Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
Trojaner an Board: Win32:BProtect-D [Trj] System:Win7

Trojaner an Board: Win32:BProtect-D [Trj] System:Win7


Log-Analyse und Auswertung: Trojaner an Board: Win32:BProtect-D [Trj] System:Win7

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

Antwort
Alt 23.09.2014, 14:10   #1
doob
 
Trojaner an Board: Win32:BProtect-D [Trj] System:Win7 - Standard

Trojaner an Board: Win32:BProtect-D [Trj] System:Win7


Guten Tag zusammen,

Avast premium hat mir beim heutigen Suchlauf folgenden Trojaner gemeldet Win32:BProtect-D [Trj]
Avast kann ihn nicht in den Container verschieben.

Ich hätte dieses Ding gerne los und wäre froh wenn ich Hilfestellung bekomme.

gemäß eurer Anleitung habe ich mein System schonmal gescannt


Systemscan mit fsrt:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 21-09-2014 01
Ran by muck (administrator) on MUCK-PC on 23-09-2014 12:42:49
Running from C:\Users\muck\Desktop\scansoftware
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\afwServ.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
() C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
(RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\RPDS\Bin\rpdsvc.exe
() C:\Program Files\Real\UpdateService\RealPlayerUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(STRATO) C:\Program Files\STRATO AG\STRATO HiDrive\STRATO HiDrive Service.exe
(X10) C:\Program Files\Common Files\X10\Common\X10nets.exe
() C:\Program Files\002\yewimmxqbs32.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
() C:\Windows\tsnp2uvc.exe
(CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
(CyberLink Corp.) C:\Program Files\CyberLink\YouCam\YouCamTray.exe
(MyHeritage) C:\Program Files\MyHeritage\Bin\FTBCheckUpdates.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastUI.exe
() C:\Program Files\DSL Soforthilfe\DSL_Soforthilfe.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
(RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\Update\realsched.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
(Akamai Technologies, Inc.) C:\Users\muck\AppData\Local\Akamai\netsession_win.exe
(Siber Systems) C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe
(RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\RPDS\Bin\rpsystray.exe
(Akamai Technologies, Inc.) C:\Users\muck\AppData\Local\Akamai\netsession_win.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Stardock) C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
(Microsoft Corporation) C:\Program Files\Windows NT\Accessories\wordpad.exe
(Microsoft Corporation) C:\Windows\System32\sdclt.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)
HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7625248 2009-07-20] (Realtek Semiconductor)
HKLM\...\Run: [snp2uvc] => C:\Windows\vsnp2uvc.exe
HKLM\...\Run: [tsnp2uvc] => C:\Windows\tsnp2uvc.exe [233472 2008-08-28] ()
HKLM\...\Run: [CLMLServer] => C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-06-03] (CyberLink)
HKLM\...\Run: [UpdateP2GoShortCut] => C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [UCam_Menu] => C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [YouCam Mirror Tray icon] => C:\Program Files\CyberLink\YouCam\YouCamTray.exe [167008 2009-09-28] (CyberLink Corp.)
HKLM\...\Run: [fspuip] => "\FSP\fspuip.exe"
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [499608 2011-03-30] (Adobe Systems Incorporated)
HKLM\...\Run: [BrMfcWnd] => C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [663552 2007-03-12] (Brother Industries, Ltd.)
HKLM\...\Run: [SwitchBoard] => C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM\...\Run: [AdobeCS5.5ServiceManager] => C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [1523360 2011-01-12] (Adobe Systems Incorporated)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [Family Tree Builder Update] => C:\Program Files\MyHeritage\Bin\FTBCheckUpdates.exe [2532352 2013-08-04] (MyHeritage)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [4085896 2014-08-05] (AVAST Software)
HKLM\...\Run: [ControlCenter3] => C:\Program Files\Brother\ControlCenter3\brctrcen.exe [65536 2007-01-26] (Brother Industries, Ltd.)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM\...\Run: [DSL Soforthilfe] => C:\Program Files\DSL Soforthilfe\DSL_Soforthilfe.exe [20585888 2013-11-21] ()
HKLM\...\Run: [ArcSoft Connection Service] => C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.)
HKLM\...\Run: [TkBellExe] => C:\Program Files\Real\RealPlayer\update\realsched.exe [296520 2014-08-03] (RealNetworks, Inc.)
HKU\S-1-5-21-2086479380-1908498283-1882529649-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-2086479380-1908498283-1882529649-1000\...\Run: [Google Update] => C:\Users\muck\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-11-01] (Google Inc.)
HKU\S-1-5-21-2086479380-1908498283-1882529649-1000\...\Run: [Akamai NetSession Interface] => C:\Users\muck\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-2086479380-1908498283-1882529649-1000\...\Run: [RoboForm] => C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe [100200 2014-01-15] (Siber Systems)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\RealPlayer Cloud Service UI.lnk
ShortcutTarget: RealPlayer Cloud Service UI.lnk -> C:\Program Files\Real\RealPlayer\RPDS\Bin\rpsystray.exe (RealNetworks, Inc.)
Startup: C:\Users\muck\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\muck\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\muck\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk
ShortcutTarget: Stardock ObjectDock.lnk -> C:\Program Files\Stardock\ObjectDock\ObjectDock.exe (Stardock)
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Alwil Software\Avast5\ashShell.dll (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://de.yhs4.search.yahoo.com/yhs/search?type=prc265&hspart=avast&hsimp=yhs-001&p={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://medion.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://de.yahoo.com?fr=hp-avast&type=prc265
HKCU\Software\Microsoft\Internet Explorer\Main,Start Default_Page_URL = hxxp://search.certified-toolbar.com?si=41460&home=true&tid=592
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://de.yahoo.com?fr=hp-avast&type=prc265
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://de.yahoo.com?fr=hp-avast&type=prc265
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.certified-toolbar.com?si=41460&tid=592&bs=true&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Start Default_Page_URL = hxxp://search.certified-toolbar.com?si=41460&home=true&tid=592
HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.certified-toolbar.com?si=41460&tid=592&bs=true&q=
SearchScopes: HKLM - DefaultScope {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?type=prc265&hspart=avast&hsimp=yhs-001&p={searchTerms}
SearchScopes: HKLM - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=coolmsd&cd=2XzuyEtN2Y1L1QzutC0CyE0B0DyCtAtDyDtCyE0D0DtC0AzztN0D0Tzu0CyDtCtBtN1L2XzutBtFtBtFtCtFyDyByEtN1L1Czu1R1F1F1I1H1B1Q&cr=821848212&ir=
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://search.certified-toolbar.com?si=41460&bs=true&tid=592&q={searchTerms}
SearchScopes: HKLM - {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?type=prc265&hspart=avast&hsimp=yhs-001&p={searchTerms}
SearchScopes: HKLM - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.certified-toolbar.com?si=41460&bs=true&tid=592&q={searchTerms}
SearchScopes: HKCU - DefaultScope {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?type=prc265&hspart=avast&hsimp=yhs-001&p={searchTerms}
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
SearchScopes: HKCU - {05836D6B-3A4B-487A-82D3-2001E0D2828F} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=coolmsd&cd=2XzuyEtN2Y1L1QzutC0CyE0B0DyCtAtDyDtCyE0D0DtC0AzztN0D0Tzu0CyDtCtBtN1L2XzutBtFtBtFtCtFyDyByEtN1L1Czu1R1F1F1I1H1B1Q&cr=821848212&ir=
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www2.delta-search.com/?q={searchTerms}&affID=120519&babsrc=SP_ss&mntrId=E23B1C4BD630514D
SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = 
SearchScopes: HKCU - {69535C9E-55B0-418C-A041-6610346008ED} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ATU2&o=14670&src=kw&q={searchTerms}&locale=&apn_ptnrs=^T8&apn_dtid=^zzz001^YY^DE&apn_uid=caedf34a-2c5c-4ca1-8d60-14a58ef0d500&apn_sauid=B3E2833F-1148-4DC5-9449-8AA579D3417A
SearchScopes: HKCU - {87C7DAB5-00A2-49E3-8892-ADF265F0308A} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://search.certified-toolbar.com?si=41460&bs=true&tid=592&q={searchTerms}
SearchScopes: HKCU - {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?type=prc265&hspart=avast&hsimp=yhs-001&p={searchTerms}
SearchScopes: HKCU - {AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8} URL = hxxp://www.daemon-search.com/search?q={searchTerms}
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.certified-toolbar.com?si=41460&bs=true&tid=592&q={searchTerms}
SearchScopes: HKCU - {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://mystart.incredibar.com/mb128/?search={searchTerms}&loc=IB_DS&a=6OySRaoenk&i=26
SearchScopes: HKCU - {F33C6390-D1E5-45D5-9694-672A7C1B29BE} URL = hxxp://ws.infospace.com/gamers_brw/ws/redir?_iceUrl=true&user_id=%userid&tool_id=%toolid&qkw={searchTerms}
BHO: No Name -> {3049C3E9-B461-4BC5-8870-4C09146192CA} ->  No File
BHO: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} ->  No File
BHO: Search Helper -> {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -> C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
BHO: avast! EasyPass Toolbar Helper -> {724d43a9-0d85-11d4-9908-00400523e39a} -> C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (AVAST Software)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
BHO: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
BHO: Windows Live Toolbar Helper -> {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} -> C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKLM - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Toolbar: HKLM - avast! EasyPass Toolbar - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (AVAST Software)
Toolbar: HKCU - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {32099AAC-C132-4136-9E9A-4E364A424E17} -  No File
DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} hxxp://www.myheritage.de/Genoogle/Components/ActiveX/SearchEngineQuery.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin: @java.com/DTPlugin,version=10.40.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.5.1 -> C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=17.0.11.7 -> c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlchromebrowserrecordext;version=17.0.11 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlhtml5videoshim;version=17.0.11 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlpepperflashvideoshim;version=17.0.11 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpplugin;version=17.0.11.7 -> c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer Cloud)
FF Plugin: @spoon.net/Spoon Plugin 3.33 -> C:\Program Files\Spoon\3.33.6.270\npMozillaSpoonPlugin.dll No File
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\muck\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\muck\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\babylon.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\Web Search.xml
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2012-03-23]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [2012-03-23]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} [2012-03-23]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} [2012-04-19]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} [2012-04-15]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-09-05]
FF HKLM\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\IB Updater\Firefox
FF HKLM\...\Firefox\Extensions: [{1DD9AC48-0855-4AE7-9934-159B4377FFA2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2014-08-03]

Chrome: 
=======
CHR CustomProfile: C:\Users\muck\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\muck\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-23]
CHR Extension: (avast! Online Security) - C:\Users\muck\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-05-29]
CHR Extension: (RealPlayer Downloader) - C:\Users\muck\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2014-08-03]
CHR Extension: (Google Wallet) - C:\Users\muck\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-07]
CHR HKLM\...\Chrome\Extension: [dkinklhnkmkhkhofcnapakaoehijaoih] - C:\Program Files\OnlineHD.TV\onhd11.crx []
CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\IB Updater\source.crx []
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\Alwil Software\Avast5\WebRep\Chrome\aswWebRepChrome.crx [2014-08-05]
CHR HKLM\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2014-06-10]
CHR HKLM\...\Chrome\Extension: [jifflliplgeajjdhmkcfnngfpgbjonjg] - C:\Program Files\Perion\NewTab\newTab.crx [2012-11-01]
CHR HKLM\...\Chrome\Extension: [kpkbnefaikfaeadgidhpoanckoiaheli] - C:\Program Files\HDvidCodec.com\HDvidCodec10.crx [2013-04-17]
CHR HKLM\...\Chrome\Extension: [lbbbdmbjkgojacipgefbifkiebpcdjhn] - C:\Program Files\Movie2KDownloader.com\m2kDownloader10.crx [2013-04-17]
CHR HKLM\...\Chrome\Extension: [niogeckbkdcabhnapjbkeiklablhjoca] - C:\Program Files\Perion\ChromeInfoBar\ChromeInfoBar.crx [2012-11-01]
CHR StartMenuInternet: Google Chrome - C:\Users\muck\AppData\Local\Google\Chrome\Application\chrome.exe

