINE LCD-FUNKWECKER user guide provided through handbucherfuralles.de (1).exe"
sh=E439C97E9EC5EB6FE1A42BA6E811F7D338F3C824 ft=1 fh=9ae7f7a18fa3b7dd vn="Variante von Win32/InstallShare.A evtl. unerwünschte Anwendung" ac=I fn="S:\Corsair-Stick\RockXP4.exe"
Code:
ATTFilter Results of screen317's Security Check version 0.99.87
Windows 7 Service Pack 1 x64 (UAC is disabled!)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Norton Internet Security
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Java 7 Update 67
Adobe Flash Player 15.0.0.152
Adobe Reader XI
Mozilla Firefox (3.5.7) Firefox out of Date!
Mozilla Thunderbird (24.6.0)
Google Chrome 37.0.2062.103
Google Chrome 37.0.2062.120
Google Chrome Plugins...
````````Process Check: objlist.exe by Laurent````````
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-09-2014
Ran by VOW (administrator) on VOW-PC on 19-09-2014 19:41:57
Running from C:\Users\VOW\Desktop
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
() C:\Program Files (x86)\Ashampoo\Ashampoo Core Tuner 2\ACT2Service.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(DATA BECKER GmbH & Co KG) C:\Program Files (x86)\Common Files\DATA BECKER Shared\DBService.exe
(mst software GmbH, Germany) D:\Programme\Ashampoo WinOptimizer 10\DfSdkS64.exe
(Garmin Ltd or its subsidiaries) D:\Programme\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
() C:\Windows\SysWOW64\XSrvSetup.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.5.0.19\nis.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
() C:\Program Files (x86)\Synology Data Replicator 3\SynoDrServicex64.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
() C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Program Files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.5.0.19\nis.exe
() C:\Program Files (x86)\ASRock Utility\AXTU\Bin\AsrXTU.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdcBase.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Apple Inc.) D:\Programme\iCloud\ApplePhotoStreams.exe
(Apple Inc.) D:\Programme\iCloud\iCloudServices.exe
() C:\Users\VOW\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe
(Garmin Ltd or its subsidiaries) D:\Programme\Garmin\Express Tray\ExpressTray.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPoint\SetPoint.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(InstallShield Software Corporation) C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Samsung Electronics.) C:\Program Files (x86)\Samsung SSD Magician\Samsung Magician.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
() C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
(Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\BrccMCtl.exe
(Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TimounterMonitor.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(FNet Co., Ltd.) C:\Program Files (x86)\XFastUSB\XFastUsb.exe
(TODO: <公司名>) C:\Program Files (x86)\Perixx Gaming mouse\SE61T-UserTools.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Apple Inc.) D:\Programme\iCloud\APSDaemon.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler64.exe
() C:\Program Files\ASRock Utility\XFast RAM\asrRd.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\WMPSideShowGadget.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Google Inc.) C:\Users\VOW\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\VOW\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\VOW\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\VOW\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\VOW\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\VOW\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [104008 2010-11-16] (Logitech Inc.)
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [403656 2012-04-27] (Acronis)
HKLM\...\Run: [Windows Mobile-based device management] => C:\Windows\WindowsMobile\wmdcBase.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13307496 2011-10-17] (Realtek Semiconductor)
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [374784 2014-01-09] (shbox.de)
HKLM-x32\...\Run: [ISUSScheduler] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [81920 2005-02-17] (InstallShield Software Corporation)
HKLM-x32\...\Run: [ArcSoft Connection Service] => C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [ATICustomerCare] => C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe [311296 2010-03-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2621440 2010-02-09] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [5993136 2012-04-27] (Acronis)
HKLM-x32\...\Run: [Name of App] => C:\Program Files (x86)\SAMSUNG\FW LiveUpdate\FWManager.exe [692307 2011-11-23] ( )
HKLM-x32\...\Run: [AcronisTimounterMonitor] => C:\Program Files (x86)\Acronis\TrueImageHome\TimounterMonitor.exe [1173680 2012-04-27] (Acronis)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-06] (Apple Inc.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-01-26] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)
HKLM-x32\...\Run: [XFastUSB] => C:\Program Files (x86)\XFastUSB\XFastUsb.exe [5019360 2012-10-16] (FNet Co., Ltd.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SE61T-UserTools] => C:\Program Files (x86)\Perixx Gaming mouse\SE61T-UserTools.exe [754176 2013-10-08] (TODO: <公司名>)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\.DEFAULT\...\Run: [GarminExpressTrayApp] => D:\Programme\Garmin\Express Tray\ExpressTray.exe [688984 2014-07-23] (Garmin Ltd or its subsidiaries)
HKU\S-1-5-21-3018767705-964232526-3307114488-1001\...\Run: [ApplePhotoStreams] => D:\Programme\iCloud\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-3018767705-964232526-3307114488-1001\...\Run: [iCloudServices] => D:\Programme\iCloud\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-3018767705-964232526-3307114488-1001\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-11-09] (Google Inc.)
