| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Win 7 (64): Links im Browser unterstrichen; eDeals, SlamDunk Savings u.v.m.Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
26.10.2014, 20:10
| #1 |
 |  Win 7 (64): Links im Browser unterstrichen; eDeals, SlamDunk Savings u.v.m. Hallo zusammen, auf dem PC eines Bekannten hat sich wirklich alles eingenistet was Rang und Namen hat ... Seit gestern versuche ich der Sache Herr zu werden - mit mäßigem Erfolg. Bin inzwischen etwas ratlos. Bisher habe ich folgende Programme eingesetzt, zum Teil mehrmals: MBAM, ESET, JRT, FRST, TFC, RKill, SC-Cleaner, ADW Cleaner ... Teilweise habe ich die Funde entfernen lassen, teilweise manuell nachgearbeitet und auch die hosts-Datei habe ich gereinigt. Nachdem der PC anfangs kaum noch lauffähig war und nicht mehr ins Internet kam, ist die Verbesserung jetzt schon deutlich, aber es scheinen immer noch aktive Reste da zu sein (siehe Titel) und auch schon gereinigte Einträge (z.B. Proxy und Browsererweiterungen) verstellen sich wieder/sind plötzlich wieder da. Welche Logs soll ich Euch zur Verfügung stellen: alle bisherigen oder soll ich nochmal ganz neue machen? Anbei schon mal die beiden 1. Logs von FRST (Stand: gestern): Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-10-2014
Ran by Admin (administrator) on ADMIN-PC on 25-10-2014 12:37:42
Running from C:\Users\Admin\Desktop
Loaded Profile: Admin (Available profiles: Admin)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Safe Mode (with Networking)
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [EKIJ5000StatusMonitor] => C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe [2922496 2011-06-16] (Eastman Kodak Company)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [Ocs_SM] => C:\Users\Admin\AppData\Roaming\OCS\SM\SearchAnonymizer.exe [106496 2012-11-10] (OCS)
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] => C:\Windows\KHALMNPR.EXE [242192 2008-02-29] (Logicool, Inc.)
HKLM-x32\...\Run: [AVMWlanClient] => C:\Program Files (x86)\avmwlanstick\wlangui.exe [2105344 2010-10-22] (AVM Berlin)
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [370176 2010-06-17] (shbox.de)
HKLM-x32\...\Run: [Conime] => %windir%\system32\conime.exe
HKLM-x32\...\Run: [DATAMNGR] => C:\PROGRA~2\SEARCH~2\Datamngr\DATAMN~2.EXE
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Updater] => C:\ProgramData\Updater\Updater.exe [486264 2013-12-18] (Updater)
HKLM-x32\...\Run: [mobilegeni daemon] => C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [fst_de_31] => C:\Program Files (x86)\fst_de_31\fst_de_31.exe [3989968 2014-06-02] ()
HKLM-x32\...\Run: [fst_de_24] => C:\Program Files (x86)\fst_de_24\fst_de_24.exe [3983824 2014-05-26] ()
HKLM-x32\...\Run: [fst_de_37] => C:\Program Files (x86)\fst_de_37\fst_de_37.exe [3984864 2014-06-06] ()
HKLM-x32\...\Run: [BService] => C:\Program Files (x86)\Bench\BService\1.1\bservice.exe [89088 2014-06-17] ()
HKLM-x32\...\Run: [BService64] => C:\Program Files (x86)\Bench\BService\1.1\bservice64.exe [109056 2014-06-17] ()
HKLM-x32\...\Run: [Wd] => C:\Program Files (x86)\Bench\Wd\wd.exe [92672 2014-06-17] ()
HKLM-x32\...\Run: [Bench Communicator Watcher] => C:\Program Files (x86)\Bench\Proxy\pwdg.exe [127488 2014-07-15] ()
HKLM-x32\...\Run: [Bench Settings Cleaner] => C:\Program Files (x86)\Bench\Proxy\cl.exe [55296 2014-07-15] ()
HKLM-x32\...\Run: [fst_de_48] => C:\Program Files (x86)\fst_de_48\fst_de_48.exe [3980280 2014-06-17] ()
HKLM-x32\...\Run: [fst_de_56] => C:\Program Files (x86)\fst_de_56\fst_de_56.exe [3979760 2014-06-20] ()
HKLM-x32\...\Run: [eDealsPop] => C:\Program Files (x86)\eDealsPop\eDealsPop.exe [7168 2014-07-17] ()
HKLM-x32\...\Run: [fst_de_89] => C:\Program Files (x86)\fst_de_89\fst_de_89.exe [3975136 2014-07-04] ()
HKLM-x32\...\Run: [AnyProtect Scanner] => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe [6210048 2014-10-18] (AnyProtect.com)
HKLM-x32\...\Run: [ConvertAd] => C:\Users\Admin\AppData\Local\ConvertAd\ConvertAd.exe [2097152 2014-10-18] ()
HKLM-x32\...\Run: [eDealPop] => C:\Program Files (x86)\eDealPop\eDealPop.exe [7168 2014-09-23] ()
HKLM-x32\...\RunOnce: [SlamDunk Savings-repairJob] => wscript.exe "C:\Users\Admin\AppData\Local\SlamDunk Savings\repair.js" "SlamDunk Savings-repairJob"
HKLM-x32\...\RunOnce: [upfst_de_37.exe] => C:\Users\Admin\AppData\Local\fst_de_37\upfst_de_37.exe [3268600 2014-06-06] ()
HKLM-x32\...\RunOnce: [upfst_de_48.exe] => C:\Users\Admin\AppData\Local\fst_de_48\upfst_de_48.exe [3341280 2014-06-17] ()
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKU\S-1-5-21-1148584671-988621172-509042803-1000\...\Run: [Google Update] => C:\Users\Admin\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-06-24] (Google Inc.)
HKU\S-1-5-21-1148584671-988621172-509042803-1000\...\Run: [Optimizer Pro] => C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe [135672 2013-06-07] (PC Utilities Pro)
HKU\S-1-5-21-1148584671-988621172-509042803-1000\...\Run: [NTRedirect] => C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Roaming\BabSolution\Shared\enhancedNT.dll",Run
HKU\S-1-5-21-1148584671-988621172-509042803-1000\...\Run: [Driver Pro] => C:\Program Files (x86)\Driver Pro\DPLauncher.exe [340512 2012-10-30] (PC Utilities Pro)
HKU\S-1-5-21-1148584671-988621172-509042803-1000\...\Run: [Updater] => C:\ProgramData\Updater\updater.exe [486264 2013-12-18] (Updater)
HKU\S-1-5-21-1148584671-988621172-509042803-1000\...\Run: [Google+ Auto Backup] => C:\Users\Admin\AppData\Local\Programs\Google\Google+ Auto Backup\Google+ Auto Backup.exe [3619096 2014-01-06] (Google Inc.)
HKU\S-1-5-21-1148584671-988621172-509042803-1000\...\Run: [Driver Detective] => c:\Program Files (x86)\PC Drivers HeadQuarters\Driver Detective\DriversHQ.DriverDetective.Client.exe /applicationMode:systemTray /showWelcome:false
HKU\S-1-5-21-1148584671-988621172-509042803-1000\...\Run: [BlockNSurf] => C:\Program Files (x86)\BlockAndSurf-soft\BlockNSurf.exe [131584 2014-05-22] (Revizer)
HKU\S-1-5-21-1148584671-988621172-509042803-1000\...\Run: [InetStat] => C:\Users\Admin\AppData\Roaming\InetStat\inetstat.exe [661984 2014-06-19] ()
HKU\S-1-5-21-1148584671-988621172-509042803-1000\...\Run: [Wallpaper Changer] => C:\Program Files (x86)\Wallpaper Changer\Wallpaper Changer.exe [735744 2013-07-22] ()
HKU\S-1-5-21-1148584671-988621172-509042803-1000\...\Run: [Desk 365] => C:\Program Files (x86)\Desk 365\desk365.exe [979024 2013-08-15] (337 Technology Limited.)
HKU\S-1-5-21-1148584671-988621172-509042803-1000\...\Run: [LookThisUp] => C:\Users\Admin\AppData\Roaming\LookThisUp\LookThisUp.exe [1848976 2014-10-17] (LookThisUp)
HKU\S-1-5-21-1148584671-988621172-509042803-1000\...\Run: [Gameo] => C:\Users\Admin\AppData\Roaming\Gameo\gameo.exe [41402880 2014-09-22] ()
HKU\S-1-5-21-1148584671-988621172-509042803-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6501656 2014-10-23] (Piriform Ltd)
HKU\S-1-5-21-1148584671-988621172-509042803-1000\...\MountPoints2: {5ef23c01-9e5c-11e0-870b-f46d049c6454} - F:\pushinst.exe
HKU\S-1-5-18\...\RunOnce: [KodakHomeCenter] => "C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe"
HKU\S-1-5-18\...\RunOnce: [SpUninstallDeleteDir] => rmdir /s /q "\SearchProtect"
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BoostUpdater.lnk
ShortcutTarget: BoostUpdater.lnk -> C:\Program Files (x86)\Boost\BoostUpdater.exe ()
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Internet.lnk
ShortcutTarget: FRITZ!DSL Internet.lnk -> C:\Program Files (x86)\FRITZ!DSL\FritzDsl.exe (AVM Berlin)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Startcenter.lnk
ShortcutTarget: FRITZ!DSL Startcenter.lnk -> C:\Program Files (x86)\FRITZ!DSL\StCenter.exe (AVM Berlin)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
ShortcutTarget: MyPC Backup.lnk -> C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe (MyPCBackup.com)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:12335
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.certified-toolbar.com?si=80415&tid=23890&ver=7.0&ts=1401919200000.000008&tguid=80415-23890-1401947521251-95342E6BC630F016FA9FF4BDE1CD25F7&st=chrome&q=
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sweet-page.com/?type=hp&ts=1401989824&from=cor&uid=395049983_1052515_B8B8DDED
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x20DDE2C42F30CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1401989824&from=cor&uid=395049983_1052515_B8B8DDED
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.certified-toolbar.com?si=80415&tid=23890&ver=7.0&ts=1401919200000.000008&tguid=80415-23890-1401947521251-95342E6BC630F016FA9FF4BDE1CD25F7&st=chrome&q=
HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = http://www.doko-search.com/?babsrc=HP_ss&mntrId=B8B800040EFFA4E0&affID=125836&tsp=5036
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.certified-toolbar.com?si=80415&tid=23890&ver=7.0&ts=1401919200000.000008&tguid=80415-23890-1401947521251-95342E6BC630F016FA9FF4BDE1CD25F7&st=chrome&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1401989824&from=cor&uid=395049983_1052515_B8B8DDED&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1401989824&from=cor&uid=395049983_1052515_B8B8DDED
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.gboxapp.com/
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1401989824&from=cor&uid=395049983_1052515_B8B8DDED&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.certified-toolbar.com?si=80415&tid=23890&ver=7.0&ts=1401919200000.000008&tguid=80415-23890-1401947521251-95342E6BC630F016FA9FF4BDE1CD25F7&st=chrome&q=
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1401989824&from=cor&uid=395049983_1052515_B8B8DDED
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:newtab
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://search.certified-toolbar.com?si=80415&tid=23890&ver=7.0&ts=1401919200000.000008&tguid=80415-23890-1401947521251-95342E6BC630F016FA9FF4BDE1CD25F7&st=chrome&q=
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Bar = http://search.certified-toolbar.com?si=80415&tid=23890&ver=7.0&ts=1401919200000.000008&tguid=80415-23890-1401947521251-95342E6BC630F016FA9FF4BDE1CD25F7&st=chrome&q=
URLSearchHook: HKLM-x32 - (No Name) - {990af1c2-5a27-4460-8149-ecc6bc122af3} - No File
URLSearchHook: HKLM-x32 - (No Name) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No File
URLSearchHook: HKLM-x32 - (No Name) - {78e516ef-11de-47a1-8364-a99b917ec5ee} - No File
URLSearchHook: HKLM-x32 - MixiDJ V30 Toolbar - {1122b43d-30ee-403f-9bfa-3cc99b0caddd} - C:\Program Files (x86)\MixiDJ_V30\prxtbMixi.dll (Conduit Ltd.)
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1401989824&from=cor&uid=395049983_1052515_B8B8DDED&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1401989824&from=cor&uid=395049983_1052515_B8B8DDED&q={searchTerms}
SearchScopes: HKLM - {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=md_14_19_ch&cd=2XzuyEtN2Y1L1Qzu0FyEyC0DtDyEzy0CyCyEyDyE0D0D0E0DtN0D0Tzu0SzzyDyBtN1L2XzutBtFtBtDtFyCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyDyD0AtDyEtCzztAtG0FyEtCtCtGtByB0FyCtG0DzzyCyCtGyCyE0E0DyD0FzytC0DyE0FtA2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDtB0DtAyD0Azy0BtGyB0ByBtCtGzztD0BzztGzzyC0AyDtGtD0CtBzytBtAtBzy0BzzyB0D2Q&cr=253987623&ir=
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2001} URL = http://dts.search.ask.com/sr?src=ieb&gct=ds&appid=1083&systemid=1&v=a12281-123&apn_uid=6428064209614225&apn_dtid=IME001&o=APN10653&apn_ptnrs=AGE&q={searchTerms}
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD21} URL = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=1083&systemid=1&apn_dtid=IME001&apn_ptnrs=AG1&o=APN10653&apn_uid=5717501305144874&q={searchTerms}
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search.ask.com/sr?src=ieb&gct=ds&appid=0&systemid=406&v=u8483-63&apn_uid=6428064209614225&apn_dtid=BND406&o=APN10645&apn_ptnrs=AG6&q={searchTerms}
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2431} URL = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=109&systemid=431&apn_uid=6428064209614225&apn_dtid=BND431&o=APN10656&apn_ptnrs=AGH&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.certified-toolbar.com?si=80415&st=bs&tid=23890&ver=7.0&ts=1401919200000.000008&tguid=80415-23890-1401947521251-95342E6BC630F016FA9FF4BDE1CD25F7&q={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1401989824&from=cor&uid=395049983_1052515_B8B8DDED&q={searchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2001} URL = http://dts.search.ask.com/sr?src=ieb&gct=ds&appid=1083&systemid=1&v=a12281-123&apn_uid=6428064209614225&apn_dtid=IME001&o=APN10653&apn_ptnrs=AGE&q={searchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search.ask.com/sr?src=ieb&gct=ds&appid=0&systemid=406&v=u8483-63&apn_uid=6428064209614225&apn_dtid=BND406&o=APN10645&apn_ptnrs=AG6&q={searchTerms}
SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.certified-toolbar.com?si=80415&st=bs&tid=23890&ver=7.0&ts=1401919200000.000008&tguid=80415-23890-1401947521251-95342E6BC630F016FA9FF4BDE1CD25F7&q={searchTerms}
SearchScopes: HKCU - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.certified-toolbar.com?si=80415&st=bs&tid=23890&ver=7.0&ts=1401919200000.000008&tguid=80415-23890-1401947521251-95342E6BC630F016FA9FF4BDE1CD25F7&q={searchTerms}
SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = http://feed.snapdo.com/?publisher=SnapdoGOblidooYB&dpid=SnapdoGOblidooYB&co=DE&userid=63171a59-6610-4a66-a522-e88533aa79b4&searchtype=ds&q={searchTerms}&installDate=31/07/2013
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL =
SearchScopes: HKCU - {09038620-190C-402B-A92F-18864E6AB22F} URL = http://go.1und1.de/suchbox/1und1suche?su={searchTerms}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www.doko-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=B8B800040EFFA4E0&affID=125836&tsp=5036
SearchScopes: HKCU - {0FB3AFB5-96B1-4E17-903E-84DCA71AC24D} URL =
SearchScopes: HKCU - {1CB43718-27AE-4507-B589-041D5B30C2CD} URL = http://go.web.de/suchbox/ebay?query={searchTerms}
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1401989824&from=cor&uid=395049983_1052515_B8B8DDED&q={searchTerms}
SearchScopes: HKCU - {4232C44C-4F56-4E94-B0B6-71E7A81800F2} URL = http://go.1und1.de/suchbox/amazon?tag=1und1icon-21&field-keywords={searchTerms}
SearchScopes: HKCU - {45764BD6-439B-4B8B-A7C7-E3BB4F8E6CF7} URL = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=cmi_14_15_ff&cd=2XzuyEtN2Y1L1Qzu0FyEyC0DtDyEzy0CyCyEyDyE0D0D0E0DtN0D0Tzu0SzztAtAtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyD0CyCyEzy0E0EtBtGyB0D0FyBtG0D0CyBtAtGtBtCyEyDtGtDtCzytCzzyEzztDyBzzyCtA2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDtB0DtAyD0Azy0BtGyB0ByBtCtGzztD0BzztGzzyC0AyDtGtD0CtBzytBtAtBzy0BzzyB0D2Q&cr=726051576&ir=
SearchScopes: HKCU - {5A817CF6-92D5-4DE5-AC38-82DF8A73EF28} URL = http://go.gmx.net/br/ie9_search_web/?su={searchTerms}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKCU - {6B1D1FB7-7233-4F7C-802C-21A1DDB12754} URL = http://go.web.de/br/ie9_search_web/?su={searchTerms}
SearchScopes: HKCU - {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=md_14_19_ch&cd=2XzuyEtN2Y1L1Qzu0FyEyC0DtDyEzy0CyCyEyDyE0D0D0E0DtN0D0Tzu0SzzyDyBtN1L2XzutBtFtBtDtFyCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyDyD0AtDyEtCzztAtG0FyEtCtCtGtByB0FyCtG0DzzyCyCtGyCyE0E0DyD0FzytC0DyE0FtA2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDtB0DtAyD0Azy0BtGyB0ByBtCtGzztD0BzztGzzyC0AyDtGtD0CtBzytBtAtBzy0BzzyB0D2Q&cr=253987623&ir=
SearchScopes: HKCU - {81CE708B-5104-4C62-B333-94B417473B29} URL = http://go.mail.com/br/ie9_search_web/?su={searchTerms}
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2001} URL = http://dts.search.ask.com/sr?src=ieb&gct=ds&appid=1083&systemid=1&v=a12281-123&apn_uid=6428064209614225&apn_dtid=IME001&o=APN10653&apn_ptnrs=AGE&q={searchTerms}
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.certified-toolbar.com?si=80415&st=bs&tid=23890&ver=7.0&ts=1401919200000.000008&tguid=80415-23890-1401947521251-95342E6BC630F016FA9FF4BDE1CD25F7&q={searchTerms}
SearchScopes: HKCU - {F664C955-1258-469B-A327-0360718ABF9F} URL = http://www.mysearchresults.com/search?c=3802&t=13&q={searchTerms}
BHO: CostMin -> {01662059-3EAA-C9BE-50C8-59962CD3763F} -> C:\Program Files (x86)\CostMin\FVtuTG.x64.dll ()
BHO: SmartSaver+ 8 -> {11111111-1111-1111-1111-110411891126} -> C:\Program Files (x86)\SmartSaver+ 8\SmartSaver+ 8-bho64.dll (smart-saverplus)
BHO: MediaPlayerplus -> {11111111-1111-1111-1111-110511421146} -> C:\Program Files (x86)\MediaPlayerplus\MediaPlayerplus-bho64.dll (Freeven)
BHO: V-bates -> {21EAF666-26B3-4a3c-ABD0-CA2F5A326744} -> C:\Program Files\V-bates\Extension64.dll ()
BHO: Snap.DoEngine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: Web Assistant -> {336D0C35-8A85-403a-B9D2-65C292C39087} -> C:\Program Files\Web Assistant\Extension64.dll ()
BHO: RegularDEals -> {40BD9927-8E87-34E2-1B15-CB7924F02714} -> C:\ProgramData\RegularDEals\cTvCMr.x64.dll ()
BHO: ShopDrop -> {4F8E06A1-6A0D-563E-4028-8CC35C2EC08C} -> C:\ProgramData\ShopDrop\miZSKu7FZm.x64.dll ()
BHO: JoniCaoupon -> {7CCB7D66-4562-BA7F-2F16-EFCDF2F672DC} -> C:\ProgramData\JoniCaoupon\cZi6M.x64.dll ()
BHO: DeissCounttExxTeNsi -> {85317591-8466-3F4B-B7CC-B81D51E1E3AC} -> C:\ProgramData\DeissCounttExxTeNsi\Z.x64.dll ()
BHO: Boost -> {8DE6FC60-E023-4AD7-A3B7-591E1460E7F7} -> C:\Program Files (x86)\Boost\64Boost.dll (Jigsaw)
BHO: HomeTab -> {92aa6038-35c9-4666-893f-84716dec281c} -> C:\Program Files\HomeTab\IE\HomeTab.dll (Simply Tech LTD.)
BHO: DataMngr -> {9D717F81-9148-4f12-8568-69135F087DB0} -> C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\BrowserConnection.dll (Bandoo Media, inc)
BHO: CheapMMe -> {a320b639-7650-485f-be02-f71b9c428c73} -> C:\ProgramData\CheapMMe\WTgXjayf3v0b2l.x64.dll ()
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: AlLSaveeR -> {E4322AD9-3FC9-7933-6633-43359B847B28} -> C:\ProgramData\AlLSaveeR\tu.x64.dll ()
BHO: SlamDunk Savings BHO -> {F33E90F9-C11A-442C-823D-F382190F93E5} -> C:\Program Files (x86)\SlamDunk Savings\FrameworkBHO64.dll ()
BHO-x32: CostMin -> {01662059-3EAA-C9BE-50C8-59962CD3763F} -> C:\Program Files (x86)\CostMin\FVtuTG.dll ()
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: 2rs3 -> {10AD2C61-0898-4348-8600-14A342F22AC3} -> C:\Program Files (x86)\SupraSavings\2rs3.dll ()
BHO-x32: Plus-HD-2.3 -> {11111111-1111-1111-1111-110311341126} -> C:\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-bho.dll (Plus HD)
BHO-x32: SmartSaver+ 8 -> {11111111-1111-1111-1111-110411891126} -> C:\Program Files (x86)\SmartSaver+ 8\SmartSaver+ 8-bho.dll (smart-saverplus)
BHO-x32: MediaPlayerplus -> {11111111-1111-1111-1111-110511421146} -> C:\Program Files (x86)\MediaPlayerplus\MediaPlayerplus-bho.dll (Freeven)
BHO-x32: MixiDJ V30 Toolbar -> {1122b43d-30ee-403f-9bfa-3cc99b0caddd} -> C:\Program Files (x86)\MixiDJ_V30\prxtbMixi.dll (Conduit Ltd.)
BHO-x32: 1und1 Konfiguration -> {17166733-40EA-4432-A85C-AE672FF0E236} -> C:\ProgramData\1und1InternetExplorerAddon\BHOXML.dll (1&1 Mail & Media GmbH)
BHO-x32: V-bates -> {21EAF666-26B3-4a3c-ABD0-CA2F5A326744} -> C:\Program Files\V-bates\Extension32.dll ()
BHO-x32: Snap.DoEngine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Web Assistant -> {336D0C35-8A85-403a-B9D2-65C292C39087} -> C:\Program Files\Web Assistant\Extension32.dll ()
BHO-x32: IETabPage Class -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> C:\Program Files (x86)\SupTab\SupTab.dll (Thinknice Co. Limited)
BHO-x32: dokotoolbar Helper Object -> {3B9F6E59-04CA-43FF-92DF-F6E66D3A8D82} -> C:\Program Files (x86)\Doko-Toolbar\dokotoolbar\1.8.26.9\bh\dokotoolbar.dll (Doko-Toolbar)
BHO-x32: RegularDEals -> {40BD9927-8E87-34E2-1B15-CB7924F02714} -> C:\ProgramData\RegularDEals\cTvCMr.dll ()
BHO-x32: Tube Dimmer -> {44ed99e2-16a6-4b89-80d6-5b21cf42e78b} -> C:\ProgramData\TubeDimmer\IE\common.dll (Creative Island Media, LLC)
BHO-x32: Music Box Toolbar (Dist. by iMesh, Inc.) -> {45177936-603b-4261-8d42-df6f7091d5d0} -> C:\PROGRA~2\MUSICT~1\Datamngr\SRTOOL~1\IE\searchresultsDx.dll No File
BHO-x32: ShopDrop -> {4F8E06A1-6A0D-563E-4028-8CC35C2EC08C} -> C:\ProgramData\ShopDrop\miZSKu7FZm.dll ()
BHO-x32: TBSB01620 Class -> {58124A0B-DC32-4180-9BFF-E0E21AE34026} -> C:\Program Files (x86)\IMinent Toolbar\tbcore3.dll ()
BHO-x32: Incredibar.com Helper Object -> {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} -> C:\Program Files (x86)\Incredibar.com\incredibar\1.5.3.27\bh\incredibar.dll (Montera Technologeis LTD)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: No Name -> {78e516ef-11de-47a1-8364-a99b917ec5ee} -> No File
BHO-x32: JoniCaoupon -> {7CCB7D66-4562-BA7F-2F16-EFCDF2F672DC} -> C:\ProgramData\JoniCaoupon\cZi6M.dll ()
BHO-x32: DefaultTab Browser Helper -> {7F6AFBF1-E065-4627-A2FD-810366367D01} -> C:\Users\Admin\AppData\Roaming\defaulttab\defaulttab\DefaultTabBHO.dll (Search Results LLC.)
BHO-x32: DeissCounttExxTeNsi -> {85317591-8466-3F4B-B7CC-B81D51E1E3AC} -> C:\ProgramData\DeissCounttExxTeNsi\Z.dll ()
BHO-x32: No Name -> {872b5b88-9db5-4310-bdd0-ac189557e5f5} -> No File
BHO-x32: Boost -> {8DE6FC60-E023-4AD7-A3B7-591E1460E7F7} -> C:\Program Files (x86)\Boost\Boost.dll (Jigsaw)
BHO-x32: BlockAndSurf -> {8E9C1CC8-FCEC-F858-9CEC-A4143CA5EE64} -> C:\Program Files (x86)\BlockAndSurf-soft\170.dll ()
BHO-x32: HomeTab -> {92aa6038-35c9-4666-893f-84716dec281c} -> C:\Program Files (x86)\HomeTab\IE\HomeTab.dll (Simply Tech LTD.)
BHO-x32: Searchqu Toolbar -> {99079a25-328f-4bd4-be04-00955acaa0a7} -> C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll No File
BHO-x32: No Name -> {990af1c2-5a27-4460-8149-ecc6bc122af3} -> No File
BHO-x32: DealPly Shopping -> {9cf699ca-2174-4ed8-bec1-ba82095edce0} -> C:\Program Files (x86)\DealPly\DealPlyIE.dll (DealPly)
BHO-x32: DataMngr -> {9D717F81-9148-4f12-8568-69135F087DB0} -> C:\Program Files (x86)\Searchqu Toolbar\Datamngr\BrowserConnection.dll (Bandoo Media, inc)
BHO-x32: CheapMMe -> {a320b639-7650-485f-be02-f71b9c428c73} -> C:\ProgramData\CheapMMe\WTgXjayf3v0b2l.dll ()
BHO-x32: Wajam -> {A7A6995D-6EE1-4FD1-A258-49395D5BF99C} -> C:\Program Files (x86)\Wajam\IE\priam_bho.dll (Wajam)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Search-Results Toolbar -> {bff6b2ca-366c-4a90-b685-d87776deb0d2} -> C:\Program Files (x86)\iMesh Applications\Mediabar\Datamngr\SRTOOL~1\searchresultsDx.dll (APN LLC)
BHO-x32: delta Helper Object -> {C1AF5FA5-852C-4C90-812E-A7F75E011D87} -> C:\Program Files (x86)\Delta\delta\1.8.22.0\bh\delta.dll (Delta-search.com)
BHO-x32: IEExtension.Extension -> {d40c654d-7c51-4eb3-95b2-1e23905c2a2d} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: 1&&1 Internet AG Browser Configuration by mquadr.at -> {D48FF4B4-E68F-47D1-8E25-81A0F0EEB341} -> C:\Windows\SysWow64\ieconfig_1und1.dll (mquadr.at software engineering und consulting GmbH)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: FlowSurf -> {E3F1CA13-EA0E-4617-8D03-3EAA6A94A7E0} -> C:\Program Files (x86)\Flowsurf\FlowSurf.dll (FlowSurf Inc.)
BHO-x32: AlLSaveeR -> {E4322AD9-3FC9-7933-6633-43359B847B28} -> C:\ProgramData\AlLSaveeR\tu.dll ()
BHO-x32: mysearchdial Helper Object -> {EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD} -> C:\Program Files (x86)\Mysearchdial\1.8.29.0\bh\mysearchdial.dll (MySearchDial)
BHO-x32: SlamDunk Savings BHO -> {F33E90F9-C11A-442C-823D-F382190F93E5} -> C:\Program Files (x86)\SlamDunk Savings\FrameworkBHO.dll ()
BHO-x32: PricePeep -> {FD6D90C0-E6EE-4BC6-B9F7-9ED319698007} -> C:\Program Files (x86)\PricePeep\pricepeep.dll (PricePeep)
BHO-x32: Yontoo Layers -> {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} -> C:\Program Files (x86)\Yontoo Layers\YontooIEClient.dll (Yontoo Technology, Inc.)
BHO-x32: BonanzaDeals -> {fe063412-bea4-4d76-8ed3-183be6220d17} -> C:\Program Files (x86)\BonanzaDeals\BonanzaDealsIE.dll (BonanzaDeals)
Toolbar: HKLM - Snap.Do - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM - HomeTab - {92aa6038-35c9-4666-893f-84716dec281c} - C:\Program Files\HomeTab\IE\HomeTab.dll (Simply Tech LTD.)
Toolbar: HKLM-x32 - IMinent Toolbar - {977AE9CC-AF83-45E8-9E03-E2798216E2D5} - C:\Program Files (x86)\IMinent Toolbar\tbcore3.dll ()
Toolbar: HKLM-x32 - Incredibar Toolbar - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - C:\Program Files (x86)\Incredibar.com\incredibar\1.5.3.27\incredibarTlbr.dll (Montera Technologeis LTD)
Toolbar: HKLM-x32 - Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll No File
Toolbar: HKLM-x32 - Search-Results Toolbar - {bff6b2ca-366c-4a90-b685-d87776deb0d2} - C:\Program Files (x86)\iMesh Applications\Mediabar\Datamngr\SRTOOL~1\searchresultsDx.dll (APN LLC)
Toolbar: HKLM-x32 - Delta Toolbar - {82E1477C-B154-48D3-9891-33D83C26BCD3} - C:\Program Files (x86)\Delta\delta\1.8.22.0\deltaTlbr.dll (Delta-search.com)
Toolbar: HKLM-x32 - Music Box Toolbar (Dist. by iMesh, Inc.) - {45177936-603b-4261-8d42-df6f7091d5d0} - C:\PROGRA~2\MUSICT~1\Datamngr\SRTOOL~1\IE\searchresultsDx.dll No File
Toolbar: HKLM-x32 - Snap.Do - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - MixiDJ V30 Toolbar - {1122b43d-30ee-403f-9bfa-3cc99b0caddd} - C:\Program Files (x86)\MixiDJ_V30\prxtbMixi.dll (Conduit Ltd.)
Toolbar: HKLM-x32 - dokotoolbar Toolbar - {339E1B37-76D3-4A64-A988-E81425DF831C} - C:\Program Files (x86)\Doko-Toolbar\dokotoolbar\1.8.26.9\dokotoolbarTlbr.dll (Doko-Toolbar)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - mysearchdial Toolbar - {3004627E-F8E9-4E8B-909D-316753CBA923} - C:\Program Files (x86)\Mysearchdial\1.8.29.0\mysearchdialTlbr.dll (MySearchDial)
Toolbar: HKLM-x32 - HomeTab - {92aa6038-35c9-4666-893f-84716dec281c} - C:\Program Files (x86)\HomeTab\IE\HomeTab.dll (Simply Tech LTD.)