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [50344 2014-08-05] (AVAST Software)
R2 avast! Firewall; C:\Program Files\Alwil Software\Avast5\afwServ.exe [106488 2014-08-05] (AVAST Software)
R2 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [39568 2014-06-10] ()
R2 RealPlayer Cloud Service; c:\program files\real\realplayer\RPDS\Bin\rpdsvc.exe [1141848 2014-08-03] (RealNetworks, Inc.)
R2 RealPlayerUpdateSvc; C:\Program Files\Real\UpdateService\RealPlayerUpdateSvc.exe [23552 2014-06-26] () [File not signed]
R2 STRATO HiDrive Service; C:\Program Files\STRATO AG\STRATO HiDrive\STRATO HiDrive Service.exe [32768 2011-07-05] (STRATO) [File not signed]
S3 SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 x10nets; C:\Program Files\Common Files\X10\Common\X10nets.exe [20480 2001-11-12] (X10) [File not signed]
R2 yewimmxqbs32; C:\Program Files\002\yewimmxqbs32.exe [541696 2014-04-30] () [File not signed]
S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 Afc; C:\Windows\System32\drivers\Afc.sys [18688 2006-11-10] (Arcsoft, Inc.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-08-05] ()
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [26136 2014-08-05] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [67824 2014-08-05] (AVAST Software)
R0 aswNdisFlt; C:\Windows\System32\DRIVERS\aswNdisFlt.sys [270752 2014-08-05] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81768 2014-08-05] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-08-05] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [779536 2014-08-05] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [414520 2014-08-05] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [71944 2014-08-05] (AVAST Software)
R1 aswTdi; C:\Windows\system32\Drivers\aswTdi.sys [56080 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [192352 2014-08-05] ()
S3 mod7700; C:\Windows\System32\DRIVERS\mod7700.sys [786400 2009-08-13] (DiBcom SA)
R2 NPF; C:\Windows\System32\drivers\npf.sys [35088 2010-06-25] (CACE Technologies, Inc.)
S3 optousb; C:\Windows\System32\DRIVERS\optousb.sys [18432 2009-08-26] (OPTO ELECTRONICS CO.,LTD.)
S3 optovcm; C:\Windows\System32\DRIVERS\optovcm.sys [26368 2009-08-26] (OPTO ELECTRONICS CO.,LTD.)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2011-09-10] (Duplex Secure Ltd.)
R3 ssudserd; C:\Windows\System32\DRIVERS\ssudserd.sys [184192 2014-01-22] (DEVGURU Co., LTD.(www.devguru.co.kr))
R3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [25984 2011-07-05] (The OpenVPN Project)
R3 X10Hid; C:\Windows\System32\Drivers\x10hid.sys [13720 2009-05-13] (X10 Wireless Technology, Inc.)
R3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [27160 2009-05-13] (X10 Wireless Technology, Inc.)
S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [X]
S3 taphss6; system32\DRIVERS\taphss6.sys [X]
S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2020-10-02 20:10 - 2020-10-02 20:10 - 00000000 ____D () C:\ProgramData\ALM
2014-09-23 12:42 - 2014-09-23 12:42 - 00000000 ____D () C:\FRST
2014-09-23 12:33 - 2014-09-23 12:34 - 00000020 _____ () C:\Users\muck\defogger_reenable
2014-09-23 12:17 - 2014-09-23 12:42 - 00000000 ____D () C:\Users\muck\Desktop\scansoftware
2014-08-28 21:01 - 2014-08-23 03:46 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 21:01 - 2014-08-23 02:42 - 02352640 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-24 19:23 - 2014-08-24 19:23 - 00000000 ____D () C:\Users\muck\AppData\Roaming\EurekaLab s.a.s

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2020-10-02 21:05 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2020-10-02 21:03 - 2011-09-05 12:24 - 00000000 ____D () C:\ProgramData\regid.1986-12.com.adobe
2020-10-02 20:10 - 2020-10-02 20:10 - 00000000 ____D () C:\ProgramData\ALM
2014-09-23 12:42 - 2014-09-23 12:42 - 00000000 ____D () C:\FRST
2014-09-23 12:42 - 2014-09-23 12:17 - 00000000 ____D () C:\Users\muck\Desktop\scansoftware
2014-09-23 12:40 - 2011-09-06 15:21 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-23 12:39 - 2013-07-19 21:42 - 00000000 ___RD () C:\Users\muck\Dropbox
2014-09-23 12:39 - 2013-07-19 21:39 - 00000000 ____D () C:\Users\muck\AppData\Roaming\Dropbox
2014-09-23 12:37 - 2011-09-06 15:21 - 00001090 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-23 12:35 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-23 12:35 - 2009-07-14 06:39 - 00101574 _____ () C:\Windows\setupact.log
2014-09-23 12:34 - 2014-09-23 12:33 - 00000020 _____ () C:\Users\muck\defogger_reenable
2014-09-23 12:34 - 2011-09-04 18:48 - 01706085 _____ () C:\Windows\WindowsUpdate.log
2014-09-23 12:33 - 2012-03-31 18:13 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-23 12:33 - 2011-09-04 18:49 - 00000000 ____D () C:\Users\muck
2014-09-23 11:56 - 2011-11-01 10:37 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2086479380-1908498283-1882529649-1000UA.job
2014-09-23 11:17 - 2010-12-30 10:18 - 00000000 ____D () C:\Users\muck\Downloads\programme
2014-09-23 09:51 - 2014-04-30 11:24 - 00000000 ____D () C:\temp
2014-09-23 09:51 - 2011-11-14 19:38 - 00000000 ____D () C:\Program Files\ScanIT-Client
2014-09-23 07:33 - 2012-03-31 18:13 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-09-23 07:33 - 2011-10-05 19:57 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-09-23 06:40 - 2013-04-24 15:51 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-09-23 06:16 - 2009-07-14 06:34 - 00019024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-23 06:16 - 2009-07-14 06:34 - 00019024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-30 23:03 - 2010-01-05 13:48 - 00000000 ____D () C:\ProgramData\Temp
2014-08-30 22:37 - 2011-12-27 22:15 - 00007607 _____ () C:\Users\muck\AppData\Local\Resmon.ResmonCfg
2014-08-30 20:56 - 2011-11-01 10:37 - 00001064 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2086479380-1908498283-1882529649-1000Core.job
2014-08-30 20:42 - 2009-07-14 06:33 - 03127952 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-25 20:36 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-08-25 06:53 - 2010-01-05 11:57 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-08-24 19:37 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-08-24 19:33 - 2009-07-14 04:37 - 00000000 __RHD () C:\Users\Public\Libraries
2014-08-24 19:23 - 2014-08-24 19:23 - 00000000 ____D () C:\Users\muck\AppData\Roaming\EurekaLab s.a.s

Some content of TEMP:
====================
C:\Users\muck\AppData\Local\Temp\99310uninstall.exe
C:\Users\muck\AppData\Local\Temp\AskSLib.dll
C:\Users\muck\AppData\Local\Temp\BackupSetup.exe
C:\Users\muck\AppData\Local\Temp\Cloud_Backup_Setup_euro.exe
C:\Users\muck\AppData\Local\Temp\distro-amzn-adknowledge-rs.exe
C:\Users\muck\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpv3wdps.dll
C:\Users\muck\AppData\Local\Temp\frnd2wtd.dll
C:\Users\muck\AppData\Local\Temp\f_kz3t_c.dll
C:\Users\muck\AppData\Local\Temp\htmlayout.dll
C:\Users\muck\AppData\Local\Temp\InstallAX.exe
C:\Users\muck\AppData\Local\Temp\installhelper.dll
C:\Users\muck\AppData\Local\Temp\InstallPlugin.exe
C:\Users\muck\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe
C:\Users\muck\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe
C:\Users\muck\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\muck\AppData\Local\Temp\jre-7u7-windows-i586-iftw.exe
C:\Users\muck\AppData\Local\Temp\jre-7u9-windows-i586-iftw.exe
C:\Users\muck\AppData\Local\Temp\mediaimpression_1.5.42.419_1.5.42.1202_update_all.exe
C:\Users\muck\AppData\Local\Temp\MyHeritage_Version_6_0_0_5634_Size_29083336.exe
C:\Users\muck\AppData\Local\Temp\MyHeritage_Version_6_0_0_5634_Size_29083344.exe
C:\Users\muck\AppData\Local\Temp\MyHeritage_Version_7_0_0_7118_Size_36943976.exe
C:\Users\muck\AppData\Local\Temp\MyHeritage_Version_7_0_0_7121_Size_36936376.exe
C:\Users\muck\AppData\Local\Temp\MyHeritage_Version_7_0_0_7128_Size_37008752.exe
C:\Users\muck\AppData\Local\Temp\nitro_pdf_reader(1).exe
C:\Users\muck\AppData\Local\Temp\nitro_pdf_reader.exe
C:\Users\muck\AppData\Local\Temp\nitro_reader3.exe
C:\Users\muck\AppData\Local\Temp\nsgAE6C.exe
C:\Users\muck\AppData\Local\Temp\nsiD2F.exe
C:\Users\muck\AppData\Local\Temp\nsmFD22.tmp.exe
C:\Users\muck\AppData\Local\Temp\nss3FA.exe
C:\Users\muck\AppData\Local\Temp\nss6447.exe
C:\Users\muck\AppData\Local\Temp\nsx5DB1.exe
C:\Users\muck\AppData\Local\Temp\setup.exe
C:\Users\muck\AppData\Local\Temp\SetupDataMngr_Searchqu.exe
C:\Users\muck\AppData\Local\Temp\Sqlite3.dll
C:\Users\muck\AppData\Local\Temp\SRAssetsHelper.dll
C:\Users\muck\AppData\Local\Temp\stubhelper.dll
C:\Users\muck\AppData\Local\Temp\uninst1.exe
C:\Users\muck\AppData\Local\Temp\uninstall8547996.exe
C:\Users\muck\AppData\Local\Temp\vcredist_x86.exe
C:\Users\muck\AppData\Local\Temp\YontooSetup-S.exe
C:\Users\muck\AppData\Local\Temp\_is4C6A.exe
C:\Users\muck\AppData\Local\Temp\_is52E.exe
C:\Users\muck\AppData\Local\Temp\_isD195.exe
C:\Users\muck\AppData\Local\Temp\_TinDel.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-25 20:26

==================== End Of Log ============================
--- --- ---



Gmerlog:
Code:
ATTFilter
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-09-23 14:49:45
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST950032 rev.0003 465,76GB
Running: tusxwiur.exe; Driver: C:\Users\muck\AppData\Local\Temp\pwldypoc.sys