HKU\S-1-5-21-3018767705-964232526-3307114488-1001\...\Run: [Amazon Cloud Player] => C:\Users\VOW\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3168576 2014-03-07] ()
HKU\S-1-5-21-3018767705-964232526-3307114488-1001\...\Run: [GarminExpressTrayApp] => D:\Programme\Garmin\Express Tray\ExpressTray.exe [688984 2014-07-23] (Garmin Ltd or its subsidiaries)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Logitech SetPoint.lnk
ShortcutTarget: Logitech SetPoint.lnk -> C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
Startup: C:\Users\VOW\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\VOW\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Magician.lnk
ShortcutTarget: Samsung Magician.lnk -> C:\Windows\System32\schtasks.exe (Microsoft Corporation)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xF53C4A75345ACA01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine64\21.5.0.19\coIEPlg.dll (Symantec Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> No File
BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine\21.5.0.19\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\21.5.0.19\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Free Download Manager -> {CC59E0F9-7E43-44FA-9FAA-8377850BF205} -> D:\Programme\Free Download Manager\iefdm2.dll (FreeDownloadManager.ORG)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.5.0.19\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\21.5.0.19\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.5.0.19\coIEPlg.dll (Symantec Corporation)
DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default
FF NewTab: about:blank
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @garmin.com/GpsControl -> C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @pages.tvunetworks.com/WebPlayer -> C:\Program Files (x86)\TVUPlayer\npTVUAx.dll No File
FF Plugin-x32: @protectdisc.com/NPPDLicenseHelper -> C:\Program Files (x86)\ProtectDisc\License Helper\NPPDLicenseHelper.dll ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 -> D:\Programme\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\VOW\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\VOW\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npnul32.dll (mozilla.org)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPPDLicenseHelper.dll ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} [2010-03-21]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} [2010-04-09]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010-04-18]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [2010-09-15]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2010-12-13]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011-05-13]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [2011-10-12]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} [2011-12-12]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} [2012-05-12]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2012-07-14]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA} [2012-08-15]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2012-10-12]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2012-11-15]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.3.0.12\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.3.0.12\coFFPlgn [2014-09-19]
FF Extension: No Name - C:\Program Files (x86)\Better-Surf\ff [Not Found]
FF Extension: No Name - C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\extensions\engine@conduit.com [Not Found]
FF Extension: No Name - C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\extensions\{e53a26f5-7199-4a5b-86f5-d2e86854b979} [Not Found]
FF Extension: No Name - C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [Not Found]
FF Extension: Free Download Manager plugin - C:\ProgramData\Free Download Manager\Firefox\Extensions\1.6.0.1 [2014-02-08]
FF Extension: No Name - C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [Not Found]
FF Extension: No Name - C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha86\ff [Not Found]
FF Extension: No Name - C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} [Not Found]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\quickstores@quickstores.de [Not Found]
FF Extension: No Name - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta736\ff [Not Found]
FF Extension: No Name - C:\Users\VOW\AppData\Roaming\Mozilla\Firefox\Profiles\c20vf9y6.default\extensions\vshare@toolbar [Not Found]
FF Extension: No Name - C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha299\ff [Not Found]
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.3.0.12\IPSFF [2014-06-01]
Chrome:
=======
CHR HomePage: Default -> 70273D4A73185E1C7F9D0A7E3F1791EB831D3793320780E6ADB5D014FA23638E
CHR DefaultSearchKeyword: Default -> BC80E05DC82AF6416A9ECFA7EEC0144E68E756648459E3918BD27F33343726AE
CHR DefaultSearchURL: Default -> 8125CF63F549EEC5F92611A408916731FA0070512C79FBB50EF3019F102DCA33
CHR Profile: C:\Users\VOW\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\VOW\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-06-30]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\VOW\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-08-27]
CHR Extension: (YouTube) - C:\Users\VOW\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-10-17]
CHR Extension: (Battlefield Heroes) - C:\Users\VOW\AppData\Local\Google\Chrome\User Data\Default\Extensions\cehdakiococlfmjcbebbkjkfjhbieknh [2013-05-30]
CHR Extension: (SAS Zombie Assault 3) - C:\Users\VOW\AppData\Local\Google\Chrome\User Data\Default\Extensions\ckmedboncpahmbhnpaamimdohjfpphea [2012-11-04]
CHR Extension: (Google Search) - C:\Users\VOW\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-10-17]
CHR Extension: (Google Wallet) - C:\Users\VOW\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-02]
CHR Extension: (Gmail) - C:\Users\VOW\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-10-17]
CHR HKCU\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\VOW\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2013-06-29]
CHR HKLM-x32\...\Chrome\Extension: [fnjbmmemklcjgepojigaapkoodmkgbae] - C:\Program Files (x86)\DivX\DivX Plus Web Player\google_chrome\wpa\wpa.crx [2013-06-29]
CHR HKLM-x32\...\Chrome\Extension: [hihneggbbhdjkjbckjdpjjnflgpghbjf] - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta736\ch\VideoPlayerV3beta736.crx [2013-06-29]
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\google_chrome\html5video\html5video.crx [2013-06-29]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 ACT2_Service; C:\Program Files (x86)\Ashampoo\Ashampoo Core Tuner 2\ACT2Service.exe [1420184 2011-08-09] ()
R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [File not signed]
R2 DBService; C:\Program Files (x86)\Common Files\DATA BECKER Shared\DBService.exe [187456 2009-11-08] (DATA BECKER GmbH & Co KG) [File not signed]
R2 DfSdkS; D:\Programme\Ashampoo WinOptimizer 10\DfsdkS64.exe [544768 2009-08-24] (mst software GmbH, Germany) [File not signed]
S2 ES lite Service; C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE [68136 2009-08-24] ()
R2 Fabs; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [1858048 2012-01-23] (MAGIX AG) [File not signed]
S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2702848 2011-04-26] (MAGIX®) [File not signed]
R2 Garmin Core Update Service; D:\Programme\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [438616 2014-07-23] (Garmin Ltd or its subsidiaries)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 JMB36X; C:\Windows\SysWOW64\XSrvSetup.exe [72304 2010-01-19] ()
R2 MSSQL$SQLEXPRESS; c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [57617752 2009-03-30] (Microsoft Corporation)
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\21.5.0.19\NIS.exe [276376 2014-07-31] (Symantec Corporation)
R2 OS Selector; C:\Program Files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe [2155848 2011-11-15] ()
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75136 2013-05-30] ()
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [117264 2009-10-20] (CACE Technologies, Inc.)