Toolbar: HKCU - No Name - {990AF1C2-5A27-4460-8149-ECC6BC122AF3} - No File
Toolbar: HKCU - No Name - {EEE6C35B-6118-11DC-9C72-001320C79847} - No File
Toolbar: HKCU - No Name - {A1E75A0E-4397-4BA8-BB50-E19FB66890F4} - No File
Toolbar: HKCU - No Name - {30F9B915-B755-4826-820B-08FBA6BD249D} - No File
Toolbar: HKCU - No Name - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - No File
Toolbar: HKCU - No Name - {977AE9CC-AF83-45E8-9E03-E2798216E2D5} - No File
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU - No Name - {78E516EF-11DE-47A1-8364-A99B917EC5EE} - No File
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Toolbar: HKCU - No Name - {1122B43D-30EE-403F-9BFA-3CC99B0CADDD} - No File
DPF: HKLM-x32 {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: HKLM-x32 {25C29129-E95F-4564-BFE3-000000007100} http://www.123webseite.de/builder/pages/KvikVideo-7-1-0-0.CAB
DPF: HKLM-x32 {6A060448-60F9-11D5-A6CD-0002B31F7455}
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default
FF SearchEngineOrder.1: Web Search
FF Homepage: about:home
FF Keyword.URL: hxxp://search.certified-toolbar.com?si=80415&tid=23890&ver=7.0&ts=1401919200000.000008&tguid=80415-23890-1401947521251-95342E6BC630F016FA9FF4BDE1CD25F7&st=chrome&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 -> C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF Plugin-x32: @tools.bdupdater.com/BonanzaDealsLive Update;version=3 -> C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll (BonanzaDeals)
FF Plugin-x32: @tools.bdupdater.com/BonanzaDealsLive Update;version=9 -> C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll (BonanzaDeals)
FF Plugin-x32: @tools.dpliveupdate.com/DealPlyLive Update;version=3 -> C:\Program Files (x86)\DealPlyLive\Update\1.3.23.0\npGoogleUpdate3.dll (DealPly Technologies Ltd)
FF Plugin-x32: @tools.dpliveupdate.com/DealPlyLive Update;version=9 -> C:\Program Files (x86)\DealPlyLive\Update\1.3.23.0\npGoogleUpdate3.dll (DealPly Technologies Ltd)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin -> C:\Users\Admin\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin -> C:\Users\Admin\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @talk.google.com/O3DPlugin -> C:\Users\Admin\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\Admin\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\Admin\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF user.js: detected! => C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\user.js
FF Plugin ProgramFiles/Appdata: C:\Users\Admin\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Admin\AppData\Roaming\mozilla\plugins\npgtpo3dautoplugin.dll ()
FF Plugin ProgramFiles/Appdata: C:\Users\Admin\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\sweet-page.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\Web Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\Ask.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\sweet-page.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: SmartSaver+ 8 - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\16eede48-12e9-4c79-bd54-c82622138533@630d8a34-73af-4e03-9664-9082492eb220.com [2014-07-12]
FF Extension: SaveRExtension - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\34jvio_gjv@oeou-chhvgi.com [2014-06-11]
FF Extension: MediaPlayerplus - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com [2014-07-12]
FF Extension: EnjoyCouupon - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\aeiioeu5eu@ckzsyuoua.org [2014-05-22]
FF Extension: Arabic spell-checking dictionary - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\ar@dictionaries.addons.mozilla.org [2014-02-08]
FF Extension: DoNotTrackMe: Online Privacy Protection - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\donottrackplus@abine.com [2014-07-12]
FF Extension: DiScounntExtensi - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\eoi7r@iyu-oo.net [2014-08-09]
FF Extension: CheapMeu - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\G7ueJAIY@k.net [2014-09-28]
FF Extension: WinDealist - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\m4@windealist.com [2014-04-29]
FF Extension: CostMin - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\nb8gd.evi@ujxrstqbev.co.uk [2014-05-04]
FF Extension: Fun2SAvE - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\nsmalxxmp-bmfw@d-mktib.co.uk [2014-05-11]
FF Extension: AllSaVer - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\pnuka_oye@ueqr-joa.edu [2014-07-07]
FF Extension: Quick Start - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\quick_start@gmail.com [2014-06-05]
FF Extension: Tube Dimmer - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\support@tubedimmerapp.com [2014-01-23]
FF Extension: SlamDunk Savings - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\{4EE52A10-7106-03E8-5290-170ABA79C05E} [2014-06-19]
FF Extension: HomeTab - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\{83d6be19-6d32-4dcc-a6cf-637a5ec1afc5} [2014-10-20]
FF Extension: Ask New Tabs - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\{E6F07F01-931E-800B-40D4-0043A11BDE51} [2014-04-09]
FF Extension: Boost - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\boost@boost.net.xpi [2014-05-16]
FF Extension: Boo.ly Shopping - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\getbooly@boo.ly.xpi [2014-06-19]
FF Extension: Foxtab Speed Dial - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\{5ebdca98-43b3-45bb-87e0-716029fb42ab}.xpi [2014-06-22]
FF Extension: MySearchDial - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}.xpi [2014-05-07]
FF Extension: DownThemAll! - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2014-03-22]
FF HKLM\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\Web Assistant\Firefox
FF Extension: Web Assistant - C:\Program Files\Web Assistant\Firefox [2012-06-01]
FF HKLM\...\Firefox\Extensions: [{8E9E3331-D360-4f87-8803-52DE43566502}] - C:\Program Files\Web Assistant\Firefox
FF HKLM\...\Firefox\Extensions: [{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}] - C:\Program Files\V-bates\Firefox
FF Extension: V-bates - C:\Program Files\V-bates\Firefox [2014-04-12]
FF HKLM-x32\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\Web Assistant\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{8E9E3331-D360-4f87-8803-52DE43566502}] - C:\Program Files\Web Assistant\Firefox
FF HKLM-x32\...\Firefox\Extensions: [quick_start@gmail.com] - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\extensions\quick_start@gmail.com
FF HKLM-x32\...\Firefox\Extensions: [{20d1f7b3-7721-4da0-b6f3-78bb4d7248f4}] - C:\Program Files (x86)\Browser Guard\browserguard.xpi
FF Extension: Browser Guard - C:\Program Files (x86)\Browser Guard\browserguard.xpi [2014-02-24]
FF HKLM-x32\...\Firefox\Extensions: [{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}] - C:\Program Files\V-bates\Firefox
FF HKLM-x32\...\Firefox\Extensions: [jid1-tofUlNEIFlkUIA@jetpack] - C:\Program Files (x86)\Flowsurf\jid1-tofUlNEIFlkUIA@jetpack
FF Extension: FlowSurf - C:\Program Files (x86)\Flowsurf\jid1-tofUlNEIFlkUIA@jetpack [2014-07-10]
FF HKCU\...\Firefox\Extensions: [{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}] - C:\Program Files (x86)\PriceGong\2.5.0\FF
FF Extension: PriceGong - C:\Program Files (x86)\PriceGong\2.5.0\FF [2011-07-04]
FF HKCU\...\Firefox\Extensions: [{b5ad6039-a173-4149-9dcf-d04371526253}] - C:\Program Files (x86)\Lyrics_Monkey\131.xpi
FF HKCU\...\Firefox\Extensions: [{354dbb0a-71d5-4e9f-9c02-6c88b9d387ba}] - C:\ProgramData\SExtension\SExtension\{354dbb0a-71d5-4e9f-9c02-6c88b9d387ba}
FF Extension: Show Mask ON - C:\ProgramData\SExtension\SExtension\{354dbb0a-71d5-4e9f-9c02-6c88b9d387ba} [2014-01-29]
FF HKCU\...\Firefox\Extensions: [{FF76B0FA-B825-A4AB-2FCC-2B2CAD781266}] - C:\Program Files (x86)\BlockAndSurf-soft\170.xpi
FF Extension: No Name - C:\Program Files (x86)\BlockAndSurf-soft\170.xpi [2014-05-22]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Plugin: (Shockwave Flash) - F:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.83\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - F:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\pdf.dll ()
CHR Plugin: (Wajam) - F:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp\1.24_0\plugins/PriamNPAPI.dll No File
CHR Plugin: (Adobe Acrobat) - F:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.170.4) - F:\Program Files\Mozilla Firefox\plugins\npdeploytk.dll No File
CHR Plugin: (2007 Microsoft Office system) - F:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll No File
CHR Plugin: (Winamp Application Detector) - F:\Program Files\Mozilla Firefox\plugins\npwachk.dll No File
CHR Plugin: (Microsoft® DRM) - F:\Program Files\Windows Media Player\npdrmv2.dll No File
CHR Plugin: (Microsoft® DRM) - F:\Program Files\Windows Media Player\npwmsdrm.dll No File
CHR Plugin: (Windows Media Player Plug-in Dynamic Link Library) - F:\Program Files\Windows Media Player\npdsplay.dll No File
CHR Plugin: (Google Update) - F:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
CHR Plugin: (Google Earth Plugin) - F:\Program Files\Google\Google Earth\plugin\npgeplugin.dll No File
CHR Plugin: (Panda ActiveScan 2.0) - F:\Program Files\Panda Security\ActiveScan 2.0\npwrapper.dll No File
CHR Plugin: (iTunes Application Detector) - F:\Program Files\iTunes\Mozilla Plugins\npitunes.dll No File
CHR Plugin: (Ma-Config.com plugin) - F:\Program Files\ma-config.com\nphardwaredetection.dll No File
CHR Plugin: (Silverlight Plug-In) - f:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Music Toolbar) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaihhnfnbnpbhpagnmoplpcjbediml [2013-08-19]
CHR Extension: (FoxyDeal) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aiennapmieppnpfhhogglccgepbdajan [2014-04-09]
CHR Extension: (Search-Gol Toolbar) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aipfmkinhleccnodemkoofnnofpbbpac [2013-10-03]
CHR Extension: (MixiDJ Toolbar) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\boipimhfjpakfgckhbljjengakjhkcbp [2013-08-19]
CHR Extension: (Doko Toolbar) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\edcikfknpchdehdlmjpbofgkoaonaijg [2014-04-09]
CHR Extension: (DealPly French) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejnmnhkgiphcaeefbaooconkceehicfi [2014-04-09]
CHR Extension: (Renren Album Downloader) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\enmkdplopmpkfnlefdldpkbcmihgcdec [2014-08-09]
CHR Extension: (SlamDunk Savings) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\eoofckbahbagadoifcjabhaklkhjmafo [2014-06-21]
CHR Extension: (Delta Toolbar) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde [2013-08-19]
CHR Extension: (MixiDJ V30) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdkednngfjmpnljkolbapdednncafhen [2013-08-19]
CHR Extension: (No Name) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\iagcajndpnfncplednpbnkahadegklfa [2014-04-16]
CHR Extension: (YouTurn) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\icphmmimmfdlgaaglejeokffekamhplg [2014-09-28]
CHR Extension: (Lightning Newtab) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifohbjbgfchkkfhphahclmkpgejiplfo [2014-07-10]
CHR Extension: (Tube Dimmer) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\igjjkeeamkpihpncmmbgdkhdnjpcfmfb [2014-09-04]
CHR Extension: (DefaultTab) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdidombaedgpfiiedeimiebkmbilgmlc [2014-07-10]
CHR Extension: (Torch Share) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kiplfnciaokpcennlkldkdaeaaomamof [2014-04-09]
CHR Extension: (SmartSaver+ 8) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\klhlfdbffplhpkpalkmacjejfbdeefaj [2014-04-12]
CHR Extension: (MediaPlayerplus) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd [2014-04-12]
CHR Extension: (Giant Savings) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndkhncnongaclekkbelchmeafffimifj [2014-04-09]
CHR Extension: (Google Wallet) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-21]
CHR Extension: (FlowSurf) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oglkiljdmflopemijdadoiepkhcaodjn [2014-07-10]
CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\Web Assistant\source.crx [2013-07-26]
CHR HKCU\...\Chrome\Extension: [fdkednngfjmpnljkolbapdednncafhen] - C:\Users\Admin\AppData\Local\CRE\fdkednngfjmpnljkolbapdednncafhen.crx [2013-08-07]
CHR HKLM-x32\...\Chrome\Extension: [aaaaihhnfnbnpbhpagnmoplpcjbediml] - C:\Users\Admin\AppData\Local\imeshmusicboxtoolbar\GC\toolbar.crx [2013-06-19]
CHR HKLM-x32\...\Chrome\Extension: [aiennapmieppnpfhhogglccgepbdajan] - C:\Program Files (x86)\FoxyDeal\foxydeal.crx [2013-06-14]
CHR HKLM-x32\...\Chrome\Extension: [aipfmkinhleccnodemkoofnnofpbbpac] - C:\Users\Admin\AppData\Roaming\BabSolution\CR\searchgol.crx [2013-10-03]
CHR HKLM-x32\...\Chrome\Extension: [boipimhfjpakfgckhbljjengakjhkcbp] - C:\Users\Admin\AppData\Roaming\BabSolution\CR\mixiDj.crx [2013-08-18]
CHR HKLM-x32\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\Web Assistant\source.crx [2013-07-26]
CHR HKLM-x32\...\Chrome\Extension: [edcikfknpchdehdlmjpbofgkoaonaijg] - C:\Users\Admin\AppData\Roaming\BabSolution\CR\Doko.crx [2013-10-15]
CHR HKLM-x32\...\Chrome\Extension: [ejnmnhkgiphcaeefbaooconkceehicfi] - C:\Program Files (x86)\DealPly\DealPly.crx [2013-05-08]
CHR HKLM-x32\...\Chrome\Extension: [eooncjejnppfjjklapaamhcdmjbilmde] - C:\Users\Admin\AppData\Roaming\BabSolution\CR\Delta.crx [2013-06-14]
CHR HKLM-x32\...\Chrome\Extension: [fdkednngfjmpnljkolbapdednncafhen] - C:\Users\Admin\AppData\Local\CRE\fdkednngfjmpnljkolbapdednncafhen.crx [2013-08-07]
CHR HKLM-x32\...\Chrome\Extension: [ifohbjbgfchkkfhphahclmkpgejiplfo] - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtab.crx [2013-09-05]
CHR HKLM-x32\...\Chrome\Extension: [jpmbfleldcgkldadpdinhjjopdfpjfjp] - C:\Users\Admin\AppData\Local\Wajam\Chrome\wajam.crx [2013-05-02]
CHR HKLM-x32\...\Chrome\Extension: [kdidombaedgpfiiedeimiebkmbilgmlc] - C:\Program Files (x86)\DefaultTab\DefaultTab.crx [2013-10-07]
CHR HKLM-x32\...\Chrome\Extension: [kiplfnciaokpcennlkldkdaeaaomamof] - C:\Users\Admin\AppData\Local\Torch\Plugins\TorchPlugin.crx [2013-08-01]
CHR HKLM-x32\...\Chrome\Extension: [kmmjjcoppdcpcdlonfflbdabbkhnnogm] - C:\Program Files (x86)\Search Results Toolbar\Datamngr\chromeExtension.crx [2013-08-01]
CHR HKLM-x32\...\Chrome\Extension: [ndkhncnongaclekkbelchmeafffimifj] - C:\Users\Admin\AppData\Local\Giant Savings\Chrome\Giant Savings.crx [2012-08-08]
CHR HKLM-x32\...\Chrome\Extension: [ofnnlhbgdcabppjmlijllkhekcglbjlg] - C:\Program Files (x86)\Lyrics_Monkey\131.crx [2012-08-08]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S2 AVM IGD CTRL Service; C:\Program Files (x86)\FRITZ!DSL\IGDCTRL.EXE [81920 2005-11-21] (AVM Berlin) [File not signed]
S2 AVM WLAN Connection Service; C:\Program Files (x86)\avmwlanstick\WlanNetService.exe [376832 2010-10-22] (AVM Berlin) [File not signed]
S2 BackupStack; C:\Program Files (x86)\MyPC Backup\BackupStack.exe [36936 2014-09-28] (Just Develop It) <==== ATTENTION
S2 be0fb33b; c:\Program Files (x86)\Supporter\SupporterSvc.dll [179536 2014-05-04] () [File not signed]
S2 BlockAndSurf; C:\Program Files (x86)\BlockAndSurf-soft\BlockAndSurfgd170.exe [179200 2014-05-22] () [File not signed]
S2 bonanzadealslive; C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe [148976 2013-10-03] (BonanzaDeals)
S3 bonanzadealslivem; C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe [148976 2013-10-03] (BonanzaDeals)
S2 ControlDefaultMotion.exe; C:\Users\Admin\AppData\Local\ControlDefaultMotion\ControlDefaultMotion.exe [158720 2014-10-13] () [File not signed]
S2 CouponDownloaderService64; C:\Program Files (x86)\A6ADCE5D-859A-4E7E-B0B2-D07F8AB9237E\CouponDownloaderService64.exe [172544 2014-06-06] () [File not signed]
S4 DefaultTabSearch; C:\Program Files (x86)\DefaultTab\DefaultTabSearch.exe [574464 2013-12-20] () [File not signed]
S4 DefaultTabUpdate; C:\Users\Admin\AppData\Roaming\defaulttab\defaulttab\dtupdate.exe [107520 2013-12-11] () [File not signed]
S4 desksvc; C:\Program Files (x86)\Desk 365\deskSvc.exe [424016 2013-08-15] (337 Technology Limited.) <==== ATTENTION
S3 de_serv; C:\Program Files (x86)\Common Files\AVM\de_serv.exe [315392 2005-11-21] (AVM Berlin) [File not signed]
S4 IePluginServices; C:\ProgramData\IePluginServices\PluginService.exe [704112 2014-05-08] (Cherished Technololgy LIMITED)
S2 InteractiveOfficeWord; C:\Windows\SysWOW64\InteractiveOfficeWord\InteractiveOfficeWord.exe [68096 2014-10-13] () [File not signed]
S2 InternetUpdater; C:\ProgramData\InternetUpdater\InternetUpdaterService.exe [45568 2014-01-15] (Parallel Lines Development, LLC) [File not signed]
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S2 MovieMode; C:\ProgramData\MovieMode\MovieMode.exe [152208 2014-03-21] (GenTechnologies Apps, LLC)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
S2 PirritUpdater; C:\Program Files (x86)\Pirrit\AutoUpdater.exe [59904 2014-02-20] () [File not signed]
S2 Registry Helper Service; C:\Program Files (x86)\Registry Helper\RegistryHelperService.exe [84328 2014-01-26] (SafeApp Software, LLC)
S2 rqpbhevlkc64; C:\Program Files\004\rqpbhevlkc64.exe [709120 2014-05-22] () [File not signed]
S2 SearchAnonymizer; C:\Users\Admin\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe [40960 2012-11-10] () [File not signed]
S2 serviceIEConfig; C:\Windows\SysWOW64\ieconfig_1und1_svc.exe [1053848 2014-06-05] ()
S4 TorchCrashHandler; C:\Users\Admin\AppData\Local\Torch\Update\TorchCrashHandler.exe [1206624 2013-07-20] (TorchMedia Inc.) [File not signed] <==== ATTENTION
S2 V-bates Updater; C:\Program Files\V-bates\ExtensionUpdaterService.exe [209408 2014-02-26] () [File not signed]
S2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27760 2011-06-14] (VIA Technologies, Inc.)
S2 vosr; C:\Users\Admin\AppData\Roaming\VOPackage\VOsrv.exe [355328 2014-04-12] () [File not signed] <==== ATTENTION
S4 WajamUpdater; C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe [109064 2013-05-02] (Wajam) [File not signed] <==== ATTENTION
S4 Web Assistant Updater; C:\Program Files\Web Assistant\ExtensionUpdaterService.exe [188760 2013-07-03] () [File not signed]
S2 WinRST; C:\Program Files (x86)\WinRST\WinRST.exe [59904 2014-02-26] () [File not signed]
S4 Wpm; C:\ProgramData\WPM\wprotectmanager.exe [566272 2014-04-12] (Cherished Technololgy LIMITED) [File not signed]
S2 0bd9c8e28672d00.exe; C:\Users\Admin\AppData\Local\910a8b731f707898fd7e649e0ad73604\0bd9c8e28672d00.exe [X]
S2 ArchiveBackupDebug.exe; C:\Users\Admin\AppData\Local\ArchiveBackupDebug\ArchiveBackupDebug.exe [X]
S2 dealplylive; C:\Program Files (x86)\DealPlyLive\Update\DealPlyLive.exe /svc [X]
S3 dealplylivem; C:\Program Files (x86)\DealPlyLive\Update\DealPlyLive.exe /medsvc [X]
S2 DebuggerFreewareNet.exe; C:\Users\Admin\AppData\Local\DebuggerFreewareNet\DebuggerFreewareNet.exe [X]
S2 DebugLogTrash.exe; C:\Users\Admin\AppData\Local\DebugLogTrash\DebugLogTrash.exe [X]
S2 FunctionLogPath.exe; C:\Users\Admin\AppData\Local\FunctionLogPath\FunctionLogPath.exe [X]
S2 Kodak AiO Status Monitor Service; "C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe" [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2010-10-22] (AVM Berlin)
S4 F06DEFF2-5B9C-490D-910F-35D3A9119622; C:\Program Files (x86)\Music Toolbar\Datamngr\x64\setmgrc1.cfg [36248 2014-04-06] (iMesh Inc)
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [460800 2010-10-22] (AVM GmbH)
S3 LHidFilt; C:\Windows\System32\DRIVERS\LHidFilt.Sys [54800 2008-02-29] (Logicool, Inc.)
S3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [57360 2008-02-29] (Logicool, Inc.)
S3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [41488 2008-02-29] (Logicool, Inc.)
S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
R1 netfilter64; C:\Windows\System32\drivers\netfilter64.sys [46376 2014-07-08] (NetFilterSDK.com)
S2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
U5 TubeDimmer; C:\ProgramData\TubeDimmer\up\2.6.80\TubeDimmer.exe [42872 2014-05-02] (Creative Island Media, LLC)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S1 avbdsgdp; \??\C:\Windows\system32\drivers\avbdsgdp.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S1 kbavjhwt; \??\C:\Windows\system32\drivers\kbavjhwt.sys [X]
S3 RgFltX64; \??\C:\Users\Admin\AppData\Local\DebuggerFreewareNet\RgFltX64.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-25 12:37 - 2014-10-25 12:38 - 00057850 _____ () C:\Users\Admin\Desktop\FRST.txt
2014-10-25 12:37 - 2014-10-25 12:37 - 00000000 ____D () C:\FRST
2014-10-25 12:07 - 2014-10-25 12:08 - 02112512 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe
2014-10-25 12:06 - 2014-10-25 12:07 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\Admin\Downloads\mbam-setup-2.0.3.1025.exe
2014-10-25 12:05 - 2014-10-25 12:05 - 00709564 _____ () C:\Users\Admin\Desktop\delfix_10.8.exe
2014-10-25 12:04 - 2014-10-25 12:04 - 07864386 _____ () C:\Users\Admin\Downloads\tweaking.com_windows_repair_aio.zip
2014-10-25 12:03 - 2014-10-25 12:03 - 01962496 _____ () C:\Users\Admin\Desktop\AdwCleaner_4.001.exe
2014-10-25 12:03 - 2014-10-25 12:03 - 00448512 _____ (OldTimer Tools) C:\Users\Admin\Desktop\TFC.exe
2014-10-25 12:02 - 2014-10-25 12:02 - 01706144 _____ (Thisisu) C:\Users\Admin\Desktop\JRT.exe
2014-10-25 11:49 - 2014-10-25 11:55 - 00000000 ____D () C:\Users\Admin\Desktop\Wartung
2014-10-25 11:46 - 2014-10-25 11:46 - 00000822 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-10-25 11:46 - 2014-10-25 11:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-10-25 11:46 - 2014-10-25 11:46 - 00000000 ____D () C:\Program Files\CCleaner
2014-10-25 11:45 - 2014-10-25 11:46 - 04974864 _____ (Piriform Ltd) C:\Users\Admin\Downloads\ccsetup419.exe
2014-10-22 00:03 - 2014-10-25 12:10 - 00001426 _____ () C:\Users\Admin\Desktop\Registry kostenlos entrümpeln!.lnk
2014-10-20 19:45 - 2014-10-20 19:45 - 00001015 _____ () C:\Users\Admin\Desktop\FRITZ!Box 7330 SL (UI) - Verknüpfung (2).lnk
2014-10-18 23:21 - 2014-10-18 23:21 - 00000000 ____D () C:\Windows\SysWOW64\InteractiveOfficeWord
2014-10-18 23:21 - 2014-10-18 23:21 - 00000000 ____D () C:\Program Files (x86)\eDealPop
2014-10-18 23:18 - 2014-10-22 00:42 - 00000000 ____D () C:\Users\Admin\AppData\Local\ControlDefaultMotion
2014-10-18 18:53 - 2014-10-18 18:53 - 00000146 _____ () C:\Users\Admin\Desktop\Internetoptionen - Verknüpfung.lnk
2014-10-18 18:15 - 2014-10-18 23:10 - 00000376 _____ () C:\Windows\Tasks\APSnotifierPP3.job
2014-10-18 18:15 - 2014-10-18 23:10 - 00000376 _____ () C:\Windows\Tasks\APSnotifierPP2.job
2014-10-18 18:15 - 2014-10-18 18:15 - 00002826 _____ () C:\Windows\System32\Tasks\APSnotifierPP3
2014-10-18 18:05 - 2014-10-18 18:05 - 00612065 _____ (CMI Limited) C:\Users\Admin\AppData\Local\nsv26A5.tmp
2014-10-18 17:45 - 2014-10-25 12:11 - 00000272 _____ () C:\Windows\Tasks\SpeedUpMyPC Startup.job
2014-10-18 17:45 - 2014-10-25 10:47 - 00000278 _____ () C:\Windows\Tasks\SpeedUpMyPC Maintenance.job
2014-10-18 17:45 - 2014-10-18 17:45 - 00003216 _____ () C:\Windows\System32\Tasks\SpeedUpMyPC Maintenance
2014-10-18 17:45 - 2014-10-18 17:45 - 00002504 _____ () C:\Windows\System32\Tasks\SpeedUpMyPC Startup
2014-10-18 17:09 - 2014-10-18 17:09 - 00000000 __SHD () C:\found.000
2014-10-17 23:21 - 2014-10-17 23:21 - 00000000 ___HD () C:\Users\Admin\AppData\Roaming\GoldenGate
2014-10-17 23:19 - 2014-10-17 23:19 - 00000000 __SHD () C:\Users\Admin\AppData\Roaming\AnyProtectEx
2014-10-17 23:19 - 2014-10-17 23:18 - 00612065 _____ (CMI Limited) C:\Users\Admin\AppData\Local\nsxA575.tmp
2014-10-17 23:18 - 2014-10-17 23:18 - 00000171 _____ () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Play Games Online.url
2014-10-17 23:17 - 2014-10-25 12:19 - 00000000 ____D () C:\Users\Admin\AppData\Local\Gameo
2014-10-17 23:17 - 2014-10-25 12:15 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\LookThisUp
2014-10-17 23:17 - 2014-10-17 23:17 - 00001785 _____ () C:\Users\Admin\Desktop\Gameo.lnk
2014-10-17 23:17 - 2014-10-17 23:17 - 00001771 _____ () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Gameo.lnk
2014-10-17 23:17 - 2014-10-17 23:17 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Gameo
2014-10-17 23:10 - 2014-10-22 00:42 - 00000000 ____D () C:\Users\Admin\AppData\Local\ConvertAd
2014-10-17 23:09 - 2014-10-17 23:20 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Gameo
2014-10-17 18:06 - 2014-10-17 18:06 - 00000000 ____D () C:\Users\Admin\{01662059-3E
2014-09-28 22:25 - 2014-08-19 20:05 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-28 22:25 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-09-28 22:25 - 2014-08-19 01:01 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-28 22:25 - 2014-08-19 00:29 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-28 22:25 - 2014-08-19 00:29 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-28 22:25 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-28 22:25 - 2014-08-19 00:20 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-28 22:25 - 2014-08-19 00:19 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-28 22:25 - 2014-08-19 00:15 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-28 22:25 - 2014-08-19 00:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-28 22:25 - 2014-08-19 00:14 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-28 22:25 - 2014-08-19 00:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-28 22:25 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-09-28 22:25 - 2014-08-19 00:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-28 22:25 - 2014-08-19 00:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-28 22:25 - 2014-08-19 00:05 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-28 22:25 - 2014-08-19 00:03 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-28 22:25 - 2014-08-19 00:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-28 22:25 - 2014-08-19 00:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-28 22:25 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-09-28 22:25 - 2014-08-18 23:56 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-28 22:25 - 2014-08-18 23:51 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-28 22:25 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-09-28 22:25 - 2014-08-18 23:45 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-28 22:25 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-09-28 22:25 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-09-28 22:25 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-09-28 22:25 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-28 22:25 - 2014-08-18 23:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-28 22:25 - 2014-08-18 23:39 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-28 22:25 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-28 22:25 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-09-28 22:25 - 2014-08-18 23:38 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-28 22:25 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-09-28 22:25 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-09-28 22:25 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-09-28 22:25 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-09-28 22:25 - 2014-08-18 23:25 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-28 22:25 - 2014-08-18 23:25 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-28 22:25 - 2014-08-18 23:23 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-28 22:25 - 2014-08-18 23:23 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-28 22:25 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-09-28 22:25 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-09-28 22:25 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-09-28 22:25 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-28 22:25 - 2014-08-18 23:16 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-28 22:25 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-28 22:25 - 2014-08-18 23:15 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-28 22:25 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-28 22:25 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-28 22:25 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-09-28 22:25 - 2014-08-18 22:55 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-28 22:25 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-28 22:25 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-28 22:25 - 2014-08-18 22:38 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-28 22:25 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-09-28 20:35 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-28 20:35 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2014-09-28 09:27 - 2014-09-10 00:11 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-28 09:27 - 2014-09-09 23:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-09-28 09:27 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-28 09:27 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-09-28 09:26 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-28 09:26 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-09-28 09:25 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-28 09:25 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-28 09:25 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-09-28 09:25 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-09-28 09:25 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-09-28 09:24 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-28 09:24 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-28 08:56 - 2014-09-28 08:58 - 00000000 ____D () C:\ProgramData\CheapMMe
2014-09-28 08:38 - 2014-10-03 16:40 - 17903792 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-25 12:32 - 2014-06-29 13:40 - 00000000 ____D () C:\Program Files\CouponDownloader
2014-10-25 12:19 - 2013-10-03 15:14 - 00000924 _____ () C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job
2014-10-25 12:15 - 2014-06-19 06:51 - 00000000 ____D () C:\Users\Admin\AppData\Local\fst_de_48
2014-10-25 12:15 - 2014-06-12 07:08 - 00000000 ____D () C:\Users\Admin\AppData\Local\fst_de_37
2014-10-25 12:15 - 2014-05-02 12:54 - 01161080 _____ () C:\Windows\SysWOW64\TubeDimmer.EA96BC9739D9.2.6.80.dll
2014-10-25 12:14 - 2014-06-19 06:50 - 00000003 _____ () C:\Users\Admin\AppData\Local\proxy.log
2014-10-25 12:10 - 2014-06-19 06:46 - 00000344 _____ () C:\Windows\Tasks\bench-sys.job
2014-10-25 12:10 - 2014-06-19 06:46 - 00000344 _____ () C:\Windows\Tasks\bench-S-1-5-21-1148584671-988621172-509042803-1000.job
2014-10-25 12:10 - 2014-05-22 12:42 - 00000424 _____ () C:\Windows\Tasks\BlockAndSurf Update.job
2014-10-25 12:10 - 2014-05-22 12:42 - 00000404 _____ () C:\Windows\Tasks\BlockAndSurf_wd.job
2014-10-25 12:10 - 2014-04-12 16:02 - 00001426 _____ () C:\Windows\Tasks\365c2923-b81b-461a-ba4b-1eba770fbbb7-5.job
2014-10-25 12:10 - 2014-04-12 16:00 - 00001326 _____ () C:\Windows\Tasks\365c2923-b81b-461a-ba4b-1eba770fbbb7-2.job
2014-10-25 12:10 - 2014-04-12 15:59 - 00001338 _____ () C:\Windows\Tasks\365c2923-b81b-461a-ba4b-1eba770fbbb7-1.job
2014-10-25 12:10 - 2014-04-12 15:58 - 00002190 _____ () C:\Windows\Tasks\365c2923-b81b-461a-ba4b-1eba770fbbb7-4.job
2014-10-25 12:10 - 2014-04-12 15:57 - 00002776 _____ () C:\Windows\Tasks\365c2923-b81b-461a-ba4b-1eba770fbbb7-3.job
2014-10-25 12:10 - 2013-10-03 15:14 - 00000920 _____ () C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job
2014-10-25 12:10 - 2013-08-18 12:30 - 00001270 _____ () C:\Windows\Tasks\Feven 1.5-updater.job
2014-10-25 12:10 - 2013-08-18 12:30 - 00001082 _____ () C:\Windows\Tasks\Feven 1.5-enabler.job
2014-10-25 12:10 - 2013-08-18 12:29 - 00001184 _____ () C:\Windows\Tasks\Feven 1.5-codedownloader.job
2014-10-25 12:10 - 2013-08-18 12:27 - 00001886 _____ () C:\Windows\Tasks\Feven 1.5-chromeinstaller.job
2014-10-25 12:10 - 2013-08-03 16:19 - 00000900 _____ () C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineCore.job
2014-10-25 12:10 - 2011-06-24 16:07 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-25 12:10 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-25 12:09 - 2014-01-19 09:34 - 00015646 _____ () C:\Windows\setupact.log
2014-10-25 11:11 - 2011-06-21 00:49 - 01922628 _____ () C:\Windows\WindowsUpdate.log
2014-10-25 10:58 - 2009-07-14 06:45 - 00031680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-25 10:58 - 2009-07-14 06:45 - 00031680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-25 10:57 - 2011-09-13 21:56 - 00000338 _____ () C:\Windows\Tasks\HP Photo Creations Communicator.job
2014-10-25 10:50 - 2014-06-19 06:46 - 00003240 _____ () C:\Windows\System32\Tasks\bench-sys
2014-10-25 10:50 - 2014-06-19 06:46 - 00003218 _____ () C:\Windows\System32\Tasks\bench-S-1-5-21-1148584671-988621172-509042803-1000
2014-10-25 10:48 - 2014-06-19 06:46 - 00000000 ____D () C:\Users\Admin\AppData\Local\SlamDunk Savings
2014-10-25 10:36 - 2012-03-31 08:17 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-25 10:34 - 2014-06-29 13:50 - 00003108 _____ () C:\Windows\System32\Tasks\RegClean Pro
2014-10-25 10:33 - 2014-08-21 11:18 - 00003132 _____ () C:\Windows\System32\Tasks\System Speedup
2014-10-25 10:30 - 2014-05-13 21:35 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\System Speedup
2014-10-22 19:05 - 2011-06-24 19:30 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1148584671-988621172-509042803-1000UA.job
2014-10-22 00:52 - 2010-11-21 09:01 - 00000000 ____D () C:\Program Files\Windows Journal
2014-10-22 00:45 - 2014-05-06 22:16 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-22 00:42 - 2014-07-26 16:15 - 00000000 ____D () C:\Users\Admin\AppData\Local\FunctionLogPath
2014-10-22 00:42 - 2014-07-10 09:17 - 00000000 ____D () C:\Users\Admin\AppData\Local\fst_de_89
2014-10-22 00:42 - 2014-07-10 09:14 - 00000000 ____D () C:\Users\Admin\AppData\Local\WPFBChanger
2014-10-22 00:42 - 2014-06-21 11:24 - 00000000 ____D () C:\Users\Admin\AppData\Local\fst_de_56
2014-10-22 00:42 - 2014-06-05 19:38 - 00000000 ____D () C:\Users\Admin\AppData\Local\fst_de_24
2014-10-22 00:42 - 2014-06-05 07:51 - 00000000 ____D () C:\Users\Admin\AppData\Local\fst_de_31
2014-10-22 00:42 - 2014-06-05 06:13 - 00000000 ____D () C:\Users\Admin\AppData\Local\f2dd4267ec6c7612b89b6123980a1fab
2014-10-22 00:42 - 2014-05-22 12:41 - 00000000 ____D () C:\Program Files (x86)\BlockAndSurf-soft
2014-10-22 00:42 - 2014-05-13 21:35 - 00000000 ____D () C:\Users\Admin\AppData\Local\emaze
2014-10-22 00:42 - 2014-04-10 08:07 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2014-10-22 00:42 - 2013-08-08 03:09 - 00000000 ____D () C:\Users\Admin\AppData\Local\Conduit
2014-10-22 00:42 - 2011-07-25 15:08 - 00000000 ____D () C:\Users\Admin\AppData\Local\Eastman_Kodak_Company
2014-10-22 00:42 - 2011-06-26 05:17 - 00000000 ____D () C:\Users\Admin\AppData\Local\IM
2014-10-22 00:42 - 2011-06-24 14:27 - 00000000 ____D () C:\Users\Admin\AVM_Driver
2014-10-22 00:42 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-10-22 00:42 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-10-22 00:41 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-10-22 00:40 - 2012-01-09 00:47 - 00000000 ____D () C:\Users\Admin\AppData\Local\Greyfirst
2014-10-22 00:40 - 2011-06-24 16:07 - 00000000 ____D () C:\Users\Admin\AppData\Local\Google
2014-10-22 00:39 - 2014-05-04 00:53 - 00000000 ____D () C:\Users\Admin\AppData\Local\Comodo
2014-10-22 00:39 - 2014-05-04 00:53 - 00000000 ____D () C:\Users\Admin\AppData\Local\Chromatic Browser
2014-10-22 00:22 - 2013-08-03 16:19 - 00000290 _____ () C:\Windows\Tasks\Dealply.job
2014-10-22 00:03 - 2013-12-11 13:23 - 00001156 __RSH () C:\Users\Admin\ntuser.pol
2014-10-22 00:03 - 2011-06-24 16:07 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-22 00:03 - 2011-06-20 19:00 - 00000000 ____D () C:\Users\Admin
2014-10-21 13:20 - 2014-04-12 16:17 - 00000000 ____D () C:\Users\Admin\AppData\Local\MovieMode
2014-10-20 21:12 - 2013-08-16 00:54 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-20 20:52 - 2014-06-05 07:53 - 00000000 ____D () C:\Program Files (x86)\HomeTab
2014-10-20 20:27 - 2014-04-12 16:13 - 00000292 _____ () C:\Windows\Tasks\MySearchDial.job
2014-10-20 20:27 - 2013-08-03 16:19 - 00000904 _____ () C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job
2014-10-20 19:23 - 2013-12-19 01:26 - 00000193 _____ () C:\Users\Admin\AppData\Roaming\WB.CFG
2014-10-20 18:55 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Public\Libraries
2014-10-20 18:04 - 2011-11-08 18:10 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\FRITZ!