---- System - GMER 2.1 ----

SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwAddBootEntry [0x9112DBA6]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwAssignProcessToJobObject [0x9112E684]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwCreateEvent [0x9113A6F8]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwCreateEventPair [0x9113A744]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwCreateIoCompletion [0x9113A8DE]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwCreateMutant [0x9113A666]
SSDT            \SystemRoot\system32\drivers\aswSP.sys                                                                                                                                                            ZwCreateSection [0x8B79EDF0]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwCreateSemaphore [0x9113A6AE]
SSDT            \SystemRoot\system32\drivers\aswSP.sys                                                                                                                                                            ZwCreateThread [0x8B79F080]
SSDT            \SystemRoot\system32\drivers\aswSP.sys                                                                                                                                                            ZwCreateThreadEx [0x8B79F16A]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwCreateTimer [0x9113A898]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwDebugActiveProcess [0x9112F472]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwDeleteBootEntry [0x9112DC0C]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwDuplicateObject [0x91132C68]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwLoadDriver [0x9112D7F8]
SSDT            \SystemRoot\system32\drivers\aswSP.sys                                                                                                                                                            ZwMapViewOfSection [0x8B79EED0]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwModifyBootEntry [0x9112DC72]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwNotifyChangeKey [0x9113305E]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwNotifyChangeMultipleKeys [0x9112FF5A]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwOpenEvent [0x9113A722]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwOpenEventPair [0x9113A766]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwOpenIoCompletion [0x9113A902]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwOpenMutant [0x9113A68C]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwOpenProcess [0x91132560]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwOpenSection [0x9113A816]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwOpenSemaphore [0x9113A6D6]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwOpenThread [0x9113294C]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwOpenTimer [0x9113A8BC]
SSDT            \SystemRoot\system32\drivers\aswSP.sys                                                                                                                                                            ZwProtectVirtualMemory [0x8B79EC6E]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwQueryObject [0x9112FDCE]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwQueueApcThreadEx [0x9112FADC]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwSetBootEntryOrder [0x9112DCD8]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwSetBootOptions [0x9112DD3E]
SSDT            \SystemRoot\system32\drivers\aswSP.sys                                                                                                                                                            ZwSetContextThread [0x8B79EFCC]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwSetSystemInformation [0x9112D892]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwSetSystemPowerState [0x9112DA64]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwShutdownSystem [0x9112D9F2]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwSuspendProcess [0x9112F63C]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwSuspendThread [0x9112F79E]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwSystemDebugControl [0x9112DAEC]
SSDT            \SystemRoot\system32\drivers\aswSP.sys                                                                                                                                                            ZwTerminateProcess [0x8B79ED3C]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwTerminateThread [0x9112F2CC]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwVdmControl [0x9112DDA4]
SSDT            \SystemRoot\system32\drivers\aswSP.sys                                                                                                                                                            ZwWriteVirtualMemory [0x8B79EBA0]

---- Kernel code sections - GMER 2.1 ----

.text           ntkrnlpa.exe!ZwRollbackEnlistment + 142D                                                                                                                                                          83084A15 1 Byte  [06]
.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                                                                                                            830BE212 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text           ntkrnlpa.exe!KeRemoveQueueEx + 10CB                                                                                                                                                               830C5460 4 Bytes  [A6, DB, 12, 91] {CMPSB ; FIST DWORD [EDX]; XCHG ECX, EAX}
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1153                                                                                                                                                               830C54E8 4 Bytes  [84, E6, 12, 91]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 11A7                                                                                                                                                               830C553C 8 Bytes  [F8, A6, 13, 91, 44, A7, 13, ...] {CLC ; CMPSB ; ADC EDX, [ECX-0x6eec58bc]}
.text           ntkrnlpa.exe!KeRemoveQueueEx + 11B3                                                                                                                                                               830C5548 4 Bytes  [DE, A8, 13, 91]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 11CF                                                                                                                                                               830C5564 4 Bytes  [66, A6, 13, 91]
.text           ...                                                                                                                                                                                               
PAGE            ntkrnlpa.exe!ZwReplyWaitReceivePortEx + 108                                                                                                                                                       832804EF 4 Bytes  CALL 91130641 \SystemRoot\system32\drivers\aswSnx.sys
PAGE            ntkrnlpa.exe!ZwAlpcSendWaitReceivePort + 122                                                                                                                                                      8329A357 4 Bytes  CALL 91130657 \SystemRoot\system32\drivers\aswSnx.sys

---- User code sections - GMER 2.1 ----

.text           C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe[148] kernel32.dll!GetBinaryTypeW + 70                                                                                                             75846AAC 1 Byte  [62]
.text           C:\Windows\system32\csrss.exe[488] kernel32.dll!GetBinaryTypeW + 70                                                                                                                               75846AAC 1 Byte  [62]
.text           C:\Windows\system32\wininit.exe[556] kernel32.dll!GetBinaryTypeW + 70                                                                                                                             75846AAC 1 Byte  [62]
.text           C:\Windows\system32\csrss.exe[576] kernel32.dll!GetBinaryTypeW + 70                                                                                                                               75846AAC 1 Byte  [62]
.text           C:\Windows\system32\services.exe[612] kernel32.dll!GetBinaryTypeW + 70                                                                                                                            75846AAC 1 Byte  [62]
.text           ...                                                                                                                                                                                               
.text           C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1524] kernel32.dll!SetUnhandledExceptionFilter                                                                                                7582F5AB 8 Bytes  [31, C0, C2, 04, 00, 90, 90, ...] {XOR EAX, EAX; RET 0x4; NOP ; NOP ; NOP }
.text           C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1524] kernel32.dll!GetBinaryTypeW + 70                                                                                                        75846AAC 1 Byte  [62]
.text           C:\Windows\System32\spoolsv.exe[1636] kernel32.dll!GetBinaryTypeW + 70                                                                                                                            75846AAC 1 Byte  [62]
.text           C:\Windows\system32\svchost.exe[1676] kernel32.dll!GetBinaryTypeW + 70                                                                                                                            75846AAC 1 Byte  [62]
.text           C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe[1696] KERNEL32.dll!GetBinaryTypeW + 70                                                                                                75846AAC 1 Byte  [62]
.text           C:\Program Files\Alwil Software\Avast5\afwServ.exe[1712] kernel32.dll!SetUnhandledExceptionFilter                                                                                                 7582F5AB 8 Bytes  [31, C0, C2, 04, 00, 90, 90, ...] {XOR EAX, EAX; RET 0x4; NOP ; NOP ; NOP }
.text           C:\Program Files\Alwil Software\Avast5\afwServ.exe[1712] kernel32.dll!GetBinaryTypeW + 70                                                                                                         75846AAC 1 Byte  [62]
.text           c:\program files\real\realplayer\RPDS\Bin\rpdsvc.exe[1860] kernel32.dll!GetBinaryTypeW + 70                                                                                                       75846AAC 1 Byte  [62]
.text           C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe[1864] kernel32.dll!GetBinaryTypeW + 70                                                                                           75846AAC 1 Byte  [62]
.text           C:\Program Files\Real\UpdateService\RealPlayerUpdateSvc.exe[2076] kernel32.dll!GetBinaryTypeW + 70                                                                                                75846AAC 1 Byte  [62]
.text           C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2100] kernel32.dll!GetBinaryTypeW + 70                                                                                     75846AAC 1 Byte  [62]
.text           ...                                                                                                                                                                                               
.text           C:\Program Files\Alwil Software\Avast5\AvastUI.exe[3160] kernel32.dll!SetUnhandledExceptionFilter                                                                                                 7582F5AB 8 Bytes  [31, C0, C2, 04, 00, 90, 90, ...] {XOR EAX, EAX; RET 0x4; NOP ; NOP ; NOP }
.text           C:\Program Files\Alwil Software\Avast5\AvastUI.exe[3160] kernel32.dll!GetBinaryTypeW + 70                                                                                                         75846AAC 1 Byte  [62]
.text           C:\Windows\system32\Dwm.exe[3256] kernel32.dll!GetBinaryTypeW + 70                                                                                                                                75846AAC 1 Byte  [62]
.text           C:\Windows\Explorer.EXE[3284] kernel32.dll!GetBinaryTypeW + 70                                                                                                                                    75846AAC 1 Byte  [62]
.text           C:\Program Files\Windows Media Player\wmpnetwk.exe[3460] kernel32.dll!GetBinaryTypeW + 70                                                                                                         75846AAC 1 Byte  [62]
.text           C:\Windows\system32\wbem\wmiprvse.exe[3484] kernel32.dll!GetBinaryTypeW + 70                                                                                                                      75846AAC 1 Byte  [62]
.text           ...                                                                                                                                                                                               
.text           C:\Program Files\Real\RealPlayer\Update\realsched.exe[4364] kernel32.dll!SetUnhandledExceptionFilter                                                                                              7582F5AB 5 Bytes  [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}
.text           C:\Program Files\Real\RealPlayer\Update\realsched.exe[4364] kernel32.dll!GetBinaryTypeW + 70                                                                                                      75846AAC 1 Byte  [62]
.text           C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[4416] kernel32.dll!GetBinaryTypeW + 70                                                                                     75846AAC 1 Byte  [62]
.text           C:\Users\muck\AppData\Local\Akamai\netsession_win.exe[4456] kernel32.dll!GetBinaryTypeW + 70                                                                                                      75846AAC 1 Byte  [62]
.text           C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe[4464] kernel32.dll!GetBinaryTypeW + 70                                                                                             75846AAC 1 Byte  [62]
.text           C:\Program Files\Real\RealPlayer\RPDS\Bin\rpsystray.exe[4484] kernel32.dll!SetUnhandledExceptionFilter                                                                                            7582F5AB 5 Bytes  [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}
.text           C:\Program Files\Real\RealPlayer\RPDS\Bin\rpsystray.exe[4484] kernel32.dll!GetBinaryTypeW + 70                                                                                                    75846AAC 1 Byte  [62]
.text           C:\Users\muck\AppData\Local\Akamai\netsession_win.exe[4500] kernel32.dll!GetBinaryTypeW + 70                                                                                                      75846AAC 1 Byte  [62]
.text           C:\Windows\system32\svchost.exe[4752] kernel32.dll!GetBinaryTypeW + 70                                                                                                                            75846AAC 1 Byte  [62]
.text           C:\Windows\system32\wbem\unsecapp.exe[4812] kernel32.dll!GetBinaryTypeW + 70                                                                                                                      75846AAC 1 Byte  [62]
.text           C:\Windows\system32\wbem\wmiprvse.exe[4888] kernel32.dll!GetBinaryTypeW + 70                                                                                                                      75846AAC 1 Byte  [62]
.text           ...                                                                                                                                                                                               

---- Devices - GMER 2.1 ----

AttachedDevice  \Driver\tdx \Device\Tcp                                                                                                                                                                           aswTdi.SYS
AttachedDevice  \Driver\tdx \Device\Udp                                                                                                                                                                           aswTdi.SYS
AttachedDevice  \FileSystem\fastfat \Fat                                                                                                                                                                          fltmgr.sys

---- Registry - GMER 2.1 ----

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                                                                                                  
Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                                                                                               0x00 0x00 0x00 0x00 ...
Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                                                                               0
Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                                                                            0xA2 0x9B 0x87 0xD2 ...
Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                                                                                              
Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                                                                                                   0x00 0x00 0x00 0x00 ...
Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                                                                                   0
Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                                                                                0xA2 0x9B 0x87 0xD2 ...
Reg             HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@C:\Users\muck\Downloads\programme\Adobe_Creative_Suite\x00a05_Master_Collection-AkamaiDLM.exe  1

---- Disk sectors - GMER 2.1 ----

Disk            \Device\Harddisk0\DR0                                                                                                                                                                             unknown MBR code

---- EOF - GMER 2.1 ----

Vielen Dank für Eure Hilfe

Alt 23.09.2014, 14:15   #2
M-K-D-B
/// TB-Ausbilder
 
Trojaner an Board: Win32:BProtect-D [Trj] System:Win7 - Standard

Trojaner an Board: Win32:BProtect-D [Trj] System:Win7





Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen.


Bitte beachte folgende Hinweise:
  • Falls wir Hinweise auf illegal erworbene Software finden, werden wir den Support unterbrechen bis jegliche Art von illegaler Software vom Rechner entfernt wurde.
  • Lies dir die Anleitungen sorgfältig durch. Solltest du Probleme haben, stoppe mit deiner Bearbeitung und beschreibe mir dein Problem so gut es geht.
  • Solltest du mir nicht innerhalb von 3 Tagen antworten, gehe ich davon aus, dass du keine Hilfe mehr benötigst. Dann lösche ich dein Thema aus meinem Abo.
    Solltest du einmal länger abwesend sein, so gib mir bitte Bescheid!
  • Während der Bereinigung bitte nichts installieren oder deinstallieren, außer ich bitte dich darum!
  • Alle zu verwendenen Programme sind auf dem Desktop abzuspeichern und von dort zu starten!


Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab und poste alle Logdateien in CODE-Tags:
So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert deinem Helfer massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke aauf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Danke für deine Mitarbeit!





Zitat:
Running from C:\Users\muck\Desktop\scansoftware
Leider hast du unsere Anleitung nicht richtig befolgt:
Bitte alle Tools direkt auf den Desktop downloaden bzw. dorthin verschieben und vom Desktop starten, da unsere Anleitungen daraufhin ausgelegt sind.
Zudem lassen sich dann am Ende der Bereinigung alle verwendeten Tools sehr einfach entfernen.
Alle Tools bis zum Ende der Bereinigung auf dem Desktop lassen, evtl. benötigen wir manche öfter.



FRST nochmal vom Desktop:
  • Starte die FRST.exe erneut. Setze einen Haken vor Addition.txt und drücke auf Scan.
  • FRST erstellt wieder zwei Logdateien (FRST.txt und Addition.txt).
  • Poste mir beide Logdateien mit deiner nächsten Antwort.
__________________
Alt 23.09.2014, 18:35   #3
doob
 
Trojaner an Board: Win32:BProtect-D [Trj] System:Win7 - Standard

Trojaner an Board: Win32:BProtect-D [Trj] System:Win7


Hallo Matthias,
sorry....ich habe Probleme mit der Internetverbindung


FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 21-09-2014 01
Ran by muck (administrator) on MUCK-PC on 23-09-2014 18:35:54
Running from C:\Users\muck\Desktop
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\afwServ.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
() C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
(RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\RPDS\Bin\rpdsvc.exe
() C:\Program Files\Real\UpdateService\RealPlayerUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(STRATO) C:\Program Files\STRATO AG\STRATO HiDrive\STRATO HiDrive Service.exe
(X10) C:\Program Files\Common Files\X10\Common\X10nets.exe
() C:\Program Files\002\yewimmxqbs32.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
() C:\Windows\tsnp2uvc.exe
(CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
(CyberLink Corp.) C:\Program Files\CyberLink\YouCam\YouCamTray.exe
(MyHeritage) C:\Program Files\MyHeritage\Bin\FTBCheckUpdates.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastUI.exe
() C:\Program Files\DSL Soforthilfe\DSL_Soforthilfe.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
(RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\Update\realsched.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
(Akamai Technologies, Inc.) C:\Users\muck\AppData\Local\Akamai\netsession_win.exe
(Siber Systems) C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe
(RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\RPDS\Bin\rpsystray.exe
(Akamai Technologies, Inc.) C:\Users\muck\AppData\Local\Akamai\netsession_win.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Stardock) C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
(Microsoft Corporation) C:\Program Files\Windows NT\Accessories\wordpad.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Google Inc.) C:\Users\muck\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\muck\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\muck\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\muck\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\muck\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\muck\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\muck\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\muck\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\muck\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\muck\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\muck\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\muck\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\muck\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\muck\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\muck\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\muck\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\muck\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\muck\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\muck\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\muck\AppData\Local\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)
HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7625248 2009-07-20] (Realtek Semiconductor)
HKLM\...\Run: [snp2uvc] => C:\Windows\vsnp2uvc.exe
HKLM\...\Run: [tsnp2uvc] => C:\Windows\tsnp2uvc.exe [233472 2008-08-28] ()
HKLM\...\Run: [CLMLServer] => C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-06-03] (CyberLink)
HKLM\...\Run: [UpdateP2GoShortCut] => C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [UCam_Menu] => C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [YouCam Mirror Tray icon] => C:\Program Files\CyberLink\YouCam\YouCamTray.exe [167008 2009-09-28] (CyberLink Corp.)
HKLM\...\Run: [fspuip] => "\FSP\fspuip.exe"
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [499608 2011-03-30] (Adobe Systems Incorporated)
HKLM\...\Run: [BrMfcWnd] => C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [663552 2007-03-12] (Brother Industries, Ltd.)
HKLM\...\Run: [SwitchBoard] => C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM\...\Run: [AdobeCS5.5ServiceManager] => C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [1523360 2011-01-12] (Adobe Systems Incorporated)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [Family Tree Builder Update] => C:\Program Files\MyHeritage\Bin\FTBCheckUpdates.exe [2532352 2013-08-04] (MyHeritage)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [4085896 2014-08-05] (AVAST Software)
HKLM\...\Run: [ControlCenter3] => C:\Program Files\Brother\ControlCenter3\brctrcen.exe [65536 2007-01-26] (Brother Industries, Ltd.)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM\...\Run: [DSL Soforthilfe] => C:\Program Files\DSL Soforthilfe\DSL_Soforthilfe.exe [20585888 2013-11-21] ()
HKLM\...\Run: [ArcSoft Connection Service] => C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.)
HKLM\...\Run: [TkBellExe] => C:\Program Files\Real\RealPlayer\update\realsched.exe [296520 2014-08-03] (RealNetworks, Inc.)
HKU\S-1-5-21-2086479380-1908498283-1882529649-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-2086479380-1908498283-1882529649-1000\...\Run: [Google Update] => C:\Users\muck\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-11-01] (Google Inc.)
HKU\S-1-5-21-2086479380-1908498283-1882529649-1000\...\Run: [Akamai NetSession Interface] => C:\Users\muck\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-2086479380-1908498283-1882529649-1000\...\Run: [RoboForm] => C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe [100200 2014-01-15] (Siber Systems)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\RealPlayer Cloud Service UI.lnk
ShortcutTarget: RealPlayer Cloud Service UI.lnk -> C:\Program Files\Real\RealPlayer\RPDS\Bin\rpsystray.exe (RealNetworks, Inc.)
Startup: C:\Users\muck\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\muck\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\muck\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk
ShortcutTarget: Stardock ObjectDock.lnk -> C:\Program Files\Stardock\ObjectDock\ObjectDock.exe (Stardock)
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Alwil Software\Avast5\ashShell.dll (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://de.yhs4.search.yahoo.com/yhs/search?type=prc265&hspart=avast&hsimp=yhs-001&p={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://medion.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://de.yahoo.com?fr=hp-avast&type=prc265
HKCU\Software\Microsoft\Internet Explorer\Main,Start Default_Page_URL = hxxp://search.certified-toolbar.com?si=41460&home=true&tid=592
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://de.yahoo.com?fr=hp-avast&type=prc265
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://de.yahoo.com?fr=hp-avast&type=prc265
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.certified-toolbar.com?si=41460&tid=592&bs=true&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Start Default_Page_URL = hxxp://search.certified-toolbar.com?si=41460&home=true&tid=592
HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.certified-toolbar.com?si=41460&tid=592&bs=true&q=
SearchScopes: HKLM - DefaultScope {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?type=prc265&hspart=avast&hsimp=yhs-001&p={searchTerms}
SearchScopes: HKLM - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=coolmsd&cd=2XzuyEtN2Y1L1QzutC0CyE0B0DyCtAtDyDtCyE0D0DtC0AzztN0D0Tzu0CyDtCtBtN1L2XzutBtFtBtFtCtFyDyByEtN1L1Czu1R1F1F1I1H1B1Q&cr=821848212&ir=
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://search.certified-toolbar.com?si=41460&bs=true&tid=592&q={searchTerms}
SearchScopes: HKLM - {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?type=prc265&hspart=avast&hsimp=yhs-001&p={searchTerms}
SearchScopes: HKLM - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.certified-toolbar.com?si=41460&bs=true&tid=592&q={searchTerms}
SearchScopes: HKCU - DefaultScope {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?type=prc265&hspart=avast&hsimp=yhs-001&p={searchTerms}
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
SearchScopes: HKCU - {05836D6B-3A4B-487A-82D3-2001E0D2828F} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=coolmsd&cd=2XzuyEtN2Y1L1QzutC0CyE0B0DyCtAtDyDtCyE0D0DtC0AzztN0D0Tzu0CyDtCtBtN1L2XzutBtFtBtFtCtFyDyByEtN1L1Czu1R1F1F1I1H1B1Q&cr=821848212&ir=
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www2.delta-search.com/?q={searchTerms}&affID=120519&babsrc=SP_ss&mntrId=E23B1C4BD630514D
SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = 
SearchScopes: HKCU - {69535C9E-55B0-418C-A041-6610346008ED} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ATU2&o=14670&src=kw&q={searchTerms}&locale=&apn_ptnrs=^T8&apn_dtid=^zzz001^YY^DE&apn_uid=caedf34a-2c5c-4ca1-8d60-14a58ef0d500&apn_sauid=B3E2833F-1148-4DC5-9449-8AA579D3417A
SearchScopes: HKCU - {87C7DAB5-00A2-49E3-8892-ADF265F0308A} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://search.certified-toolbar.com?si=41460&bs=true&tid=592&q={searchTerms}
SearchScopes: HKCU - {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?type=prc265&hspart=avast&hsimp=yhs-001&p={searchTerms}
SearchScopes: HKCU - {AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8} URL = hxxp://www.daemon-search.com/search?q={searchTerms}
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.certified-toolbar.com?si=41460&bs=true&tid=592&q={searchTerms}
SearchScopes: HKCU - {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://mystart.incredibar.com/mb128/?search={searchTerms}&loc=IB_DS&a=6OySRaoenk&i=26
SearchScopes: HKCU - {F33C6390-D1E5-45D5-9694-672A7C1B29BE} URL = hxxp://ws.infospace.com/gamers_brw/ws/redir?_iceUrl=true&user_id=%userid&tool_id=%toolid&qkw={searchTerms}
BHO: No Name -> {3049C3E9-B461-4BC5-8870-4C09146192CA} ->  No File
BHO: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} ->  No File
BHO: Search Helper -> {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -> C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
BHO: avast! EasyPass Toolbar Helper -> {724d43a9-0d85-11d4-9908-00400523e39a} -> C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (AVAST Software)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
BHO: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
BHO: Windows Live Toolbar Helper -> {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} -> C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKLM - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Toolbar: HKLM - avast! EasyPass Toolbar - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (AVAST Software)
Toolbar: HKCU - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {32099AAC-C132-4136-9E9A-4E364A424E17} -  No File
DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} hxxp://www.myheritage.de/Genoogle/Components/ActiveX/SearchEngineQuery.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin: @java.com/DTPlugin,version=10.40.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.5.1 -> C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=17.0.11.7 -> c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlchromebrowserrecordext;version=17.0.11 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlhtml5videoshim;version=17.0.11 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlpepperflashvideoshim;version=17.0.11 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpplugin;version=17.0.11.7 -> c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer Cloud)
FF Plugin: @spoon.net/Spoon Plugin 3.33 -> C:\Program Files\Spoon\3.33.6.270\npMozillaSpoonPlugin.dll No File
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\muck\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\muck\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\babylon.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\Web Search.xml
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2012-03-23]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [2012-03-23]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} [2012-03-23]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} [2012-04-19]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} [2012-04-15]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-09-05]
FF HKLM\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\IB Updater\Firefox
FF HKLM\...\Firefox\Extensions: [{1DD9AC48-0855-4AE7-9934-159B4377FFA2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2014-08-03]