S4 SQLAgent$SQLEXPRESS; c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [427880 2009-03-30] (Microsoft Corporation)
R2 SynoDrService; C:\Program Files (x86)\Synology Data Replicator 3\SynoDrServicex64.exe [381312 2013-04-24] () [File not signed]
R2 UsbClientService; C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe [248704 2013-04-30] () [File not signed]
S3 WO_LiveService; D:\Programme\Ashampoo WinOptimizer 10\LiveTunerService.exe [885096 2013-05-15] ()
S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe /launchService [X]
S3 STSService; "C:\Program Files (x86)\SoundTaxi Media Suite\STSService.exe" [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 ACT2PM; C:\Program Files (x86)\Ashampoo\Ashampoo Core Tuner 2\ACT2ProcessMonitor64.sys [15160 2011-06-10] ()
R0 asahci64; C:\Windows\System32\DRIVERS\asahci64.sys [49760 2011-09-21] (Asmedia Technology)
R0 AsrRamDisk; C:\Windows\System32\DRIVERS\AsrRamDisk.sys [31016 2012-01-13] (ASRock Inc.)
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [211456 2010-11-27] () [File not signed]
R1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.3.0.12\Definitions\BASHDefs\20140912.003\BHDrvx64.sys [1586904 2014-09-13] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1505000.013\ccSetx64.sys [162392 2014-02-21] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [487216 2014-09-09] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142640 2014-09-09] (Symantec Corporation)
R3 FNETTBOH_305; C:\Windows\System32\drivers\FNETTBOH_305.SYS [32320 2014-09-19] (FNet Co., Ltd.)
R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [15936 2012-10-16] (FNet Co., Ltd.)
U5 FontCache3.0.0.0; C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [42856 2010-11-05] (Microsoft Corporation)
R1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.3.0.12\Definitions\IPSDefs\20140918.003\IDSvia64.sys [633560 2014-08-29] (Symantec Corporation)
S3 leafnets; C:\Windows\System32\DRIVERS\leafnets.sys [29696 2011-05-26] (Leaf Networks)
S3 libusb0; C:\Windows\System32\drivers\libusb0.sys [44480 2013-09-23] (hxxp://libusb-win32.sourceforge.net)
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [35328 2010-11-27] () [File not signed]
S2 lirsgt; C:\Windows\SysWOW64\DRIVERS\lirsgt.sys [18048 2010-11-27] () [File not signed]
R2 LiveTunerPM; D:\Programme\Ashampoo WinOptimizer 10\LiveTunerProcessMonitor64.sys [12824 2011-03-08] ()
S3 NAVENG; C:\Program Files (x86)\Norton Internet Security\NortonData\21.3.0.12\Definitions\VirusDefs\20140918.025\ENG64.SYS [129752 2014-08-21] (Symantec Corporation)
S3 NAVEX15; C:\Program Files (x86)\Norton Internet Security\NortonData\21.3.0.12\Definitions\VirusDefs\20140918.025\EX64.SYS [2137304 2014-08-21] (Symantec Corporation)
R2 NPF; C:\Windows\system32\drivers\npf.sys [35344 2013-01-03] (CACE Technologies, Inc.)
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [19912 2009-12-21] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [13264 2009-12-21] ()
R0 sfdrv01a; C:\Windows\System32\drivers\sfdrv01a.sys [77432 2009-02-03] (Protection Technology (StarForce))
S3 SndTAudio; C:\Windows\System32\drivers\SndTAudio.sys [33336 2010-02-18] (Windows (R) Codename Longhorn DDK provider)
S3 SRTSP; C:\Windows\System32\Drivers\NISx64\1505000.013\SRTSP64.SYS [875736 2014-02-13] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1505000.013\SRTSPX64.SYS [36952 2013-10-30] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1505000.013\SYMDS64.SYS [493656 2013-10-30] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1505000.013\SYMEFA64.SYS [1148120 2014-03-04] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-06-01] (Symantec Corporation)
R1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [78936 2013-10-30] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1505000.013\Ironx64.SYS [264280 2013-10-30] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1505000.013\SYMNETS.SYS [593112 2014-02-18] (Symantec Corporation)
S3 V0260VID; C:\Windows\System32\DRIVERS\V0260Vid.sys [189664 2007-07-18] (Creative Technology Ltd.)