2014-10-20 17:00 - 2010-11-21 08:50 - 00702598 _____ () C:\Windows\system32\perfh007.dat
2014-10-20 17:00 - 2010-11-21 08:50 - 00151390 _____ () C:\Windows\system32\perfc007.dat
2014-10-20 17:00 - 2009-07-14 07:13 - 01630758 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-20 16:22 - 2014-06-05 07:54 - 00000000 ____D () C:\Windows\System32\Tasks\SystemSockets
2014-10-20 16:22 - 2014-06-05 07:54 - 00000000 ____D () C:\Windows\System32\Tasks\ProtectedSearch
2014-10-20 16:22 - 2014-06-05 07:54 - 00000000 ____D () C:\Windows\System32\Tasks\Browser Updater
2014-10-20 16:22 - 2013-11-09 11:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-10-20 16:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-10-20 16:21 - 2011-06-25 19:05 - 00000000 ____D () C:\Program Files (x86)\Java
2014-10-18 20:35 - 2011-11-12 15:10 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\vlc
2014-10-18 18:35 - 2014-04-12 16:01 - 00000378 _____ () C:\Windows\Tasks\APSnotifierPP1.job
2014-10-18 18:15 - 2014-05-22 20:32 - 00002826 _____ () C:\Windows\System32\Tasks\APSnotifierPP2
2014-10-18 18:14 - 2014-04-15 21:15 - 00002828 _____ () C:\Windows\System32\Tasks\APSnotifierPP1
2014-10-18 17:41 - 2013-08-08 03:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue
2014-10-17 19:12 - 2014-06-05 07:52 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Activeris
2014-10-03 16:51 - 2012-03-31 08:17 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-10-03 16:42 - 2012-03-31 08:17 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-10-03 16:42 - 2011-06-21 18:25 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-10-03 16:37 - 2013-08-08 03:06 - 00000000 ____D () C:\Program Files (x86)\MyPC Backup
2014-10-03 13:07 - 2014-06-05 07:53 - 00034368 _____ () C:\Windows\Launcher.exe
2014-09-29 10:42 - 2013-12-09 12:19 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-09-29 10:26 - 2014-01-19 09:34 - 00158190 _____ () C:\Windows\PFRO.log
2014-09-28 22:20 - 2011-06-21 17:19 - 01604102 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-09-28 22:18 - 2013-02-28 04:09 - 00002117 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2014-09-28 22:18 - 2011-06-21 17:19 - 00001912 _____ () C:\Windows\epplauncher.mif
2014-09-28 22:18 - 2011-06-21 17:19 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2014-09-28 22:18 - 2011-06-21 17:18 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-09-28 20:38 - 2011-06-21 13:42 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-28 09:49 - 2011-06-24 18:20 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{C6295D87-0223-4913-87E0-549DC15EB489}
2014-09-28 08:59 - 2014-05-04 00:54 - 00000000 ____D () C:\ProgramData\2b58a7cbef08f6a2
Files to move or delete:
====================
C:\Users\Admin\photobooksmjpb2pah~1311301458036-5ec56f16-2b51-4723-bc50-88d0d8f055d7.js
C:\Users\Admin\photocardspah~1318247042883-e61ee557-bf45-42de-aea5-909a0eba5893.js
C:\Users\Admin\ShowScript.js
Some content of TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\18be6784_.exe
C:\Users\Admin\AppData\Local\Temp\294823_.exe
C:\Users\Admin\AppData\Local\Temp\amsetup_activeris_default_010414_installer.exe
C:\Users\Admin\AppData\Local\Temp\BackupSetup.exe
C:\Users\Admin\AppData\Local\Temp\BundleSweetIMSetup.exe
C:\Users\Admin\AppData\Local\Temp\Delta.exe
C:\Users\Admin\AppData\Local\Temp\DeltaTB.exe
C:\Users\Admin\AppData\Local\Temp\EasyLogin_setup_DE.exe
C:\Users\Admin\AppData\Local\Temp\fastagainsetup.exe
C:\Users\Admin\AppData\Local\Temp\findopolissetup.exe
C:\Users\Admin\AppData\Local\Temp\fp_pl_pfs_installer-1.exe
C:\Users\Admin\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Admin\AppData\Local\Temp\freesofttoday.exe
C:\Users\Admin\AppData\Local\Temp\gkc.exe
C:\Users\Admin\AppData\Local\Temp\hometab.exe
C:\Users\Admin\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Admin\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\Admin\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
C:\Users\Admin\AppData\Local\Temp\mpam-7b2337eb.exe
C:\Users\Admin\AppData\Local\Temp\mpam-b138a77.exe
C:\Users\Admin\AppData\Local\Temp\MybabylonTB.exe
C:\Users\Admin\AppData\Local\Temp\newvideoplayersetup.exe
C:\Users\Admin\AppData\Local\Temp\nsa2FFB.exe
C:\Users\Admin\AppData\Local\Temp\nsb806A.tmp.exe
C:\Users\Admin\AppData\Local\Temp\nscFB44.tmp.exe
C:\Users\Admin\AppData\Local\Temp\nsf34AD.exe
C:\Users\Admin\AppData\Local\Temp\nsg694A.exe
C:\Users\Admin\AppData\Local\Temp\nsp25AD.exe
C:\Users\Admin\AppData\Local\Temp\nsq5E8F.exe
C:\Users\Admin\AppData\Local\Temp\nsrD41.tmp.exe
C:\Users\Admin\AppData\Local\Temp\nsv15DB.exe
C:\Users\Admin\AppData\Local\Temp\nsw6EEC.tmp.exe
C:\Users\Admin\AppData\Local\Temp\nv3DVStreaming.dll
C:\Users\Admin\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\Admin\AppData\Local\Temp\nvStereoApiI.dll
C:\Users\Admin\AppData\Local\Temp\nvStInst.exe
C:\Users\Admin\AppData\Local\Temp\PrefJsonCpp.exe
C:\Users\Admin\AppData\Local\Temp\sdpupdater.exe
C:\Users\Admin\AppData\Local\Temp\SendMsg.dll
C:\Users\Admin\AppData\Local\Temp\setup_SlamDunk Savings-1.0.20141023.exe
C:\Users\Admin\AppData\Local\Temp\setup{1A91FE00-1E62-4889-9A90-09F85322BA9F}.exe
C:\Users\Admin\AppData\Local\Temp\setup{90EC946F-E8AA-4607-8B91-DC1C3F2819D1}.exe
C:\Users\Admin\AppData\Local\Temp\setup{C3142629-606B-41A8-A874-723AD72C361F}.exe
C:\Users\Admin\AppData\Local\Temp\setup{D5FDEF8D-2C39-4650-8FB8-8F5F71E951B2}.exe
C:\Users\Admin\AppData\Local\Temp\spidentifierimpl.exe
C:\Users\Admin\AppData\Local\Temp\Sqlite3.dll
C:\Users\Admin\AppData\Local\Temp\sqlite3.exe
C:\Users\Admin\AppData\Local\Temp\tbu253B.exe
C:\Users\Admin\AppData\Local\Temp\tbu2599.exe
C:\Users\Admin\AppData\Local\Temp\tbu28E3.exe
C:\Users\Admin\AppData\Local\Temp\tbu2970.exe
C:\Users\Admin\AppData\Local\Temp\tbu29AE.exe
C:\Users\Admin\AppData\Local\Temp\tbu2BD0.exe
C:\Users\Admin\AppData\Local\Temp\tbu3726.exe
C:\Users\Admin\AppData\Local\Temp\tbu37B2.exe
C:\Users\Admin\AppData\Local\Temp\tbu4BC1.exe
C:\Users\Admin\AppData\Local\Temp\tbu669E.exe
C:\Users\Admin\AppData\Local\Temp\tbu7741.exe
C:\Users\Admin\AppData\Local\Temp\tbu7EFE.exe
C:\Users\Admin\AppData\Local\Temp\tbu7F7B.exe
C:\Users\Admin\AppData\Local\Temp\tbu9701.exe
C:\Users\Admin\AppData\Local\Temp\tbu9B45.exe
C:\Users\Admin\AppData\Local\Temp\tbu9D28.exe
C:\Users\Admin\AppData\Local\Temp\tbu9FF6.exe
C:\Users\Admin\AppData\Local\Temp\tbuAA61.exe
C:\Users\Admin\AppData\Local\Temp\tbuAEF3.exe
C:\Users\Admin\AppData\Local\Temp\tbuC051.exe
C:\Users\Admin\AppData\Local\Temp\tbuCABD.exe
C:\Users\Admin\AppData\Local\Temp\tbuCB4D.exe
C:\Users\Admin\AppData\Local\Temp\tbuEDE.exe
C:\Users\Admin\AppData\Local\Temp\tbuFB4E.exe
C:\Users\Admin\AppData\Local\Temp\tmp4D4E.dll
C:\Users\Admin\AppData\Local\Temp\v-bates.exe
C:\Users\Admin\AppData\Local\Temp\vbmz10.exe
C:\Users\Admin\AppData\Local\Temp\vlc-2.1.3-win32.exe
C:\Users\Admin\AppData\Local\Temp\vstor_redist_2010.exe
C:\Users\Admin\AppData\Local\Temp\WSSetup.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-07-22 18:18
==================== End Of Log ============================
Gruß Riddle |
|
26.10.2014, 20:12
| #2 |
| |  Win 7 (64): Links im Browser unterstrichen; eDeals, SlamDunk Savings u.v.m. Fortsetzung ...
__________________Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-10-2014
Ran by Admin at 2014-10-25 12:39:33
Running from C:\Users\Admin\Desktop
Boot Mode: Safe Mode (with Networking)
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
1&1 EasyLogin (HKLM-x32\...\1&1 EasyLogin) (Version: - )
1und1 Desktop Icons (HKLM-x32\...\1&1 Mail & Media GmbH 1und1DesktopIconsInstaller) (Version: 3.0.0.22 - 1&1 Mail & Media GmbH)
1und1 Internet Explorer Addon (HKLM-x32\...\1&1 Mail & Media GmbH 1und1InternetExplorerAddon) (Version: 1.0.1.0 - 1&1 Mail & Media GmbH)
1und1 Internet Explorer Add-On (HKLM-x32\...\1und1 Internet Explorer Add-On) (Version: - 1&1 Internet AG)
1und1 Internet Explorer Add-On (x32 Version: 1.0 - 1&1 Internet AG) Hidden
1und1 Softwareaktualisierung (HKLM-x32\...\1&1 Mail & Media GmbH 1und1Softwareaktualisierung) (Version: 3.0.0.53 - 1&1 Mail & Media GmbH)
ABC FontViewer (HKLM-x32\...\{00C94176-9CC8-4184-B069-EC377D632658}) (Version: - )
ABC of Pics (HKLM-x32\...\{222263D0-01D2-4A59-ABA6-63D05E89B12B}) (Version: - )
ADAC Druckstudio (HKLM-x32\...\{4030A832-BB96-4E85-BAD4-2059C3420064}) (Version: - )
Adobe Bridge 1.0 (HKLM-x32\...\{B74D4E10-6884-0000-0000-000000000101}) (Version: 001.000.001 - Adobe Systems)
Adobe ConnectNow Add-in (HKCU\...\Adobe ConnectNow Add-in) (Version: - )
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Advanced Driver Updater (HKLM-x32\...\{8314F6F5-5292-453E-9D48-A7244102EEA1}_is1) (Version: 1.0.850.11203 - Systweak, Inc.)
Advanced Driver Updater (HKLM-x32\...\Advanced Driver Updater_is1) (Version: 2.1.1086.15131 - Systweak Inc)
Advanced System Protector (HKLM-x32\...\00212D92-C5D8-4ff4-AE50-B20F0F85C40A_Systweak_Ad~B9F029BF_is1) (Version: 2.1.1000.12580 - Systweak Software) <==== ATTENTION
aioprnt (Version: 5.3.1.0 - Eastman Kodak Company) Hidden
aioscnnr (x32 Version: 6.2.3.10 - Your Company Name) Hidden
aioscnnr (x32 Version: 7.3.4.0 - Your Company Name) Hidden
AlLSaveeR (HKLM-x32\...\{F5853CDF-2C63-6D1D-B286-CBB1CD5DFD62}) (Version: - ALllSaveer) <==== ATTENTION
AnyProtect (HKLM-x32\...\AnyProtect) (Version: 1.0.0.1 - CMI Limited) <==== ATTENTION
Ashampoo Photo Commander 11 v.11.1.5 (HKLM-x32\...\{C92AB6F1-0F9C-8526-5DF1-0A2FD0FB33D9}_is1) (Version: 11.1.5 - Ashampoo GmbH & Co. KG)
AVM FRITZ!DSL (HKLM-x32\...\FRITZ!DSL) (Version: - )
AVM FRITZ!WLAN (HKLM-x32\...\AVMWLANCLI) (Version: - AVM Berlin)
BlockAndSurf (HKLM-x32\...\D032F61B-6096-81CF-603B-7666CA244A96) (Version: - BlockAndSurf-software) <==== ATTENTION
Bonanza Deals (remove only) (HKLM-x32\...\Bonanza Deals) (Version: 5.0.1.0 - Bonanza Deals) <==== ATTENTION
Boost for Internet Explorer (HKLM-x32\...\Boost) (Version: 3.0.0.10 - Verti Technology Group, Inc.)
Browser Guard (HKLM-x32\...\Browser Guard) (Version: - )
C4USelfUpdater (x32 Version: 1.00.0000 - Your Company Name) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.19 - Piriform)
Celtx (2.9) (HKLM-x32\...\Celtx (2.9)) (Version: 2.9 (de) - Greyfirst)
CheapMMe (HKLM-x32\...\{F6C44C71-2CFE-8176-3A4D-CBD0DCE5AEFA}) (Version: - "") <==== ATTENTION
ConvertAd (HKLM-x32\...\ConvertAd) (Version: 1.0.0.0 - ConvertAd) <==== ATTENTION
CostMin (HKLM-x32\...\{2F5F003B-C71B-72E3-42B4-DE51AB079EB2}) (Version: 3.0.0.1448 - CostMin)
Coupon Downloader (HKLM\...\coupon downloader) (Version: 2.0.1 - CouponDownloader) <==== ATTENTION
Cradle of Rome (HKLM-x32\...\exent_554750) (Version: - )
CVE-2012-4969 (HKLM\...\{777afb2a-98e5-4f14-b455-378a925cae15}.sdb) (Version: - )
Dealply (HKCU\...\Dealply) (Version: - ) <==== ATTENTION
DealPly (remove only) (HKLM-x32\...\DealPly) (Version: 4.8.7.3 - DealPly Technologies Ltd.) <==== ATTENTION
DefaultTab (HKLM-x32\...\DefaultTab) (Version: 2.3.3.0 - Search Results, LLC) <==== ATTENTION
DeissCounttExxTeNsi (HKLM-x32\...\{B138259A-351E-33FA-2726-8D71704F1DA9}) (Version: - DisCCOuuntExtensi) <==== ATTENTION
Delta Chrome Toolbar (HKLM-x32\...\Delta Chrome Toolbar) (Version: - Visual Tools) <==== ATTENTION
Delta toolbar (HKLM-x32\...\delta) (Version: 1.8.22.0 - Delta) <==== ATTENTION
Desk 365 (HKLM-x32\...\Desk 365) (Version: 1.13.20 - 337 Technology Limited.) <==== ATTENTION
Desktop Icon für Amazon (HKLM\...\DesktopIconAmazon) (Version: 1.0.1 (de) - )
DMUninstaller (HKLM-x32\...\DMUninstaller) (Version: - ) <==== ATTENTION
Doko toolbar (HKLM-x32\...\dokotoolbar) (Version: 1.8.26.9 - Doko-Toolbar) <==== ATTENTION
Driver Pro v3.0 (HKLM-x32\...\Driver Pro_is1) (Version: 3.0 - PC Utilities Pro)
DVDVideoSoftTB Toolbar (HKLM-x32\...\DVDVideoSoftTB Toolbar) (Version: 6.8.2.0 - DVDVideoSoftTB)
eDealPop version 1.0 (HKLM-x32\...\eDealPop_is1) (Version: 1.0 - eDealPop)
eDealsPop version 1.0 (HKLM-x32\...\eDealsPop_is1) (Version: 1.0 - eDealsPop)
FastAgain PC Booster (HKLM-x32\...\FastAgain PC Booster_is1) (Version: 1.0 - Activeris) <==== ATTENTION
File Extractor (HKLM-x32\...\Tweaks File Extractor) (Version: 1.1.1 - Tweaks) <==== ATTENTION
FileConverter 1.3 Toolbar (HKLM-x32\...\FileConverter_1.3 Toolbar) (Version: 6.9.0.16 - FileConverter 1.3)
FilesFrog Update Checker (HKLM-x32\...\FilesFrog Update Checker) (Version: - ) <==== ATTENTION
Flash Player Pro V5.4 (HKLM-x32\...\Flash Player Pro_is1) (Version: - FlashPlayerPro.com)
FlvPlayer (HKLM-x32\...\FlvPlayer) (Version: ${VERSION} - ) <==== ATTENTION
Foto-Pro (HKLM-x32\...\Foto-Pro_V_is1) (Version: - )
Foxtab (HKLM-x32\...\foxtab) (Version: - FoxTab) <==== ATTENTION
FoxyDeal version 1.0.0 (HKLM-x32\...\FoxyDeal_is1) (Version: 1.0.0 - R&E Media GmbH)
Free YouTube to MP3 Converter version 3.10.14.1206 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: - DVDVideoSoft Ltd.)
FreePDF (Remove only) (HKLM-x32\...\FreePDF_XP) (Version: - )
FreeSoftToday 014.89 (HKLM-x32\...\FreeSoftToday_is1) (Version: - FrEeSoFtOdAy) <==== ATTENTION
fst_de_24 (HKLM-x32\...\fst_de_24_is1) (Version: - fst) <==== ATTENTION
fst_de_31 (HKLM-x32\...\fst_de_31_is1) (Version: - fst) <==== ATTENTION
fst_de_37 (HKLM-x32\...\fst_de_37_is1) (Version: - fst) <==== ATTENTION
fst_de_48 (HKLM-x32\...\fst_de_48_is1) (Version: - FREE_SOFT_TODAY) <==== ATTENTION
fst_de_56 (HKLM-x32\...\fst_de_56_is1) (Version: - FREE_SOFT_TODAY) <==== ATTENTION
Gameo (HKCU\...\Gameo) (Version: 0.10.5 - Fried Cookie Software)
GIMP 2.6.11 (HKLM-x32\...\WinGimp-2.0_is1) (Version: 2.6.11 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 32.0.1700.76 - Google Inc.)
Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Talk Plugin (HKLM-x32\...\{CA8444DB-540C-3A6B-9B81-202C79C92BDC}) (Version: 5.1.1.17055 - Google)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.4805.320 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.23.9 - Google Inc.) Hidden
Google+ Auto Backup (HKLM-x32\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google)
HomeTab 7.0 (HKLM-x32\...\{7ac3fd38-27b0-428d-b368-7b0dbd1e78f0}_is1) (Version: 7.0 - One Floor App) <==== ATTENTION
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.12992 - HP Photo Creations)
HP Product Detection (HKLM-x32\...\{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}) (Version: 10.7.9.0 - Hewlett-Packard Company)
iLivid (HKLM-x32\...\iLivid) (Version: 4.0.0.3276 - Bandoo Media Inc) <==== ATTENTION
iMesh (x32 Version: 11.0.0.128944 - iMesh Inc.) Hidden <==== ATTENTION
IMinent Toolbar (HKLM-x32\...\{A76AA284-E52D-47E6-9E4F-B85DBF8E35C3}) (Version: 3.26.0 - IMinent) <==== ATTENTION
Incredibar Toolbar on IE and Chrome (HKLM-x32\...\incredibar) (Version: - ) <==== ATTENTION
IncrediMail (x32 Version: 6.6.0.5288 - IncrediMail) Hidden
IncrediMail 2.5 (HKLM-x32\...\IncrediMail) (Version: 6.6.0.5288 - IncrediMail Ltd.)
IncrediMail MediaBar Deutsch 2 Toolbar (HKLM-x32\...\IncrediMail_MediaBar_Deutsch_2 Toolbar) (Version: 6.3.3.3 - IncrediMail MediaBar Deutsch 2) <==== ATTENTION
InetStat (HKCU\...\InetStat) (Version: 0.5b - InetStat)
InkJet-TuningPro (HKLM-x32\...\{5EAB789D-6AF4-4D59-89CE-2A7381517EAE}) (Version: - )
Internet Updater (HKLM-x32\...\InternetUpdater) (Version: 2.6.57 - Parallel Lines Development, LLC) <==== ATTENTION
Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217055FF}) (Version: 7.0.550 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 22 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216022F0}) (Version: 6.0.220 - Oracle)
Java(TM) 7 Update 5 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217005F0}) (Version: 7.0.50 - Oracle)
JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
JoniCaoupon (HKLM-x32\...\{51417852-174C-88D4-34A0-D0FE7858BE47}) (Version: - JoniCoupon) <==== ATTENTION
jose (HKLM-x32\...\jose-chess) (Version: 1.3 - )
Kodak AIO Printer (Version: 7.5.0.0 - Eastman Kodak Company) Hidden
ksDIP (x32 Version: 3.20.0000.0001 - Eastman Kodak Company) Hidden
KvikVideo 7.1 (HKLM-x32\...\KvikVideo_is1) (Version: - 123hjemmeside.dk)
LG PC Suite II (HKLM-x32\...\{14DCD95A-EBA3-4BF0-B7EF-533852E99BE6}) (Version: 2.00.0000 - LG PC Suite)
LG PC Suite II (x32 Version: 2.00.0000 - LG PC Suite) Hidden
LibreOffice 3.4 (HKLM-x32\...\{D64833F8-860D-4216-8EDC-DD08AD68C0B5}) (Version: 3.4.402 - LibreOffice)
LookThisUp (HKLM\...\LookThisUp) (Version: 1.0.2 - LookThisUp) <==== ATTENTION
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
MediaPlayerplus (HKLM-x32\...\MediaPlayerplus) (Version: 1.34.4.10 - Freeven) <==== ATTENTION
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.10411.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{D285FC5F-3021-32E9-9C59-24CA325BDC5C}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MixiDJ chrome Toolbar (HKLM-x32\...\MixiDJ chrome Toolbar) (Version: - MixiDJ) <==== ATTENTION
MixiDJ V30 Toolbar (HKLM-x32\...\MixiDJ_V30 Toolbar) (Version: 6.15.0.27 - MixiDJ V30) <==== ATTENTION
Movie Mode (HKLM-x32\...\MovieMode) (Version: 2.6.71 - GenTechnologies Apps, LLC)
Mozilla Firefox 28.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
Mozilla Thunderbird 17.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 17.0 (x86 de)) (Version: 17.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Music Box Toolbar for Chrome (Dist. by iMesh, Inc.) (HKLM-x32\...\imeshmusicboxtoolbarGC) (Version: 1.5.0.0 - APN LLC) <==== ATTENTION
Music Box Toolbar for Internet Explorer (Dist. by iMesh, Inc.) (HKLM-x32\...\imeshmusicboxtoolbarIE) (Version: 1.5.0.0 - APN LLC) <==== ATTENTION
MyPC Backup (HKLM\...\MyPC Backup) (Version: - JDi Backup Ltd) <==== ATTENTION
Mysearchdial (HKLM-x32\...\mysearchdial) (Version: - Mysearchdial) <==== ATTENTION
NirSoft VideoCacheView (HKLM-x32\...\NirSoft VideoCacheView) (Version: - )
NVIDIA 3D Vision Controller-Treiber 306.97 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 306.97 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.62.40 - NVIDIA Corporation)
NVIDIA Grafiktreiber 306.97 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 306.97 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.18.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.18.0 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.85.551 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.12.0604 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.12.0604 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.0604 - NVIDIA Corporation)
NVIDIA Systemsteuerung 306.97 (Version: 306.97 - NVIDIA Corporation) Hidden
NVIDIA Update 1.10.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.10.8 - NVIDIA Corporation)
ocr (x32 Version: 6.2.3.50 - Eastman Kodak Company) Hidden
OpenOffice.org 3.3 (HKLM-x32\...\{4286716B-1287-48E7-9078-3DC8248DBA96}) (Version: 3.3.9567 - OpenOffice.org)
Optimizer Pro v3.1 (HKLM-x32\...\Optimizer Pro_is1) (Version: 3.1 - PC Utilities Pro) <==== ATTENTION
Paint.NET v3.5.10 (HKLM\...\{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}) (Version: 3.60.0 - dotPDN LLC)
Photo Notifier and Animation Creator (HKLM-x32\...\Photo Notifier and Animation Creator) (Version: 1.0.0.1009 - IncrediMail Ltd.)
Photo Notifier and Animation Creator (x32 Version: 1.0.0.1009 - Ihr Firmenname) Hidden
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Plus-HD-2.3 (HKLM-x32\...\Plus-HD-2.3) (Version: 1.27.153.5 - Plus HD) <==== ATTENTION
PreReq (x32 Version: 6.2.4.0 - Eastman Kodak Company) Hidden
PricePeep (HKLM-x32\...\PricePeep) (Version: 2.2.0.1 - betwikx LLC) <==== ATTENTION
Qtrax (HKCU\...\Qtrax) (Version: 20.13.06.24 - Qtrax)
Qtrax Player (HKCU\...\435959792.portal.qtrax.com) (Version: - portal.qtrax.com)
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version: - )
RegClean Pro (HKLM-x32\...\RegClean Pro_is1) (Version: 6.21 - Systweak Inc) <==== ATTENTION
Registry Helper (HKLM-x32\...\Registry Helper) (Version: - SafeApp Software, LLC) <==== ATTENTION
RegularDEals (HKLM-x32\...\{76DEE3DC-2B8B-E212-2126-D31D9E73DFE4}) (Version: - RRegularDeals)
Search Protect (HKLM-x32\...\SearchProtect) (Version: 2.13.2.14 - Client Connect LTD) <==== ATTENTION
SearchAnonymizer (HKLM\...\SearchAnonymizer) (Version: 1.0.1 (de) - )
Search-Gol Chrome Toolbar (HKLM-x32\...\Search-Gol Chrome Toolbar) (Version: - Search-Gol) <==== ATTENTION
Searchqu Toolbar (HKLM-x32\...\Searchqu Toolbar) (Version: 4.1.0.3114 - Bandoo Media Inc) <==== ATTENTION
Search-Results Toolbar (HKLM-x32\...\imeshtoolbar2) (Version: 1.0.0.12 - APN LLC) <==== ATTENTION
ShopDrop (HKLM-x32\...\{B6D700D3-3D0D-FEEB-D675-2CE78F9EC5D6}) (Version: - SHopDRop) <==== ATTENTION
SlamDunk Savings (HKLM-x32\...\38946_SlamDunk Savings) (Version: 1.0 - Actually Apps) <==== ATTENTION
SmartPCFixer 4.2 (HKLM\...\{2C5927BD-3F65-4207-8FB5-8EDF638A3511}_is1) (Version: 4.2 - LionSea Software) <==== ATTENTION
SmartSaver+ 8 (HKLM-x32\...\SmartSaver+ 8) (Version: 1.34.3.28 - smart-saverplus) <==== ATTENTION
Snap.Do (HKLM-x32\...\{F9562224-09A3-473C-845D-F9AD46D9CF41}) (Version: 1.71.1.11943 - ReSoft Ltd.) <==== ATTENTION
Snap.Do Engine (HKCU\...\{6ac880ca-b126-40be-93c0-53b0d140fb3e}) (Version: 1.71.1.11943 - ReSoft Ltd.) <==== ATTENTION
SpeedUpMyPC (HKLM-x32\...\{E55B3271-7CA8-4D0C-AE06-69A24856E996}_is1) (Version: 6.0.4.5 - Uniblue Systems Limited) <==== ATTENTION
Supporter 1.80 (HKLM-x32\...\{5F189DF5-2D05-472B-9091-84D9848AE48B}{be0fb33b}) (Version: - Costmin) <==== ATTENTION
suprasavings (HKLM\...\suprasavings) (Version: 2.0.1 - suprasavings) <==== ATTENTION
SupraSavings (x32 Version: 1.0.0.0 - SupraSavings) Hidden <==== ATTENTION
Supreme AdBlocker (HKLM-x32\...\{37476589-E48E-439E-A706-56189E2ED4C4}_is1) (Version: - Supreme AdBlocker) <==== ATTENTION
Sweet Home 3D version 3.2 (HKLM-x32\...\Sweet Home 3D_is1) (Version: - eTeks)
sweet-page uninstaller (HKLM-x32\...\sweet-page uninstaller) (Version: - sweet-page) <==== ATTENTION
System Speedup (HKLM-x32\...\System Speedup_is1) (Version: 2.1 - systemspeedup.com)
Torch (HKCU\...\Torch) (Version: 25.0.0.3831 - Torch Media Inc.) <==== ATTENTION
Tube Dimmer (HKLM-x32\...\TubeDimmer) (Version: 2.6.53 - Creative Island Media, LLC)
Ulead VideoStudio 7 SE VCD (HKLM-x32\...\{757AD3D4-036B-42FA-B0A4-96BD6F4605A0}) (Version: 7.0 - Ulead Systems, Inc.)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
Updater (HKLM-x32\...\{D54E3D9F-FEB8-4D2D-A138-B69A5C80080B}) (Version: 2.6.53 - Creative Island Media, LLC) <==== ATTENTION
VAFPlayer (HKLM-x32\...\{EBE677C0-CBCB-4EBF-8098-E27E1B5271CF}) (Version: 1.6.8 - Tuguu SL) <==== ATTENTION
V-bates 2.0.0.438 (HKLM\...\{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}_is1) (Version: 2.0.0.438 - Wajamu) <==== ATTENTION
Video Downloader version 2.0 (HKLM-x32\...\Video Downloader_is1) (Version: 2.0 - )
VisualBee for Microsoft PowerPoint (HKCU\...\VisualBee for Microsoft PowerPoint) (Version: V4.1 - VisualBee.com)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
VO Package (HKLM-x32\...\VOPackage) (Version: 1.0.0.0 - ) <==== ATTENTION
Wajam (HKLM-x32\...\Wajam) (Version: 1.81 - Wajam) <==== ATTENTION
Wallpaper Changer (HKLM-x32\...\{62340a00-1b99-4a03-9efc-765636e35146}) (Version: 3.0.6.0 - Digital Distribution)
Wallpaper Changer (x32 Version: 3.0.6.0 - Digital Distribution) Hidden
Web Assistant version 2.0.0.611 (HKLM\...\{336D0C35-8A85-403a-B9D2-65C292C39087}_is1) (Version: 2.0.0.611 - IncrediBar) <==== ATTENTION
Windows Mobile-Gerätecenter (HKLM\...\{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}) (Version: 6.1.6965.0 - Microsoft Corporation)
WPM18.8.0.212 (HKLM-x32\...\WPM) (Version: 18.8.0.212 - Cherished Technololgy LIMITED) <==== ATTENTION
XviD MPEG-4 Video Codec (HKLM-x32\...\XviD_is1) (Version: XviD-1.0.1-05062004 - XviD Team (Koepi))
Yontoo Layers 1.10.01 (HKLM\...\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}) (Version: 1.10.01 - ) <==== ATTENTION
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-1148584671-988621172-509042803-1000_Classes\CLSID\{087B3AE3-E237-4467-B8DB-5A38AB959AC9}\InprocServer32 -> C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl_x64.dll (OpenOffice.org)
CustomCLSID: HKU\S-1-5-21-1148584671-988621172-509042803-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Admin\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1148584671-988621172-509042803-1000_Classes\CLSID\{3B092F0C-7696-40E3-A80F-68D74DA84210}\InprocServer32 -> C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl_x64.dll (OpenOffice.org)
CustomCLSID: HKU\S-1-5-21-1148584671-988621172-509042803-1000_Classes\CLSID\{63542C48-9552-494A-84F7-73AA6A7C99C1}\InprocServer32 -> C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl_x64.dll (OpenOffice.org)
CustomCLSID: HKU\S-1-5-21-1148584671-988621172-509042803-1000_Classes\CLSID\{7BC0E710-5703-45BE-A29D-5D46D8B39262}\InprocServer32 -> C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\ooofilt_x64.dll (OpenOffice.org)
CustomCLSID: HKU\S-1-5-21-1148584671-988621172-509042803-1000_Classes\CLSID\{AE424E85-F6DF-4910-A6A9-438797986431}\InprocServer32 -> C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\propertyhdl_x64.dll (OpenOffice.org)
CustomCLSID: HKU\S-1-5-21-1148584671-988621172-509042803-1000_Classes\CLSID\{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\InprocServer32 -> C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl_x64.dll (OpenOffice.org)
CustomCLSID: HKU\S-1-5-21-1148584671-988621172-509042803-1000_Classes\CLSID\{DFEAF541-F3E1-4c24-ACAC-99C30715084A}\InprocServer32 -> c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1148584671-988621172-509042803-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Admin\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll (Google Inc.)
==================== Restore Points =========================
17-10-2014 21:59:06 Windows Update
20-10-2014 12:25:54 Installed Java 7 Update 71
20-10-2014 13:32:50 Windows Update
20-10-2014 14:11:23 Wiederherstellungsvorgang
20-10-2014 18:14:20 Windows Update
20-10-2014 18:55:10 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2014-10-25 10:51 - 00008957 ____A C:\Windows\system32\Drivers\etc\hosts
216.239.32.20 google.com
216.239.32.20 google.com www.google.ad
216.239.32.20 google.com www.google.ae
216.239.32.20 google.com www.google.com.af
216.239.32.20 google.com www.google.com.ag
216.239.32.20 google.com www.google.com.ai
216.239.32.20 google.com www.google.al
216.239.32.20 google.com www.google.am
216.239.32.20 google.com www.google.co.ao
216.239.32.20 google.com www.google.com.ar
216.239.32.20 google.com www.google.as
216.239.32.20 google.com www.google.at
216.239.32.20 google.com www.google.com.au
216.239.32.20 google.com www.google.az
216.239.32.20 google.com www.google.ba
216.239.32.20 google.com www.google.com.bd
216.239.32.20 google.com www.google.be
216.239.32.20 google.com www.google.bf
216.239.32.20 google.com www.google.bg
216.239.32.20 google.com www.google.com.bh
216.239.32.20 google.com www.google.bi
216.239.32.20 google.com www.google.bj
216.239.32.20 google.com www.google.com.bn
216.239.32.20 google.com www.google.com.bo
216.239.32.20 google.com www.google.com.br
216.239.32.20 google.com www.google.bs
216.239.32.20 google.com www.google.bt
216.239.32.20 google.com www.google.co.bw
216.239.32.20 google.com www.google.by
There are 163 more lines.