Chrome: 
=======
CHR CustomProfile: C:\Users\muck\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\muck\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-23]
CHR Extension: (avast! Online Security) - C:\Users\muck\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-05-29]
CHR Extension: (RealPlayer Downloader) - C:\Users\muck\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2014-08-03]
CHR Extension: (Google Wallet) - C:\Users\muck\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-07]
CHR HKLM\...\Chrome\Extension: [dkinklhnkmkhkhofcnapakaoehijaoih] - C:\Program Files\OnlineHD.TV\onhd11.crx []
CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\IB Updater\source.crx []
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\Alwil Software\Avast5\WebRep\Chrome\aswWebRepChrome.crx [2014-08-05]
CHR HKLM\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2014-06-10]
CHR HKLM\...\Chrome\Extension: [jifflliplgeajjdhmkcfnngfpgbjonjg] - C:\Program Files\Perion\NewTab\newTab.crx [2012-11-01]
CHR HKLM\...\Chrome\Extension: [kpkbnefaikfaeadgidhpoanckoiaheli] - C:\Program Files\HDvidCodec.com\HDvidCodec10.crx [2013-04-17]
CHR HKLM\...\Chrome\Extension: [lbbbdmbjkgojacipgefbifkiebpcdjhn] - C:\Program Files\Movie2KDownloader.com\m2kDownloader10.crx [2013-04-17]
CHR HKLM\...\Chrome\Extension: [niogeckbkdcabhnapjbkeiklablhjoca] - C:\Program Files\Perion\ChromeInfoBar\ChromeInfoBar.crx [2012-11-01]
CHR StartMenuInternet: Google Chrome - C:\Users\muck\AppData\Local\Google\Chrome\Application\chrome.exe

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [50344 2014-08-05] (AVAST Software)
R2 avast! Firewall; C:\Program Files\Alwil Software\Avast5\afwServ.exe [106488 2014-08-05] (AVAST Software)
R2 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [39568 2014-06-10] ()
R2 RealPlayer Cloud Service; c:\program files\real\realplayer\RPDS\Bin\rpdsvc.exe [1141848 2014-08-03] (RealNetworks, Inc.)
R2 RealPlayerUpdateSvc; C:\Program Files\Real\UpdateService\RealPlayerUpdateSvc.exe [23552 2014-06-26] () [File not signed]
R2 STRATO HiDrive Service; C:\Program Files\STRATO AG\STRATO HiDrive\STRATO HiDrive Service.exe [32768 2011-07-05] (STRATO) [File not signed]
S3 SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 x10nets; C:\Program Files\Common Files\X10\Common\X10nets.exe [20480 2001-11-12] (X10) [File not signed]
R2 yewimmxqbs32; C:\Program Files\002\yewimmxqbs32.exe [541696 2014-04-30] () [File not signed]
S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 Afc; C:\Windows\System32\drivers\Afc.sys [18688 2006-11-10] (Arcsoft, Inc.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-08-05] ()
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [26136 2014-08-05] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [67824 2014-08-05] (AVAST Software)
R0 aswNdisFlt; C:\Windows\System32\DRIVERS\aswNdisFlt.sys [270752 2014-08-05] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81768 2014-08-05] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-08-05] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [779536 2014-08-05] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [414520 2014-08-05] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [71944 2014-08-05] (AVAST Software)
R1 aswTdi; C:\Windows\system32\Drivers\aswTdi.sys [56080 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [192352 2014-08-05] ()
S3 mod7700; C:\Windows\System32\DRIVERS\mod7700.sys [786400 2009-08-13] (DiBcom SA)
R2 NPF; C:\Windows\System32\drivers\npf.sys [35088 2010-06-25] (CACE Technologies, Inc.)
S3 optousb; C:\Windows\System32\DRIVERS\optousb.sys [18432 2009-08-26] (OPTO ELECTRONICS CO.,LTD.)
S3 optovcm; C:\Windows\System32\DRIVERS\optovcm.sys [26368 2009-08-26] (OPTO ELECTRONICS CO.,LTD.)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2011-09-10] (Duplex Secure Ltd.)
R3 ssudserd; C:\Windows\System32\DRIVERS\ssudserd.sys [184192 2014-01-22] (DEVGURU Co., LTD.(www.devguru.co.kr))
R3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [25984 2011-07-05] (The OpenVPN Project)
R3 X10Hid; C:\Windows\System32\Drivers\x10hid.sys [13720 2009-05-13] (X10 Wireless Technology, Inc.)
R3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [27160 2009-05-13] (X10 Wireless Technology, Inc.)
S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [X]
S3 taphss6; system32\DRIVERS\taphss6.sys [X]
S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [X]
U3 pwldypoc; \??\C:\Users\muck\AppData\Local\Temp\pwldypoc.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2020-10-02 20:10 - 2020-10-02 20:10 - 00000000 ____D () C:\ProgramData\ALM
2014-09-23 18:35 - 2014-09-23 18:36 - 00026913 _____ () C:\Users\muck\Desktop\FRST.txt
2014-09-23 12:42 - 2014-09-23 18:36 - 00000000 ____D () C:\FRST
2014-09-23 12:33 - 2014-09-23 12:34 - 00000020 _____ () C:\Users\muck\defogger_reenable
2014-09-23 12:21 - 2014-09-23 12:21 - 00380416 _____ () C:\Users\muck\Desktop\tusxwiur.exe
2014-09-23 12:20 - 2014-09-23 12:20 - 01097728 _____ (Farbar) C:\Users\muck\Desktop\FRST.exe
2014-09-23 12:19 - 2014-09-23 12:19 - 00050477 _____ () C:\Users\muck\Desktop\Defogger.exe
2014-09-23 12:17 - 2014-09-23 18:34 - 00000000 ____D () C:\Users\muck\Desktop\scansoftware
2014-08-28 21:01 - 2014-08-23 03:46 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 21:01 - 2014-08-23 02:42 - 02352640 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-24 19:23 - 2014-08-24 19:23 - 00000000 ____D () C:\Users\muck\AppData\Roaming\EurekaLab s.a.s

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2020-10-02 21:05 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2020-10-02 21:03 - 2011-09-05 12:24 - 00000000 ____D () C:\ProgramData\regid.1986-12.com.adobe
2020-10-02 20:10 - 2020-10-02 20:10 - 00000000 ____D () C:\ProgramData\ALM
2014-09-23 18:36 - 2014-09-23 18:35 - 00026913 _____ () C:\Users\muck\Desktop\FRST.txt
2014-09-23 18:36 - 2014-09-23 12:42 - 00000000 ____D () C:\FRST
2014-09-23 18:34 - 2014-09-23 12:17 - 00000000 ____D () C:\Users\muck\Desktop\scansoftware
2014-09-23 18:33 - 2012-03-31 18:13 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-23 17:58 - 2011-11-01 10:37 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2086479380-1908498283-1882529649-1000UA.job
2014-09-23 17:58 - 2011-09-06 15:21 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-23 17:58 - 2011-09-04 18:48 - 01711833 _____ () C:\Windows\WindowsUpdate.log
2014-09-23 12:48 - 2009-07-14 06:34 - 00019024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-23 12:48 - 2009-07-14 06:34 - 00019024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-23 12:39 - 2013-07-19 21:42 - 00000000 ___RD () C:\Users\muck\Dropbox
2014-09-23 12:39 - 2013-07-19 21:39 - 00000000 ____D () C:\Users\muck\AppData\Roaming\Dropbox
2014-09-23 12:37 - 2011-09-06 15:21 - 00001090 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-23 12:35 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-23 12:35 - 2009-07-14 06:39 - 00101574 _____ () C:\Windows\setupact.log
2014-09-23 12:34 - 2014-09-23 12:33 - 00000020 _____ () C:\Users\muck\defogger_reenable
2014-09-23 12:33 - 2011-09-04 18:49 - 00000000 ____D () C:\Users\muck
2014-09-23 12:21 - 2014-09-23 12:21 - 00380416 _____ () C:\Users\muck\Desktop\tusxwiur.exe
2014-09-23 12:20 - 2014-09-23 12:20 - 01097728 _____ (Farbar) C:\Users\muck\Desktop\FRST.exe
2014-09-23 12:19 - 2014-09-23 12:19 - 00050477 _____ () C:\Users\muck\Desktop\Defogger.exe
2014-09-23 11:17 - 2010-12-30 10:18 - 00000000 ____D () C:\Users\muck\Downloads\programme
2014-09-23 09:51 - 2014-04-30 11:24 - 00000000 ____D () C:\temp
2014-09-23 09:51 - 2011-11-14 19:38 - 00000000 ____D () C:\Program Files\ScanIT-Client
2014-09-23 07:33 - 2012-03-31 18:13 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-09-23 07:33 - 2011-10-05 19:57 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-09-23 06:40 - 2013-04-24 15:51 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-08-30 23:03 - 2010-01-05 13:48 - 00000000 ____D () C:\ProgramData\Temp
2014-08-30 22:37 - 2011-12-27 22:15 - 00007607 _____ () C:\Users\muck\AppData\Local\Resmon.ResmonCfg
2014-08-30 20:56 - 2011-11-01 10:37 - 00001064 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2086479380-1908498283-1882529649-1000Core.job
2014-08-30 20:42 - 2009-07-14 06:33 - 03127952 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-25 20:36 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-08-25 06:53 - 2010-01-05 11:57 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-08-24 19:37 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-08-24 19:33 - 2009-07-14 04:37 - 00000000 __RHD () C:\Users\Public\Libraries
2014-08-24 19:23 - 2014-08-24 19:23 - 00000000 ____D () C:\Users\muck\AppData\Roaming\EurekaLab s.a.s

Some content of TEMP:
====================
C:\Users\muck\AppData\Local\Temp\99310uninstall.exe
C:\Users\muck\AppData\Local\Temp\AskSLib.dll
C:\Users\muck\AppData\Local\Temp\BackupSetup.exe
C:\Users\muck\AppData\Local\Temp\Cloud_Backup_Setup_euro.exe
C:\Users\muck\AppData\Local\Temp\distro-amzn-adknowledge-rs.exe
C:\Users\muck\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpv3wdps.dll
C:\Users\muck\AppData\Local\Temp\frnd2wtd.dll
C:\Users\muck\AppData\Local\Temp\f_kz3t_c.dll
C:\Users\muck\AppData\Local\Temp\htmlayout.dll
C:\Users\muck\AppData\Local\Temp\InstallAX.exe
C:\Users\muck\AppData\Local\Temp\installhelper.dll
C:\Users\muck\AppData\Local\Temp\InstallPlugin.exe
C:\Users\muck\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe
C:\Users\muck\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe
C:\Users\muck\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\muck\AppData\Local\Temp\jre-7u7-windows-i586-iftw.exe
C:\Users\muck\AppData\Local\Temp\jre-7u9-windows-i586-iftw.exe
C:\Users\muck\AppData\Local\Temp\mediaimpression_1.5.42.419_1.5.42.1202_update_all.exe
C:\Users\muck\AppData\Local\Temp\MyHeritage_Version_6_0_0_5634_Size_29083336.exe
C:\Users\muck\AppData\Local\Temp\MyHeritage_Version_6_0_0_5634_Size_29083344.exe
C:\Users\muck\AppData\Local\Temp\MyHeritage_Version_7_0_0_7118_Size_36943976.exe
C:\Users\muck\AppData\Local\Temp\MyHeritage_Version_7_0_0_7121_Size_36936376.exe
C:\Users\muck\AppData\Local\Temp\MyHeritage_Version_7_0_0_7128_Size_37008752.exe
C:\Users\muck\AppData\Local\Temp\nitro_pdf_reader(1).exe
C:\Users\muck\AppData\Local\Temp\nitro_pdf_reader.exe
C:\Users\muck\AppData\Local\Temp\nitro_reader3.exe
C:\Users\muck\AppData\Local\Temp\nsgAE6C.exe
C:\Users\muck\AppData\Local\Temp\nsiD2F.exe
C:\Users\muck\AppData\Local\Temp\nsmFD22.tmp.exe
C:\Users\muck\AppData\Local\Temp\nss3FA.exe
C:\Users\muck\AppData\Local\Temp\nss6447.exe
C:\Users\muck\AppData\Local\Temp\nsx5DB1.exe
C:\Users\muck\AppData\Local\Temp\setup.exe
C:\Users\muck\AppData\Local\Temp\SetupDataMngr_Searchqu.exe
C:\Users\muck\AppData\Local\Temp\Sqlite3.dll
C:\Users\muck\AppData\Local\Temp\SRAssetsHelper.dll
C:\Users\muck\AppData\Local\Temp\stubhelper.dll
C:\Users\muck\AppData\Local\Temp\uninst1.exe
C:\Users\muck\AppData\Local\Temp\uninstall8547996.exe
C:\Users\muck\AppData\Local\Temp\vcredist_x86.exe
C:\Users\muck\AppData\Local\Temp\YontooSetup-S.exe
C:\Users\muck\AppData\Local\Temp\_is4C6A.exe
C:\Users\muck\AppData\Local\Temp\_is52E.exe
C:\Users\muck\AppData\Local\Temp\_isD195.exe
C:\Users\muck\AppData\Local\Temp\_TinDel.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-25 20:26