S3 AIDA64Driver; \??\C:\Users\VOW\AppData\Local\Temp\Rar$EX01.439\kerneld.x64 [X]
S2 AODDriver4.01; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [X]
S2 AODDriver4.1; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [X]
R3 AxtuDrv; \??\C:\Windows\SysWOW64\Drivers\AxtuDrv.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
S3 Fwleaf; system32\DRIVERS\fwleaf.sys [X]
S3 SliceDisk5; \??\C:\Program Files\A-FF Find and Mount\slicedisk-x64.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 WPRO_41_1742; system32\drivers\WPRO_41_1742.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-19 19:41 - 2014-09-19 19:41 - 00033819 _____ () C:\Users\VOW\Desktop\FRST.txt
2014-09-19 15:44 - 2014-09-19 15:44 - 00854417 _____ () C:\Users\VOW\Desktop\SecurityCheck.exe
2014-09-19 15:43 - 2014-09-19 15:40 - 02347384 _____ (ESET) C:\Users\VOW\Desktop\esetsmartinstaller_deu.exe
2014-09-18 18:05 - 2014-09-18 18:05 - 00061985 _____ () C:\Users\VOW\Desktop\FRST_180914.txt
2014-09-18 18:04 - 2014-09-18 18:05 - 00061985 _____ () C:\Users\VOW\Desktop\FRST_180914_v2.txt
2014-09-18 18:03 - 2014-09-18 18:03 - 00002104 _____ () C:\Users\VOW\Desktop\JRT.txt
2014-09-18 17:59 - 2014-09-18 17:59 - 00000000 ____D () C:\Windows\ERUNT
2014-09-18 17:57 - 2014-09-18 17:57 - 00043689 _____ () C:\Users\VOW\Desktop\AdwCleaner[S0].txt
2014-09-18 17:53 - 2014-09-18 17:56 - 00000000 ____D () C:\AdwCleaner
2014-09-18 17:45 - 2014-09-18 17:45 - 00028283 _____ () C:\Users\VOW\Desktop\mbam_180914_1.txt
2014-09-18 17:43 - 2014-09-19 15:35 - 00003018 _____ () C:\Windows\System32\Tasks\asrRd
2014-09-18 17:35 - 2014-09-18 17:44 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-18 17:34 - 2014-09-18 17:34 - 00001108 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-18 17:34 - 2014-09-18 17:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-09-18 17:34 - 2014-09-18 17:34 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-18 17:34 - 2014-09-18 17:34 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-09-18 17:34 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-18 17:34 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-09-18 17:34 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-18 17:33 - 2014-09-18 17:33 - 01016830 _____ (Thisisu) C:\Users\VOW\Desktop\JRT.exe
2014-09-18 17:32 - 2014-09-18 17:32 - 01373475 _____ () C:\Users\VOW\Desktop\AdwCleaner_3.310.exe
2014-09-18 17:32 - 2014-09-18 17:31 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\VOW\Desktop\mbam-setup-2.0.2.1012.exe
2014-09-18 06:48 - 2014-09-18 06:48 - 00043286 _____ () C:\Users\VOW\Desktop\Combofix.txt
2014-09-18 06:47 - 2014-09-18 06:47 - 00043286 _____ () C:\ComboFix.txt
2014-09-18 06:40 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-09-18 06:40 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-09-18 06:40 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-09-18 06:40 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-09-18 06:40 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-09-18 06:40 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-09-18 06:40 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-09-18 06:40 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-09-18 06:39 - 2014-09-18 06:47 - 00000000 ____D () C:\Qoobox
2014-09-18 06:39 - 2014-09-18 06:46 - 00000000 ____D () C:\Windows\erdnt
2014-09-18 06:38 - 2014-09-18 06:37 - 05579386 ____R (Swearware) C:\Users\VOW\Desktop\ComboFix.exe
2014-09-18 06:20 - 2014-09-18 06:20 - 00001288 _____ () C:\Users\VOW\Desktop\Revo Uninstaller.lnk
2014-09-18 06:20 - 2014-09-18 06:20 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-09-18 06:18 - 2014-09-18 06:18 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\VOW\Desktop\revosetup95.exe
2014-09-17 23:13 - 2014-09-17 23:13 - 00037812 _____ () C:\Users\VOW\Desktop\Logfiles.zip
2014-09-17 22:51 - 2014-09-17 22:51 - 00021731 _____ () C:\Users\VOW\Desktop\Gmer.txt
2014-09-17 22:42 - 2014-09-17 22:42 - 00079142 _____ () C:\Users\VOW\Desktop\Addition_170914_1.txt
2014-09-17 22:41 - 2014-09-19 19:41 - 00000000 ____D () C:\FRST
2014-09-17 22:41 - 2014-09-17 22:42 - 00071690 _____ () C:\Users\VOW\Desktop\FRST_170914_1.txt
2014-09-17 22:38 - 2014-09-17 22:38 - 00000477 _____ () C:\Users\VOW\Desktop\Ad-Aware_Report_Full_Manual_2014-09-17T22-37-25.374734.xml
2014-09-17 22:10 - 2014-09-17 22:11 - 00000468 _____ () C:\Users\VOW\Desktop\defogger_disable.log
2014-09-17 22:10 - 2014-09-17 22:10 - 00000000 _____ () C:\Users\VOW\defogger_reenable
2014-09-17 21:56 - 2014-09-17 21:55 - 00380416 _____ () C:\Users\VOW\Desktop\Gmer-19357.exe
2014-09-17 21:55 - 2014-09-17 21:55 - 02105856 _____ (Farbar) C:\Users\VOW\Desktop\FRST64.exe