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {03D4AA45-6A2A-4B53-901E-2B8904381C33} - System32\Tasks\Driver Detective-RTMScan => c:\Program Files (x86)\PC Drivers HeadQuarters\Driver Detective\DriversHQ.DriverDetective.Client.exe
Task: {04ACBF7D-3A08-4439-8ACE-724DA330FC0E} - System32\Tasks\fsupdate => C:\Program Files (x86)\Flowsurf\fsupd.exe [2014-04-15] ()
Task: {056A7D9F-C979-47B7-9A49-5726D55CA942} - System32\Tasks\0b09b8b1-b267-4ac3-a1e3-c3f904efd354-2 => C:\Program Files (x86)\MediaPlayerplus\0b09b8b1-b267-4ac3-a1e3-c3f904efd354-2.exe [2014-04-12] (Freeven) <==== ATTENTION
Task: {098C1F15-1B5C-4600-BC70-EE0FFCABDD2D} - System32\Tasks\BonanzaDealsUpdate => C:\Program <==== ATTENTION
Task: {0DEE4CB1-1BBC-4622-B36A-907AFB996544} - System32\Tasks\Plus-HD-2.3-chromeinstaller => C:\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-chromeinstaller.exe <==== ATTENTION
Task: {0E9202A3-1C98-4FA4-8674-1EDBE0EFB31F} - System32\Tasks\bench-S-1-5-21-1148584671-988621172-509042803-1000 => C:\Program Files (x86)\Bench\Updater\updater.exe [2014-05-29] () <==== ATTENTION
Task: {0E9647FC-0271-47AE-9624-7991DCDB3A8F} - System32\Tasks\Plus-HD-2.3-codedownloader => C:\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-codedownloader.exe <==== ATTENTION
Task: {131E139D-5D00-4742-99E0-9805BA97771D} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {15952321-4B25-4870-B7F9-0C48702A6B0C} - System32\Tasks\Feven 1.5-chromeinstaller => C:\Program Files (x86)\Feven 1.5\Feven 1.5-chromeinstaller.exe <==== ATTENTION
Task: {2576CC2F-8840-44E5-A89D-82525DF270D3} - System32\Tasks\Plus-HD-2.3-enabler => C:\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-enabler.exe <==== ATTENTION
Task: {2646AC0B-6315-4911-868F-52C9198AB357} - System32\Tasks\DealPlyLiveUpdateTaskMachineUA => C:\Program Files (x86)\DealPlyLive\Update\DealPlyLive.exe <==== ATTENTION
Task: {27D89B1F-0D70-45B2-8C31-C256B9C6CDE0} - System32\Tasks\MySearchDial => C:\Users\Admin\AppData\Roaming\mysearchdial\UpdateProc\UpdateTask.exe [2013-04-12] () <==== ATTENTION
Task: {2DFC4619-D7B5-46BA-BC8E-E71B87D93198} - System32\Tasks\Plus-HD-2.3-updater => C:\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-updater.exe <==== ATTENTION
Task: {3160343B-5E68-4E5E-9412-79273F446D60} - System32\Tasks\Advanced System Protector_startup => C:\Program Files (x86)\Advanced System Protector\AdvancedSystemProtector.exe [2014-01-15] (Systweak) <==== ATTENTION
Task: {343B54A0-BB02-4E40-86B7-BB1625BBF186} - System32\Tasks\Driver Detective-RTMScanRunOnce => c:\Program Files (x86)\PC Drivers HeadQuarters\Driver Detective\DriversHQ.DriverDetective.Client.exe
Task: {35B2E4E6-9594-4045-9AAE-37DCCF2BA1BF} - System32\Tasks\Advanced System Protector => C:\Program Files (x86)\RegClean Pro\SystweakASP.exe <==== ATTENTION
Task: {38963F3A-3CD9-48BE-897D-486F8B0A9709} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1148584671-988621172-509042803-1000UA => C:\Users\Admin\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-24] (Google Inc.)
Task: {39083E0E-599F-4F35-9216-238FF9ACC5E7} - System32\Tasks\Dealply => C:\Users\Admin\AppData\Roaming\DealPly\UpdateProc\UpdateTask.exe [2013-04-12] () <==== ATTENTION
Task: {3944B01B-7D55-4413-8BEF-927FD09A939B} - System32\Tasks\bench-sys => C:\Program Files (x86)\Bench\Updater\updater.exe [2014-05-29] () <==== ATTENTION
Task: {3FEED30B-E4B9-4458-9F32-3DED3D1179ED} - System32\Tasks\Driver Detective-RTMUpdater => c:\Program Files (x86)\PC Drivers HeadQuarters\Driver Detective\DriversHQ.DriverDetective.Client.exe
Task: {425236EF-4348-482B-A56B-E323177A8908} - System32\Tasks\DTReg => C:\Users\Admin\AppData\Roaming\defaulttab\defaulttab\DTReg.exe [2014-02-06] (Search Results, LLC) <==== ATTENTION
Task: {4D3B5E8D-05E1-438B-8030-5A572924F1CC} - System32\Tasks\Google Updater and Installer => C:\Users\Admin\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-24] (Google Inc.)
Task: {4D51653B-349E-42DC-AC01-EEF086B49F46} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe [2014-10-18] (AnyProtect.com) <==== ATTENTION
Task: {4EB44561-C3B0-4B63-8339-842D615AE074} - System32\Tasks\AdvancedDriverUpdater_UPDATES => C:\Program Files (x86)\Advanced Driver Updater\adu.exe [2013-03-08] (Systweak Inc)
Task: {51D79DBB-6FB4-4B8A-AD50-08A6750612B5} - System32\Tasks\HP Photo Creations Communicator => C:\ProgramData\HP Photo Creations\Communicator.exe [2012-06-11] ()
Task: {52B69A7D-CBC6-4B40-B4E0-DFCC0709A492} - System32\Tasks\BlockAndSurf Update => C:\Program Files (x86)\BlockAndSurf-soft\BlockAndSurfB15.exe [2014-05-22] () <==== ATTENTION
Task: {53B2063F-E82F-4A46-8D23-2341A0EDAE7D} - System32\Tasks\BlockAndSurf_wd => C:\Program Files (x86)\BlockAndSurf-soft\BlockAndSurfC.exe [2014-05-22] () <==== ATTENTION
Task: {548BE664-BA14-4EE1-A4DD-B2A5459B3770} - System32\Tasks\DealPlyUpdate => C:\Program <==== ATTENTION
Task: {59EBD43F-C253-46A9-A240-BB3BEB2FC3AB} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-06-24] (Google Inc.)
Task: {5D55F7E7-39B5-4FB8-A9D2-626B038F1326} - System32\Tasks\{A1B4EC9E-DA36-43D9-AC61-426FCC4953FB} => C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe [2014-02-19] (Mozilla Corporation)
Task: {60316093-4B9D-40FD-99B8-362EE678DA14} - System32\Tasks\{61E683C3-A6CB-499C-A6CD-A97143A3A7DB} => Firefox.exe
Task: {68280A51-CEFF-4DD8-B219-17CABD40E9CD} - System32\Tasks\Feven 1.5-codedownloader => C:\Program Files (x86)\Feven 1.5\Feven 1.5-codedownloader.exe <==== ATTENTION
Task: {6C2764C3-734B-493B-9C87-6CE49D81E961} - System32\Tasks\{07C3BB06-0652-4669-9FB4-C4432ADA5D5E} => C:\Program Files (x86)\VideoLAN\VLC\vlc.exe [2014-02-05] (VideoLAN)
Task: {7007C2B5-2E72-469F-BCF6-EB1DF93F341B} - System32\Tasks\DTChk => C:\Users\Public\Util\DTChk.exe [2014-05-15] (Search Results, LLC) <==== ATTENTION
Task: {7269D30B-C307-4AE7-9536-0EC7B6CA1DC5} - System32\Tasks\0b09b8b1-b267-4ac3-a1e3-c3f904efd354-3 => C:\Program Files (x86)\MediaPlayerplus\0b09b8b1-b267-4ac3-a1e3-c3f904efd354-3.exe [2014-04-12] (Freeven) <==== ATTENTION
Task: {730A1203-1A77-43F3-ACFE-BE75C67FA8E4} - System32\Tasks\365c2923-b81b-461a-ba4b-1eba770fbbb7-2 => C:\Program Files (x86)\SmartSaver+ 8\365c2923-b81b-461a-ba4b-1eba770fbbb7-2.exe [2014-04-12] (smart-saverplus)
Task: {74F1BB0E-13EF-4F82-A40D-1E896C44E84A} - System32\Tasks\FoxTab => C:\Users\Admin\AppData\Roaming\FoxTab\UpdateProc\UpdateTask.exe [2013-04-12] () <==== ATTENTION
Task: {75A960F8-5445-4324-845A-0CC792A5F81A} - System32\Tasks\RegClean Pro => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe [2011-07-07] (Systweak Inc) <==== ATTENTION
Task: {818620FE-35B3-45A6-9354-36996792080F} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1148584671-988621172-509042803-1000Core => C:\Users\Admin\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-24] (Google Inc.)
Task: {8A85C79F-606C-4D93-9232-A3FB241AAE28} - System32\Tasks\Driver Detective-RTMRules => c:\Program Files (x86)\PC Drivers HeadQuarters\Driver Detective\DriversHQ.DriverDetective.Client.exe
Task: {8CB056E9-CDA4-4867-92CA-FA02273A71EB} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe [2014-10-18] (AnyProtect.com) <==== ATTENTION
Task: {8EE2B1E0-E86E-4150-8D7B-D61CCDAD51A8} - System32\Tasks\0b09b8b1-b267-4ac3-a1e3-c3f904efd354-1 => C:\Program Files (x86)\MediaPlayerplus\MediaPlayerplus-codedownloader.exe [2014-04-12] (Freeven) <==== ATTENTION
Task: {9BB5E7EE-08AB-49D7-ADA5-4803F6EB0180} - System32\Tasks\Feven 1.5-updater => C:\Program Files (x86)\Feven 1.5\Feven 1.5-updater.exe <==== ATTENTION
Task: {9D6A883E-FDF7-436A-925E-E642B34233FF} - System32\Tasks\LaunchApp => C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe [2014-09-28] (MyPCBackup.com) <==== ATTENTION
Task: {9EC21BEE-0A4F-4690-9D22-59D3252717E7} - System32\Tasks\SystemSockets\SystemSockets => C:\Program Files (x86)\HomeTab\WBrowserProductivity.exe [2014-10-03] () <==== ATTENTION
Task: {A02CD230-1774-40EE-AAB7-D3630EE7A155} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-10-03] (Adobe Systems Incorporated)
Task: {A13703E7-B5E2-4E49-BD2B-AAD46B69BF8A} - System32\Tasks\365c2923-b81b-461a-ba4b-1eba770fbbb7-3 => C:\Program Files (x86)\SmartSaver+ 8\365c2923-b81b-461a-ba4b-1eba770fbbb7-3.exe [2014-04-12] (smart-saverplus)
Task: {A78281C2-B43D-424C-8F95-1D00A9DD2336} - System32\Tasks\System Speedup_DEFAULT => C:\Program Files (x86)\System Speedup\SystemSpeedup.exe [2013-12-13] (System Speedup)
Task: {A8F27C2C-C706-4320-B844-330573DF8F9B} - System32\Tasks\SpeedUpMyPC Startup => C:\Program Files (x86)\Uniblue\SpeedUpMyPC\speedupmypc.exe [2014-10-02] (Uniblue Systems Limited) <==== ATTENTION
Task: {A9DA188C-291E-4F0E-9D09-C21230C083A0} - System32\Tasks\{8D1C4D21-C472-4DB1-93F1-4E34AA4E25B9} => C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe [2014-02-19] (Mozilla Corporation)
Task: {AEE5ECE1-EA33-48ED-B14E-FF07CF7498BB} - System32\Tasks\ProtectedSearch\Protected Search => C:\Program Files (x86)\HomeTab\WBrowserDefender.exe [2014-10-03] () <==== ATTENTION
Task: {B3826124-5412-47E6-9048-1B56A208956D} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-08-21] (Adobe Systems Incorporated)
Task: {B4062D34-CDAE-4FE9-9494-69AAB862DE2A} - System32\Tasks\LyricsContainer Update => C:\Program Files (x86)\LyricsContainer\LrcsCtrUpdr.exe <==== ATTENTION
Task: {BAC76E8D-A944-4892-B2B7-C6FA31FECF70} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-06-24] (Google Inc.)
Task: {BC337ACF-681C-4D94-B4BD-C5F61B361823} - System32\Tasks\System Speedup_UPDATES => C:\Program Files (x86)\System Speedup\SystemSpeedup.exe [2013-12-13] (System Speedup)
Task: {BE4B2975-FB6B-41A4-A7CB-C43D2FB35A23} - System32\Tasks\SpeedUpMyPC Maintenance => C:\Program Files (x86)\Uniblue\SpeedUpMyPC\speedupmypc.exe [2014-10-02] (Uniblue Systems Limited) <==== ATTENTION
Task: {BFB4E1E5-DD12-43DA-84D8-408410D918B4} - System32\Tasks\365c2923-b81b-461a-ba4b-1eba770fbbb7-1 => C:\Program Files (x86)\SmartSaver+ 8\SmartSaver+ 8-codedownloader.exe [2014-04-12] (smart-saverplus)
Task: {C0D2E201-75E8-40ED-AFC3-4894A4C7B182} - System32\Tasks\{11A79C9E-7166-423F-A9AB-E851152AE05C} => C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe [2014-02-19] (Mozilla Corporation)
Task: {C2D3C7AA-90E4-499E-8E04-AAA2DF45D857} - System32\Tasks\1und1 Konfiguration => C:\ProgramData\1und1InternetExplorerAddon\ConfigTask.exe [2011-04-19] (1und1 Mail und Media GmbH)
Task: {C4EE3E2D-8B68-4047-9FA2-8BCD30053A6D} - System32\Tasks\Registration 1und1 Task => C:\Program Files (x86)\1und1Softwareaktualisierung\cdsupdclient.exe [2013-03-15] (1&1 Mail & Media GmbH)
Task: {C6FB120D-3571-42F1-8091-A1260F30F567} - System32\Tasks\DealPlyLiveUpdateTaskMachineCore => C:\Program Files (x86)\DealPlyLive\Update\DealPlyLive.exe <==== ATTENTION
Task: {C9C330C8-18D4-442A-AB3E-9979D4A99FED} - System32\Tasks\{24CBABD0-6F53-4170-AE0E-1C232C953F30} => C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe [2014-02-19] (Mozilla Corporation)
Task: {CD35A10C-D9DF-4C19-BBE6-700EFDC6E053} - System32\Tasks\BonanzaDealsLiveUpdateTaskMachineCore => C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe [2013-10-03] (BonanzaDeals) <==== ATTENTION
Task: {CD915C5C-DC11-415F-B6EC-61BE59D48691} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe [2014-10-18] (AnyProtect.com) <==== ATTENTION
Task: {CE857C3B-9C5F-4AF9-9B0B-A7438303C320} - System32\Tasks\Browser Updater\Browser Updater => C:\Program Files (x86)\HomeTab\WBrowserUpdater.exe [2014-10-03] () <==== ATTENTION
Task: {D11BE905-B0C6-4597-B333-E31C53A16B09} - System32\Tasks\0b09b8b1-b267-4ac3-a1e3-c3f904efd354-5 => C:\Program Files (x86)\MediaPlayerplus\0b09b8b1-b267-4ac3-a1e3-c3f904efd354-5.exe [2014-04-12] (Freeven) <==== ATTENTION
Task: {D1ED88BD-617E-44DE-841F-9467B19B6AEB} - System32\Tasks\Desk 365 RunAsStdUser => C:\Program Files (x86)\Desk 365\desk365.exe [2013-08-15] (337 Technology Limited.) <==== ATTENTION
Task: {D5CB90CF-8B43-4261-BB84-FB9A52470D2C} - System32\Tasks\System Speedup => C:\Program Files (x86)\System Speedup\SystemSpeedup.exe [2013-12-13] (System Speedup)
Task: {E14D056A-C9B5-480E-92FC-6CFD81CB8E52} - System32\Tasks\BonanzaDealsLiveUpdateTaskMachineUA => C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe [2013-10-03] (BonanzaDeals) <==== ATTENTION
Task: {E3E90612-7C68-4F65-B0FD-1AE44035E186} - System32\Tasks\{E4CBD825-76B2-4B8B-BD1E-27962441AE86} => Firefox.exe
Task: {E451A08E-985E-4E04-A083-BAC91CD2BDAC} - System32\Tasks\Start Registry Reviver => C:\Program Files (x86)\Reviversoft\Registry Reviver\RegistryReviver.exe
Task: {E9AEAB57-44C8-48DF-8868-2A041C5B43AB} - System32\Tasks\365c2923-b81b-461a-ba4b-1eba770fbbb7-4 => C:\Program Files (x86)\SmartSaver+ 8\365c2923-b81b-461a-ba4b-1eba770fbbb7-4.exe [2014-04-12] (smart-saverplus)
Task: {EC7BADA3-7721-4457-ADFB-A367B4DD3CDE} - System32\Tasks\365c2923-b81b-461a-ba4b-1eba770fbbb7-5 => C:\Program Files (x86)\SmartSaver+ 8\365c2923-b81b-461a-ba4b-1eba770fbbb7-5.exe [2014-04-12] (smart-saverplus)
Task: {F3C983C8-70E9-4F67-8C94-7D4C7857DF36} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation)
Task: {FEF88009-6CD2-410D-8C61-E047A142D093} - System32\Tasks\Feven 1.5-enabler => C:\Program Files (x86)\Feven 1.5\Feven 1.5-enabler.exe <==== ATTENTION
Task: {FF62ABC0-79C5-464E-B9AA-94E2B5A06337} - System32\Tasks\0b09b8b1-b267-4ac3-a1e3-c3f904efd354-4 => C:\Program Files (x86)\MediaPlayerplus\0b09b8b1-b267-4ac3-a1e3-c3f904efd354-4.exe [2014-04-12] (Freeven) <==== ATTENTION
Task: C:\Windows\Tasks\0b09b8b1-b267-4ac3-a1e3-c3f904efd354-1.job => C:\Program Files (x86)\MediaPlayerplus\MediaPlayerplus-codedownloader.exe <==== ATTENTION
Task: C:\Windows\Tasks\0b09b8b1-b267-4ac3-a1e3-c3f904efd354-2.job => C:\Program Files (x86)\MediaPlayerplus\0b09b8b1-b267-4ac3-a1e3-c3f904efd354-2.exe <==== ATTENTION
Task: C:\Windows\Tasks\0b09b8b1-b267-4ac3-a1e3-c3f904efd354-3.job => C:\Program Files (x86)\MediaPlayerplus\0b09b8b1-b267-4ac3-a1e3-c3f904efd354-3.exe <==== ATTENTION
Task: C:\Windows\Tasks\0b09b8b1-b267-4ac3-a1e3-c3f904efd354-4.job => C:\Program Files (x86)\MediaPlayerplus\0b09b8b1-b267-4ac3-a1e3-c3f904efd354-4.exe <==== ATTENTION
Task: C:\Windows\Tasks\0b09b8b1-b267-4ac3-a1e3-c3f904efd354-5.job => C:\Program Files (x86)\MediaPlayerplus\0b09b8b1-b267-4ac3-a1e3-c3f904efd354-5.exe <==== ATTENTION
Task: C:\Windows\Tasks\365c2923-b81b-461a-ba4b-1eba770fbbb7-1.job => C:\Program Files (x86)\SmartSaver+ 8\SmartSaver+ 8-codedownloader.exe
Task: C:\Windows\Tasks\365c2923-b81b-461a-ba4b-1eba770fbbb7-2.job => C:\Program Files (x86)\SmartSaver+ 8\365c2923-b81b-461a-ba4b-1eba770fbbb7-2.exe
Task: C:\Windows\Tasks\365c2923-b81b-461a-ba4b-1eba770fbbb7-3.job => C:\Program Files (x86)\SmartSaver+ 8\365c2923-b81b-461a-ba4b-1eba770fbbb7-3.exe
Task: C:\Windows\Tasks\365c2923-b81b-461a-ba4b-1eba770fbbb7-4.job => C:\Program Files (x86)\SmartSaver+ 8\365c2923-b81b-461a-ba4b-1eba770fbbb7-4.exe
Task: C:\Windows\Tasks\365c2923-b81b-461a-ba4b-1eba770fbbb7-5.job => C:\Program Files (x86)\SmartSaver+ 8\365c2923-b81b-461a-ba4b-1eba770fbbb7-5.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\AdvancedDriverUpdater_UPDATES.job => C:\Program Files (x86)\Advanced Driver Updater\adu.exe
Task: C:\Windows\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\bench-S-1-5-21-1148584671-988621172-509042803-1000.job => C:\Program Files (x86)\Bench\Updater\updater.exe <==== ATTENTION
Task: C:\Windows\Tasks\bench-sys.job => C:\Program Files (x86)\Bench\Updater\updater.exe <==== ATTENTION
Task: C:\Windows\Tasks\BlockAndSurf Update.job => C:\Program Files (x86)\BlockAndSurf-soft\BlockAndSurfB15.exe
Task: C:\Windows\Tasks\BlockAndSurf_wd.job => C:\Program Files (x86)\BlockAndSurf-soft\BlockAndSurfC.exe
Task: C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job => C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe
Task: C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job => C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe
Task: C:\Windows\Tasks\Dealply.job => C:\Users\Admin\AppData\Roaming\Dealply\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineCore.job => C:\Program Files (x86)\DealPlyLive\Update\DealPlyLive.exe <==== ATTENTION
Task: C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job => C:\Program Files (x86)\DealPlyLive\Update\DealPlyLive.exe <==== ATTENTION
Task: C:\Windows\Tasks\Feven 1.5-chromeinstaller.job => C:\Program Files (x86)\Feven 1.5\Feven 1.5-chromeinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\Feven 1.5-codedownloader.job => C:\Program Files (x86)\Feven 1.5\Feven 1.5-codedownloader.exe <==== ATTENTION
Task: C:\Windows\Tasks\Feven 1.5-enabler.job => C:\Program Files (x86)\Feven 1.5\Feven 1.5-enabler.exe <==== ATTENTION
Task: C:\Windows\Tasks\Feven 1.5-updater.job => C:\Program Files (x86)\Feven 1.5\Feven 1.5-updater.exe <==== ATTENTION
Task: C:\Windows\Tasks\FoxTab.job => C:\Users\Admin\AppData\Roaming\FoxTab\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1148584671-988621172-509042803-1000Core.job => C:\Users\Admin\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1148584671-988621172-509042803-1000UA.job => C:\Users\Admin\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HP Photo Creations Communicator.job => C:\ProgramData\HP Photo Creations\Communicator.exe
Task: C:\Windows\Tasks\MySearchDial.job => C:\Users\Admin\AppData\Roaming\MYSEAR~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-2.3-chromeinstaller.job => C:\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-chromeinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-2.3-codedownloader.job => C:\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-codedownloader.exe <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-2.3-enabler.job => C:\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-enabler.exe <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-2.3-updater.job => C:\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-updater.exe <==== ATTENTION
Task: C:\Windows\Tasks\SpeedUpMyPC Maintenance.job => C:\Program Files (x86)\Uniblue\SpeedUpMyPC\speedupmypc.exe <==== ATTENTION
Task: C:\Windows\Tasks\SpeedUpMyPC Startup.job => C:\Program Files (x86)\Uniblue\SpeedUpMyPC\speedupmypc.exe <==== ATTENTION
Task: C:\Windows\Tasks\System Speedup_DEFAULT.job => C:\Program Files (x86)\System Speedup\SystemSpeedup.exe
Task: C:\Windows\Tasks\System Speedup_UPDATES.job => C:\Program Files (x86)\System Speedup\SystemSpeedup.exe
==================== Loaded Modules (whitelisted) =============
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Users\Admin\Documents\Konfirmation 2008 013.AVI:TOC.WMV
AlternateDataStreams: C:\ProgramData\TEMP:373E1720
AlternateDataStreams: C:\ProgramData\TEMP:AD022376
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="2"
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Admin (S-1-5-21-1148584671-988621172-509042803-1000 - Administrator - Enabled) => C:\Users\Admin
Administrator (S-1-5-21-1148584671-988621172-509042803-500 - Administrator - Disabled)
Gast (S-1-5-21-1148584671-988621172-509042803-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1148584671-988621172-509042803-1006 - Limited - Enabled)
==================== Faulty Device Manager Devices =============
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Name: Security Processor Loader Driver
Description: Security Processor Loader Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: spldr
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Event log errors: =========================
Application errors:
==================
Error: (10/25/2014 00:36:47 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (10/25/2014 00:21:15 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm MyPC Backup.exe, Version 1.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1374
Startzeit: 01cff03c3d754fa0
Endzeit: 400
Anwendungspfad: C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe
Berichts-ID: d55fa901-5c2f-11e4-b10e-f46d049c6454
Error: (10/25/2014 00:11:26 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (10/25/2014 00:10:21 PM) (Source: Registry Helper Service) (EventID: 109) (User: )
Description: Error: Service started
Error: (10/25/2014 11:01:42 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (10/25/2014 10:48:30 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm SystemSpeedup.exe, Version 2.1.72.2820 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 128
Startzeit: 01cff02d90947260
Endzeit: 3983
Anwendungspfad: C:\Program Files (x86)\System Speedup\SystemSpeedup.exe
Berichts-ID: 518ae791-5c23-11e4-8041-f46d049c6454
Error: (10/25/2014 10:28:42 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (10/25/2014 10:27:56 AM) (Source: Registry Helper Service) (EventID: 109) (User: )
Description: Error: Service started
Error: (10/22/2014 07:12:36 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: AnyProtect.exe, Version: 1.0.0.1, Zeitstempel: 0x543d65b4
Name des fehlerhaften Moduls: Flash32_15_0_0_167.ocx, Version: 15.0.0.167, Zeitstempel: 0x541384c0
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0013d693
ID des fehlerhaften Prozesses: 0x1078
Startzeit der fehlerhaften Anwendung: 0xAnyProtect.exe0
Pfad der fehlerhaften Anwendung: AnyProtect.exe1
Pfad des fehlerhaften Moduls: AnyProtect.exe2
Berichtskennung: AnyProtect.exe3
Error: (10/22/2014 07:08:08 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (10/25/2014 00:37:54 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (10/25/2014 00:37:54 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (10/25/2014 00:37:54 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (10/25/2014 00:36:16 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (10/25/2014 00:36:16 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (10/25/2014 00:36:16 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (10/25/2014 00:36:11 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1084WSearch{9E175B6D-F52A-11D8-B9A5-505054503030}
Error: (10/25/2014 00:36:10 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1084WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
Error: (10/25/2014 00:36:06 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1084NVSvc{DCAB0989-1301-4319-BE5F-ADE89F88581C}
Error: (10/25/2014 00:36:05 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Microsoft Office Sessions:
=========================
==================== Memory info ===========================
Processor: AMD Athlon(tm) II X2 265 Processor
Percentage of memory in use: 55%
Total physical RAM: 2047.23 MB
Available physical RAM: 917.61 MB
Total Pagefile: 4094.45 MB
Available Pagefile: 3017.71 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:465.66 GB) (Free:353.57 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: F6FC491F)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=465.7 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
27.10.2014, 16:12
| #3 |
| /// the machine /// TB-Ausbilder    | Win 7 (64): Links im Browser unterstrichen; eDeals, SlamDunk Savings u.v.m. hi,
__________________Tools mit Adminrechten aus dem normalen Modus. Lade Dir bitte von hier  Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
Scan mit Combofix
__________________ |
|
27.10.2014, 18:07
| #4 |
| | Win 7 (64): Links im Browser unterstrichen; eDeals, SlamDunk Savings u.v.m. Hallo Schrauber, danke für die super schnelle Reaktion. Entgegen anders lautender Aussagen, macht ihr scheinbar doch nichts anderes als am PC zu sitzen ...  Alle Übereinstimmungen mit Revo entfernt (soweit nicht schon gestern erledigt). Combofix: Code:
ATTFilter ComboFix 14-10-27.01 - Admin 27.10.2014 17:31:46.1.2 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.2047.554 [GMT 1:00]
ausgeführt von:: c:\users\Admin\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
SP: Microsoft Security Essentials *Disabled/Updated* {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\users\Admin\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\enmkdplopmpkfnlefdldpkbcmihgcdec
c:\users\Admin\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\enmkdplopmpkfnlefdldpkbcmihgcdec\135\background.html
c:\users\Admin\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\enmkdplopmpkfnlefdldpkbcmihgcdec\135\content.js
c:\users\Admin\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\enmkdplopmpkfnlefdldpkbcmihgcdec\135\lsdb.js
c:\users\Admin\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\enmkdplopmpkfnlefdldpkbcmihgcdec\135\manifest.json
c:\users\Admin\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\enmkdplopmpkfnlefdldpkbcmihgcdec\135\YpOhsuw5.js
c:\users\Admin\AppData\Local\Google\Chrome SxS\User Data\Default\Preferences
c:\users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_gfjijibnpohkjdmbahejpeoilmgjahei_0.localstorage
c:\users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_glokmmdhnaeahioiigdcjppebblccbae_0.localstorage
c:\users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_impaepofmnammebeenafgmllpnjaiime_0.localstorage
c:\users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_iniabgbbmccaomaocmhcfioahgipigbh_0.localstorage
c:\users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ncdcmppncglfghbkclecobhhdldlbkik_0.localstorage
c:\users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_nmhabpdmbncdndpmbfohigagdffgehma_0.localstorage
c:\users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
c:\users\Admin\AppData\Roaming\1&1
c:\users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Startseite.url
c:\users\Admin\AppData\Roaming\Microsoft\Windows\Recent\VideoLAN Website.url
c:\users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae
c:\users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae\2.2\background.html
c:\users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae\2.2\content.js
c:\users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae\2.2\lsdb.js
c:\users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae\2.2\manifest.json
c:\users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae\2.2\vZd35bc_.js
c:\users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae
c:\users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae\2.2\background.html
c:\users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae\2.2\content.js
c:\users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae\2.2\lsdb.js
c:\users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae\2.2\manifest.json
c:\users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae\2.2\vZd35bc_.js
c:\users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae
c:\users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae\2.2\background.html
c:\users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae\2.2\content.js
c:\users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae\2.2\lsdb.js
c:\users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae\2.2\manifest.json
c:\users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae\2.2\vZd35bc_.js
c:\users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae
c:\users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae\2.2\background.html
c:\users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae\2.2\content.js
c:\users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae\2.2\lsdb.js
c:\users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae\2.2\manifest.json
c:\users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae\2.2\vZd35bc_.js
c:\users\HomeGroupUser$\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae
c:\users\HomeGroupUser$\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae\2.2\background.html
c:\users\HomeGroupUser$\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae\2.2\content.js
c:\users\HomeGroupUser$\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae\2.2\lsdb.js
c:\users\HomeGroupUser$\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae\2.2\manifest.json
c:\users\HomeGroupUser$\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae\2.2\vZd35bc_.js
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae\2.2\background.html
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae\2.2\content.js
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae\2.2\lsdb.js
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae\2.2\manifest.json
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\glokmmdhnaeahioiigdcjppebblccbae\2.2\vZd35bc_.js
c:\windows\IsUn0407.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-09-27 bis 2014-10-27 ))))))))))))))))))))))))))))))
.
.