==================== End Of Log ============================
--- --- ---



Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 21-09-2014 01
Ran by muck at 2014-09-23 18:36:52
Running from C:\Users\muck\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKLM\...\uTorrent) (Version: 3.3.0.29126 - BitTorrent Inc.)
3D Land-Garten 11 (HKLM\...\{554A4E80-0001-2008-FFFF-11FF59A27A18}) (Version: 11 - DiComp)
7-Zip 9.22beta (HKLM\...\7-Zip) (Version:  - )
Activation Assistant for the 2007 Microsoft Office suites (HKLM\...\Activation Assistant for the 2007 Microsoft Office suites) (Version:  - Microsoft Corporation)
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
Adobe AIR (HKLM\...\Adobe AIR) (Version: 2.7.1.19610 - Adobe Systems Incorporated)
Adobe AIR (Version: 2.7.1.19610 - Adobe Systems Incorporated) Hidden
Adobe Creative Suite 5.5 Design Premium (HKLM\...\{60E59A6C-7399-495A-B85C-C829F4E59602}) (Version: 5.5 - Adobe Systems Incorporated)
Adobe Download Assistant (HKLM\...\com.adobe.downloadassistant.AdobeDownloadAssistant) (Version: 1.0.5 - Adobe Systems Incorporated)
Adobe Download Assistant (Version: 1.0.5 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKCU\...\Akamai) (Version:  - Akamai Technologies, Inc)
AliceHilfe (HKLM\...\AliceHilfe 1.0.0.1) (Version: 1.0.0.1 - )
Apple Application Support (HKLM\...\{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}) (Version: 2.3.4 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ArcSoft MediaImpression (HKLM\...\{9EC9754D-CA34-4293-B5DB-3BD245A88A43}) (Version: 1.5.42.1202 - ArcSoft)
aTube Catcher (HKLM\...\aTube Catcher) (Version: 3.8.5187 - DsNET Corp)
Avast License by ZeNiX [2012-03-14] (HKLM\...\Avast_2050_ZeNiX [2012-03-14]_is1) (Version:  - )
avast! EasyPass (HKLM\...\AI RoboForm) (Version: 7-9-1-129 - AVAST Software)
avast! Premier (HKLM\...\avast) (Version: 9.0.2021 - AVAST Software)
Bejeweled 3 (HKLM\...\BFG-Bejeweled 3) (Version:  - )
Big Fish Games: Game Manager (HKLM\...\BFGC) (Version: 3.0.1.60 - )
Brother MFL-Pro Suite (HKLM\...\{A3FEC306-FBFF-4B0D-95B9-F9C67C65079E}) (Version: 1.00 - Brother Industries, Ltd.)
Charles 3.6.4 (HKLM\...\{23AFEF78-6F8E-408E-825E-695B1892581F}) (Version: 3.6.4.0 - XK72 Ltd)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6425.1000 - Microsoft Corporation)
Cradle of Egypt (HKLM\...\BFG-Cradle of Egypt) (Version:  - )
CyberLink Power2Go (HKLM\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.3213 - CyberLink Corp.)
CyberLink Power2Go (Version: 6.1.3213 - CyberLink Corp.) Hidden
CyberLink PowerDVD Copy (HKLM\...\{E3D04529-6EDB-11D8-A372-0050BAE317E1}) (Version: 1.0.6720 - CyberLink Corp.)
CyberLink YouCam (HKLM\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.0.2128 - CyberLink Corp.)
CyberLink YouCam (Version: 3.0.2128 - CyberLink Corp.) Hidden
Dropbox (HKCU\...\Dropbox) (Version: 2.10.28 - Dropbox, Inc.)
DSL Soforthilfe (HKLM\...\DSL Soforthilfe) (Version: 1.1.0.51 - Telefónica Germany GmbH & Co. OHG)
ElsterFormular (HKLM\...\ElsterFormular) (Version: 15.2.20140326 - Landesfinanzdirektion Thüringen)
Finger-sensing Pad Driver (HKLM\...\{E86906FF-C63D-4EAF-ACE7-5F8D55FBEA9A}) (Version: 8.4.2.8 - FSP)
Fishdom 3 Sammleredition (HKLM\...\BFG-Fishdom 3 Sammleredition) (Version:  - )
Foxlink Webcam (HKLM\...\{399C37FB-08AF-493B-BFED-20FBD85EDF7F}) (Version: 5.8.51000.202_WHQL - Sonix)
Google Chrome (HKCU\...\Google Chrome) (Version: 37.0.2062.120 - Google Inc.)
Google Update Helper (Version: 1.3.24.15 - Google Inc.) Hidden
Inkscape 0.48.2 (HKLM\...\Inkscape) (Version: 0.48.2 - )
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
IZArc 4.1.6 (HKLM\...\{97C82B44-D408-4F14-9252-47FC1636D23E}_is1) (Version: 4.1.6 - Ivan Zahariev)
Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 31 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216031FF}) (Version: 6.0.310 - Oracle)
JavaFX 2.1.1 (HKLM\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
Junk Mail filter update (Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Kingo Android ROOT version 1.2.2.1915 (HKLM\...\{AE7675D6-0B31-494F-ABFA-822E1A0FDF17}_is1) (Version: 1.2.2.1915 - Kingosoft Technology Ltd.)
KompoZer 0.8b3 (HKLM\...\{20aa4150-b5f4-11de-8a39-0800200c9a66}_is1) (Version:  - KompoZer)
Livebrush (HKLM\...\com.livebrush) (Version: 1.5 - MoreMeYou)
Livebrush (Version: 1.5 - MoreMeYou) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6425.1000 - Microsoft Corporation)
Microsoft Search Enhancement Pack (Version: 1.3.59.0 - Microsoft Corporation) Hidden
Microsoft SQL Server 2005 Compact Edition [DEU] (HKLM\...\{BAC80EF3-E106-4AEA-8C57-F217F9BC7358}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Sync Framework Runtime Native v1.0 (x86) (HKLM\...\{8A74E887-8F0F-4017-AF53-CBA42211AAA5}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Sync Framework Services Native v1.0 (x86) (HKLM\...\{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{09298F26-A95C-31E2-9D95-2C60F586F075}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Microsoft_VC80_ATL_x86 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_CRT_x86 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFC_x86 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFCLOC_x86 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC90_ATL_x86 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_CRT_x86 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFC_x86 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFCLOC_x86 (Version: 1.00.0000 - Adobe) Hidden
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 31.0 - Mozilla)
Mozilla Thunderbird 31.0 (x86 de) (HKLM\...\Mozilla Thunderbird 31.0 (x86 de)) (Version: 31.0 - Mozilla)
MSVCRT (Version: 14.0.1468.721 - Microsoft) Hidden
MyHeritage Family Tree Builder (HKLM\...\Family Tree Builder) (Version: 7.0.0.7121 - MyHeritage.com)
Neufelius Ten Deluxe V10 (C)2002-2007 (HKLM\...\Neufelius Ten Deluxe_is1) (Version:  - Burian Software Development / www.neufelius.com)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.8 - NVIDIA Corporation)
ObjectDock (HKLM\...\ObjectDock) (Version:  - )
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0 - Microsoft Corporation) Hidden
Opticon USB Drivers Installer (HKLM\...\Opticon USB Installer) (Version:  - )
PDF Settings CS5 (Version: 10.0 - Adobe Systems Incorporated) Hidden
PxMergeModule (Version: 1.00.0000 - Your Company Name) Hidden
QuickTime 7 (HKLM\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Ralink RT2860 Wireless LAN Card (HKLM\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309B0}) (Version: 1.2.0.1 - Ralink)
RealDownloader (Version: 17.0.11 - RealNetworks, Inc.) Hidden
RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0 - RealNetworks, Inc) Hidden
RealPlayer Cloud (HKLM\...\RealPlayer 17.0) (Version: 17.0.11 - RealNetworks)
Realtek 8136 8168 8169 Ethernet Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0005 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5898 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7100.30093 - Realtek Semiconductor Corp.)
RealUpgrade 1.1 (Version: 1.1.0 - RealNetworks, Inc.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.24.0 - SAMSUNG Electronics Co., Ltd.)
ScanIT-Client 3.2 (HKLM\...\ScanIT-Client_is1) (Version:  - GfK Panel Services Deutschland GmbH)
Scribus 1.4.0rc5 (HKLM\...\Scribus 1.4.0) (Version: 1.4.0rc5 - The Scribus Team)
STRATO HiDrive (HKLM\...\{3E00C574-B650-401D-A898-4581AAD6CC74}) (Version: 1.0.0 - STRATO AG)
TrueCrypt (HKLM\...\TrueCrypt) (Version: 7.1a - TrueCrypt Foundation)
UpdateService (Version: 1.0.0 - RealNetworks, Inc.) Hidden
VLC media player 1.1.5 (HKLM\...\VLC media player) (Version: 1.1.5 - VideoLAN)
Windows Live Anmelde-Assistent (HKLM\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Call (Version: 14.0.8064.0206 - Microsoft Corporation) Hidden
Windows Live Communications Platform (Version: 14.0.8064.206 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Essentials (Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (Version: 14.0.8081.709 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Messenger (Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Movie Maker (Version: 14.0.8091.0730 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live Toolbar (Version: 14.0.8064.206 - Microsoft Corporation) Hidden
Windows Live Writer (Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WinPcap 4.1.2 (HKLM\...\WinPcapInst) (Version: 4.1.0.2001 - CACE Technologies)
WinRAR 4.11 (32-bit) (HKLM\...\WinRAR archiver) (Version: 4.11.0 - win.rar GmbH)
X10 Hardware(TM) (HKLM\...\X10Hardware) (Version:  - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\muck\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> C:\Users\muck\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{035FBE31-3755-450A-A775-5E6BBD43D344}\InprocServer32 -> C:\Users\muck\AppData\Local\Google\Update\1.3.21.135\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{095A2EEC-F7FE-42E8-96FB-C20E53081908}\InprocServer32 -> C:\Users\muck\AppData\Local\Google\Update\1.3.21.99\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> C:\Users\muck\AppData\Local\Google\Update\1.3.24.15\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> C:\Users\muck\AppData\Local\Google\Update\1.3.24.15\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{320F0FDB-BE0A-4648-9D18-4A2C3448C007}\InprocServer32 -> C:\Users\muck\AppData\Local\Google\Update\1.3.21.79\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\muck\AppData\Local\Google\Update\1.3.23.9\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> C:\Users\muck\AppData\Local\Google\Update\1.3.24.15\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\localserver32 -> C:\Users\muck\AppData\Local\Google\Chrome\Application\37.0.2062.120\delegate_execute.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{62A0D750-DED9-448C-B693-406B34BB0892}\InprocServer32 -> C:\Users\muck\AppData\Local\Google\Update\1.3.21.145\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{634059C0-D264-4B2C-AE80-F73E48D33E5B}\InprocServer32 -> C:\Users\muck\AppData\Local\Google\Update\1.3.21.123\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{6D7374DE-63AA-473C-8C02-60D9CDCD84C5}\InprocServer32 -> C:\Users\muck\AppData\Local\Google\Update\1.3.21.153\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\muck\AppData\Local\Google\Update\1.3.24.15\psuser.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{91EFB276-CEFE-48EC-BB3A-57795A7B4008}\InprocServer32 -> C:\Users\muck\AppData\Local\Google\Update\1.3.21.149\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{A45426FB-E444-42B2-AA56-419F8FBEEC61}\InprocServer32 -> C:\Users\muck\AppData\Local\Google\Update\1.3.22.3\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{A54D478D-4F70-4F72-9A74-17C9986E35AB}\InprocServer32 -> C:\Users\muck\AppData\Local\Google\Update\1.3.21.165\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Users\muck\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Users\muck\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{C5A2122B-A05B-4FD8-AE49-91990AE10998}\InprocServer32 -> C:\Users\muck\AppData\Local\Google\Update\1.3.21.115\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> C:\Users\muck\AppData\Local\Google\Update\1.3.24.15\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\muck\AppData\Local\Google\Update\1.3.24.15\psuser.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{EB06378B-ABB6-4B3C-9B40-D488DD8A6E93}\InprocServer32 -> C:\Users\muck\AppData\Local\Google\Update\1.3.22.5\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\muck\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\muck\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\muck\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\muck\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\muck\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\muck\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\muck\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\muck\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{FB994D36-B312-46CE-A40B-CF63980641F9}\InprocServer32 -> C:\Users\muck\AppData\Local\Google\Update\1.3.21.111\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2086479380-1908498283-1882529649-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\muck\AppData\Local\Google\Update\1.3.24.7\psuser.dll No File