2014-09-17 21:53 - 2014-09-17 21:53 - 00050477 _____ () C:\Users\VOW\Desktop\Defogger.exe
2014-09-17 21:51 - 2014-09-17 21:51 - 00000000 ____D () C:\Users\VOW\Desktop\Outdoor
2014-09-17 21:51 - 2014-09-17 21:51 - 00000000 ____D () C:\Users\VOW\Desktop\Copter
2014-09-12 18:53 - 2014-09-12 18:53 - 00000000 ____D () C:\Users\VOW\AppData\Roaming\LavasoftStatistics
2014-09-10 21:16 - 2014-09-10 21:16 - 00000000 ____D () C:\Users\VOW\AppData\Local\Adobe
2014-09-09 21:13 - 2014-08-19 20:05 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-09 21:13 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-09-09 21:13 - 2014-08-19 00:29 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-09 21:13 - 2014-08-19 00:29 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-09 21:13 - 2014-08-19 00:15 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-09 21:13 - 2014-08-19 00:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-09 21:13 - 2014-08-19 00:14 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-09 21:13 - 2014-08-19 00:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-09 21:13 - 2014-08-19 00:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-09 21:13 - 2014-08-19 00:05 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-09 21:13 - 2014-08-19 00:03 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-09 21:13 - 2014-08-19 00:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-09 21:13 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-09-09 21:13 - 2014-08-18 23:51 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-09 21:13 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-09-09 21:13 - 2014-08-18 23:45 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-09 21:13 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-09-09 21:13 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-09-09 21:13 - 2014-08-18 23:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-09 21:13 - 2014-08-18 23:39 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-09 21:13 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-09 21:13 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-09-09 21:13 - 2014-08-18 23:38 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-09 21:13 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-09-09 21:13 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-09-09 21:13 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-09-09 21:13 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-09-09 21:13 - 2014-08-18 23:25 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-09 21:13 - 2014-08-18 23:25 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-09 21:13 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-09-09 21:13 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-09-09 21:13 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-09-09 21:13 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-09 21:13 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-09 21:12 - 2014-08-19 01:01 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-09 21:12 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-09 21:12 - 2014-08-19 00:20 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-09 21:12 - 2014-08-19 00:19 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-09 21:12 - 2014-08-19 00:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-09 21:12 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-09-09 21:12 - 2014-08-19 00:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-09 21:12 - 2014-08-18 23:56 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-09 21:12 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-09-09 21:12 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-09 21:12 - 2014-08-18 23:23 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-09 21:12 - 2014-08-18 23:23 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-09 21:12 - 2014-08-18 23:16 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-09 21:12 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-09 21:12 - 2014-08-18 23:15 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-09 21:12 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-09 21:12 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-09-09 21:12 - 2014-08-18 22:55 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-09 21:12 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-09 21:12 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-09 21:12 - 2014-08-18 22:38 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-09 21:12 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-09-09 21:10 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-09 21:10 