2014-10-27 15:50 . 2012-05-04 17:29 772504 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2014-10-27 09:14 . 2014-10-14 19:59 11627712 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DC1D4D9C-3272-477B-A172-4DF991E76BBF}\mpengine.dll
2014-10-27 09:11 . 2012-05-04 17:29 687504 ----a-w- c:\windows\SysWow64\deployJava1.dll
2014-10-27 09:08 . 2014-10-27 09:08 98216 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-10-26 16:36 . 2014-10-26 16:36 -------- d-----w- c:\users\Admin\AppData\Local\CheckCode
2014-10-26 16:06 . 2014-10-26 16:06 4 ----a-w- c:\users\Admin\AppData\Roaming\appdataFr2.bin
2014-10-26 12:35 . 2014-10-14 19:59 11627712 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-10-26 09:38 . 2014-10-26 09:38 -------- d-----w- c:\program files (x86)\ESET
2014-10-25 22:08 . 2014-10-25 22:08 -------- d-----w- c:\program files (x86)\Tweaking.com - Windows Repair
2014-10-25 14:52 . 2014-10-25 14:52 -------- d-----w- c:\windows\ERUNT
2014-10-25 13:01 . 2014-07-09 02:03 7168 ----a-w- c:\windows\system32\KBDYAK.DLL
2014-10-25 13:01 . 2014-07-09 02:03 7168 ----a-w- c:\windows\system32\KBDTAT.DLL
2014-10-25 13:01 . 2014-07-09 02:03 7168 ----a-w- c:\windows\system32\KBDRU1.DLL
2014-10-25 13:01 . 2014-07-09 02:03 6656 ----a-w- c:\windows\system32\KBDRU.DLL
2014-10-25 13:01 . 2014-07-09 02:03 7168 ----a-w- c:\windows\system32\KBDBASH.DLL
2014-10-25 13:01 . 2014-07-09 01:31 7168 ----a-w- c:\windows\SysWow64\KBDYAK.DLL
2014-10-25 13:01 . 2014-07-09 01:31 6656 ----a-w- c:\windows\SysWow64\KBDBASH.DLL
2014-10-25 13:01 . 2014-10-10 02:05 276480 ----a-w- c:\windows\system32\generaltel.dll
2014-10-25 13:01 . 2014-10-10 02:05 507392 ----a-w- c:\windows\system32\aepdu.dll
2014-10-25 13:01 . 2014-10-10 02:00 424448 ----a-w- c:\windows\system32\aeinv.dll
2014-10-25 12:56 . 2014-09-25 02:08 371712 ----a-w- c:\windows\system32\qdvd.dll
2014-10-25 12:56 . 2014-09-25 01:40 519680 ----a-w- c:\windows\SysWow64\qdvd.dll
2014-10-25 12:49 . 2014-09-18 02:00 3241472 ----a-w- c:\windows\system32\msi.dll
2014-10-25 12:49 . 2014-09-18 01:32 2363904 ----a-w- c:\windows\SysWow64\msi.dll
2014-10-25 12:48 . 2014-08-29 02:07 44032 ----a-w- c:\windows\system32\tsgqec.dll
2014-10-25 12:48 . 2014-08-29 01:44 37376 ----a-w- c:\windows\SysWow64\tsgqec.dll
2014-10-25 12:48 . 2014-08-29 01:44 269312 ----a-w- c:\windows\SysWow64\aaclient.dll
2014-10-25 12:48 . 2014-08-29 01:44 1050112 ----a-w- c:\windows\SysWow64\mstsc.exe
2014-10-25 12:48 . 2014-08-29 02:07 5780480 ----a-w- c:\windows\system32\mstscax.dll
2014-10-25 12:48 . 2014-08-29 02:07 322560 ----a-w- c:\windows\system32\aaclient.dll
2014-10-25 12:48 . 2014-08-29 02:06 1125888 ----a-w- c:\windows\system32\mstsc.exe
2014-10-25 12:48 . 2014-08-29 01:44 4922368 ----a-w- c:\windows\SysWow64\mstscax.dll
2014-10-25 12:48 . 2014-08-29 02:07 3179520 ----a-w- c:\windows\system32\rdpcorets.dll
2014-10-25 12:42 . 2014-09-13 01:58 77312 ----a-w- c:\windows\system32\packager.dll
2014-10-25 12:42 . 2014-09-13 01:40 67072 ----a-w- c:\windows\SysWow64\packager.dll
2014-10-25 12:07 . 2014-10-27 08:47 129752 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-10-25 12:07 . 2014-10-01 09:11 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-10-25 12:07 . 2014-10-01 09:11 93400 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-10-25 12:07 . 2014-10-01 09:11 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-10-25 12:07 . 2014-10-25 12:07 -------- d-----w- c:\program files (x86)\ Malwarebytes Anti-Malware
2014-10-25 12:07 . 2014-10-25 12:07 -------- d-----w- c:\programdata\Malwarebytes
2014-10-25 11:39 . 2014-10-25 11:39 -------- d-----w- c:\program files (x86)\VS Revo Group
2014-10-25 10:42 . 2014-10-26 16:30 -------- d-----w- C:\AdwCleaner
2014-10-25 10:37 . 2014-10-26 20:57 -------- d-----w- C:\FRST
2014-10-25 09:46 . 2014-10-25 09:46 -------- d-----w- c:\program files\CCleaner
2014-10-20 16:49 . 2014-09-19 00:39 241664 ----a-w- c:\program files (x86)\Internet Explorer\F12Tools.dll
2014-10-18 21:21 . 2014-10-18 21:21 -------- d-----w- c:\windows\SysWow64\InteractiveOfficeWord
2014-10-18 21:18 . 2014-10-21 22:42 -------- d-----w- c:\users\Admin\AppData\Local\ControlDefaultMotion
2014-10-18 17:46 . 2014-09-10 14:30 1188440 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BC429F90-6E60-4AE6-9D69-1854FAE11604}\gapaengine.dll
2014-10-18 15:09 . 2014-10-18 15:09 -------- d-----w- C:\found.000
2014-10-17 21:21 . 2014-10-17 21:21 -------- d--h--w- c:\users\Admin\AppData\Roaming\GoldenGate
2014-10-17 16:06 . 2014-10-17 16:06 -------- d-----w- c:\users\Admin\{01662059-3E
2014-09-28 20:25 . 2014-08-18 21:15 1064960 ----a-w- c:\program files (x86)\Internet Explorer\networkinspection(70).dll
2014-09-28 20:25 . 2014-08-19 17:39 812216 ----a-w- c:\program files (x86)\Internet Explorer\iexplore(69).exe
2014-09-28 18:35 . 2014-06-27 02:08 2777088 ----a-w- c:\windows\system32\msmpeg2vdec.dll
2014-09-28 18:35 . 2014-06-27 01:45 2285056 ----a-w- c:\windows\SysWow64\msmpeg2vdec.dll
2014-09-28 07:27 . 2014-09-09 22:11 2048 ----a-w- c:\windows\system32\tzres.dll
2014-09-28 07:27 . 2014-09-09 21:47 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2014-09-28 07:27 . 2014-08-01 11:53 1031168 ----a-w- c:\windows\system32\TSWorkspace.dll
2014-09-28 07:27 . 2014-08-01 11:35 793600 ----a-w- c:\windows\SysWow64\TSWorkspace.dll
2014-09-28 07:26 . 2014-06-24 03:29 2565120 ----a-w- c:\windows\system32\d3d10warp.dll
2014-09-28 07:26 . 2014-06-24 02:59 1987584 ----a-w- c:\windows\SysWow64\d3d10warp.dll
2014-09-28 07:25 . 2014-07-07 02:06 728064 ----a-w- c:\windows\system32\kerberos.dll
2014-09-28 07:25 . 2014-07-07 02:06 1460736 ----a-w- c:\windows\system32\lsasrv.dll
2014-09-28 07:25 . 2014-07-07 01:40 22016 ----a-w- c:\windows\SysWow64\secur32.dll
2014-09-28 07:25 . 2014-07-07 01:40 550912 ----a-w- c:\windows\SysWow64\kerberos.dll
2014-09-28 07:25 . 2014-07-07 01:39 96768 ----a-w- c:\windows\SysWow64\sspicli.dll
2014-09-28 06:38 . 2014-10-03 14:40 17903792 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-10-25 23:58 . 2011-06-21 11:42 103265616 ----a-w- c:\windows\system32\MRT.exe
2014-10-03 14:42 . 2012-03-31 06:17 701104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-10-03 14:42 . 2011-06-21 16:25 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-09-22 06:42 . 2010-11-21 03:27 278152 ------w- c:\windows\system32\MpSigStub.exe
2014-09-10 14:30 . 2011-08-11 18:31 1188440 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2014-08-23 02:07 . 2014-08-28 09:11 404480 ----a-w- c:\windows\system32\gdi32.dll
2014-08-23 01:45 . 2014-08-28 09:11 311808 ----a-w- c:\windows\SysWow64\gdi32.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AVMWlanClient"="c:\program files (x86)\avmwlanstick\wlangui.exe" [2010-10-22 2105344]
"FreePDF Assistant"="c:\program files (x86)\FreePDF_XP\fpassist.exe" [2010-06-17 370176]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-08-21 959176]
"EKIJ5000StatusMonitor"="c:\windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe" [2011-06-16 2922496]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SpUninstallDeleteDir"="rmdir" [X]
.
c:\users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
FRITZ!DSL Internet.lnk - c:\program files (x86)\FRITZ!DSL\FritzDsl.exe [2011-6-24 901120]
FRITZ!DSL Startcenter.lnk - c:\program files (x86)\FRITZ!DSL\StCenter.exe [2011-6-24 679936]
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2009-2-26 97680]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer4"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"Conime"=%windir%\system32\conime.exe
.
R1 avbdsgdp;avbdsgdp;c:\windows\system32\drivers\avbdsgdp.sys;c:\windows\SYSNATIVE\drivers\avbdsgdp.sys [x]
R1 kbavjhwt;kbavjhwt;c:\windows\system32\drivers\kbavjhwt.sys;c:\windows\SYSNATIVE\drivers\kbavjhwt.sys [x]
R2 0bd9c8e28672d00.exe;0bd9c8e28672d00.exe;c:\users\Admin\AppData\Local\910a8b731f707898fd7e649e0ad73604\0bd9c8e28672d00.exe;c:\users\Admin\AppData\Local\910a8b731f707898fd7e649e0ad73604\0bd9c8e28672d00.exe [x]
R2 ArchiveBackupDebug.exe;ArchiveBackupDebug.exe;c:\users\Admin\AppData\Local\ArchiveBackupDebug\ArchiveBackupDebug.exe;c:\users\Admin\AppData\Local\ArchiveBackupDebug\ArchiveBackupDebug.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 DebuggerFreewareNet.exe;DebuggerFreewareNet.exe;c:\users\Admin\AppData\Local\DebuggerFreewareNet\DebuggerFreewareNet.exe;c:\users\Admin\AppData\Local\DebuggerFreewareNet\DebuggerFreewareNet.exe [x]
R2 DebugLogTrash.exe;DebugLogTrash.exe;c:\users\Admin\AppData\Local\DebugLogTrash\DebugLogTrash.exe;c:\users\Admin\AppData\Local\DebugLogTrash\DebugLogTrash.exe [x]
R2 FunctionLogPath.exe;FunctionLogPath.exe;c:\users\Admin\AppData\Local\FunctionLogPath\FunctionLogPath.exe;c:\users\Admin\AppData\Local\FunctionLogPath\FunctionLogPath.exe [x]
R2 Kodak AiO Status Monitor Service;Kodak AiO Status Monitor Service;c:\program files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe;c:\program files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe [x]
R3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys;c:\windows\SYSNATIVE\drivers\avmeject.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
R3 FWLANUSB;AVM FRITZ!WLAN;c:\windows\system32\DRIVERS\fwlanusb.sys;c:\windows\SYSNATIVE\DRIVERS\fwlanusb.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 RgFltX64;RgFltX64;c:\users\Admin\AppData\Local\DebuggerFreewareNet\RgFltX64.sys;c:\users\Admin\AppData\Local\DebuggerFreewareNet\RgFltX64.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
S2 ControlDefaultMotion.exe;ControlDefaultMotion.exe;c:\users\Admin\AppData\Local\ControlDefaultMotion\ControlDefaultMotion.exe;c:\users\Admin\AppData\Local\ControlDefaultMotion\ControlDefaultMotion.exe [x]
S2 InteractiveOfficeWord;InteractiveOfficeWord;c:\windows\SysWOW64\InteractiveOfficeWord\InteractiveOfficeWord.exe;c:\windows\SysWOW64\InteractiveOfficeWord\InteractiveOfficeWord.exe [x]
S2 serviceIEConfig;IEConfig 1und1 Edition;c:\windows\SysWOW64\ieconfig_1und1_svc.exe;c:\windows\SysWOW64\ieconfig_1und1_svc.exe [x]
S2 VIAKaraokeService;VIA Karaoke digital mixer Service;c:\windows\system32\viakaraokesrv.exe;c:\windows\SYSNATIVE\viakaraokesrv.exe [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys;c:\windows\SYSNATIVE\drivers\viahduaa.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-10-26 21:13 1089352 ----a-w- c:\program files (x86)\Google\Chrome\Application\38.0.2125.104\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-10-27 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 14:42]
.
2014-10-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-24 21:00]
.
2014-10-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-24 21:00]
.
2014-10-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1148584671-988621172-509042803-1000Core.job
- c:\users\Admin\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-24 21:00]
.
2014-10-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1148584671-988621172-509042803-1000UA.job
- c:\users\Admin\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-24 21:00]
.
2014-10-27 c:\windows\Tasks\HP Photo Creations Communicator.job
- c:\programdata\HP Photo Creations\Communicator.exe [2012-06-11 16:52]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 660360]
"EKIJ5000StatusMonitor"="c:\windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe" [2011-06-16 2922496]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2014-08-22 1331288]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 242192]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.de/
mDefault_Search_URL = hxxp://www.google.com
mDefault_Page_URL = hxxp://www.google.com
mStart Page = about:newtab
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = hxxp://www.google.com
mSearch Bar = hxxp://www.google.com
uInternet Settings,ProxyServer = http=127.0.0.1:31735
uInternet Settings,ProxyOverride = <local>;*origin.com;*ea.com;*akamaihd.net
uSearchAssistant = hxxp://www.google.com
uSearchURL,(Default) = hxxp://www.google.com
TCP: DhcpNameServer = 192.168.178.1
DPF: {25C29129-E95F-4564-BFE3-000000007100} - hxxp://www.123webseite.de/builder/pages/KvikVideo-7-1-0-0.CAB
FF - ProfilePath - c:\users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4u8qrjmu.default-1414266222116\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-10 - (no file)
Toolbar-Locked - (no file)
Wow6432Node-HKU-Default-RunOnce-KodakHomeCenter - c:\program files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-10 - (no file)
Toolbar-Locked - (no file)
AddRemove-FRITZ!DSL - c:\windows\IsUn0407.exe
AddRemove-Adobe ConnectNow Add-in - c:\users\Admin\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\acaddin\acaddin.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\serviceIEConfig]
"ImagePath"="c:\windows\SysWOW64\ieconfig_1und1_svc.exe /startedbyscm:016FE01B-40E31F2D-serviceIEConfig"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_167_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_167_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.15"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Windows CE Services]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-10-27 17:51:45
ComboFix-quarantined-files.txt 2014-10-27 16:51
.
Vor Suchlauf: 19 Verzeichnis(se), 396.543.950.848 Bytes frei
Nach Suchlauf: 24 Verzeichnis(se), 398.249.345.024 Bytes frei
.
- - End Of File - - F49C08A63E3615C04F4A23C6A52ADE37
A36C5E4F47E84449FF07ED3517B43A31
|
|
28.10.2014, 11:33
| #5 |
| /// the machine /// TB-Ausbilder | Win 7 (64): Links im Browser unterstrichen; eDeals, SlamDunk Savings u.v.m. Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
28.10.2014, 13:53
| #6 |
| | Win 7 (64): Links im Browser unterstrichen; eDeals, SlamDunk Savings u.v.m. Mir ist aufgefallen, dass sich im IE der Proxy nicht ausschalten lässt ... Und die veränderten Links "by eDeals" sind ebenfalls noch vorhanden. Hier die Logs: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 28.10.2014 Suchlauf-Zeit: 12:47:57 Logdatei: Mbam3.txt Administrator: Ja Version: 2.00.3.1025 Malware Datenbank: v2014.10.28.02 Rootkit Datenbank: v2014.10.22.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Admin Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 476381 Verstrichene Zeit: 20 Min, 47 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente erkannt) Module: 0 (Keine schädliche Elemente erkannt) Registrierungsschlüssel: 1 PUP.Optional.SuperFish.A, HKU\S-1-5-21-1148584671-988621172-509042803-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DOMSTORAGE\superfish.com, In Quarantäne, [bd046aad75072b0b7fd551e70df6d12f], Registrierungswerte: 0 (Keine schädliche Elemente erkannt) Registrierungsdaten: 0 (Keine schädliche Elemente erkannt) Ordner: 0 (Keine schädliche Elemente erkannt) Dateien: 1 Trojan.AntiSniff, C:\Users\Admin\AppData\Local\ControlDefaultMotion\SrDt.exe, In Quarantäne, [7948e03748342016abb3ff25b74e3cc4], Physische Sektoren: 0 (Keine schädliche Elemente erkannt) (end) Code:
ATTFilter # AdwCleaner v4.002 - Bericht erstellt am 28/10/2014 um 13:28:15
# DB v2014-10-26.6
# Aktualisiert 27/10/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Admin - ADMIN-PC
# Gestartet von : C:\Users\Admin\Desktop\AdwCleaner_4.002.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Users\Admin\AppData\Local\CheckCode
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\www.superfish.com
Schlüssel Gelöscht : HKLM\SOFTWARE\Upt
Schlüssel Gelöscht : HKLM\SOFTWARE\WinUpd
Schlüssel Gelöscht : HKLM\SOFTWARE\SI-App
Schlüssel Gelöscht : HKLM\SOFTWARE\RST
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Upt
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\WinUpd
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\SI-App
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\RST
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options\GoogleUpdate.exe
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17344
-\\ Mozilla Firefox v33.0.1 (x86 de)
-\\ Google Chrome v38.0.2125.111
*************************
AdwCleaner[R0].txt - [192381 octets] - [25/10/2014 11:42:15]
AdwCleaner[R1].txt - [6850 octets] - [25/10/2014 12:44:17]
AdwCleaner[R2].txt - [2459 octets] - [25/10/2014 12:50:56]
AdwCleaner[R3].txt - [1668 octets] - [25/10/2014 21:48:59]
AdwCleaner[R4].txt - [7376 octets] - [26/10/2014 17:27:11]
AdwCleaner[R5].txt - [2042 octets] - [28/10/2014 13:25:18]
AdwCleaner[S0].txt - [180112 octets] - [25/10/2014 11:52:48]
AdwCleaner[S1].txt - [5385 octets] - [25/10/2014 12:47:43]
AdwCleaner[S2].txt - [1102 octets] - [25/10/2014 12:54:02]
AdwCleaner[S3].txt - [1643 octets] - [25/10/2014 21:52:00]
AdwCleaner[S4].txt - [7351 octets] - [26/10/2014 17:30:55]
AdwCleaner[S5].txt - [1939 octets] - [28/10/2014 13:28:15]
########## EOF - C:\AdwCleaner\AdwCleaner[S5].txt - [1999 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.3.3 (10.21.2014:1)
OS: Windows 7 Professional x64
Ran by Admin on 28.10.2014 at 13:33:44,00
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\4u8qrjmu.default-1414266222116\minidumps [5 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 28.10.2014 at 13:36:57,10
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
29.10.2014, 08:20
| #7 |
| /// the machine /// TB-Ausbilder | Win 7 (64): Links im Browser unterstrichen; eDeals, SlamDunk Savings u.v.m.ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
30.10.2014, 11:40
| #8 |
| | Win 7 (64): Links im Browser unterstrichen; eDeals, SlamDunk Savings u.v.m. So, hat leider etwas länger gedauert ... ESET lief gestern bis 99% durch und ging dann bei einer DLL in einem der letzten 3 Verzeichnisse C:\Windows\winsxs\x86_wwf-system.workflow.runtime_... nicht mehr weiter. Aufgrund der fortgeschrittenen Uhrzeit musste ich abbrechen. Die meisten Funde stecken in der noch nicht gelöschten Quarantäne von Adwcleaner; lediglich die Funde am Ende des Log sind neu. Der Proxy lässt er sich nach wie vor nicht abstellen, entsprechend ist auch "by EDeals" immer noch aktiv. Logs: Code:
ATTFilter C:\AdwCleaner\Quarantine\C\Program Files\004\rqpbhevlkc64.exe.vir Variante von Win64/Adware.Adpeak.C Anwendung
C:\AdwCleaner\Quarantine\C\Program Files\Uninstaller\Uninstall.exe.vir MSIL/DomaIQ.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files\V-bates\ExtensionUpdaterService.exe.vir Variante von Win32/Toolbar.BitCocktail.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files\Web Assistant\Extension32.dll.vir Variante von Win32/Toolbar.Perion.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files\Web Assistant\Extension64.dll.vir Variante von Win64/Toolbar.Perion.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files\Web Assistant\ExtensionUpdaterService.exe.vir Variante von Win32/Toolbar.BitCocktail.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files\Web Assistant\InstallerHelper.dll.vir Variante von Win32/Toolbar.BitCocktail.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Advanced Driver Updater\adu.exe.vir Variante von Win32/Systweak.H evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Advanced Driver Updater\ADUHelper.dll.vir Variante von Win32/Systweak.N evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Advanced Driver Updater\SYSADUCheckUpdate.exe.vir Variante von Win32/Systweak.L evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Advanced Driver Updater\SYSADUNewScheduler.exe.vir Variante von Win32/Systweak.L evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Advanced System Protector\AdvancedSystemProtector.exe.vir Variante von MSIL/AdvancedSystemProtector.E evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Advanced System Protector\AspManager.exe.vir Variante von MSIL/AdvancedSystemProtector.F evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Advanced System Protector\ASPUninstall.exe.vir Variante von Win32/Systweak.K evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Advanced System Protector\Communication.dll.vir Win32/Systweak.F evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Advanced System Protector\filetypehelper.exe.vir Variante von MSIL/AdvancedSystemProtector.F evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Advanced System Protector\scandll.dll.vir Variante von MSIL/AdvancedSystemProtector.F evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Advanced System Protector\SSDPTstub.exe.vir Win32/Systweak.G evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Advanced System Protector\Troubleshooter\asp-fixer.com.vir MSIL/AdvancedSystemProtector.G evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Advanced System Protector\Troubleshooter\asp-fixer.exe.vir MSIL/AdvancedSystemProtector.G evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Advanced System Protector\Troubleshooter\asp-fixer.pif.vir MSIL/AdvancedSystemProtector.G evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Advanced System Protector\Troubleshooter\asp-fixer.scr.vir MSIL/AdvancedSystemProtector.G evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Advanced System Protector\Troubleshooter\firefox.com.vir MSIL/AdvancedSystemProtector.G evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Advanced System Protector\Troubleshooter\iexplore.exe.vir MSIL/AdvancedSystemProtector.G evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\AnyProtectEx\AnyProtectTrayIcon.exe.vir Win32/AnyProtect.E evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Bench\BService\1.1\bhelper.dll.vir Win32/AdWare.SmartApps.E Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Bench\BService\1.1\bservice.exe.vir Variante von Win32/AdWare.SmartApps.E Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Bench\NmHost\nmhost.exe.vir Win32/AdWare.SmartApps.E Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Bench\Proxy\cl.exe.vir Win32/AdWare.SmartApps.E Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Bench\Proxy\proc.exe.vir Win32/AdWare.SmartApps.E Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Bench\Proxy\pwdg.exe.vir Variante von Win32/AdWare.SmartApps.E Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Bench\Wd\wd.exe.vir Win32/AdWare.SmartApps.E Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\BlockAndSurf-soft\170.dll.vir Variante von Win32/AdWare.AddLyrics.BH Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\BlockAndSurf-soft\BlockAndSurfB15.exe.vir Variante von Win32/AdWare.AddLyrics.AM Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\BlockAndSurf-soft\BlockAndSurfC.exe.vir Variante von Win32/AdWare.AddLyrics.AO Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\BlockAndSurf-soft\BlockAndSurfgd170.dll.vir Variante von Win32/AdWare.AddLyrics.BA Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\BlockAndSurf-soft\BlockAndSurfgd170.exe.vir Variante von Win32/AdWare.AddLyrics.AN Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\BlockAndSurf-soft\BlockNSurf.exe.vir Variante von Win32/AdWare.AddLyrics.AR Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\BlockAndSurf-soft\Uninstall.exe.vir Variante von Win32/AdWare.AddLyrics.AS Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\BonanzaDeals\BonanzaDealsIE.dll.vir Variante von Win32/DealPly.G evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe.vir Win32/DealPly.L evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\BonanzaDealsLive.exe.vir Win32/DealPly.L evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\BonanzaDealsLiveBroker.exe.vir Win32/DealPly.L evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\BonanzaDealsLiveHandler.exe.vir Win32/DealPly.L evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\BonanzaDealsLiveOnDemand.exe.vir Variante von Win32/DealPly.L evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\goopdate.dll.vir Win32/DealPly.L evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll.vir Win32/DealPly.N evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\psmachine.dll.vir Win32/DealPly.L evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\psuser.dll.vir Variante von Win32/DealPly.L evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Boost\BoostUpdater.exe.vir Win32/Verti.G evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\DVDVideoSoft\TB\ConduitInstaller.exe.vir Win32/Toolbar.Conduit evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Conduit\Community Alerts\Alert.dll.vir Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Conduit\CT3298566\plugins\TBVerifier.dll.vir Win32/Toolbar.Conduit.AC evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\CostMin\FVtuTG.dll.vir Variante von Win32/AdWare.MultiPlug.Y Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\CostMin\FVtuTG.x64.dll.vir Variante von Win64/Adware.MultiPlug.C Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\DealPly\DealPly.crx.vir Win32/DealPly.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\DealPly\DealPly.xpi.vir Win32/DealPly.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\DealPly\DealPlyIE.dll.vir Variante von Win32/DealPly.G evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\DealPly\DealPlyUpdate.exe.vir Win32/DealPly.D evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\DealPly\DealPlyUpdateRun.exe.vir Variante von Win32/DealPly.C evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\DealPly\DealPlyUpdateVer.exe.vir Win32/DealPly.F evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\DealPlyLive\Update\1.3.23.0\DealPlyLive.exe.vir Win32/DealPly.N evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\DealPlyLive\Update\1.3.23.0\DealPlyLiveBroker.exe.vir Win32/DealPly.N evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\DealPlyLive\Update\1.3.23.0\DealPlyLiveHandler.exe.vir Win32/DealPly.N evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\DealPlyLive\Update\1.3.23.0\DealPlyLiveOnDemand.exe.vir Win32/DealPly.N evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\DealPlyLive\Update\1.3.23.0\goopdate.dll.vir Win32/DealPly.N evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\DealPlyLive\Update\1.3.23.0\goopdateres_ru.dll.vir Win32/DealPly.N evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\DealPlyLive\Update\1.3.23.0\npGoogleUpdate3.dll.vir Win32/DealPly.N evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\DealPlyLive\Update\1.3.23.0\psmachine.dll.vir Win32/DealPly.N evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\defaulttab\DefaultTabHost.exe.vir Win32/Toolbar.DefaultTab.C evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\defaulttab\DefaultTabSearch.exe.vir Variante von Win32/Toolbar.DefaultTab.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Delta\delta\1.8.21.5\deltaApp.dll.vir Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Delta\delta\1.8.21.5\deltaEng.dll.vir Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Delta\delta\1.8.21.5\deltasrv.exe.vir Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Delta\delta\1.8.21.5\deltaTlbr.dll.vir Win32/Toolbar.Babylon.G evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Delta\delta\1.8.21.5\uninstall.exe.vir Win32/Toolbar.Montiera.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Delta\delta\1.8.21.5\bh\delta.dll.vir Win32/Toolbar.Escort.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Delta\delta\1.8.22.0\deltaApp.dll.vir Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Delta\delta\1.8.22.0\deltaEng.dll.vir Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Delta\delta\1.8.22.0\deltasrv.exe.vir Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Delta\delta\1.8.22.0\deltaTlbr.dll.vir Variante von Win32/Toolbar.Montiera.F evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Delta\delta\1.8.22.0\uninstall.exe.vir Win32/Toolbar.Montiera.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Delta\delta\1.8.22.0\bh\delta.dll.vir Variante von Win32/Toolbar.Escort.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Desk 365\deskSvc.exe.vir Variante von Win32/ELEX.Y evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Doko-Toolbar\dokotoolbar\1.8.26.9\dokotoolbarApp.dll.vir Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Doko-Toolbar\dokotoolbar\1.8.26.9\dokotoolbarEng.dll.vir Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Doko-Toolbar\dokotoolbar\1.8.26.9\dokotoolbarsrv.exe.vir Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Doko-Toolbar\dokotoolbar\1.8.26.9\dokotoolbarTlbr.dll.vir Variante von Win32/Toolbar.Montiera.F evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Doko-Toolbar\dokotoolbar\1.8.26.9\uninstall.exe.vir Win32/Toolbar.Montiera.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Doko-Toolbar\dokotoolbar\1.8.26.9\bh\dokotoolbar.dll.vir Variante von Win32/Toolbar.Escort.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Driver Pro\DPSmartScan.exe.vir Win32/Adware.SpeedingUpMyPC.C Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\eDealsPop\IM.exe.vir Win32/InstallMonetizer.AZ evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\FilesFrog Update Checker\update_checker.exe.vir Win32/Somoto.D evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\FlvPlayer\FLVPlayerApp.exe.vir Win32/InstallCore.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\fst_de_24\fst_de_24.exe.vir Variante von Win32/AdWare.EoRezo.AU Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\fst_de_31\fst_de_31.exe.vir Variante von Win32/AdWare.EoRezo.AU Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\fst_de_37\fst_de_37.exe.vir Variante von Win32/AdWare.EoRezo.AU Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\fst_de_48\freeSoftToday_widget.exe.vir Variante von Win32/AdWare.EoRezo.AU Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\fst_de_48\fst_de_48.exe.vir Variante von Win32/AdWare.EoRezo.AU Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\fst_de_48\predm.exe.vir Mehrere Bedrohungen
C:\AdwCleaner\Quarantine\C\Program Files (x86)\fst_de_56\freeSoftToday_widget.exe.vir Variante von Win32/AdWare.EoRezo.AU Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\fst_de_56\fst_de_56.exe.vir Variante von Win32/AdWare.EoRezo.AU Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\fst_de_56\predm.exe.vir Mehrere Bedrohungen
C:\AdwCleaner\Quarantine\C\Program Files (x86)\fst_de_89\freeSoftToday_widget.exe.vir Variante von Win32/AdWare.EoRezo.AU Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\fst_de_89\fst_de_89.exe.vir Variante von Win32/AdWare.EoRezo.AU Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\iLivid\Helper.dll.vir Variante von Win32/Toolbar.SearchSuite.P evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\iLivid\uninstall.exe.vir Variante von Win32/Toolbar.SearchSuite.G evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\iMesh Applications\Mediabar\Datamngr\SRTOOL~1\dtUser.exe.vir Variante von Win32/Toolbar.Visicom.C evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\iMesh Applications\Mediabar\Datamngr\SRTOOL~1\searchresultsDx.dll.vir Variante von Win32/Toolbar.Visicom.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\iMesh Applications\Mediabar\Datamngr\SRTOOL~1\searchresultstb.dll.vir Variante von Win32/Toolbar.Visicom.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Iminent\IMBooster\inst\Bootstrapper\Bootstrapper.exe.vir Variante von Win32/Toolbar.Iminent.E evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\IMinent toolbar\IMinent_Toolbar.dll.vir Variante von Win32/Toolbar.Iminent.E evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\IMinent toolbar\TbCommonUtils.dll.vir Variante von Win32/Toolbar.Iminent.E evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\IMinent toolbar\tbcore3.dll.vir Variante von Win32/Toolbar.Iminent.E evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\IMinent toolbar\tbhelper.dll.vir Variante von Win32/Toolbar.Iminent.E evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\IMinent toolbar\TbHelper2.exe.vir Variante von Win32/Toolbar.Iminent.E evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\IMinent toolbar\uninstall.exe.vir Variante von Win32/Toolbar.Iminent.E evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\IMinent toolbar\update.exe.vir Variante von Win32/Toolbar.Iminent.E evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\incredibar.com\incredibar\1.5.3.27\incredibarApp.dll.vir Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\incredibar.com\incredibar\1.5.3.27\incredibarEng.dll.vir Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\incredibar.com\incredibar\1.5.3.27\incredibarsrv.exe.vir Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\incredibar.com\incredibar\1.5.3.27\incredibarTlbr.dll.vir Variante von Win32/Toolbar.Montiera.F evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\incredibar.com\incredibar\1.5.3.27\bh\incredibar.dll.vir Variante von Win32/Toolbar.Escort.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\MediaPlayerplus\0b09b8b1-b267-4ac3-a1e3-c3f904efd354-2.exe.vir Variante von Win32/Toolbar.CrossRider.AJ evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\MediaPlayerplus\0b09b8b1-b267-4ac3-a1e3-c3f904efd354-3.exe.vir Variante von Win32/Toolbar.CrossRider.AK evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\MediaPlayerplus\0b09b8b1-b267-4ac3-a1e3-c3f904efd354-4.exe.vir Variante von Win32/Toolbar.CrossRider.AK evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\MediaPlayerplus\0b09b8b1-b267-4ac3-a1e3-c3f904efd354-5.exe.vir Variante von Win32/Toolbar.CrossRider.AJ evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\MediaPlayerplus\54246.crx.vir JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\MediaPlayerplus\54246.xpi.vir JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\MediaPlayerplus\MediaPlayerplus-bg.exe.vir Variante von Win32/Toolbar.CrossRider.AL evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\MediaPlayerplus\MediaPlayerplus-bho.dll.vir Variante von Win32/Toolbar.CrossRider.AF evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\MediaPlayerplus\MediaPlayerplus-bho64.dll.vir Variante von Win64/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\MediaPlayerplus\MediaPlayerplus-codedownloader.exe.vir Variante von Win32/Toolbar.CrossRider.AJ evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\MediaPlayerplus\utils.exe.vir Win32/Packed.VMDetector.I evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\MixiDJ_V30\hk64tbMixi.dll.vir Win64/Toolbar.Conduit.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\MixiDJ_V30\hktbMixi.dll.vir Win32/Toolbar.Conduit.W evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\MixiDJ_V30\ldrtbMixi.dll.vir Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\MixiDJ_V30\MixiDJ_V30ToolbarHelper.exe.vir Win32/Toolbar.Conduit.V evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\MixiDJ_V30\prxtbMixi.dll.vir Win32/Toolbar.Conduit.W evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\MixiDJ_V30\tbMixi.dll.vir Variante von Win32/Toolbar.Conduit.X evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Music Toolbar\Datamngr\setmgrc1.cfg.vir Win32/AdWare.Bandoo.AD Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Music Toolbar\Datamngr\SRTOOL~1\IE\dtUser.exe.vir Variante von Win32/Toolbar.Visicom.C evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Music Toolbar\Datamngr\SRTOOL~1\IE\__searchresultsDx.dll.vir Variante von Win32/Toolbar.Visicom.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Music Toolbar\Datamngr\SRTOOL~1\IE\__searchresultstb.dll.vir Variante von Win32/Toolbar.Visicom.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Music Toolbar\Datamngr\x64\apcrtldr.dll.vir Variante von Win64/Toolbar.SearchSuite.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Music Toolbar\Datamngr\x64\Datamngr.dll.vir Variante von Win64/Toolbar.SearchSuite.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Music Toolbar\Datamngr\x64\del_DM_LL_nsmBAB4.dll.vir Variante von Win64/Toolbar.SearchSuite.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Music Toolbar\Datamngr\x64\IEBHO.dll.vir Variante von Win64/Toolbar.SearchSuite.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Music Toolbar\Datamngr\x64\Internet Explorer Settings.exe.vir Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Music Toolbar\Datamngr\x64\mgrldr.dll.vir Variante von Win64/Toolbar.SearchSuite.C evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Music Toolbar\Datamngr\x64\setmgrc1.cfg.vir Win64/Adware.Bandoo.A Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Mysearchdial\1.8.29.0\mysearchdialApp.dll.vir Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Mysearchdial\1.8.29.0\mysearchdialEng.dll.vir Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Mysearchdial\1.8.29.0\mysearchdialsrv.exe.vir Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Mysearchdial\1.8.29.0\mysearchdialTlbr.dll.vir Variante von Win32/Toolbar.Montiera.F evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Mysearchdial\1.8.29.0\bh\mysearchdial.dll.vir Variante von Win32/Toolbar.Escort.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Optimizer Pro\OptProLauncher.exe.vir Variante von Win32/AdWare.SpeedingUpMyPC.D Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Optimizer Pro\OptProSmartScan.exe.vir Variante von Win32/Adware.SpeedingUpMyPC.C Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Pirrit\AutoUpdater.exe.vir Variante von Win32/AdWare.Pirrit.A Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus-HD-2.3\33426.crx.vir JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-bho.dll.vir Variante von Win32/Toolbar.CrossRider.H evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-buttonutil.dll.vir Variante von Win32/Toolbar.CrossRider.AZ evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-buttonutil.exe.vir Variante von Win32/Toolbar.CrossRider.I evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-buttonutil64.dll.vir Variante von Win64/Toolbar.Crossrider.