==================== Restore Points  =========================

05-08-2014 19:55:29 avast! antivirus system restore point
05-08-2014 19:59:05 Gerätetreiber-Paketinstallation: Avast Netzwerkdienst
07-08-2014 19:30:21 Windows Update
10-08-2014 20:04:32 Windows Update
15-08-2014 18:42:06 Windows Update
15-08-2014 20:11:31 Windows Update
16-08-2014 20:13:15 Windows Update
17-08-2014 20:39:53 OpenOffice.org 3.3 wird entfernt
17-08-2014 20:44:22 OpenOffice.org 3.3 wird entfernt
19-08-2014 19:08:00 Removed AKVIS Coloriage.
25-08-2014 18:02:15 Windows Update
28-08-2014 19:50:51 Windows Update
23-09-2014 04:17:33 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2011-09-08 10:48 - 2020-10-02 20:58 - 00001570 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
127.0.0.1 activate.adobe.com 
127.0.0.1 practivate.adobe.com 
127.0.0.1 adobeereg.com 
127.0.0.1 activate.adobe.com 
127.0.0.1 activate-sea.adobe.com 
127.0.0.1 activate-sjc0.adobe.com 
127.0.0.1 wwis-dubc1-vip60.adobe.com 
127.0.0.1 192.150.18.108 
127.0.0.1 activate.adobe.com:443 
127.0.0.1 3dns.adobe.com 
127.0.0.1 3dns-1.adobe.com 
127.0.0.1 3dns-2.adobe.com 
127.0.0.1 3dns-3.adobe.com 
127.0.0.1 3dns-4.adobe.com 
127.0.0.1 adobeereg.com 
127.0.0.1 activate.adobe.com 
127.0.0.1 activate-sea.adobe.com 
127.0.0.1 activate-sjc0.adobe.com 
127.0.0.1 wwis-dubc1-vip60.adobe.com 
127.0.0.1 192.150.18.108 
127.0.0.1 adobe-dns.adobe.com 
127.0.0.1 adobe-dns-1.adobe.com 
127.0.0.1 adobe-dns-2.adobe.com 
127.0.0.1 adobe-dns-3.adobe.com 
127.0.0.1 adobe-dns-4.adobe.com 
127.0.0.1 adobe-dns-5.adobe.com 
127.0.0.1 ereg.wip3.adobe.com 
127.0.0.1 ereg.adobe.com 

There are 20 more lines.


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {00233FE6-A20C-4F15-9DF3-DDF832C7D3A9} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-2086479380-1908498283-1882529649-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2014-06-26] (RealNetworks, Inc.)
Task: {2195153A-DCBE-4ED6-9B60-BA8B32FA42CD} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-2086479380-1908498283-1882529649-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2014-06-26] (RealNetworks, Inc.)
Task: {3034405D-FF3D-4148-88B4-23FAF853EDDD} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {30B792F4-B04E-4202-82B5-C95989D077C9} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-09-06] (Google Inc.)
Task: {35A1B238-DE18-45D1-8EC6-1B035B860B23} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-09-06] (Google Inc.)
Task: {3C8FAAAD-A121-4EDF-965C-0E93C2ADA0F2} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-2086479380-1908498283-1882529649-1000 => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe [2014-06-10] (RealNetworks, Inc.)
Task: {514B519A-9DE4-4BB4-9D88-E93B2B95B0B2} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2086479380-1908498283-1882529649-1000UA => C:\Users\muck\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-01] (Google Inc.)
Task: {82EA1B8C-7DE7-4030-B280-C6C799E1F50F} - System32\Tasks\AdobeAAMUpdater-1.0-muck-PC-muck => C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2011-03-30] (Adobe Systems Incorporated)
Task: {902ACB3A-E23C-46D9-B2C5-453F7EC044BA} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2086479380-1908498283-1882529649-1000Core => C:\Users\muck\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-01] (Google Inc.)
Task: {95FC6EE5-8A63-49F4-9F9F-E6F37FEC131B} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {B9B3830A-5AF7-467B-876E-9B1F6B30E8A0} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2086479380-1908498283-1882529649-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2014-06-26] (RealNetworks, Inc.)
Task: {C0FF62BB-8F62-4AB9-B6E7-E4D766AEDEB1} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2086479380-1908498283-1882529649-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2014-06-26] (RealNetworks, Inc.)
Task: {D4186ED7-9A87-4B34-B66C-FC47DF33B0B4} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-2086479380-1908498283-1882529649-1000 => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe [2014-06-10] (RealNetworks, Inc.)
Task: {E143C33A-9D28-41F7-B6DD-CC2BD0C0D087} - System32\Tasks\YourFile Update => C:\Program Files\YourFileDownloader\YourFileUpdater.exe <==== ATTENTION
Task: {E1CB530C-FDF7-4123-8F23-A4294E34F2ED} - System32\Tasks\avast! Emergency Update => C:\Program Files\Alwil Software\Avast5\AvastEmUpdate.exe [2014-08-05] (AVAST Software)
Task: {E66CA837-69CF-423D-8A70-6AE880E6BA5A} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-23] (Adobe Systems Incorporated)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2086479380-1908498283-1882529649-1000Core.job => C:\Users\muck\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2086479380-1908498283-1882529649-1000UA.job => C:\Users\muck\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-08-05 21:57 - 2014-08-05 21:57 - 00301152 _____ () C:\Program Files\Alwil Software\Avast5\aswProperty.dll
2014-09-23 06:09 - 2014-09-23 06:09 - 02865152 _____ () C:\Program Files\Alwil Software\Avast5\defs\14092201\algo.dll
2014-09-23 12:36 - 2014-09-23 12:36 - 02865152 _____ () C:\Program Files\Alwil Software\Avast5\defs\14092300\algo.dll
2014-06-10 17:50 - 2014-06-10 17:50 - 00039568 _____ () C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
2014-08-03 19:17 - 2014-08-03 19:17 - 00861784 _____ () c:\program files\real\realplayer\RPDS\Plugins\cldplin.dll
2014-06-26 00:43 - 2014-06-26 00:43 - 00023552 _____ () C:\Program Files\Real\UpdateService\RealPlayerUpdateSvc.exe
2014-04-30 11:24 - 2014-04-30 11:24 - 00541696 _____ () C:\Program Files\002\yewimmxqbs32.exe
2011-09-05 10:03 - 2007-04-30 19:18 - 00112400 _____ () C:\Program Files\Stardock\ObjectDock\DockShellHook.dll
2010-01-05 11:38 - 2008-08-28 16:03 - 00233472 _____ () C:\Windows\tsnp2uvc.exe
2009-06-03 21:59 - 2009-06-03 21:59 - 00619816 ____N () C:\Program Files\CyberLink\Power2Go\CLMediaLibrary.dll
2009-06-03 21:59 - 2009-06-03 21:59 - 00013096 ____N () C:\Program Files\CyberLink\Power2Go\CLMLSvcPS.dll
2014-08-05 21:57 - 2014-08-05 21:57 - 19329904 _____ () C:\Program Files\Alwil Software\Avast5\libcef.dll
2014-06-30 05:57 - 2013-11-21 22:57 - 20585888 ____N () C:\Program Files\DSL Soforthilfe\DSL_Soforthilfe.exe
2011-09-05 10:03 - 2007-04-19 14:23 - 00095944 _____ () C:\Program Files\Stardock\ObjectDock\CrashRpt.dll
2011-09-05 10:03 - 2007-04-21 13:47 - 00059592 _____ () C:\Program Files\Stardock\ObjectDock\zlib.dll
2011-09-05 10:03 - 2002-11-19 14:11 - 00139264 _____ () C:\Program Files\Common Files\Stardock\ODImg.dll
2011-09-05 10:03 - 2002-03-13 19:46 - 00118784 _____ () C:\Program Files\Stardock\ObjectDock\ODImg.dll
2011-09-05 10:03 - 2007-04-23 00:19 - 00026392 _____ () C:\Program Files\Stardock\ObjectDock\Docklets\Calendar\Calendar.dll
2014-09-23 06:32 - 2014-09-04 05:01 - 01098056 _____ () C:\Users\muck\AppData\Local\Google\Chrome\Application\37.0.2062.120\libglesv2.dll
2014-09-23 06:32 - 2014-09-04 05:01 - 00174408 _____ () C:\Users\muck\AppData\Local\Google\Chrome\Application\37.0.2062.120\libegl.dll
2014-09-23 06:32 - 2014-09-04 05:01 - 08577864 _____ () C:\Users\muck\AppData\Local\Google\Chrome\Application\37.0.2062.120\pdf.dll
2014-09-23 06:32 - 2014-09-04 05:01 - 00331592 _____ () C:\Users\muck\AppData\Local\Google\Chrome\Application\37.0.2062.120\ppGoogleNaClPluginChrome.dll
2014-09-23 06:32 - 2014-09-04 05:01 - 01660232 _____ () C:\Users\muck\AppData\Local\Google\Chrome\Application\37.0.2062.120\ffmpegsumo.dll
2014-09-23 07:33 - 2014-09-23 07:33 - 16825520 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:0C65EA0E
AlternateDataStreams: C:\ProgramData\Temp:260575F1
AlternateDataStreams: C:\ProgramData\Temp:639BB5E9
AlternateDataStreams: C:\ProgramData\Temp:6AD65294

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============

Name: SD
Description: RTS5121LUN0     
Class Guid: {eec5ad98-8080-425f-922a-dabf3de3f69a}
Manufacturer: REALSIL 
Service: WUDFRd
Problem: : Windows has stopped this device because it has reported problems. (Code 43)
Resolution: One of the drivers controlling the device notified the operating system that the device failed in some manner. For more information about how to diagnose the problem, see the hardware documentation. 

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: GT-I9105P
Description: GT-I9105P
Class Guid: {eec5ad98-8080-425f-922a-dabf3de3f69a}
Manufacturer: SAMSUNG Electronics Co. Ltd. 
Service: WUDFRd
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (09/23/2014 06:17:00 AM) (Source: Windows Backup) (EventID: 4103) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "F:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"

Error: (08/26/2014 08:41:20 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.