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2014-09-09 19:30 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-09 19:30 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-09 19:30 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-09 19:30 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-09-09 19:30 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-09 19:30 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-09 19:30 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-09-09 19:30 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-09-09 19:30 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-09-09 19:30 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-09 19:30 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-09-05 20:48 - 2014-09-05 19:41 - 00675988 _____ () C:\Users\VOW\Desktop\Minecraft.exe
2014-09-01 09:34 - 2014-09-01 09:34 - 00000891 _____ () C:\Users\Public\Desktop\MAGIX Video deluxe 2015 Plus.lnk
2014-09-01 09:34 - 2014-09-01 09:34 - 00000000 ____D () C:\Users\VOW\AppData\Local\Magix
2014-09-01 09:34 - 2014-09-01 09:34 - 00000000 ____D () C:\Program Files\Common Files\MAGIX Shared
2014-09-01 09:09 - 2014-09-05 13:31 - 00000026 _____ () C:\Windows\Zone.Identifier
2014-09-01 08:39 - 2014-09-01 08:39 - 00000000 ____D () C:\Amazon MP3
2014-08-28 06:35 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 06:35 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-28 06:35 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-26 16:12 - 2014-04-13 10:15 - 834916622 _____ () C:\Users\VOW\Desktop\Copter_Flug3_remix_dashware_120414.mp4
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-19 19:42 - 2014-09-19 19:41 - 00033819 _____ () C:\Users\VOW\Desktop\FRST.txt
2014-09-19 19:41 - 2014-09-17 22:41 - 00000000 ____D () C:\FRST
2014-09-19 19:26 - 2012-04-01 08:31 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-19 19:06 - 2012-10-17 18:57 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3018767705-964232526-3307114488-1001UA.job
2014-09-19 19:06 - 2009-10-31 17:55 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-19 16:06 - 2009-10-31 17:55 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-19 15:44 - 2014-09-19 15:44 - 00854417 _____ () C:\Users\VOW\Desktop\SecurityCheck.exe
2014-09-19 15:44 - 2009-07-14 19:58 - 00767720 _____ () C:\Windows\system32\perfh007.dat
2014-09-19 15:44 - 2009-07-14 19:58 - 00175704 _____ () C:\Windows\system32\perfc007.dat
2014-09-19 15:44 - 2009-07-14 07:13 - 01813706 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-19 15:42 - 2010-06-06 17:28 - 00003914 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{74AA5567-A267-4A41-8611-8F0F98C5D7DA}
2014-09-19 15:42 - 2009-07-14 06:45 - 00022864 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-19 15:42 - 2009-07-14 06:45 - 00022864 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-19 15:41 - 2012-10-20 15:19 - 00032320 _____ (FNet Co., Ltd.) C:\Windows\system32\Drivers\FNETTBOH_305.SYS
2014-09-19 15:40 - 2014-09-19 15:43 - 02347384 _____ (ESET) C:\Users\VOW\Desktop\esetsmartinstaller_deu.exe
2014-09-19 15:36 - 2009-10-31 16:04 - 01927702 _____ () C:\Windows\WindowsUpdate.log
2014-09-19 15:35 - 2014-09-18 17:43 - 00003018 _____ () C:\Windows\System32\Tasks\asrRd
2014-09-19 15:35 - 2012-10-16 22:45 - 00002952 _____ () C:\Windows\System32\Tasks\AsrXTU
2014-09-19 15:35 - 2009-11-29 19:25 - 00000000 ____D () C:\Users\VOW\AppData\Local\FreePDF_XP
2014-09-19 15:34 - 2013-09-11 06:26 - 00000073 _____ () C:\service.log
2014-09-19 15:34 - 2013-08-16 19:06 - 00031247 _____ () C:\Windows\setupact.log
2014-09-19 15:34 - 2010-07-27 21:49 - 00025640 _____ (Windows (R) Server 2003 DDK provider) C:\Windows\gdrv.sys
2014-09-19 15:34 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-18 21:06 - 2012-10-17 18:57 - 00001060 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3018767705-964232526-3307114488-1001Core.job
2014-09-18 18:05 - 2014-09-18 18:05 - 00061985 _____ () C:\Users\VOW\Desktop\FRST_180914.txt
2014-09-18 18:05 - 2014-09-18 18:04 - 00061985 _____ () C:\Users\VOW\Desktop\FRST_180914_v2.txt
2014-09-18 18:03 - 2014-09-18 18:03 - 00002104 _____ () C:\Users\VOW\Desktop\JRT.txt
2014-09-18 17:59 - 2014-09-18 17:59 - 00000000 ____D () C:\Windows\ERUNT
2014-09-18 17:57 - 2014-09-18 17:57 - 00043689 _____ () C:\Users\VOW\Desktop\AdwCleaner[S0].txt
2014-09-18 17:57 - 2013-08-21 18:04 - 00366384 _____ () C:\Windows\PFRO.log
2014-09-18 17:56 - 2014-09-18 17:53 - 00000000 ____D () C:\AdwCleaner
2014-09-18 17:56 - 2009-10-31 16:20 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-18 17:45 - 2014-09-18 17:45 - 00028283 _____ () C:\Users\VOW\Desktop\mbam_180914_1.txt