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-buttonutil64.exe.vir Variante von Win64/Toolbar.Crossrider.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-helper.exe.vir Variante von Win32/Toolbar.CrossRider.I evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus-HD-2.3\Uninstall.exe.vir Win32/Packed.ScrambleWrapper.C evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\PricePeep\pricepeep.dll.vir Variante von Win32/AdWare.PricePeep.A Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\RegClean Pro\RegCleanPro.exe.vir Variante von Win32/Systweak evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Search Results Toolbar\Datamngr\del_DM_LL_nsnD61C.dll.vir Win32/Toolbar.SearchSuite.C evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Search Results Toolbar\Datamngr\x64\del_DM_LL_nsnD61C.dll.vir Win64/Toolbar.SearchSuite.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\SPTool.dll.vir Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\uninstall.exe.vir Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe.vir Variante von Win32/Conduit.SearchProtect.I evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPTool64.exe.vir Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32.dll.vir Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll.vir Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64.dll.vir Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll.vir Variante von Win64/Conduit.SearchProtect.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe.vir Variante von Win32/Conduit.SearchProtect.I evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Searchqu Toolbar\del_DM_DLL_22.dll.vir Variante von Win64/Toolbar.SearchSuite.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Searchqu Toolbar\del_DM_DLL_33.dll.vir Variante von Win64/Toolbar.SearchSuite.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Searchqu Toolbar\del_DM_DLL_69.dll.vir Variante von Win32/Toolbar.SearchSuite.C evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Searchqu Toolbar\del_DM_DLL_77.dll.vir Variante von Win64/Toolbar.SearchSuite.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Searchqu Toolbar\del_DM_DLL_88.dll.vir Win32/Toolbar.SearchSuite evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Searchqu Toolbar\del_DM_DLL_98.dll.vir Win32/Toolbar.SearchSuite evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Searchqu Toolbar\del_DM_EXE_23.dll.vir Variante von Win32/Toolbar.SearchSuite evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Searchqu Toolbar\del_DM_EXE_81.dll.vir Variante von Win32/Toolbar.SearchSuite.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Searchqu Toolbar\del_DM_EXE_97.dll.vir Variante von Win32/Toolbar.SearchSuite evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Searchqu Toolbar\del_IEBHO_29.dll.vir Variante von Win32/Toolbar.SearchSuite evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Searchqu Toolbar\del_IEBHO_36.dll.vir Win32/Toolbar.SearchSuite evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Searchqu Toolbar\del_IEBHO_47.dll.vir Win32/Toolbar.SearchSuite evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Searchqu Toolbar\del_IEBHO_55.dll.vir Variante von Win64/Toolbar.SearchSuite.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Searchqu Toolbar\del_IEBHO_84.dll.vir Variante von Win64/Toolbar.SearchSuite.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Searchqu Toolbar\del_IEBHO_85.dll.vir Variante von Win64/Toolbar.SearchSuite.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Searchqu Toolbar\Datamngr\BrowserConnection.dll.vir Win32/Toolbar.SearchSuite.H evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Searchqu Toolbar\Datamngr\datamngr.dll.vir Variante von Win32/Toolbar.SearchSuite.C evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Searchqu Toolbar\Datamngr\datamngrUI.exe.vir Variante von Win32/Toolbar.SearchSuite.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Searchqu Toolbar\Datamngr\DnsBHO.dll.vir Variante von Win32/Toolbar.SearchSuite.R evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Searchqu Toolbar\Datamngr\IEBHO.dll.vir Variante von Win32/Toolbar.SearchSuite evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\datamngr.dll.vir Variante von Win64/Toolbar.SearchSuite.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\IEBHO.dll.vir Variante von Win64/Toolbar.SearchSuite.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SmartSaver+ 8\365c2923-b81b-461a-ba4b-1eba770fbbb7-2.exe.vir Variante von Win32/Toolbar.CrossRider.AJ evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SmartSaver+ 8\365c2923-b81b-461a-ba4b-1eba770fbbb7-3.exe.vir Variante von Win32/Toolbar.CrossRider.AK evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SmartSaver+ 8\365c2923-b81b-461a-ba4b-1eba770fbbb7-4.exe.vir Variante von Win32/Toolbar.CrossRider.AK evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SmartSaver+ 8\365c2923-b81b-461a-ba4b-1eba770fbbb7-5.exe.vir Variante von Win32/Toolbar.CrossRider.AJ evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SmartSaver+ 8\48926.crx.vir JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SmartSaver+ 8\48926.xpi.vir JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SmartSaver+ 8\SmartSaver+ 8-bg.exe.vir Variante von Win32/Toolbar.CrossRider.AL evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SmartSaver+ 8\SmartSaver+ 8-bho.dll.vir Variante von Win32/Toolbar.CrossRider.AF evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SmartSaver+ 8\SmartSaver+ 8-bho64.dll.vir Variante von Win64/Toolbar.Crossrider.J evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SmartSaver+ 8\SmartSaver+ 8-codedownloader.exe.vir Variante von Win32/Toolbar.CrossRider.AJ evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SmartSaver+ 8\utils.exe.vir Win32/Packed.VMDetector.I evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\supporter\Supporter.dll.vir Variante von Win32/SProtector.D evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\supporter\SupporterSvc.dll.vir Variante von Win32/SProtector.D evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\supporter\Supporter_x64.dll.vir Variante von Win64/SProtector.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupraSavings\2rs3.dll.vir Variante von Win32/AdWare.Adpeak.I Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupraSavings\CustomActionInstall.vir Variante von Win32/AdWare.Adpeak.I Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupraSavings\CustomActionUninstall.vir Variante von Win32/AdWare.Adpeak.I Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterface32.dll.vir Win32/Thinknice.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterface64.dll.vir Win64/Thinknice.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterfacef32.dll.vir Variante von Win32/Thinknice.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\RSHP.exe.vir Variante von Win32/ELEX.AR evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SearchProtect32.dll.vir Win32/Thinknice.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SearchProtect64.dll.vir Win64/Thinknice.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SpAPPSv32.dll.vir Variante von Win32/Thinknice.C evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SpAPPSv64.dll.vir Variante von Win64/Thinknice.C evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SupTab.dll.vir Win32/Thinknice.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\System Speedup\BeforeUninstall.exe.vir Variante von Win32/Systweak.K evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\System Speedup\SystemSpeedup.exe.vir Variante von Win32/Systweak evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\System Speedup\systweakasp.exe.vir MSIL/AdvancedSystemProtector.D evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Uniblue\SpeedUpMyPC\speedupmypc.exe.vir Win32/SpeedUpMyPC evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Wajam\IE\priam_bho.dll.vir Variante von Win32/Wajam.G evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Wajam\Updater\update.exe.vir Variante von Win32/Wajam.D evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Wajam\Updater\WajamUpdater.exe.vir Win32/Wajam.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Windows Searchqu Toolbar\del_b64DLL_nsvE1E1.dll.vir Win64/Toolbar.SearchSuite.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Windows Searchqu Toolbar\del_IEBHO_63.dll.vir Variante von Win64/Toolbar.SearchSuite.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Windows Searchqu Toolbar\del_IEBHO_70.dll.vir Win32/Toolbar.SearchSuite evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\datamngr.dll.vir Win32/Toolbar.SearchSuite evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\datamngrUI.exe.vir Variante von Win32/Toolbar.SearchSuite evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\ChromeExtension\lib\default-config.js.vir JS/Bandoo.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\ToolBar\dtUser.exe.vir Variante von Win32/Toolbar.Visicom.C evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\ToolBar\searchquband.dll.vir Variante von Win32/Toolbar.Visicom.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll.vir Variante von Win32/Toolbar.Visicom.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\x64\datamngr.dll.vir Variante von Win64/Toolbar.SearchSuite.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\WinRST\WinRST.exe.vir Variante von Win32/AdWare.Pirrit.A Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Yontoo Layers\YontooIEClient.dll.vir Win32/Adware.Yontoo.A Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\CheapMMe\WTgXjayf3v0b2l.dll.vir Variante von Win32/AdWare.MultiPlug.BN Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\CheapMMe\WTgXjayf3v0b2l.exe.vir Variante von Win32/AdWare.MultiPlug.BN Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\CheapMMe\WTgXjayf3v0b2l.x64.dll.vir Variante von Win64/Adware.MultiPlug.E Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\CostMin\mi_t1w0.exe.vir Variante von Win32/AdWare.MultiPlug.Y Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\DeissCounttExxTeNsi\Z.dll.vir Variante von Win32/AdWare.MultiPlug.AY Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\DeissCounttExxTeNsi\Z.exe.vir Variante von Win32/AdWare.MultiPlug.AG Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\DeissCounttExxTeNsi\Z.x64.dll.vir Variante von Win64/Adware.MultiPlug.D Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\IePluginService\PluginService.exe.vir Variante von Win32/ELEX.AV evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\IePluginServices\PluginService.exe.vir Variante von Win32/ELEX.AV evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\InternetUpdater\InternetUpdaterService.exe.vir Variante von MSIL/Adware.PullUpdate.A Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\JoniCaoupon\cZi6M.dll.vir Variante von Win32/AdWare.MultiPlug.N Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\JoniCaoupon\cZi6M.exe.vir Variante von Win32/AdWare.MultiPlug.K.gen Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\JoniCaoupon\cZi6M.x64.dll.vir Variante von Win64/Adware.MultiPlug.A Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\MovieMode\MovieMode.exe.vir Variante von MSIL/Adware.PullUpdate.B Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\MovieMode\MovieModeService.exe.vir Variante von MSIL/Adware.PullUpdate.A Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\RegularDEals\cTvCMr.dll.vir Variante von Win32/AdWare.MultiPlug.Y Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\RegularDEals\cTvCMr.exe.vir Variante von Win32/AdWare.MultiPlug.Y Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\RegularDEals\cTvCMr.x64.dll.vir Variante von Win64/Adware.MultiPlug.B Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\RHelpers\ChromeHelper\ChromeHelper.exe.vir Variante von Win32/Toolbar.WebApp.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\RHelpers\FirefoxHelper\FirefoxHelper.exe.vir Variante von Win32/Toolbar.WebApp.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\RHelpers\IeHelper\IeHelper.exe.vir Variante von Win32/Toolbar.WebApp.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\ShopDroP\miZSKu7FZm.dll.vir Variante von Win32/AdWare.MultiPlug.T Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\ShopDroP\miZSKu7FZm.exe.vir Variante von Win32/AdWare.MultiPlug.T Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\ShopDroP\miZSKu7FZm.x64.dll.vir Variante von Win64/Adware.MultiPlug.C Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll.vir Variante von Win32/Adware.Yontoo.B Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\TubeDimmer\TubeDimmer.exe.vir Variante von MSIL/Adware.PullUpdate.D Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\TubeDimmer\TubeDimmer64.exe.vir Variante von MSIL/Adware.PullUpdate.D Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\TubeDimmer\TubeDimmerService.exe.vir Variante von MSIL/Adware.PullUpdate.A Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\TubeDimmer\IE\common.dll.vir Variante von Win32/ExFriendAlert.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\TubeDimmer\up\2.6.80\TubeDimmer.exe.vir Variante von MSIL/Adware.PullUpdate.D Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\TubeDimmer\up\2.6.80\TubeDimmer64.exe.vir Variante von MSIL/Adware.PullUpdate.D Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\TubeDimmer\up\2.6.80\TubeDimmerService.exe.vir Variante von MSIL/Adware.PullUpdate.A Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\Updater\Uninstall.exe.vir Mehrere Bedrohungen
C:\AdwCleaner\Quarantine\C\ProgramData\Updater\updater.exe.vir Variante von Win32/Toolbar.WebApp.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\wincert\del_bDLL_nsvE1E1.dll.vir Win32/Toolbar.SearchSuite.M evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\wincert\del_DLL_bnsqF82A.dll.vir Win32/Toolbar.SearchSuite.M evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\wincert\del_DLL_bnsv7CA4.dll.vir Win32/Toolbar.SearchSuite.M evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\wincert\del_DLL_bnsv828C.dll.vir Win32/Toolbar.SearchSuite.M evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\wincert\del_DLL_bnsy4B61.dll.vir Win32/Toolbar.SearchSuite.M evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\wincert\del_DLL_nsqF82A.dll.vir Win32/Toolbar.SearchSuite.M evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\wincert\del_DLL_nsv7CA4.dll.vir Win32/Toolbar.SearchSuite.M evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\wincert\del_DLL_nsv828C.dll.vir Win32/Toolbar.SearchSuite.M evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\wincert\del_DLL_nsvE1E1.dll.vir Win32/Toolbar.SearchSuite.M evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\wincert\del_DLL_nsy4B61.dll.vir Win32/Toolbar.SearchSuite.M evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\wincert\win32cert.dll.vir Win32/Toolbar.SearchSuite.M evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\wincert\win32prop.dll.vir Win32/Toolbar.SearchSuite.M evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\wincert\win64cert.dll.vir Win64/Toolbar.SearchSuite.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\wincert\win64prop.dll.vir Win64/Toolbar.SearchSuite.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\WPM\wprotectmanager.exe.vir Variante von Win32/ELEX.AE evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\AnyProtectScannerSetup.exe.vir Win32/AnyProtect.E evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Conduit\CT3298566\MixiDJ_V30AutoUpdateHelper.exe.vir Win32/Toolbar.Conduit.V evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\ConvertAd\ConvertAd.exe.vir Win32/Adware.ConvertAd.D Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\CRE\fdkednngfjmpnljkolbapdednncafhen.crx.vir Variante von Win32/Toolbar.Conduit.AH evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\fst_de_24\upfst_de_24.exe.vir Variante von Win32/Adware.EoRezo.AJ Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\fst_de_31\upfst_de_31.exe.vir Variante von Win32/Adware.EoRezo.AJ Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\fst_de_31\Download\majfst.exe.vir Win32/AdWare.EoRezo.AW Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\fst_de_31\Download\majfst_gentlede.exe.vir Win32/AdWare.EoRezo.AW Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\fst_de_31\Download\majmp_gentleeu.exe.vir Win32/AdWare.EoRezo.AW Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\fst_de_31\Download\setup_recover_fst_de_182.exe.vir Variante von Win32/AdWare.EoRezo.AU Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\fst_de_31\Download\setup_recover_fst_de_187.exe.vir Variante von Win32/AdWare.EoRezo.AU Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\fst_de_37\upfst_de_37.exe.vir Variante von Win32/Adware.EoRezo.AJ Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\fst_de_48\upfst_de_48.exe.vir Variante von Win32/Adware.EoRezo.AJ Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\fst_de_48\Download\majfst_gentlede.exe.vir Win32/AdWare.EoRezo.AW Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\fst_de_48\Download\majmp_gentleeu.exe.vir Win32/AdWare.EoRezo.AW Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\fst_de_48\Download\setup_recover_fst_de_182.exe.vir Variante von Win32/AdWare.EoRezo.AU Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\fst_de_48\Download\setup_recover_fst_de_187.exe.vir Variante von Win32/AdWare.EoRezo.AU Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\fst_de_56\upfst_de_56.exe.vir Variante von Win32/Adware.EoRezo.AJ Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\fst_de_89\upfst_de_89.exe.vir Variante von Win32/Adware.EoRezo.AJ Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdkednngfjmpnljkolbapdednncafhen\10.31.4.510_1\APISupport\APISupport.dll.vir Variante von Win32/Conduit.SearchProtect.P evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdkednngfjmpnljkolbapdednncafhen\10.31.4.510_1\nativeMessaging\TBMessagingHost.exe.vir Variante von Win32/Toolbar.Conduit.AH evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdkednngfjmpnljkolbapdednncafhen\10.31.4.510_1\plugins\ChromeApiPlugin.dll.vir Variante von Win32/Conduit.SearchProtect.N evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie2.1.37.zip.vir Variante von Win32/Mobogenie.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\DaemonProcess.exe.vir Variante von Win32/Mobogenie.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\Mobogenie.exe.vir Variante von Win32/Mobogenie.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\MUServer.apk.vir Variante von Android/Mobserv.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\nengine.dll.vir Win32/NextLive.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\New_UpdateMoboGenie.exe.vir Variante von Win32/Mobogenie.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\BrowserHelper.exe.vir Variante von MSIL/Toolbar.Linkury.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.GUI.MainClient.dll.vir Variante von Win32/Toolbar.Linkury.F evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Core.dll.vir Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.ChromeLocalPlugin.dll.vir Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.FireFoxLocalPlugin.dll.vir Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.InternetExplorerLocalPlugin.dll.vir Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.Personalization.BusinessEntities.dll.vir Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.Resources.ProductUninstaller.dll.vir Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.Resources.SetBrowsersSettings.dll.vir Variante von MSIL/Toolbar.Linkury.C evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO.dll.vir Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO2.dll.vir Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension.dll.vir Variante von MSIL/Toolbar.Linkury.D evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension2.dll.vir Variante von MSIL/Toolbar.Linkury.D evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\SmartbarVersionsHelper.exe.vir Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\SnapDo.exe.vir Variante von Win32/Toolbar.Linkury.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\amfclgbdpgndipgoegfpkkgobahigbcl\GoogleChromeRemotePlugin.dll.vir Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\ar\Smartbar.Resources.LanguageSettings.resources.dll.vir Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\de\Smartbar.Resources.LanguageSettings.resources.dll.vir Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\es\Smartbar.Resources.LanguageSettings.resources.dll.vir Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\fr\Smartbar.Resources.LanguageSettings.resources.dll.vir Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\he\Smartbar.Resources.LanguageSettings.resources.dll.vir Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_16.dll.vir Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_17.dll.vir Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_18.dll.vir Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_19.dll.vir Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_20.dll.vir Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_21.dll.vir Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_22.dll.vir Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_23.dll.vir Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\it\Smartbar.Resources.LanguageSettings.resources.dll.vir Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\nl\Smartbar.Resources.LanguageSettings.resources.dll.vir Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\pt\Smartbar.Resources.LanguageSettings.resources.dll.vir Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\ru\Smartbar.Resources.LanguageSettings.resources.dll.vir Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\tr\Smartbar.Resources.LanguageSettings.resources.dll.vir Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\LocalLow\DVDVideoSoftTB\hk64tbDVD0.dll.vir Variante von Win64/Toolbar.Conduit.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\LocalLow\DVDVideoSoftTB\hk64tbDVD2.dll.vir Variante von Win64/Toolbar.Conduit.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\LocalLow\DVDVideoSoftTB\hktbDVD0.dll.vir Variante von Win32/Toolbar.Conduit.X evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\LocalLow\DVDVideoSoftTB\hktbDVD2.dll.vir Variante von Win32/Toolbar.Conduit.X evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\LocalLow\DVDVideoSoftTB\ldrtbDVD0.dll.vir Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\LocalLow\DVDVideoSoftTB\ldrtbDVD2.dll.vir Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\LocalLow\DVDVideoSoftTB\ldrtbDVDV.dll.vir Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\LocalLow\DVDVideoSoftTB\tbDVD0.dll.vir Variante von Win32/Toolbar.Conduit.X evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\LocalLow\DVDVideoSoftTB\tbDVD1.dll.vir Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\LocalLow\DVDVideoSoftTB\tbDVD2.dll.vir Variante von Win32/Toolbar.Conduit.X evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\LocalLow\DVDVideoSoftTB\tbDVDV.dll.vir Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\LocalLow\DVDVideoSoftTB\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.6.12\bin\PriceGongIE.dll.vir Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\LocalLow\FileConverter_1.3\hk64tbFil0.dll.vir Variante von Win64/Toolbar.Conduit.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\LocalLow\FileConverter_1.3\hk64tbFil2.dll.vir Variante von Win64/Toolbar.Conduit.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\LocalLow\FileConverter_1.3\hktbFil0.dll.vir Variante von Win32/Toolbar.Conduit.X evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\LocalLow\FileConverter_1.3\hktbFil2.dll.vir Variante von Win32/Toolbar.Conduit.X evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\LocalLow\FileConverter_1.3\ldrtbFil0.dll.vir Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\LocalLow\FileConverter_1.3\ldrtbFil2.dll.vir Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\LocalLow\FileConverter_1.3\ldrtbFile.dll.vir Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\LocalLow\FileConverter_1.3\tbFil0.dll.vir Variante von Win32/Toolbar.Conduit.X evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\LocalLow\FileConverter_1.3\tbFil1.dll.vir Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\LocalLow\FileConverter_1.3\tbFil2.dll.vir Variante von Win32/Toolbar.Conduit.X evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\LocalLow\FileConverter_1.3\tbFile.dll.vir Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\LocalLow\FileConverter_1.3\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.6.12\bin\PriceGongIE.dll.vir Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\LocalLow\MixiDJ_V30\hk64tbMixi.dll.vir Win64/Toolbar.Conduit.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\LocalLow\MixiDJ_V30\hktbMixi.dll.vir Win32/Toolbar.Conduit.W evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\LocalLow\MixiDJ_V30\ldrtbMixi.dll.vir Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\LocalLow\MixiDJ_V30\tbMixi.dll.vir Variante von Win32/Toolbar.Conduit.X evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\LocalLow\MixiDJ_V30\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.6.12\bin\PriceGongIE.dll.vir Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Roaming\BabSolution\CR\delta2.crx.vir Variante von Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Roaming\BabSolution\Shared\BabMaint.exe.vir Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Roaming\BabSolution\Shared\enhancedNT.dll.vir Variante von Win32/Toolbar.Babylon.W evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Roaming\BabSolution\Shared\NTRedirect.dll.vir Win32/Toolbar.Babylon.W evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Roaming\DealPly\UpdateProc\UpdateTask.exe.vir Win32/DealPly.F evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Roaming\defaulttab\defaulttab\DefaultTabBHO.dll.vir Variante von Win32/Toolbar.DefaultTab.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Roaming\defaulttab\defaulttab\DefaultTabStart.exe.vir Variante von Win32/Toolbar.DefaultTab.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Roaming\defaulttab\defaulttab\DefaultTabStart64.exe.vir Win64/Toolbar.DefaultTab.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Roaming\defaulttab\defaulttab\defaulttabuninstaller.exe.vir Win32/Toolbar.DefaultTab.E evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Roaming\defaulttab\defaulttab\DefaultTabWrap.dll.vir Variante von Win32/Toolbar.DefaultTab.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Roaming\defaulttab\defaulttab\DefaultTabWrap64.dll.vir Win64/Toolbar.DefaultTab.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Roaming\defaulttab\defaulttab\DTChrome.exe.vir Variante von Win32/Toolbar.DefaultTab.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Roaming\defaulttab\defaulttab\dtupdate.exe.vir Win32/Toolbar.DefaultTab.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Roaming\defaulttab\defaulttab\uninstalldt.exe.vir Variante von Win32/Toolbar.DefaultTab.E evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Roaming\defaulttab\defaulttab\update.exe.vir Variante von Win32/Toolbar.DefaultTab.F evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Roaming\FoxTab\UpdateProc\UpdateTask.exe.vir Variante von Win32/DealPly.M evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Roaming\InetStat\inetstat.exe.vir Variante von Win32/RiskWare.Astori.B Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Roaming\LookThisUp\LookThisUp.exe.vir Variante von MSIL/Adware.iBryte.H Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Roaming\LookThisUp\LookThisUpUninstall.exe.vir Variante von MSIL/Adware.iBryte.H Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\16eede48-12e9-4c79-bd54-c82622138533@630d8a34-73af-4e03-9664-9082492eb220.com\extensionData\plugins\91.js.vir JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\91.js.vir JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Roaming\Mysearchdial\UpdateProc\UpdateTask.exe.vir Variante von Win32/DealPly.S evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Roaming\OpenCandy\OpenCandy_C5E1EB56485547A8ADF3E69142A3C98E\PCBeschleunigen.exe.vir Variante von Win32/Speedchecker.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Roaming\SupTab\SupTab.dll.vir Win32/Thinknice.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Roaming\Systweak\ssd\SSDPTstub.exe.vir Win32/Systweak.G evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Roaming\Uniblue\SpeedUpMyPC\app_downloads\liveupdate.exe.vir Win32/SpeedUpMyPC evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Roaming\VOPackage\VOPackage.exe.vir Win32/VOPackage.F evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Roaming\VOPackage\VOsrv.exe.vir Variante von Win32/VOPackage.D evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Public\Util\DTChk.exe.vir Win32/Toolbar.DefaultTab.F evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Windows\System32\roboot64.exe.vir Variante von Win64/Systweak.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Windows\System32\sasnative64.exe.vir Win64/AdvancedSystemProtector.A evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Windows\System32\drivers\netfilter64.sys.vir Variante von Win64/Riskware.NetFilter.F Anwendung
C:\Windows\System32\InteractiveOfficeWord\InteractiveOfficeWord.exe Variante von Win32/Adware.Pirrit.I Anwendung
C:\Windows\SysWOW64\InteractiveOfficeWord\InteractiveOfficeWord.exe Variante von Win32/Adware.Pirrit.I Anwendung
Code:
ATTFilter Results of screen317's Security Check version 0.99.89
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Microsoft Security Essentials
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
MVPS Hosts File
SpywareBlaster 5.0
Java 8 Update 25
Java version out of Date!
Adobe Flash Player 15.0.0.152
Adobe Reader XI
Mozilla Firefox (33.0.1)
Mozilla Thunderbird (17.0.)
Google Chrome 38.0.2125.104
Google Chrome 38.0.2125.111
Google Chrome plugins...
Google Chrome update.dll..
````````Process Check: objlist.exe by Laurent````````
Microsoft Security Essentials MSMpEng.exe
Microsoft Security Essentials msseces.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-10-2014
Ran by Admin (administrator) on ADMIN-PC on 30-10-2014 11:16:24
Running from C:\Users\Admin\Desktop
Loaded Profile: Admin (Available profiles: Admin)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVM Berlin) C:\Program Files (x86)\FRITZ!DSL\IGDCTRL.EXE
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\WLanNetService.exe
(Microsoft Corporation) C:\Windows\System32\CISVC.EXE
() C:\Windows\SysWOW64\ieconfig_1und1_svc.exe
(VIA Technologies, Inc.) C:\Windows\System32\ViakaraokeSrv.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Eastman Kodak Company) C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(AVM Berlin) C:\Program Files (x86)\FRITZ!DSL\FritzDsl.exe
(AVM Berlin) C:\Program Files (x86)\FRITZ!DSL\StCenter.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\WLanGUI.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
() C:\Windows\SysWOW64\InteractiveOfficeWord\InteractiveOfficeWord.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [EKIJ5000StatusMonitor] => C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe [2922496 2011-06-16] (Eastman Kodak Company)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] => C:\Windows\KHALMNPR.EXE [242192 2008-02-29] (Logicool, Inc.)
HKLM-x32\...\Run: [AVMWlanClient] => C:\Program Files (x86)\avmwlanstick\wlangui.exe [2105344 2010-10-22] (AVM Berlin)
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [370176 2010-06-17] (shbox.de)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [EKIJ5000StatusMonitor] => C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKU\S-1-5-18\...\RunOnce: [SpUninstallDeleteDir] => rmdir /s /q "\SearchProtect"
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Internet.lnk
ShortcutTarget: FRITZ!DSL Internet.lnk -> C:\Program Files (x86)\FRITZ!DSL\FritzDsl.exe (AVM Berlin)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Startcenter.lnk
ShortcutTarget: FRITZ!DSL Startcenter.lnk -> C:\Program Files (x86)\FRITZ!DSL\StCenter.exe (AVM Berlin)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:25705
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:newtab
SearchScopes: HKCU - {09038620-190C-402B-A92F-18864E6AB22F} URL = http://go.1und1.de/suchbox/1und1suche?su={searchTerms}
SearchScopes: HKCU - {0FB3AFB5-96B1-4E17-903E-84DCA71AC24D} URL =
SearchScopes: HKCU - {5A817CF6-92D5-4DE5-AC38-82DF8A73EF28} URL = http://go.gmx.net/br/ie9_search_web/?su={searchTerms}
SearchScopes: HKCU - {6B1D1FB7-7233-4F7C-802C-21A1DDB12754} URL = http://go.web.de/br/ie9_search_web/?su={searchTerms}
SearchScopes: HKCU - {81CE708B-5104-4C62-B333-94B417473B29} URL = http://go.mail.com/br/ie9_search_web/?su={searchTerms}
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO-x32: 1und1 Konfiguration -> {17166733-40EA-4432-A85C-AE672FF0E236} -> C:\ProgramData\1und1InternetExplorerAddon\BHOXML.dll (1&1 Mail & Media GmbH)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: 1&&1 Internet AG Browser Configuration by mquadr.at -> {D48FF4B4-E68F-47D1-8E25-81A0F0EEB341} -> C:\Windows\SysWow64\ieconfig_1und1.dll (mquadr.at software engineering und consulting GmbH)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
DPF: HKLM-x32 {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: HKLM-x32 {25C29129-E95F-4564-BFE3-000000007100} http://www.123webseite.de/builder/pages/KvikVideo-7-1-0-0.CAB
DPF: HKLM-x32 {6A060448-60F9-11D5-A6CD-0002B31F7455}
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4u8qrjmu.default-1414266222116
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.5.1 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 -> C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin -> C:\Users\Admin\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin -> C:\Users\Admin\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\Admin\AppData\Local\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\Admin\AppData\Local\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Admin\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Admin\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Edge - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4u8qrjmu.default-1414266222116\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2014-10-26]
FF HKCU\...\Firefox\Extensions: [{b5ad6039-a173-4149-9dcf-d04371526253}] - C:\Program Files (x86)\Lyrics_Monkey\131.xpi
FF HKCU\...\Firefox\Extensions: [{354dbb0a-71d5-4e9f-9c02-6c88b9d387ba}] - C:\ProgramData\SExtension\SExtension\{354dbb0a-71d5-4e9f-9c02-6c88b9d387ba}
Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-10-27]
CHR Extension: (Google Docs) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-10-27]
CHR Extension: (Google Drive) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-10-27]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-10-27]
CHR Extension: (YouTube) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-10-27]
CHR Extension: (Google-Suche) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-10-27]
CHR Extension: (Google Tabellen) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-10-27]
CHR Extension: (AdBlock) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-10-27]
CHR Extension: (Google Wallet) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-10-27]
CHR Extension: (Google Mail) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-10-27]
CHR HKLM-x32\...\Chrome\Extension: [aaaaihhnfnbnpbhpagnmoplpcjbediml] - C:\Users\Admin\AppData\Local\imeshmusicboxtoolbar\GC\toolbar.crx []
CHR HKLM-x32\...\Chrome\Extension: [kmmjjcoppdcpcdlonfflbdabbkhnnogm] - C:\Program Files (x86)\Search Results Toolbar\Datamngr\chromeExtension.crx []
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AVM IGD CTRL Service; C:\Program Files (x86)\FRITZ!DSL\IGDCTRL.EXE [81920 2005-11-21] (AVM Berlin) [File not signed]
R2 AVM WLAN Connection Service; C:\Program Files (x86)\avmwlanstick\WlanNetService.exe [376832 2010-10-22] (AVM Berlin) [File not signed]
S3 de_serv; C:\Program Files (x86)\Common Files\AVM\de_serv.exe [315392 2005-11-21] (AVM Berlin) [File not signed]
R2 InteractiveOfficeWord; C:\Windows\SysWOW64\InteractiveOfficeWord\InteractiveOfficeWord.exe [68096 2014-10-13] () [File not signed]
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
R2 serviceIEConfig; C:\Windows\SysWOW64\ieconfig_1und1_svc.exe [1053848 2014-06-05] ()
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27760 2011-06-14] (VIA Technologies, Inc.)
S2 0bd9c8e28672d00.exe; C:\Users\Admin\AppData\Local\910a8b731f707898fd7e649e0ad73604\0bd9c8e28672d00.exe [X]
S2 ArchiveBackupDebug.exe; C:\Users\Admin\AppData\Local\ArchiveBackupDebug\ArchiveBackupDebug.exe [X]
S2 DebuggerFreewareNet.exe; C:\Users\Admin\AppData\Local\DebuggerFreewareNet\DebuggerFreewareNet.exe [X]
S2 DebugLogTrash.exe; C:\Users\Admin\AppData\Local\DebugLogTrash\DebugLogTrash.exe [X]
S2 FunctionLogPath.exe; C:\Users\Admin\AppData\Local\FunctionLogPath\FunctionLogPath.exe [X]
S2 Kodak AiO Status Monitor Service; "C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe" [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2010-10-22] (AVM Berlin)
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [460800 2010-10-22] (AVM GmbH)
S3 LHidFilt; C:\Windows\System32\DRIVERS\LHidFilt.Sys [54800 2008-02-29] (Logicool, Inc.)
S3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [57360 2008-02-29] (Logicool, Inc.)