Error: (08/26/2014 08:41:17 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="&#x2a;",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="&#x2a;",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (08/26/2014 08:41:07 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (08/26/2014 08:39:26 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (08/25/2014 08:32:33 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.

Error: (08/25/2014 08:32:28 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="&#x2a;",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="&#x2a;",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (08/25/2014 08:32:13 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (08/25/2014 08:29:36 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (08/24/2014 07:30:59 PM) (Source: Windows Backup) (EventID: 4103) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "F:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"


System errors:
=============
Error: (09/23/2014 00:42:59 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Windows Update" wurde nicht richtig gestartet.

Error: (08/28/2014 09:51:06 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (08/24/2014 07:26:53 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "yewimmxqbs32" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 300000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (08/24/2014 07:25:50 PM) (Source: Server) (EventID: 2505) (User: )
Description: Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{FBA15503-8961-46C5-A07A-E80D88157122} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden.

Error: (08/18/2014 10:06:31 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {FCC74B77-EC3E-4DD8-A80B-008A702075A9}

Error: (08/17/2014 11:01:56 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Windows Update" wurde nicht richtig gestartet.

Error: (08/16/2014 08:30:58 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Windows Update" wurde nicht richtig gestartet.

Error: (08/07/2014 09:10:43 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Windows Update" wurde nicht richtig gestartet.

Error: (08/05/2014 09:55:26 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "yewimmxqbs32" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 300000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (07/24/2014 08:54:18 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {005A3A96-BAC4-4B0A-94EA-C0CE100EA736}


Microsoft Office Sessions:
=========================
Error: (09/23/2014 06:17:00 AM) (Source: Windows Backup) (EventID: 4103) (User: )
Description: F:\Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)

Error: (08/26/2014 08:41:20 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: c:\program files\microsoft\search enhancement pack\search helper\sepsearchhelperie.dllc:\program files\microsoft\search enhancement pack\search helper\sepsearchhelperie.dll2

Error: (08/26/2014 08:41:17 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: rpshellextension.1.0,language="&#x2a;",type="win32",version="1.0.0.0"C:\Windows\Installer\{20C2051A-1ACA-48B4-9BA5-24625DCBD880}\recordingmanager.exe

Error: (08/26/2014 08:41:07 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\kingo android root\tools\DPInst64.exe

Error: (08/26/2014 08:39:26 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\Opticon\usb_drivers_installer\DPInst64.exe

Error: (08/25/2014 08:32:33 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: c:\program files\microsoft\search enhancement pack\search helper\sepsearchhelperie.dllc:\program files\microsoft\search enhancement pack\search helper\sepsearchhelperie.dll2

Error: (08/25/2014 08:32:28 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: rpshellextension.1.0,language="&#x2a;",type="win32",version="1.0.0.0"C:\Windows\Installer\{20C2051A-1ACA-48B4-9BA5-24625DCBD880}\recordingmanager.exe

Error: (08/25/2014 08:32:13 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\kingo android root\tools\DPInst64.exe

Error: (08/25/2014 08:29:36 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\Opticon\usb_drivers_installer\DPInst64.exe

Error: (08/24/2014 07:30:59 PM) (Source: Windows Backup) (EventID: 4103) (User: )
Description: F:\Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)


==================== Memory info =========================== 

Processor: Pentium(R) Dual-Core CPU T4400 @ 2.20GHz
Percentage of memory in use: 54%
Total physical RAM: 3066.88 MB
Available physical RAM: 1406.1 MB
Total Pagefile: 6132.04 MB
Available Pagefile: 3823.24 MB
Total Virtual: 2047.88 MB
Available Virtual: 1920.53 MB

==================== Drives ================================

Drive c: (Boot) (Fixed) (Total:434.66 GB) (Free:291.45 GB) NTFS
Drive d: (Recover) (Fixed) (Total:30 GB) (Free:21.31 GB) NTFS
Drive h: (SD) (Removable) (Total:3.74 GB) (Free:3.31 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: F98D6E74)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=434.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=30 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=1 GB) - (Type=12)

========================================================
Disk: 1 (Size: 3.7 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

==================== End Of Log ============================
__________________
Alt 24.09.2014, 13:12   #4
M-K-D-B
/// TB-Ausbilder
 
Trojaner an Board: Win32:BProtect-D [Trj] System:Win7 - Standard

Trojaner an Board: Win32:BProtect-D [Trj] System:Win7


Zitat:
127.0.0.1 activate.adobe.com
127.0.0.1 practivate.adobe.com
127.0.0.1 adobeereg.com
127.0.0.1 activate.adobe.com
Die von mir gelisteten Einträge deuten stark darauf hin, dass auf diesem Rechner folgende Software benutzt wird, die nicht legal erworben wurde: Adobe Creative Suite 5.5 Design Premium

Supportunterbrechung
Lesestoff:
Cracks und Keygens
Den Kopierschutz von Software zu umgehen ist nach geltendem Recht illegal. Die Logfiles deuten stark darauf hin, dass du nicht legal erworbene Software einsetzt. Zudem sind Cracks und Patches aus dubioser Quelle sehr oft mit Schädlingen versehen, womit man sich also fast vorsätzlich infiziert.

Wir haben uns hier auf dem Board darauf geeinigt, dass wir an dieser Stelle nicht weiter bereinigen, da wir ein solches Vorgehen nicht unterstützen. Hinzu kommt, dass wir dich in unserer Anleitung und auch in diesem Wichtig-Thema unmissverständlich darauf hingewiesen haben, wie wir damit umgehen werden. Saubere, gute Software hat seinen Preis und die Softwarefirmen leben von diesen Einnahmen.

Unsere Hilfe beschränkt sich daher nur auf das Neuaufsetzen und Absichern deines Systems.
Fragen dazu beantworten wir dir aber weiterhin gerne und zwar in unserem Forum.


Erst wenn du deine illegale Software vom Rechner entfernt hast, können wir mit der Bereinigung fortfahren.

Alt 24.09.2014, 19:11   #5
doob
 
Trojaner an Board: Win32:BProtect-D [Trj] System:Win7 - Standard

Trojaner an Board: Win32:BProtect-D [Trj] System:Win7


das ist die testversion der creativ suite die habe ich natürlich nicht erworben sondern nur getestet


Alt 25.09.2014, 13:33   #6
M-K-D-B
/// TB-Ausbilder
 
Trojaner an Board: Win32:BProtect-D [Trj] System:Win7 - Standard

Trojaner an Board: Win32:BProtect-D [Trj] System:Win7


Zitat:
Zitat von doob Beitrag anzeigen
das ist die testversion der creativ suite die habe ich natürlich nicht erworben sondern nur getestet
Wozu dann die Einträge in der Hosts-Datei? Damit umgehst du die Registrierung.

Programm deinstallieren, sollte ich nochmal was Illegales in der Logdatei sehen, gibt es keinen Support mehr.


FRST neu ausführen, bitte Logdateien posten:
  • Starte die FRST.exe erneut. Setze einen Haken vor Addition.txt und drücke auf Scan.
  • FRST erstellt wieder zwei Logdateien (FRST.txt und Addition.txt).
  • Poste mir beide Logdateien mit deiner nächsten Antwort.
Alt 28.09.2014, 12:54   #7
M-K-D-B
/// TB-Ausbilder
 
Trojaner an Board: Win32:BProtect-D [Trj] System:Win7 - Standard

Trojaner an Board: Win32:BProtect-D [Trj] System:Win7


Fehlende Rückmeldung
Dieses Thema wurde aus den Abos gelöscht. Somit bekomme ich keine Benachrichtigung über neue Antworten.
PM an mich falls Du denoch weiter machen willst.

Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner schon sauber ist.

Jeder andere bitte hier klicken und einen eigenen Thread erstellen!

Antwort

Themen zu Trojaner an Board: Win32:BProtect-D [Trj] System:Win7
administrator, antivirus, avast, dll, dsl, fehlercode 0x81000006, fehlercode 22, fehlercode 43, firewall, flash player, helper, home, newtab, realtek, registry, security, services.exe, system, this device cannot start. (code10), this device is disabled. (code 22), trojaner, vcredist, windows, winlogon.exe


« Werbeinblendungen und ungewollte Umleitungen | Windows 7: Lauter Links und neue Fenster in Chrome und Firefox »


Ähnliche Themen: Trojaner an Board: Win32:BProtect-D [Trj] System:Win7


  1. PC langsam, hängt sich beim Surfen auf, Bluescreen, Advanced System Protector, Win32:Dropper-gen, Win32:Malware-gen, Win32:Rootkit-gen u.a.
    Log-Analyse und Auswertung - 07.02.2015 (12)
  2. Win7 BProtect und Adware sowie Addlyrics auf dem Laptop gefunden
    Plagegeister aller Art und deren Bekämpfung - 13.12.2014 (13)
  3. Win7 Prof. Infiziert mit Win32/Packed.Asprotect.DS Trojaner! Entfernung?
    Log-Analyse und Auswertung - 01.10.2014 (9)
  4. Windows 8: Win32:BProtect-J [Trj]
    Log-Analyse und Auswertung - 11.08.2014 (9)
  5. Trojaner: Advanced System Protector, Win7
    Log-Analyse und Auswertung - 11.08.2014 (7)
  6. Windows 7: Avast meldete Infektion durch win32:bprotect-D
    Log-Analyse und Auswertung - 23.06.2014 (17)
  7. WIN7: AVAST meldet Win32:Bprotect-D /-F /-H und weitere, Rechner läuft
    Log-Analyse und Auswertung - 05.06.2014 (12)
  8. Windows 7 : Avast fand Win32:BProtect-D [Trj] - Löschung nicht möglich
    Log-Analyse und Auswertung - 27.05.2014 (10)
  9. Windows 7: Win32:BProtect-D
    Plagegeister aller Art und deren Bekämpfung - 13.05.2014 (13)
  10. System mit BKA-Trojaner ähnlichem Schädling infiziert (Win7 Home Premium)
    Log-Analyse und Auswertung - 17.04.2014 (7)
  11. Windows 7: diverse Viren nach Avast Scan erkannt z.B. Win32:BProtect-D
    Log-Analyse und Auswertung - 24.01.2014 (12)
  12. GVU-Trojaner befallen/Win7- System wiederhergestellt und nun?
    Plagegeister aller Art und deren Bekämpfung - 10.01.2013 (3)
  13. GVU-Trojaner auf Win7 (64bit) System
    Plagegeister aller Art und deren Bekämpfung - 06.09.2012 (9)
  14. Avira nicht installierbar, Rechner langsam und Win32 und andere Trojaner an Board
    Plagegeister aller Art und deren Bekämpfung - 02.02.2012 (3)
  15. gleiches Problem wie http://www.trojaner-board.de/99057-das-system-hat-ein-problem-mit-einem-oder-me
    Plagegeister aller Art und deren Bekämpfung - 26.05.2011 (1)
  16. pin-tan-bank-trojaner / system neuaufsetzen vist->win7
    Plagegeister aller Art und deren Bekämpfung - 20.10.2010 (12)
  17. Win32/mebroot Trojaner auf Win7
    Antiviren-, Firewall- und andere Schutzprogramme - 07.06.2010 (2)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Trojaner an Board: Win32:BProtect-D [Trj] System:Win7 - Guten Tag zusammen, Avast premium hat mir beim heutigen Suchlauf folgenden Trojaner gemeldet Win32:BProtect-D [Trj] Avast kann ihn nicht in den Container verschieben. Ich hätte dieses Ding gerne los und - Trojaner an Board: Win32:BProtect-D [Trj] System:Win7...
Archiv
Du betrachtest: Trojaner an Board: Win32:BProtect-D [Trj] System:Win7 auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55