2014-09-18 17:44 - 2014-09-18 17:35 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-18 17:34 - 2014-09-18 17:34 - 00001108 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-18 17:34 - 2014-09-18 17:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-09-18 17:34 - 2014-09-18 17:34 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-18 17:34 - 2014-09-18 17:34 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-09-18 17:33 - 2014-09-18 17:33 - 01016830 _____ (Thisisu) C:\Users\VOW\Desktop\JRT.exe
2014-09-18 17:32 - 2014-09-18 17:32 - 01373475 _____ () C:\Users\VOW\Desktop\AdwCleaner_3.310.exe
2014-09-18 17:31 - 2014-09-18 17:32 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\VOW\Desktop\mbam-setup-2.0.2.1012.exe
2014-09-18 07:01 - 2014-02-22 14:12 - 00000000 ____D () C:\Users\VOW\AppData\Local\Amazon Cloud Player
2014-09-18 06:48 - 2014-09-18 06:48 - 00043286 _____ () C:\Users\VOW\Desktop\Combofix.txt
2014-09-18 06:47 - 2014-09-18 06:47 - 00043286 _____ () C:\ComboFix.txt
2014-09-18 06:47 - 2014-09-18 06:39 - 00000000 ____D () C:\Qoobox
2014-09-18 06:46 - 2014-09-18 06:39 - 00000000 ____D () C:\Windows\erdnt
2014-09-18 06:46 - 2009-07-14 04:34 - 00000246 _____ () C:\Windows\system.ini
2014-09-18 06:45 - 2009-07-14 04:34 - 56623104 _____ () C:\Windows\system32\config\components.bak
2014-09-18 06:45 - 2009-07-14 04:34 - 43515904 _____ () C:\Windows\system32\config\system.bak
2014-09-18 06:45 - 2009-07-14 04:34 - 110100480 _____ () C:\Windows\system32\config\software.bak
2014-09-18 06:45 - 2009-07-14 04:34 - 03407872 _____ () C:\Windows\system32\config\default.bak
2014-09-18 06:45 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\security.bak
2014-09-18 06:45 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\sam.bak
2014-09-18 06:44 - 2009-10-31 16:10 - 00000000 ____D () C:\Users\VOW
2014-09-18 06:37 - 2014-09-18 06:38 - 05579386 ____R (Swearware) C:\Users\VOW\Desktop\ComboFix.exe
2014-09-18 06:36 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Public\Libraries
2014-09-18 06:35 - 2014-02-01 11:30 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-09-18 06:20 - 2014-09-18 06:20 - 00001288 _____ () C:\Users\VOW\Desktop\Revo Uninstaller.lnk
2014-09-18 06:20 - 2014-09-18 06:20 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-09-18 06:18 - 2014-09-18 06:18 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\VOW\Desktop\revosetup95.exe
2014-09-18 06:13 - 2014-02-01 11:30 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-09-17 23:13 - 2014-09-17 23:13 - 00037812 _____ () C:\Users\VOW\Desktop\Logfiles.zip
2014-09-17 23:13 - 2011-08-18 09:47 - 00000000 ____D () C:\Program Files (x86)\PowerArchiver
2014-09-17 22:51 - 2014-09-17 22:51 - 00021731 _____ () C:\Users\VOW\Desktop\Gmer.txt
2014-09-17 22:42 - 2014-09-17 22:42 - 00079142 _____ () C:\Users\VOW\Desktop\Addition_170914_1.txt
2014-09-17 22:42 - 2014-09-17 22:41 - 00071690 _____ () C:\Users\VOW\Desktop\FRST_170914_1.txt
2014-09-17 22:38 - 2014-09-17 22:38 - 00000477 _____ () C:\Users\VOW\Desktop\Ad-Aware_Report_Full_Manual_2014-09-17T22-37-25.374734.xml
2014-09-17 22:11 - 2014-09-17 22:10 - 00000468 _____ () C:\Users\VOW\Desktop\defogger_disable.log
2014-09-17 22:10 - 2014-09-17 22:10 - 00000000 _____ () C:\Users\VOW\defogger_reenable
2014-09-17 21:55 - 2014-09-17 21:56 - 00380416 _____ () C:\Users\VOW\Desktop\Gmer-19357.exe
2014-09-17 21:55 - 2014-09-17 21:55 - 02105856 _____ (Farbar) C:\Users\VOW\Desktop\FRST64.exe
2014-09-17 21:53 - 2014-09-17 21:53 - 00050477 _____ () C:\Users\VOW\Desktop\Defogger.exe
2014-09-17 21:51 - 2014-09-17 21:51 - 00000000 ____D () C:\Users\VOW\Desktop\Outdoor
2014-09-17 21:51 - 2014-09-17 21:51 - 00000000 ____D () C:\Users\VOW\Desktop\Copter
2014-09-17 18:34 - 2013-05-12 20:55 - 00002471 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-09-14 16:04 - 2012-05-26 18:13 - 00000000 ____D () C:\Users\VOW\AppData\Roaming\.minecraft
2014-09-13 11:20 - 2010-07-14 05:38 - 00000472 ____H () C:\Windows\Tasks\Norton Security Scan for VOW.job
2014-09-12 18:53 - 2014-09-12 18:53 - 00000000 ____D () C:\Users\VOW\AppData\Roaming\LavasoftStatistics
2014-09-10 21:16 - 2014-09-10 21:16 - 00000000 ____D () C:\Users\VOW\AppData\Local\Adobe
2014-09-10 19:26 - 2012-04-01 08:31 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-10 19:26 - 2012-04-01 08:30 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-10 19:26 - 2011-06-10 22:05 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-10 19:10 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-09 21:12 - 2013-08-16 23:02 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-09 21:12 - 2010-12-17 19:26 - 01787050 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-09-09 21:10 - 2014-05-09 21:25 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-09 21:10 - 2009-10-31 16:18 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-05 20:49 - 2010-03-06 14:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\gMapMaker