S3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [41488 2008-02-29] (Logicool, Inc.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S1 avbdsgdp; \??\C:\Windows\system32\drivers\avbdsgdp.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S1 kbavjhwt; \??\C:\Windows\system32\drivers\kbavjhwt.sys [X]
S3 RgFltX64; \??\C:\Users\Admin\AppData\Local\DebuggerFreewareNet\RgFltX64.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-30 11:15 - 2014-10-30 11:15 - 00000000 ____D () C:\Users\Admin\Desktop\FRST-OlderVersion
2014-10-30 10:38 - 2014-10-30 10:39 - 00854448 _____ () C:\Users\Admin\Desktop\SecurityCheck.exe
2014-10-29 12:00 - 2014-10-29 12:00 - 02347384 _____ (ESET) C:\Users\Admin\Downloads\esetsmartinstaller_deu(1).exe
2014-10-28 15:05 - 2014-10-28 15:05 - 00000000 ____D () C:\Users\Admin\Downloads\tweaking.com_windows_repair_aio
2014-10-28 15:04 - 2014-10-28 15:05 - 07864386 _____ () C:\Users\Admin\Downloads\tweaking.com_windows_repair_aio.zip
2014-10-28 13:36 - 2014-10-28 13:36 - 00000770 _____ () C:\Users\Admin\Desktop\JRT.txt
2014-10-28 13:33 - 2014-10-28 13:33 - 00000000 ____D () C:\Users\Admin\AppData\Local\CheckCode
2014-10-28 13:20 - 2014-10-28 13:21 - 01706144 _____ (Thisisu) C:\Users\Admin\Desktop\JRT.exe
2014-10-28 13:17 - 2014-10-28 13:17 - 01998336 _____ () C:\Users\Admin\Desktop\AdwCleaner_4.002.exe
2014-10-28 10:22 - 2014-10-28 10:31 - 00001164 _____ () C:\Users\Admin\Desktop\SystemLook.txt
2014-10-28 10:20 - 2014-10-28 10:20 - 00165376 _____ () C:\Users\Admin\Desktop\SystemLook_x64.exe
2014-10-27 21:47 - 2014-10-27 21:48 - 00003234 _____ () C:\Windows\System32\Tasks\SidebarExecute
2014-10-27 21:32 - 2014-10-27 21:34 - 00000000 ____D () C:\Program Files (x86)\SpywareBlaster
2014-10-27 21:32 - 2014-10-27 21:32 - 00001093 _____ () C:\Users\Public\Desktop\SpywareBlaster.lnk
2014-10-27 21:32 - 2014-10-27 21:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
2014-10-27 21:32 - 2014-10-27 21:32 - 00000000 ____D () C:\ProgramData\Licenses
2014-10-27 21:23 - 2014-10-27 21:25 - 04095448 _____ (BrightFort LLC ) C:\Users\Admin\Downloads\spywareblastersetup50.exe
2014-10-27 17:51 - 2014-10-27 17:51 - 00029549 _____ () C:\ComboFix.txt
2014-10-27 17:29 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-10-27 17:29 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-10-27 17:29 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-10-27 17:29 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-10-27 17:29 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-10-27 17:29 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-10-27 17:29 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-10-27 17:29 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-10-27 17:28 - 2014-10-27 17:51 - 00000000 ____D () C:\Qoobox
2014-10-27 17:27 - 2014-10-27 17:49 - 00000000 ____D () C:\Windows\erdnt
2014-10-27 16:50 - 2012-05-04 18:29 - 00772504 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2014-10-27 16:30 - 2014-10-27 16:30 - 05591695 ____R (Swearware) C:\Users\Admin\Desktop\ComboFix.exe
2014-10-27 10:11 - 2012-05-04 18:29 - 00687504 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2014-10-27 10:08 - 2014-10-27 10:08 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-10-26 18:35 - 2014-10-25 09:51 - 00008957 _____ () C:\Windows\system32\Drivers\etc\hosts - vir
2014-10-26 18:27 - 2014-10-26 18:30 - 00005136 _____ () C:\Users\Admin\Desktop\Rkill.txt
2014-10-26 18:27 - 2014-10-26 18:27 - 01944824 _____ (Bleeping Computer, LLC) C:\Users\Admin\Desktop\rkill.exe
2014-10-26 18:16 - 2014-10-26 18:16 - 00001796 _____ () C:\sc-cleaner.txt
2014-10-26 18:14 - 2014-10-26 18:14 - 00441592 _____ (Bleeping Computer, LLC) C:\Users\Admin\Desktop\sc-cleaner.exe
2014-10-26 17:06 - 2014-10-26 17:06 - 00000004 _____ () C:\Users\Admin\AppData\Roaming\appdataFr2.bin
2014-10-26 10:38 - 2014-10-26 10:38 - 02347384 _____ (ESET) C:\Users\Admin\Downloads\esetsmartinstaller_deu.exe
2014-10-26 10:38 - 2014-10-26 10:38 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-10-25 23:08 - 2014-10-25 23:08 - 00000000 ____D () C:\Program Files (x86)\Tweaking.com - Windows Repair
2014-10-25 21:54 - 2014-10-30 10:29 - 00000952 _____ () C:\Windows\setupact.log
2014-10-25 21:54 - 2014-10-25 21:54 - 00000000 _____ () C:\Windows\setuperr.log
2014-10-25 21:53 - 2014-10-28 13:29 - 00206268 _____ () C:\Windows\PFRO.log
2014-10-25 20:48 - 2014-10-27 09:54 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-10-25 16:57 - 2014-10-27 10:21 - 00000000 ____D () C:\Windows\pss
2014-10-25 15:52 - 2014-10-25 15:52 - 00000000 ____D () C:\Windows\ERUNT
2014-10-25 14:03 - 2014-10-07 03:54 - 00378552 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-25 14:03 - 2014-10-07 03:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-10-25 14:03 - 2014-09-25 23:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-10-25 14:03 - 2014-09-25 23:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-10-25 14:03 - 2014-09-25 23:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-10-25 14:03 - 2014-09-19 02:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-25 14:03 - 2014-09-19 02:55 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-10-25 14:03 - 2014-09-19 02:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-10-25 14:03 - 2014-09-19 02:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-10-25 14:03 - 2014-09-19 02:30 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-25 14:03 - 2014-09-19 02:25 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-10-25 14:03 - 2014-09-19 02:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-10-25 14:03 - 2014-09-19 02:06 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-25 14:03 - 2014-09-19 02:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-10-25 14:03 - 2014-09-19 02:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-10-25 14:03 - 2014-09-19 01:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-10-25 14:03 - 2014-09-19 01:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-10-25 14:03 - 2014-09-19 01:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-10-25 14:03 - 2014-09-19 01:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-10-25 14:03 - 2014-09-19 01:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-25 14:03 - 2014-09-19 01:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-10-25 14:03 - 2014-09-19 01:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-25 14:03 - 2014-09-19 00:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-10-25 14:02 - 2014-09-29 01:58 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-25 14:02 - 2014-09-25 23:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-25 14:02 - 2014-09-25 23:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-10-25 14:02 - 2014-09-25 23:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-10-25 14:02 - 2014-09-25 23:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-25 14:02 - 2014-09-19 03:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-25 14:02 - 2014-09-19 02:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-25 14:02 - 2014-09-19 02:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-25 14:02 - 2014-09-19 02:40 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-25 14:02 - 2014-09-19 02:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-25 14:02 - 2014-09-19 02:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-25 14:02 - 2014-09-19 02:31 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-25 14:02 - 2014-09-19 02:27 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-25 14:02 - 2014-09-19 02:26 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-25 14:02 - 2014-09-19 02:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-10-25 14:02 - 2014-09-19 02:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-25 14:02 - 2014-09-19 02:18 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-25 14:02 - 2014-09-19 02:14 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-25 14:02 - 2014-09-19 02:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-10-25 14:02 - 2014-09-19 02:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-25 14:02 - 2014-09-19 02:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-25 14:02 - 2014-09-19 01:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-10-25 14:02 - 2014-09-19 01:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-25 14:02 - 2014-09-19 01:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-10-25 14:02 - 2014-09-19 01:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-10-25 14:02 - 2014-09-19 01:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-25 14:02 - 2014-09-19 01:40 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-10-25 14:02 - 2014-09-19 01:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-10-25 14:02 - 2014-09-19 01:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-25 14:02 - 2014-09-19 01:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-10-25 14:02 - 2014-09-19 01:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-10-25 14:02 - 2014-09-19 00:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-10-25 14:02 - 2014-09-19 00:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-25 14:02 - 2014-09-19 00:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-10-25 14:02 - 2014-06-18 23:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-25 14:02 - 2014-06-18 23:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2014-10-25 14:02 - 2014-06-18 23:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2014-10-25 14:02 - 2014-06-18 23:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-25 14:02 - 2014-06-18 23:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2014-10-25 14:02 - 2014-06-18 23:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-25 14:01 - 2014-10-10 03:05 - 00507392 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-25 14:01 - 2014-10-10 03:05 - 00276480 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-10-25 14:01 - 2014-10-10 03:00 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-10-25 14:01 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-10-25 14:01 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-10-25 14:01 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-10-25 14:01 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-10-25 14:01 - 2014-07-09 03:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-10-25 14:01 - 2014-07-09 02:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-10-25 14:01 - 2014-07-09 02:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-10-25 14:01 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-10-25 14:01 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-10-25 14:01 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-10-25 14:01 - 2014-07-08 23:38 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-10-25 14:01 - 2014-07-08 23:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-10-25 13:56 - 2014-09-25 03:08 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-10-25 13:56 - 2014-09-25 02:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2014-10-25 13:49 - 2014-09-18 03:00 - 03241472 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-25 13:49 - 2014-09-18 02:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-25 13:48 - 2014-08-29 03:07 - 05780480 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-25 13:48 - 2014-08-29 03:07 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-10-25 13:48 - 2014-08-29 03:07 - 00322560 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2014-10-25 13:48 - 2014-08-29 03:07 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-10-25 13:48 - 2014-08-29 03:06 - 01125888 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-10-25 13:48 - 2014-08-29 02:44 - 04922368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-25 13:48 - 2014-08-29 02:44 - 01050112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-10-25 13:48 - 2014-08-29 02:44 - 00269312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2014-10-25 13:48 - 2014-08-29 02:44 - 00037376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-10-25 13:45 - 2014-09-04 06:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-25 13:45 - 2014-09-04 06:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-25 13:45 - 2014-07-17 03:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-25 13:45 - 2014-07-17 03:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-10-25 13:45 - 2014-07-17 03:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-25 13:45 - 2014-07-17 03:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-10-25 13:45 - 2014-07-17 03:07 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-10-25 13:45 - 2014-07-17 03:07 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-10-25 13:45 - 2014-07-17 02:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
2014-10-25 13:45 - 2014-07-17 02:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-10-25 13:45 - 2014-07-17 02:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-10-25 13:45 - 2014-07-17 02:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-10-25 13:45 - 2014-07-17 02:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-10-25 13:42 - 2014-09-13 02:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-25 13:42 - 2014-09-13 02:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-25 13:07 - 2014-10-28 12:47 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-25 13:07 - 2014-10-25 13:07 - 00001116 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-25 13:07 - 2014-10-25 13:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-10-25 13:07 - 2014-10-25 13:07 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-10-25 13:07 - 2014-10-25 13:07 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-10-25 13:07 - 2014-10-01 10:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-25 13:07 - 2014-10-01 10:11 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-10-25 13:07 - 2014-10-01 10:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-10-25 12:39 - 2014-10-25 12:39 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Admin\Downloads\revosetup.exe
2014-10-25 12:39 - 2014-10-25 12:39 - 00001224 _____ () C:\Users\Admin\Desktop\Revo Uninstaller.lnk
2014-10-25 12:39 - 2014-10-25 12:39 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-10-25 12:01 - 2014-10-25 12:01 - 00002772 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-10-25 11:42 - 2014-10-28 13:28 - 00000000 ____D () C:\AdwCleaner
2014-10-25 11:39 - 2014-10-26 20:52 - 00035083 _____ () C:\Users\Admin\Desktop\Addition.txt
2014-10-25 11:37 - 2014-10-30 11:16 - 00016837 _____ () C:\Users\Admin\Desktop\FRST.txt
2014-10-25 11:37 - 2014-10-30 11:16 - 00000000 ____D () C:\FRST
2014-10-25 11:07 - 2014-10-30 11:15 - 02113536 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe
2014-10-25 11:06 - 2014-10-25 11:07 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\Admin\Downloads\mbam-setup-2.0.3.1025.exe
2014-10-25 11:05 - 2014-10-25 11:05 - 00709564 _____ () C:\Users\Admin\Desktop\delfix_10.8.exe
2014-10-25 11:03 - 2014-10-25 11:03 - 00448512 _____ (OldTimer Tools) C:\Users\Admin\Desktop\TFC.exe
2014-10-25 10:49 - 2014-10-30 11:14 - 00000000 ____D () C:\Users\Admin\Desktop\Wartung
2014-10-25 10:46 - 2014-10-25 10:46 - 00000822 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-10-25 10:46 - 2014-10-25 10:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-10-25 10:46 - 2014-10-25 10:46 - 00000000 ____D () C:\Program Files\CCleaner
2014-10-25 10:45 - 2014-10-25 10:46 - 04974864 _____ (Piriform Ltd) C:\Users\Admin\Downloads\ccsetup419.exe
2014-10-18 22:21 - 2014-10-18 22:21 - 00000000 ____D () C:\Windows\SysWOW64\InteractiveOfficeWord
2014-10-18 16:09 - 2014-10-18 16:09 - 00000000 ____D () C:\found.000
2014-10-17 22:21 - 2014-10-17 22:21 - 00000000 ___HD () C:\Users\Admin\AppData\Roaming\GoldenGate
2014-10-17 22:18 - 2014-10-17 22:18 - 00000171 _____ () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Play Games Online.url
2014-10-17 22:17 - 2014-10-17 22:17 - 00001771 _____ () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Gameo.lnk
2014-10-17 17:06 - 2014-10-17 17:06 - 00000000 ____D () C:\Users\Admin\{01662059-3E
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-30 11:05 - 2011-06-24 18:30 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1148584671-988621172-509042803-1000UA.job
2014-10-30 10:49 - 2011-06-20 23:49 - 01138952 _____ () C:\Windows\WindowsUpdate.log
2014-10-30 10:45 - 2011-09-13 20:56 - 00000338 _____ () C:\Windows\Tasks\HP Photo Creations Communicator.job
2014-10-30 10:38 - 2009-07-14 05:45 - 00031680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-30 10:38 - 2009-07-14 05:45 - 00031680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-30 10:36 - 2012-03-31 07:17 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-30 10:34 - 2010-11-21 07:50 - 00702598 _____ () C:\Windows\system32\perfh007.dat
2014-10-30 10:34 - 2010-11-21 07:50 - 00151390 _____ () C:\Windows\system32\perfc007.dat
2014-10-30 10:34 - 2009-07-14 06:13 - 01630758 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-30 10:29 - 2011-06-24 15:07 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-30 10:29 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-29 14:21 - 2011-06-24 17:20 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{C6295D87-0223-4913-87E0-549DC15EB489}
2014-10-28 22:05 - 2011-06-24 18:30 - 00001068 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1148584671-988621172-509042803-1000Core.job
2014-10-28 13:12 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SchCache
2014-10-28 10:48 - 2009-07-14 04:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-10-28 10:07 - 2011-11-01 19:52 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Mozilla
2014-10-27 22:11 - 2013-05-08 19:39 - 00000000 ____D () C:\ProgramData\TEMP
2014-10-27 17:51 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2014-10-27 17:47 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-10-27 17:47 - 2009-07-14 03:34 - 00000027 _____ () C:\Windows\system32\Drivers\etc\HOSTS.MVP
2014-10-27 10:14 - 2013-11-09 10:03 - 00000000 ____D () C:\ProgramData\Oracle
2014-10-27 10:11 - 2011-06-25 18:05 - 00000000 ____D () C:\Program Files (x86)\Java
2014-10-27 10:08 - 2013-11-09 10:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-10-27 10:07 - 2014-05-23 18:10 - 00272296 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-10-27 10:07 - 2012-11-10 16:12 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-10-27 10:07 - 2012-11-10 16:12 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-10-26 22:06 - 2014-01-11 10:49 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google+ Auto Backup
2014-10-26 22:01 - 2011-06-24 15:07 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-10-26 22:01 - 2011-06-24 15:07 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-10-26 22:01 - 2011-06-24 15:07 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-26 22:00 - 2011-06-24 18:30 - 00004090 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1148584671-988621172-509042803-1000UA
2014-10-26 22:00 - 2011-06-24 18:30 - 00003694 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1148584671-988621172-509042803-1000Core
2014-10-26 21:58 - 2014-05-22 11:41 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2014-10-26 21:58 - 2013-12-11 12:23 - 00000008 __RSH () C:\Users\Admin\ntuser.pol
2014-10-26 21:58 - 2011-06-20 18:00 - 00000000 ____D () C:\Users\Admin
2014-10-26 16:16 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-10-26 12:35 - 2012-01-11 22:37 - 00000000 ____D () C:\Users\Admin\AppData\Local\Microsoft Games
2014-10-26 10:15 - 2009-07-14 04:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-10-26 10:13 - 2009-07-14 05:45 - 00407104 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-26 10:10 - 2014-05-06 21:16 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-26 01:10 - 2011-06-24 16:07 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-26 01:05 - 2013-08-15 23:54 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-26 00:58 - 2011-06-21 12:42 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-25 21:53 - 2014-01-22 18:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-10-25 21:53 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\Performance
2014-10-25 17:07 - 2011-06-29 16:23 - 00000000 ____D () C:\Users\Admin\AppData\Temp
2014-10-25 16:53 - 2012-02-13 23:08 - 00000000 ____D () C:\Windows\Minidump
2014-10-25 15:33 - 2014-05-03 09:25 - 00000000 ____D () C:\temp
2014-10-25 14:36 - 2014-07-26 15:15 - 00000000 ____D () C:\Users\Admin\AppData\Local\FunctionLogPath
2014-10-25 12:42 - 2014-05-03 23:54 - 00000000 ____D () C:\ProgramData\2b58a7cbef08f6a2
2014-10-21 23:52 - 2010-11-21 08:01 - 00000000 ____D () C:\Program Files\Windows Journal
2014-10-21 23:42 - 2014-07-10 08:14 - 00000000 ____D () C:\Users\Admin\AppData\Local\WPFBChanger
2014-10-21 23:42 - 2014-06-05 05:13 - 00000000 ____D () C:\Users\Admin\AppData\Local\f2dd4267ec6c7612b89b6123980a1fab
2014-10-21 23:42 - 2011-07-25 14:08 - 00000000 ____D () C:\Users\Admin\AppData\Local\Eastman_Kodak_Company
2014-10-21 23:42 - 2011-06-26 04:17 - 00000000 ____D () C:\Users\Admin\AppData\Local\IM
2014-10-21 23:42 - 2011-06-24 13:27 - 00000000 ____D () C:\Users\Admin\AVM_Driver
2014-10-21 23:42 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-10-21 23:41 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2014-10-21 23:40 - 2012-01-08 23:47 - 00000000 ____D () C:\Users\Admin\AppData\Local\Greyfirst
2014-10-21 23:40 - 2011-06-24 15:07 - 00000000 ____D () C:\Users\Admin\AppData\Local\Google
2014-10-21 23:39 - 2014-05-03 23:53 - 00000000 ____D () C:\Users\Admin\AppData\Local\Comodo
2014-10-20 18:23 - 2013-12-19 00:26 - 00000193 _____ () C:\Users\Admin\AppData\Roaming\WB.CFG
2014-10-20 17:55 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Public\Libraries
2014-10-20 17:04 - 2011-11-08 17:10 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\FRITZ!
2014-10-20 15:22 - 2014-06-05 06:54 - 00000000 ____D () C:\Windows\System32\Tasks\SystemSockets
2014-10-20 15:22 - 2014-06-05 06:54 - 00000000 ____D () C:\Windows\System32\Tasks\ProtectedSearch
2014-10-20 15:22 - 2014-06-05 06:54 - 00000000 ____D () C:\Windows\System32\Tasks\Browser Updater
2014-10-20 15:22 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-10-18 19:35 - 2011-11-12 14:10 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\vlc
2014-10-03 15:51 - 2012-03-31 07:17 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-10-03 15:42 - 2012-03-31 07:17 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-10-03 15:42 - 2011-06-21 17:25 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-10-03 15:40 - 2014-09-28 07:38 - 17903792 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
Files to move or delete:
====================
C:\Users\Admin\photobooksmjpb2pah~1311301458036-5ec56f16-2b51-4723-bc50-88d0d8f055d7.js
C:\Users\Admin\photocardspah~1318247042883-e61ee557-bf45-42de-aea5-909a0eba5893.js
C:\Users\Admin\ShowScript.js
Some content of TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\Quarantine.exe
C:\Users\Admin\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-10-26 16:07
==================== End Of Log ============================
|
|
31.10.2014, 08:46
| #9 |
| /// the machine /// TB-Ausbilder | Win 7 (64): Links im Browser unterstrichen; eDeals, SlamDunk Savings u.v.m. Java updaten. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Windows\System32\InteractiveOfficeWord
C:\Windows\SysWOW64\InteractiveOfficeWord
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKU\S-1-5-18\...\RunOnce: [SpUninstallDeleteDir] => rmdir /s /q "\SearchProtect"
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:25705
R2 InteractiveOfficeWord; C:\Windows\SysWOW64\InteractiveOfficeWord\InteractiveOfficeWord.exe [68096 2014-10-13] () [File not signed]
R2 serviceIEConfig; C:\Windows\SysWOW64\ieconfig_1und1_svc.exe [1053848 2014-06-05] ()
S2 0bd9c8e28672d00.exe; C:\Users\Admin\AppData\Local\910a8b731f707898fd7e649e0ad73604\0bd9c8e28672d00.exe [X]
C:\Users\Admin\AppData\Local\910a8b731f707898fd7e649e0ad73604
S1 kbavjhwt; \??\C:\Windows\system32\drivers\kbavjhwt.sys [X]
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
31.10.2014, 15:20
| #10 |
| | Win 7 (64): Links im Browser unterstrichen; eDeals, SlamDunk Savings u.v.m. IMHO ist Java aktuell. Hatte ich vor 4 Tagen aktualisiert; und lt. Java Update-Funktion ist die aktuellste Version installiert. ??? Proxy-Einstellungen immer noch vorhanden ... Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 30-10-2014
Ran by Admin at 2014-10-31 15:03:15 Run:2
Running from C:\Users\Admin\Desktop
Loaded Profile: Admin (Available profiles: Admin)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
C:\Windows\System32\InteractiveOfficeWord
C:\Windows\SysWOW64\InteractiveOfficeWord
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKU\S-1-5-18\...\RunOnce: [SpUninstallDeleteDir] => rmdir /s /q "\SearchProtect"
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:25705
R2 InteractiveOfficeWord; C:\Windows\SysWOW64\InteractiveOfficeWord\InteractiveOfficeWord.exe [68096 2014-10-13] () [File not signed]
R2 serviceIEConfig; C:\Windows\SysWOW64\ieconfig_1und1_svc.exe [1053848 2014-06-05] ()
S2 0bd9c8e28672d00.exe; C:\Users\Admin\AppData\Local\910a8b731f707898fd7e649e0ad73604\0bd9c8e28672d00.exe [X]
C:\Users\Admin\AppData\Local\910a8b731f707898fd7e649e0ad73604
S1 kbavjhwt; \??\C:\Windows\system32\drivers\kbavjhwt.sys [X]
*****************
"C:\Windows\System32\InteractiveOfficeWord" => File/Directory not found.
C:\Windows\SysWOW64\InteractiveOfficeWord => Moved successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpUninstallDeleteDir => value deleted successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
InteractiveOfficeWord => Unable to stop service
InteractiveOfficeWord => Service deleted successfully.
serviceIEConfig => Service stopped successfully.
serviceIEConfig => Service deleted successfully.
0bd9c8e28672d00.exe => Service deleted successfully.
"C:\Users\Admin\AppData\Local\910a8b731f707898fd7e649e0ad73604" => File/Directory not found.
kbavjhwt => Service deleted successfully.
The system needed a reboot.
==== End of Fixlog ====
|
|
01.11.2014, 11:39
| #11 |
| /// the machine /// TB-Ausbilder | Win 7 (64): Links im Browser unterstrichen; eDeals, SlamDunk Savings u.v.m. POste bitte nochmal ein frisches FRST Log.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
01.11.2014, 12:09
| #12 |
| | Win 7 (64): Links im Browser unterstrichen; eDeals, SlamDunk Savings u.v.m.FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-10-2014
Ran by Admin (administrator) on ADMIN-PC on 01-11-2014 12:04:27
Running from C:\Users\Admin\Desktop
Loaded Profile: Admin (Available profiles: Admin)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-
tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVM Berlin) C:\Program Files (x86)\FRITZ!DSL\IGDCTRL.EXE
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\WLanNetService.exe
(Microsoft Corporation) C:\Windows\System32\CISVC.EXE
() C:\Users\Admin\AppData\Local\ControlDefaultMotion\ControlDefaultMotion.exe
(VIA Technologies, Inc.) C:\Windows\System32\ViakaraokeSrv.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Eastman Kodak Company) C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\WLanGUI.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
() C:\Users\Admin\AppData\Local\ControlDefaultMotion\JREMemoryRemote.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or
removed. The file will not be moved.)
HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [660360 2007-
05-31] (Microsoft Corporation)
HKLM\...\Run: [EKIJ5000StatusMonitor] => C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe
[2922496 2011-06-16] (Eastman Kodak Company)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-
22] (Microsoft Corporation)
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] => C:\Windows\KHALMNPR.EXE [242192 2008-02
-29] (Logicool, Inc.)
HKLM-x32\...\Run: [AVMWlanClient] => C:\Program Files (x86)\avmwlanstick\wlangui.exe [2105344
2010-10-22] (AVM Berlin)
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [370176
2010-06-17] (shbox.de)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
[959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [EKIJ5000StatusMonitor] => C:\Windows\System32\spool\drivers
\x64\3\EKIJ5000MUI.exe
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL
Internet.lnk
ShortcutTarget: FRITZ!DSL Internet.lnk -> C:\Program Files (x86)\FRITZ!DSL\FritzDsl.exe (AVM
Berlin)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL
Startcenter.lnk
ShortcutTarget: FRITZ!DSL Startcenter.lnk -> C:\Program Files (x86)\FRITZ!DSL\StCenter.exe (AVM
Berlin)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote
2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files
(x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored
to default.)
ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:40405
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:newtab
SearchScopes: HKCU - {09038620-190C-402B-A92F-18864E6AB22F} URL =
http://go.1und1.de/suchbox/1und1suche?su={searchTerms}
SearchScopes: HKCU - {0FB3AFB5-96B1-4E17-903E-84DCA71AC24D} URL =
SearchScopes: HKCU - {5A817CF6-92D5-4DE5-AC38-82DF8A73EF28} URL =
http://go.gmx.net/br/ie9_search_web/?su={searchTerms}
SearchScopes: HKCU - {6B1D1FB7-7233-4F7C-802C-21A1DDB12754} URL =
http://go.web.de/br/ie9_search_web/?su={searchTerms}
SearchScopes: HKCU - {81CE708B-5104-4C62-B333-94B417473B29} URL =
http://go.mail.com/br/ie9_search_web/?su={searchTerms}
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files
(x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO-x32: 1und1 Konfiguration -> {17166733-40EA-4432-A85C-AE672FF0E236} -> C:\ProgramData
\1und1InternetExplorerAddon\BHOXML.dll (1&1 Mail & Media GmbH)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program
Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files
(x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: 1&&1 Internet AG Browser Configuration by mquadr.at -> {D48FF4B4-E68F-47D1-8E25-
81A0F0EEB341} -> C:\Windows\SysWow64\ieconfig_1und1.dll (mquadr.at software engineering und
consulting GmbH)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program
Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files
(x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files
(x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files
(x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
DPF: HKLM-x32 {02BCC737-B171-4746-94C9-0D8A0B2C0089}
http://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: HKLM-x32 {25C29129-E95F-4564-BFE3-000000007100}
http://www.123webseite.de/builder/pages/KvikVideo-7-1-0-0.CAB
DPF: HKLM-x32 {6A060448-60F9-11D5-A6CD-0002B31F7455}
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000}
http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4u8qrjmu.default-
1414266222116
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight
\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash
\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth
\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google
\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.5.1 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle
Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java
\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight
\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office
Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 -> C:\ProgramData
\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update
\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update
\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll
(VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll
(VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll
(Adobe Systems Inc.)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin -> C:\Users\Admin\AppData\Roaming\Mozilla
\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin -> C:\Users\Admin\AppData\Roaming\Mozilla\plugins
\npo1d.dll (Google)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\Admin\AppData\Local\Google
\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\Admin\AppData\Local\Google
\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Admin\AppData\Roaming\mozilla\plugins\npgoogletalk.dll
(Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Admin\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Edge - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles
\4u8qrjmu.default-1414266222116\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2014-10-
26]
FF HKCU\...\Firefox\Extensions: [{b5ad6039-a173-4149-9dcf-d04371526253}] - C:\Program Files
(x86)\Lyrics_Monkey\131.xpi
FF HKCU\...\Firefox\Extensions: [{354dbb0a-71d5-4e9f-9c02-6c88b9d387ba}] - C:\ProgramData
\SExtension\SExtension\{354dbb0a-71d5-4e9f-9c02-6c88b9d387ba}
Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data
\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-10-27]
CHR Extension: (Google Docs) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default
\Extensions\aohghmighlieiainnegkcijnfilokake [2014-10-27]
CHR Extension: (Google Drive) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default
\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-10-27]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Admin\AppData\Local\Google\Chrome
\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-10-27]
CHR Extension: (YouTube) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default
\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-10-27]
CHR Extension: (Google-Suche) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default
\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-10-27]
CHR Extension: (Google Tabellen) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default
\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-10-27]
CHR Extension: (AdBlock) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default
\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-10-27]
CHR Extension: (Google Wallet) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default
\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-10-27]
CHR Extension: (Google Mail) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default
\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-10-27]
CHR HKLM-x32\...\Chrome\Extension: [aaaaihhnfnbnpbhpagnmoplpcjbediml] - C:\Users\Admin\AppData
\Local\imeshmusicboxtoolbar\GC\toolbar.crx []
CHR HKLM-x32\...\Chrome\Extension: [kmmjjcoppdcpcdlonfflbdabbkhnnogm] - C:\Program Files
(x86)\Search Results Toolbar\Datamngr\chromeExtension.crx []
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file
will not be moved unless listed separately.)
R2 AVM IGD CTRL Service; C:\Program Files (x86)\FRITZ!DSL\IGDCTRL.EXE [81920 2005-11-21] (AVM
Berlin) [File not signed]
R2 AVM WLAN Connection Service; C:\Program Files (x86)\avmwlanstick\WlanNetService.exe [376832
2010-10-22] (AVM Berlin) [File not signed]
R2 ControlDefaultMotion.exe; C:\Users\Admin\AppData\Local\ControlDefaultMotion
\ControlDefaultMotion.exe [158720 2014-10-13] () [File not signed]
S3 de_serv; C:\Program Files (x86)\Common Files\AVM\de_serv.exe [315392 2005-11-21] (AVM Berlin)
[File not signed]
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft
Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft
Corporation)
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27760 2011-06-14] (VIA Technologies,
Inc.)
S2 ArchiveBackupDebug.exe; C:\Users\Admin\AppData\Local\ArchiveBackupDebug\ArchiveBackupDebug.exe
[X]
S2 DebuggerFreewareNet.exe; C:\Users\Admin\AppData\Local\DebuggerFreewareNet
\DebuggerFreewareNet.exe [X]
S2 DebugLogTrash.exe; C:\Users\Admin\AppData\Local\DebugLogTrash\DebugLogTrash.exe [X]
S2 FunctionLogPath.exe; C:\Users\Admin\AppData\Local\FunctionLogPath\FunctionLogPath.exe [X]
S2 Kodak AiO Status Monitor Service; "C:\Program Files (x86)\Kodak\AiO\StatusMonitor
\EKPrinterSDK.exe" [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file
will not be moved unless listed separately.)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2010-10-22] (AVM Berlin)
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [460800 2010-10-22] (AVM GmbH)
S3 LHidFilt; C:\Windows\System32\DRIVERS\LHidFilt.Sys [54800 2008-02-29] (Logicool, Inc.)
S3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [57360 2008-02-29] (Logicool, Inc.)