2014-09-05 19:41 - 2014-09-05 20:48 - 00675988 _____ () C:\Users\VOW\Desktop\Minecraft.exe
2014-09-05 13:31 - 2014-09-01 09:09 - 00000026 _____ () C:\Windows\Zone.Identifier
2014-09-05 04:10 - 2014-09-09 19:30 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-05 04:05 - 2014-09-09 19:30 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-03 19:21 - 2009-07-14 06:45 - 00513544 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-01 09:37 - 2009-10-31 16:58 - 00148448 _____ () C:\Users\VOW\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-01 09:36 - 2009-11-09 21:11 - 00000000 ____D () C:\Users\VOW\AppData\Local\CrashDumps
2014-09-01 09:34 - 2014-09-01 09:34 - 00000891 _____ () C:\Users\Public\Desktop\MAGIX Video deluxe 2015 Plus.lnk
2014-09-01 09:34 - 2014-09-01 09:34 - 00000000 ____D () C:\Users\VOW\AppData\Local\Magix
2014-09-01 09:34 - 2014-09-01 09:34 - 00000000 ____D () C:\Program Files\Common Files\MAGIX Shared
2014-09-01 09:34 - 2011-11-25 19:06 - 00000000 ____D () C:\Users\VOW\AppData\Roaming\MAGIX
2014-09-01 09:34 - 2011-11-25 19:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MAGIX
2014-09-01 09:34 - 2011-11-25 19:05 - 00000000 ____D () C:\ProgramData\MAGIX
2014-09-01 09:33 - 2011-11-25 19:05 - 00000000 ____D () C:\Program Files (x86)\MAGIX
2014-09-01 09:31 - 2014-03-26 19:06 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-09-01 09:20 - 2014-05-13 20:06 - 00000000 ____D () C:\ProgramData\Package Cache
2014-09-01 08:39 - 2014-09-01 08:39 - 00000000 ____D () C:\Amazon MP3
2014-08-28 21:41 - 2010-12-04 14:27 - 00040211 _____ () C:\Windows\cdplayer.ini
2014-08-28 21:19 - 2010-12-04 10:36 - 00000000 ____D () C:\Program Files (x86)\Audiograbber
2014-08-23 04:07 - 2014-08-28 06:35 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-08-28 06:35 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-08-28 06:35 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-21 19:08 - 2013-06-29 14:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2014-08-20 19:41 - 2011-01-20 21:38 - 00000000 ____D () C:\Program Files (x86)\Brother
Some content of TEMP:
====================
C:\Users\VOW\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-09-17 18:54
==================== End Of Log ============================
--- --- --- --- --- --- ...und nein - aktuell scheint es nicht so als gäbe es noch irgendwelche Probleme. Gibt es eigentlich irgendeine Empfehlung seitens Trojaner-Board welche Schutzprogramme man permanent oder regelmäßig manuell laufen lassen sollte? Aktuell habe ich nur Norten Internet Security im Einsatz. Güße Volker |
|
20.09.2014, 15:10
| #11 |
| /// the machine /// TB-Ausbilder | Win7-64Bit - Browser, Netzwerkeinstellungen, Proxy wird immer automatisch aktiviert 127.0.0.1:49273 Norton is schon mal, neben Antivir, die aller schlechteste Lösung die man haben kann. Ich empfehle immer Emsisoft. Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
20.09.2014, 15:59
| #12 |
| | Win7-64Bit - Browser, Netzwerkeinstellungen, Proxy wird immer automatisch aktiviert 127.0.0.1:49273 Hallo schrauber, scheint alles sauber und rund zu laufen. Vielen Dank für deine Hilfe und die vielen Tips. Fettes danke gibts an geeigneter Stelle natürlich auch, ebenso wie eine entsprechende Spende. Ehrensache. Für mich ist nichts mehr offen. Nochmals Danke Volker |
|
21.09.2014, 09:37
| #13 |
| /// the machine /// TB-Ausbilder | Win7-64Bit - Browser, Netzwerkeinstellungen, Proxy wird immer automatisch aktiviert 127.0.0.1:49273 Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Win7-64Bit - Browser, Netzwerkeinstellungen, Proxy wird immer automatisch aktiviert 127.0.0.1:49273 |
| norton internet security, pup.optional.bettersurf, pup.optional.bettersurf.a, pup.optional.datamangr.a, pup.optional.datamngr.a, pup.optional.dealply.a, pup.optional.delta.a, pup.optional.dvdvideosofttb.a, pup.optional.getnow.a, pup.optional.installcore.a, pup.optional.lookthisup.a, pup.optional.mediaplayeralpha.a, pup.optional.opencandy, pup.optional.pricegong.a, pup.optional.rockettab.a, pup.optional.searchprotect.a, pup.optional.snapdo, pup.optional.snapdo.a, pup.optional.snapdo.t, pup.optional.softonic.a, pup.optional.softwareupdater.a, pup.optional.videoplayer.a, pup.optional.wajam.a, pup.optional.webcake.a, trojan.msil.bladabindi |
Revo Uninstaller herunter.
dann auf 
und dann auf 
.
WARNUNG an die MITLESER: 
Linear-Darstellung