S3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [41488 2008-02-29] (Logicool, Inc.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S1 avbdsgdp; \??\C:\Windows\system32\drivers\avbdsgdp.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S3 RgFltX64; \??\C:\Users\Admin\AppData\Local\DebuggerFreewareNet\RgFltX64.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file
could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-30 11:15 - 2014-10-30 11:15 - 00000000 ____D () C:\Users\Admin\Desktop\FRST-OlderVersion
2014-10-30 10:38 - 2014-10-30 10:39 - 00854448 _____ () C:\Users\Admin\Desktop\SecurityCheck.exe
2014-10-29 12:00 - 2014-10-29 12:00 - 02347384 _____ (ESET) C:\Users\Admin\Downloads
\esetsmartinstaller_deu(1).exe
2014-10-28 15:05 - 2014-10-28 15:05 - 00000000 ____D () C:\Users\Admin\Downloads
\tweaking.com_windows_repair_aio
2014-10-28 15:04 - 2014-10-28 15:05 - 07864386 _____ () C:\Users\Admin\Downloads
\tweaking.com_windows_repair_aio.zip
2014-10-28 13:36 - 2014-10-28 13:36 - 00000770 _____ () C:\Users\Admin\Desktop\JRT.txt
2014-10-28 13:33 - 2014-10-28 13:33 - 00000000 ____D () C:\Users\Admin\AppData\Local\CheckCode
2014-10-28 13:20 - 2014-10-28 13:21 - 01706144 _____ (Thisisu) C:\Users\Admin\Desktop\JRT.exe
2014-10-28 13:17 - 2014-10-28 13:17 - 01998336 _____ () C:\Users\Admin\Desktop
\AdwCleaner_4.002.exe
2014-10-28 10:22 - 2014-10-28 10:31 - 00001164 _____ () C:\Users\Admin\Desktop\SystemLook.txt
2014-10-28 10:20 - 2014-10-28 10:20 - 00165376 _____ () C:\Users\Admin\Desktop\SystemLook_x64.exe
2014-10-27 21:47 - 2014-10-27 21:48 - 00003234 _____ () C:\Windows\System32\Tasks\SidebarExecute
2014-10-27 21:32 - 2014-10-27 21:34 - 00000000 ____D () C:\Program Files (x86)\SpywareBlaster
2014-10-27 21:32 - 2014-10-27 21:32 - 00001093 _____ () C:\Users\Public\Desktop
\SpywareBlaster.lnk
2014-10-27 21:32 - 2014-10-27 21:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start
Menu\Programs\SpywareBlaster
2014-10-27 21:32 - 2014-10-27 21:32 - 00000000 ____D () C:\ProgramData\Licenses
2014-10-27 21:23 - 2014-10-27 21:25 - 04095448 _____ (BrightFort LLC ) C:\Users\Admin\Downloads
\spywareblastersetup50.exe
2014-10-27 17:51 - 2014-10-27 17:51 - 00029549 _____ () C:\ComboFix.txt
2014-10-27 17:29 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-10-27 17:29 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-10-27 17:29 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-10-27 17:29 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-10-27 17:29 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-10-27 17:29 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-10-27 17:29 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-10-27 17:29 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-10-27 17:28 - 2014-10-27 17:51 - 00000000 ____D () C:\Qoobox
2014-10-27 17:27 - 2014-10-27 17:49 - 00000000 ____D () C:\Windows\erdnt
2014-10-27 16:50 - 2012-05-04 18:29 - 00772504 _____ (Oracle Corporation) C:\Windows
\SysWOW64\npDeployJava1.dll
2014-10-27 16:30 - 2014-10-27 16:30 - 05591695 ____R (Swearware) C:\Users\Admin\Desktop
\ComboFix.exe
2014-10-27 10:11 - 2012-05-04 18:29 - 00687504 _____ (Oracle Corporation) C:\Windows
\SysWOW64\deployJava1.dll
2014-10-27 10:08 - 2014-10-27 10:08 - 00098216 _____ (Oracle Corporation) C:\Windows
\SysWOW64\WindowsAccessBridge-32.dll
2014-10-26 18:35 - 2014-10-25 09:51 - 00008957 _____ () C:\Windows\system32\Drivers\etc\hosts -
vir
2014-10-26 18:27 - 2014-10-26 18:30 - 00005136 _____ () C:\Users\Admin\Desktop\Rkill.txt
2014-10-26 18:27 - 2014-10-26 18:27 - 01944824 _____ (Bleeping Computer, LLC) C:\Users\Admin
\Desktop\rkill.exe
2014-10-26 18:16 - 2014-10-26 18:16 - 00001796 _____ () C:\sc-cleaner.txt
2014-10-26 18:14 - 2014-10-26 18:14 - 00441592 _____ (Bleeping Computer, LLC) C:\Users\Admin
\Desktop\sc-cleaner.exe
2014-10-26 17:06 - 2014-10-26 17:06 - 00000004 _____ () C:\Users\Admin\AppData\Roaming
\appdataFr2.bin
2014-10-26 10:38 - 2014-10-26 10:38 - 02347384 _____ (ESET) C:\Users\Admin\Downloads
\esetsmartinstaller_deu.exe
2014-10-26 10:38 - 2014-10-26 10:38 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-10-25 23:08 - 2014-10-25 23:08 - 00000000 ____D () C:\Program Files (x86)\Tweaking.com -
Windows Repair
2014-10-25 21:54 - 2014-11-01 11:50 - 00001120 _____ () C:\Windows\setupact.log
2014-10-25 21:54 - 2014-10-25 21:54 - 00000000 _____ () C:\Windows\setuperr.log
2014-10-25 21:53 - 2014-10-28 13:29 - 00206268 _____ () C:\Windows\PFRO.log
2014-10-25 20:48 - 2014-10-27 09:54 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-10-25 16:57 - 2014-10-27 10:21 - 00000000 ____D () C:\Windows\pss
2014-10-25 15:52 - 2014-10-25 15:52 - 00000000 ____D () C:\Windows\ERUNT
2014-10-25 14:03 - 2014-10-07 03:54 - 00378552 _____ (Microsoft Corporation) C:\Windows
\system32\iedkcs32.dll
2014-10-25 14:03 - 2014-10-07 03:04 - 00331448 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\iedkcs32.dll
2014-10-25 14:03 - 2014-09-25 23:46 - 00365056 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\dxtmsft.dll
2014-10-25 14:03 - 2014-09-25 23:46 - 00069632 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\mshtmled.dll
2014-10-25 14:03 - 2014-09-25 23:32 - 02017280 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\inetcpl.cpl
2014-10-25 14:03 - 2014-09-19 02:56 - 02724864 _____ (Microsoft Corporation) C:\Windows
\system32\mshtml.tlb
2014-10-25 14:03 - 2014-09-19 02:55 - 00004096 _____ (Microsoft Corporation) C:\Windows
\system32\ieetwcollectorres.dll
2014-10-25 14:03 - 2014-09-19 02:44 - 17484800 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\mshtml.dll
2014-10-25 14:03 - 2014-09-19 02:39 - 00048640 _____ (Microsoft Corporation) C:\Windows
\system32\ieetwproxystub.dll
2014-10-25 14:03 - 2014-09-19 02:30 - 00033792 _____ (Microsoft Corporation) C:\Windows
\system32\iernonce.dll
2014-10-25 14:03 - 2014-09-19 02:25 - 00111616 _____ (Microsoft Corporation) C:\Windows
\system32\ieetwcollector.exe
2014-10-25 14:03 - 2014-09-19 02:14 - 02724864 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\mshtml.tlb
2014-10-25 14:03 - 2014-09-19 02:06 - 00072704 _____ (Microsoft Corporation) C:\Windows
\system32\JavaScriptCollectionAgent.dll
2014-10-25 14:03 - 2014-09-19 02:01 - 00061952 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\iesetup.dll
2014-10-25 14:03 - 2014-09-19 02:01 - 00051200 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\ieetwproxystub.dll
2014-10-25 14:03 - 2014-09-19 01:55 - 02187264 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\iertutil.dll
2014-10-25 14:03 - 2014-09-19 01:54 - 00043008 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\jsproxy.dll
2014-10-25 14:03 - 2014-09-19 01:53 - 00032768 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\iernonce.dll
2014-10-25 14:03 - 2014-09-19 01:49 - 00597504 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\jscript9diag.dll
2014-10-25 14:03 - 2014-09-19 01:42 - 00710656 _____ (Microsoft Corporation) C:\Windows
\system32\ie4uinit.exe
2014-10-25 14:03 - 2014-09-19 01:20 - 00607744 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\msfeeds.dll
2014-10-25 14:03 - 2014-09-19 01:14 - 01447936 _____ (Microsoft Corporation) C:\Windows
\system32\urlmon.dll
2014-10-25 14:03 - 2014-09-19 00:53 - 01190400 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\urlmon.dll
2014-10-25 14:02 - 2014-09-29 01:58 - 03198976 _____ (Microsoft Corporation) C:\Windows
\system32\win32k.sys
2014-10-25 14:02 - 2014-09-25 23:50 - 13619200 _____ (Microsoft Corporation) C:\Windows
\system32\ieframe.dll
2014-10-25 14:02 - 2014-09-25 23:46 - 00243200 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\dxtrans.dll
2014-10-25 14:02 - 2014-09-25 23:43 - 11807232 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\ieframe.dll
2014-10-25 14:02 - 2014-09-25 23:31 - 02108416 _____ (Microsoft Corporation) C:\Windows
\system32\inetcpl.cpl
2014-10-25 14:02 - 2014-09-19 03:25 - 23631360 _____ (Microsoft Corporation) C:\Windows
\system32\mshtml.dll
2014-10-25 14:02 - 2014-09-19 02:41 - 02796032 _____ (Microsoft Corporation) C:\Windows
\system32\iertutil.dll
2014-10-25 14:02 - 2014-09-19 02:40 - 00547328 _____ (Microsoft Corporation) C:\Windows
\system32\vbscript.dll
2014-10-25 14:02 - 2014-09-19 02:40 - 00066048 _____ (Microsoft Corporation) C:\Windows
\system32\iesetup.dll
2014-10-25 14:02 - 2014-09-19 02:38 - 00083968 _____ (Microsoft Corporation) C:\Windows
\system32\MshtmlDac.dll
2014-10-25 14:02 - 2014-09-19 02:36 - 05829632 _____ (Microsoft Corporation) C:\Windows
\system32\jscript9.dll
2014-10-25 14:02 - 2014-09-19 02:31 - 00051200 _____ (Microsoft Corporation) C:\Windows
\system32\jsproxy.dll
2014-10-25 14:02 - 2014-09-19 02:27 - 00595968 _____ (Microsoft Corporation) C:\Windows
\system32\ieui.dll
2014-10-25 14:02 - 2014-09-19 02:26 - 00139264 _____ (Microsoft Corporation) C:\Windows
\system32\ieUnatt.exe
2014-10-25 14:02 - 2014-09-19 02:25 - 04201472 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\jscript9.dll
2014-10-25 14:02 - 2014-09-19 02:25 - 00758272 _____ (Microsoft Corporation) C:\Windows
\system32\jscript9diag.dll
2014-10-25 14:02 - 2014-09-19 02:18 - 00940032 _____ (Microsoft Corporation) C:\Windows
\system32\MsSpellCheckingFacility.exe
2014-10-25 14:02 - 2014-09-19 02:14 - 00446464 _____ (Microsoft Corporation) C:\Windows
\system32\dxtmsft.dll
2014-10-25 14:02 - 2014-09-19 02:02 - 00454656 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\vbscript.dll
2014-10-25 14:02 - 2014-09-19 02:01 - 00195584 _____ (Microsoft Corporation) C:\Windows
\system32\msrating.dll
2014-10-25 14:02 - 2014-09-19 02:00 - 00085504 _____ (Microsoft Corporation) C:\Windows
\system32\mshtmled.dll
2014-10-25 14:02 - 2014-09-19 01:59 - 00061952 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\MshtmlDac.dll
2014-10-25 14:02 - 2014-09-19 01:58 - 00289280 _____ (Microsoft Corporation) C:\Windows
\system32\dxtrans.dll
2014-10-25 14:02 - 2014-09-19 01:51 - 00440320 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\ieui.dll
2014-10-25 14:02 - 2014-09-19 01:50 - 00112128 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\ieUnatt.exe
2014-10-25 14:02 - 2014-09-19 01:42 - 00731136 _____ (Microsoft Corporation) C:\Windows
\system32\msfeeds.dll
2014-10-25 14:02 - 2014-09-19 01:40 - 01249280 _____ (Microsoft Corporation) C:\Windows
\system32\mshtmlmedia.dll
2014-10-25 14:02 - 2014-09-19 01:36 - 00060416 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\JavaScriptCollectionAgent.dll
2014-10-25 14:02 - 2014-09-19 01:33 - 02309632 _____ (Microsoft Corporation) C:\Windows
\system32\wininet.dll
2014-10-25 14:02 - 2014-09-19 01:32 - 00164864 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\msrating.dll
2014-10-25 14:02 - 2014-09-19 01:18 - 01068032 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\mshtmlmedia.dll
2014-10-25 14:02 - 2014-09-19 00:59 - 01810944 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\wininet.dll
2014-10-25 14:02 - 2014-09-19 00:59 - 00775168 _____ (Microsoft Corporation) C:\Windows
\system32\ieapfltr.dll
2014-10-25 14:02 - 2014-09-19 00:52 - 00678400 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\ieapfltr.dll
2014-10-25 14:02 - 2014-06-18 23:23 - 01943696 _____ (Microsoft Corporation) C:\Windows
\system32\dfshim.dll
2014-10-25 14:02 - 2014-06-18 23:23 - 01131664 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\dfshim.dll
2014-10-25 14:02 - 2014-06-18 23:23 - 00156824 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\mscorier.dll
2014-10-25 14:02 - 2014-06-18 23:23 - 00156312 _____ (Microsoft Corporation) C:\Windows
\system32\mscorier.dll
2014-10-25 14:02 - 2014-06-18 23:23 - 00081560 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\mscories.dll
2014-10-25 14:02 - 2014-06-18 23:23 - 00073880 _____ (Microsoft Corporation) C:\Windows
\system32\mscories.dll
2014-10-25 14:01 - 2014-10-10 03:05 - 00507392 _____ (Microsoft Corporation) C:\Windows
\system32\aepdu.dll
2014-10-25 14:01 - 2014-10-10 03:05 - 00276480 _____ (Microsoft Corporation) C:\Windows
\system32\generaltel.dll
2014-10-25 14:01 - 2014-10-10 03:00 - 00424448 _____ (Microsoft Corporation) C:\Windows
\system32\aeinv.dll
2014-10-25 14:01 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows
\system32\KBDYAK.DLL
2014-10-25 14:01 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows
\system32\KBDTAT.DLL
2014-10-25 14:01 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows
\system32\KBDRU1.DLL
2014-10-25 14:01 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows
\system32\KBDBASH.DLL
2014-10-25 14:01 - 2014-07-09 03:03 - 00006656 _____ (Microsoft Corporation) C:\Windows
\system32\KBDRU.DLL
2014-10-25 14:01 - 2014-07-09 02:31 - 00007168 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\KBDYAK.DLL
2014-10-25 14:01 - 2014-07-09 02:31 - 00007168 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\KBDTAT.DLL
2014-10-25 14:01 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\KBDRU1.DLL
2014-10-25 14:01 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\KBDRU.DLL
2014-10-25 14:01 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\KBDBASH.DLL
2014-10-25 14:01 - 2014-07-08 23:38 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-10-25 14:01 - 2014-07-08 23:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-10-25 13:56 - 2014-09-25 03:08 - 00371712 _____ (Microsoft Corporation) C:\Windows
\system32\qdvd.dll
2014-10-25 13:56 - 2014-09-25 02:40 - 00519680 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\qdvd.dll
2014-10-25 13:49 - 2014-09-18 03:00 - 03241472 _____ (Microsoft Corporation) C:\Windows
\system32\msi.dll
2014-10-25 13:49 - 2014-09-18 02:32 - 02363904 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\msi.dll
2014-10-25 13:48 - 2014-08-29 03:07 - 05780480 _____ (Microsoft Corporation) C:\Windows
\system32\mstscax.dll
2014-10-25 13:48 - 2014-08-29 03:07 - 03179520 _____ (Microsoft Corporation) C:\Windows
\system32\rdpcorets.dll
2014-10-25 13:48 - 2014-08-29 03:07 - 00322560 _____ (Microsoft Corporation) C:\Windows
\system32\aaclient.dll
2014-10-25 13:48 - 2014-08-29 03:07 - 00044032 _____ (Microsoft Corporation) C:\Windows
\system32\tsgqec.dll
2014-10-25 13:48 - 2014-08-29 03:06 - 01125888 _____ (Microsoft Corporation) C:\Windows
\system32\mstsc.exe
2014-10-25 13:48 - 2014-08-29 02:44 - 04922368 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\mstscax.dll
2014-10-25 13:48 - 2014-08-29 02:44 - 01050112 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\mstsc.exe
2014-10-25 13:48 - 2014-08-29 02:44 - 00269312 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\aaclient.dll
2014-10-25 13:48 - 2014-08-29 02:44 - 00037376 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\tsgqec.dll
2014-10-25 13:45 - 2014-09-04 06:23 - 00424448 _____ (Microsoft Corporation) C:\Windows
\system32\rastls.dll
2014-10-25 13:45 - 2014-09-04 06:04 - 00372736 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\rastls.dll
2014-10-25 13:45 - 2014-07-17 03:07 - 00681984 _____ (Microsoft Corporation) C:\Windows
\system32\termsrv.dll
2014-10-25 13:45 - 2014-07-17 03:07 - 00455168 _____ (Microsoft Corporation) C:\Windows
\system32\winlogon.exe
2014-10-25 13:45 - 2014-07-17 03:07 - 00235520 _____ (Microsoft Corporation) C:\Windows
\system32\winsta.dll
2014-10-25 13:45 - 2014-07-17 03:07 - 00150528 _____ (Microsoft Corporation) C:\Windows
\system32\rdpcorekmts.dll
2014-10-25 13:45 - 2014-07-17 03:07 - 00086528 _____ (Microsoft Corporation) C:\Windows
\system32\TSpkg.dll
2014-10-25 13:45 - 2014-07-17 03:07 - 00022016 _____ (Microsoft Corporation) C:\Windows
\system32\credssp.dll
2014-10-25 13:45 - 2014-07-17 02:40 - 00157696 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\winsta.dll
2014-10-25 13:45 - 2014-07-17 02:39 - 00065536 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\TSpkg.dll
2014-10-25 13:45 - 2014-07-17 02:39 - 00017408 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\credssp.dll
2014-10-25 13:45 - 2014-07-17 02:21 - 00212480 _____ (Microsoft Corporation) C:\Windows
\system32\Drivers\rdpwd.sys
2014-10-25 13:45 - 2014-07-17 02:21 - 00039936 _____ (Microsoft Corporation) C:\Windows
\system32\Drivers\tssecsrv.sys
2014-10-25 13:42 - 2014-09-13 02:58 - 00077312 _____ (Microsoft Corporation) C:\Windows
\system32\packager.dll
2014-10-25 13:42 - 2014-09-13 02:40 - 00067072 _____ (Microsoft Corporation) C:\Windows
\SysWOW64\packager.dll
2014-10-25 13:07 - 2014-10-28 12:47 - 00129752 _____ (Malwarebytes Corporation) C:\Windows
\system32\Drivers\MBAMSwissArmy.sys
2014-10-25 13:07 - 2014-10-25 13:07 - 00001116 _____ () C:\Users\Public\Desktop\Malwarebytes
Anti-Malware.lnk
2014-10-25 13:07 - 2014-10-25 13:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start
Menu\Programs\ Malwarebytes Anti-Malware
2014-10-25 13:07 - 2014-10-25 13:07 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-10-25 13:07 - 2014-10-25 13:07 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes
Anti-Malware
2014-10-25 13:07 - 2014-10-01 10:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows
\system32\Drivers\mbamchameleon.sys
2014-10-25 13:07 - 2014-10-01 10:11 - 00063704 _____ (Malwarebytes Corporation) C:\Windows
\system32\Drivers\mwac.sys
2014-10-25 13:07 - 2014-10-01 10:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows
\system32\Drivers\mbam.sys
2014-10-25 12:39 - 2014-10-25 12:39 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Admin
\Downloads\revosetup.exe
2014-10-25 12:39 - 2014-10-25 12:39 - 00001224 _____ () C:\Users\Admin\Desktop\Revo
Uninstaller.lnk
2014-10-25 12:39 - 2014-10-25 12:39 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-10-25 12:01 - 2014-10-25 12:01 - 00002772 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-10-25 11:42 - 2014-10-28 13:28 - 00000000 ____D () C:\AdwCleaner
2014-10-25 11:39 - 2014-10-26 20:52 - 00035083 _____ () C:\Users\Admin\Desktop\Addition.txt
2014-10-25 11:37 - 2014-11-01 12:04 - 00016226 _____ () C:\Users\Admin\Desktop\FRST.txt
2014-10-25 11:37 - 2014-11-01 12:04 - 00000000 ____D () C:\FRST
2014-10-25 11:07 - 2014-10-30 11:15 - 02113536 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe
2014-10-25 11:06 - 2014-10-25 11:07 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\Admin
\Downloads\mbam-setup-2.0.3.1025.exe
2014-10-25 11:05 - 2014-10-25 11:05 - 00709564 _____ () C:\Users\Admin\Desktop\delfix_10.8.exe
2014-10-25 11:03 - 2014-10-25 11:03 - 00448512 _____ (OldTimer Tools) C:\Users\Admin\Desktop
\TFC.exe
2014-10-25 10:49 - 2014-10-31 15:13 - 00000000 ____D () C:\Users\Admin\Desktop\Wartung
2014-10-25 10:46 - 2014-10-25 10:46 - 00000822 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-10-25 10:46 - 2014-10-25 10:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start
Menu\Programs\CCleaner
2014-10-25 10:46 - 2014-10-25 10:46 - 00000000 ____D () C:\Program Files\CCleaner
2014-10-25 10:45 - 2014-10-25 10:46 - 04974864 _____ (Piriform Ltd) C:\Users\Admin\Downloads
\ccsetup419.exe
2014-10-18 22:18 - 2014-10-28 13:10 - 00000000 ____D () C:\Users\Admin\AppData\Local
\ControlDefaultMotion
2014-10-18 16:09 - 2014-10-18 16:09 - 00000000 ____D () C:\found.000
2014-10-17 22:21 - 2014-10-17 22:21 - 00000000 ___HD () C:\Users\Admin\AppData\Roaming\GoldenGate
2014-10-17 22:18 - 2014-10-17 22:18 - 00000171 _____ () C:\Users\Admin\AppData\Roaming\Microsoft
\Windows\Start Menu\Programs\Play Games Online.url
2014-10-17 22:17 - 2014-10-17 22:17 - 00001771 _____ () C:\Users\Admin\AppData\Roaming\Microsoft
\Windows\Start Menu\Programs\Gameo.lnk
2014-10-17 17:06 - 2014-10-17 17:06 - 00000000 ____D () C:\Users\Admin\{01662059-3E
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-11-01 12:05 - 2011-06-24 18:30 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1
-5-21-1148584671-988621172-509042803-1000UA.job
2014-11-01 11:59 - 2009-07-14 05:45 - 00031680 ____H () C:\Windows\system32\7B296FB0-376B-497e-
B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-01 11:59 - 2009-07-14 05:45 - 00031680 ____H () C:\Windows\system32\7B296FB0-376B-497e-
B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-01 11:56 - 2011-06-20 23:49 - 01221613 _____ () C:\Windows\WindowsUpdate.log
2014-11-01 11:56 - 2010-11-21 07:50 - 00702598 _____ () C:\Windows\system32\perfh007.dat
2014-11-01 11:56 - 2010-11-21 07:50 - 00151390 _____ () C:\Windows\system32\perfc007.dat
2014-11-01 11:56 - 2009-07-14 06:13 - 01630758 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-01 11:50 - 2011-06-24 15:07 - 00001106 _____ () C:\Windows\Tasks
\GoogleUpdateTaskMachineCore.job
2014-11-01 11:50 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-31 19:45 - 2011-09-13 20:56 - 00000338 _____ () C:\Windows\Tasks\HP Photo Creations
Communicator.job
2014-10-31 19:36 - 2012-03-31 07:17 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player
Updater.job
2014-10-31 14:43 - 2011-06-24 17:20 - 00003930 _____ () C:\Windows\System32\Tasks
\User_Feed_Synchronization-{C6295D87-0223-4913-87E0-549DC15EB489}
2014-10-30 12:25 - 2010-11-21 04:27 - 00275080 ____N (Microsoft Corporation) C:\Windows
\system32\MpSigStub.exe
2014-10-28 22:05 - 2011-06-24 18:30 - 00001068 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1
-5-21-1148584671-988621172-509042803-1000Core.job
2014-10-28 13:12 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SchCache
2014-10-28 10:48 - 2009-07-14 04:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-10-28 10:07 - 2011-11-01 19:52 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Mozilla
2014-10-27 22:11 - 2013-05-08 19:39 - 00000000 ____D () C:\ProgramData\TEMP
2014-10-27 17:51 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2014-10-27 17:47 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-10-27 17:47 - 2009-07-14 03:34 - 00000027 _____ () C:\Windows\system32\Drivers\etc\HOSTS.MVP
2014-10-27 10:14 - 2013-11-09 10:03 - 00000000 ____D () C:\ProgramData\Oracle
2014-10-27 10:11 - 2011-06-25 18:05 - 00000000 ____D () C:\Program Files (x86)\Java
2014-10-27 10:08 - 2013-11-09 10:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start
Menu\Programs\Java
2014-10-27 10:07 - 2014-05-23 18:10 - 00272296 _____ (Oracle Corporation) C:\Windows
\SysWOW64\javaws.exe
2014-10-27 10:07 - 2012-11-10 16:12 - 00176552 _____ (Oracle Corporation) C:\Windows
\SysWOW64\javaw.exe
2014-10-27 10:07 - 2012-11-10 16:12 - 00176552 _____ (Oracle Corporation) C:\Windows
\SysWOW64\java.exe
2014-10-26 22:06 - 2014-01-11 10:49 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Microsoft
\Windows\Start Menu\Programs\Google+ Auto Backup
2014-10-26 22:01 - 2011-06-24 15:07 - 00004106 _____ () C:\Windows\System32\Tasks
\GoogleUpdateTaskMachineUA
2014-10-26 22:01 - 2011-06-24 15:07 - 00003854 _____ () C:\Windows\System32\Tasks
\GoogleUpdateTaskMachineCore
2014-10-26 22:01 - 2011-06-24 15:07 - 00001110 _____ () C:\Windows\Tasks
\GoogleUpdateTaskMachineUA.job
2014-10-26 22:00 - 2011-06-24 18:30 - 00004090 _____ () C:\Windows\System32\Tasks
\GoogleUpdateTaskUserS-1-5-21-1148584671-988621172-509042803-1000UA
2014-10-26 22:00 - 2011-06-24 18:30 - 00003694 _____ () C:\Windows\System32\Tasks
\GoogleUpdateTaskUserS-1-5-21-1148584671-988621172-509042803-1000Core
2014-10-26 21:58 - 2014-05-22 11:41 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2014-10-26 21:58 - 2013-12-11 12:23 - 00000008 __RSH () C:\Users\Admin\ntuser.pol
2014-10-26 21:58 - 2011-06-20 18:00 - 00000000 ____D () C:\Users\Admin
2014-10-26 16:16 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-10-26 12:35 - 2012-01-11 22:37 - 00000000 ____D () C:\Users\Admin\AppData\Local\Microsoft
Games
2014-10-26 10:15 - 2009-07-14 04:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start
Menu\Programs\Accessories
2014-10-26 10:13 - 2009-07-14 05:45 - 00407104 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-26 10:10 - 2014-05-06 21:16 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-26 01:10 - 2011-06-24 16:07 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-26 01:05 - 2013-08-15 23:54 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-26 00:58 - 2011-06-21 12:42 - 103265616 _____ (Microsoft Corporation) C:\Windows
\system32\MRT.exe
2014-10-25 21:53 - 2014-01-22 18:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla
Maintenance Service
2014-10-25 21:53 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\Performance
2014-10-25 17:07 - 2011-06-29 16:23 - 00000000 ____D () C:\Users\Admin\AppData\Temp
2014-10-25 16:53 - 2012-02-13 23:08 - 00000000 ____D () C:\Windows\Minidump
2014-10-25 15:33 - 2014-05-03 09:25 - 00000000 ____D () C:\temp
2014-10-25 14:36 - 2014-07-26 15:15 - 00000000 ____D () C:\Users\Admin\AppData\Local
\FunctionLogPath
2014-10-25 12:42 - 2014-05-03 23:54 - 00000000 ____D () C:\ProgramData\2b58a7cbef08f6a2
2014-10-21 23:52 - 2010-11-21 08:01 - 00000000 ____D () C:\Program Files\Windows Journal
2014-10-21 23:42 - 2014-07-10 08:14 - 00000000 ____D () C:\Users\Admin\AppData\Local\WPFBChanger
2014-10-21 23:42 - 2014-06-05 05:13 - 00000000 ____D () C:\Users\Admin\AppData\Local
\f2dd4267ec6c7612b89b6123980a1fab
2014-10-21 23:42 - 2011-07-25 14:08 - 00000000 ____D () C:\Users\Admin\AppData\Local
\Eastman_Kodak_Company
2014-10-21 23:42 - 2011-06-26 04:17 - 00000000 ____D () C:\Users\Admin\AppData\Local\IM
2014-10-21 23:42 - 2011-06-24 13:27 - 00000000 ____D () C:\Users\Admin\AVM_Driver
2014-10-21 23:42 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft
Shared
2014-10-21 23:41 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2014-10-21 23:40 - 2012-01-08 23:47 - 00000000 ____D () C:\Users\Admin\AppData\Local\Greyfirst
2014-10-21 23:40 - 2011-06-24 15:07 - 00000000 ____D () C:\Users\Admin\AppData\Local\Google
2014-10-21 23:39 - 2014-05-03 23:53 - 00000000 ____D () C:\Users\Admin\AppData\Local\Comodo
2014-10-20 18:23 - 2013-12-19 00:26 - 00000193 _____ () C:\Users\Admin\AppData\Roaming\WB.CFG
2014-10-20 17:55 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Public\Libraries
2014-10-20 17:04 - 2011-11-08 17:10 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\FRITZ!
2014-10-20 15:22 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-10-18 19:35 - 2011-11-12 14:10 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\vlc
2014-10-03 15:51 - 2012-03-31 07:17 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash
Player Updater
2014-10-03 15:42 - 2012-03-31 07:17 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows
\SysWOW64\FlashPlayerApp.exe
2014-10-03 15:42 - 2011-06-21 17:25 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows
\SysWOW64\FlashPlayerCPLApp.cpl
2014-10-03 15:40 - 2014-09-28 07:38 - 17903792 _____ (Adobe Systems Incorporated) C:\Windows
\SysWOW64\FlashPlayerInstaller.exe
Files to move or delete:
====================
C:\Users\Admin\photobooksmjpb2pah~1311301458036-5ec56f16-2b51-4723-bc50-88d0d8f055d7.js
C:\Users\Admin\photocardspah~1318247042883-e61ee557-bf45-42de-aea5-909a0eba5893.js
C:\Users\Admin\ShowScript.js
Some content of TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\Quarantine.exe
C:\Users\Admin\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-10-26 16:07
==================== End Of Log ============================
|
|
01.11.2014, 20:33
| #13 |
| /// the machine /// TB-Ausbilder | Win 7 (64): Links im Browser unterstrichen; eDeals, SlamDunk Savings u.v.m. Kannst du bitte mal das WordWrap ändern im Editor und das Log neu posten. Mit den Zeilenumbrüchen ist das Log nicht lesbar.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
01.11.2014, 20:57
| #14 |
| | Win 7 (64): Links im Browser unterstrichen; eDeals, SlamDunk Savings u.v.m. Entschuldigung ... FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-10-2014
Ran by Admin (administrator) on ADMIN-PC on 01-11-2014 12:04:27
Running from C:\Users\Admin\Desktop
Loaded Profile: Admin (Available profiles: Admin)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVM Berlin) C:\Program Files (x86)\FRITZ!DSL\IGDCTRL.EXE
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\WLanNetService.exe
(Microsoft Corporation) C:\Windows\System32\CISVC.EXE
(VIA Technologies, Inc.) C:\Windows\System32\ViakaraokeSrv.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Eastman Kodak Company) C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\WLanGUI.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [EKIJ5000StatusMonitor] => C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe [2922496 2011-06-16] (Eastman Kodak Company)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] => C:\Windows\KHALMNPR.EXE [242192 2008-02-29] (Logicool, Inc.)
HKLM-x32\...\Run: [AVMWlanClient] => C:\Program Files (x86)\avmwlanstick\wlangui.exe [2105344 2010-10-22] (AVM Berlin)
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [370176 2010-06-17] (shbox.de)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [EKIJ5000StatusMonitor] => C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Internet.lnk
ShortcutTarget: FRITZ!DSL Internet.lnk -> C:\Program Files (x86)\FRITZ!DSL\FritzDsl.exe (AVM Berlin)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Startcenter.lnk
ShortcutTarget: FRITZ!DSL Startcenter.lnk -> C:\Program Files (x86)\FRITZ!DSL\StCenter.exe (AVM Berlin)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:40405
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:newtab
SearchScopes: HKCU - {09038620-190C-402B-A92F-18864E6AB22F} URL = http://go.1und1.de/suchbox/1und1suche?su={searchTerms}
SearchScopes: HKCU - {0FB3AFB5-96B1-4E17-903E-84DCA71AC24D} URL =
SearchScopes: HKCU - {5A817CF6-92D5-4DE5-AC38-82DF8A73EF28} URL = http://go.gmx.net/br/ie9_search_web/?su={searchTerms}
SearchScopes: HKCU - {6B1D1FB7-7233-4F7C-802C-21A1DDB12754} URL = http://go.web.de/br/ie9_search_web/?su={searchTerms}
SearchScopes: HKCU - {81CE708B-5104-4C62-B333-94B417473B29} URL = http://go.mail.com/br/ie9_search_web/?su={searchTerms}
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO-x32: 1und1 Konfiguration -> {17166733-40EA-4432-A85C-AE672FF0E236} -> C:\ProgramData\1und1InternetExplorerAddon\BHOXML.dll (1&1 Mail & Media GmbH)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: 1&&1 Internet AG Browser Configuration by mquadr.at -> {D48FF4B4-E68F-47D1-8E25-81A0F0EEB341} -> C:\Windows\SysWow64\ieconfig_1und1.dll (mquadr.at software engineering und consulting GmbH)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
DPF: HKLM-x32 {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: HKLM-x32 {25C29129-E95F-4564-BFE3-000000007100} http://www.123webseite.de/builder/pages/KvikVideo-7-1-0-0.CAB
DPF: HKLM-x32 {6A060448-60F9-11D5-A6CD-0002B31F7455}
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4u8qrjmu.default-1414266222116
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.5.1 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 -> C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin -> C:\Users\Admin\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin -> C:\Users\Admin\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\Admin\AppData\Local\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\Admin\AppData\Local\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Admin\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Admin\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Edge - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4u8qrjmu.default-1414266222116\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2014-10-26]
FF HKCU\...\Firefox\Extensions: [{b5ad6039-a173-4149-9dcf-d04371526253}] - C:\Program Files (x86)\Lyrics_Monkey\131.xpi
FF HKCU\...\Firefox\Extensions: [{354dbb0a-71d5-4e9f-9c02-6c88b9d387ba}] - C:\ProgramData\SExtension\SExtension\{354dbb0a-71d5-4e9f-9c02-6c88b9d387ba}
Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-10-27]
CHR Extension: (Google Docs) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-10-27]
CHR Extension: (Google Drive) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-10-27]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-10-27]
CHR Extension: (YouTube) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-10-27]
CHR Extension: (Google-Suche) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-10-27]
CHR Extension: (Google Tabellen) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-10-27]
CHR Extension: (AdBlock) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-10-27]
CHR Extension: (Google Wallet) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-10-27]
CHR Extension: (Google Mail) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-10-27]
CHR HKLM-x32\...\Chrome\Extension: [aaaaihhnfnbnpbhpagnmoplpcjbediml] - C:\Users\Admin\AppData\Local\imeshmusicboxtoolbar\GC\toolbar.crx []
CHR HKLM-x32\...\Chrome\Extension: [kmmjjcoppdcpcdlonfflbdabbkhnnogm] - C:\Program Files (x86)\Search Results Toolbar\Datamngr\chromeExtension.crx []
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AVM IGD CTRL Service; C:\Program Files (x86)\FRITZ!DSL\IGDCTRL.EXE [81920 2005-11-21] (AVM Berlin) [File not signed]
R2 AVM WLAN Connection Service; C:\Program Files (x86)\avmwlanstick\WlanNetService.exe [376832 2010-10-22] (AVM Berlin) [File not signed]
S3 de_serv; C:\Program Files (x86)\Common Files\AVM\de_serv.exe [315392 2005-11-21] (AVM Berlin) [File not signed]
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27760 2011-06-14] (VIA Technologies, Inc.)
S2 ArchiveBackupDebug.exe; C:\Users\Admin\AppData\Local\ArchiveBackupDebug\ArchiveBackupDebug.exe [X]
S2 DebuggerFreewareNet.exe; C:\Users\Admin\AppData\Local\DebuggerFreewareNet\DebuggerFreewareNet.exe [X]
S2 DebugLogTrash.exe; C:\Users\Admin\AppData\Local\DebugLogTrash\DebugLogTrash.exe [X]
S2 FunctionLogPath.exe; C:\Users\Admin\AppData\Local\FunctionLogPath\FunctionLogPath.exe [X]
S2 Kodak AiO Status Monitor Service; "C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe" [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2010-10-22] (AVM Berlin)
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [460800 2010-10-22] (AVM GmbH)
S3 LHidFilt; C:\Windows\System32\DRIVERS\LHidFilt.Sys [54800 2008-02-29] (Logicool, Inc.)
S3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [57360 2008-02-29] (Logicool, Inc.)
S3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [41488 2008-02-29] (Logicool, Inc.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S1 avbdsgdp; \??\C:\Windows\system32\drivers\avbdsgdp.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S3 RgFltX64; \??\C:\Users\Admin\AppData\Local\DebuggerFreewareNet\RgFltX64.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-30 11:15 - 2014-10-30 11:15 - 00000000 ____D () C:\Users\Admin\Desktop\FRST-OlderVersion
2014-10-30 10:38 - 2014-10-30 10:39 - 00854448 _____ () C:\Users\Admin\Desktop\SecurityCheck.exe
2014-10-29 12:00 - 2014-10-29 12:00 - 02347384 _____ (ESET) C:\Users\Admin\Downloads\esetsmartinstaller_deu(1).exe
2014-10-28 15:05 - 2014-10-28 15:05 - 00000000 ____D () C:\Users\Admin\Downloads\tweaking.com_windows_repair_aio
2014-10-28 15:04 - 2014-10-28 15:05 - 07864386 _____ () C:\Users\Admin\Downloads\tweaking.com_windows_repair_aio.zip
2014-10-28 13:36 - 2014-10-28 13:36 - 00000770 _____ () C:\Users\Admin\Desktop\JRT.txt
2014-10-28 13:33 - 2014-10-28 13:33 - 00000000 ____D () C:\Users\Admin\AppData\Local\CheckCode
2014-10-28 13:20 - 2014-10-28 13:21 - 01706144 _____ (Thisisu) C:\Users\Admin\Desktop\JRT.exe
2014-10-28 13:17 - 2014-10-28 13:17 - 01998336 _____ () C:\Users\Admin\Desktop\AdwCleaner_4.002.exe
2014-10-28 10:22 - 2014-10-28 10:31 - 00001164 _____ () C:\Users\Admin\Desktop\SystemLook.txt
2014-10-28 10:20 - 2014-10-28 10:20 - 00165376 _____ () C:\Users\Admin\Desktop\SystemLook_x64.exe
2014-10-27 21:47 - 2014-10-27 21:48 - 00003234 _____ () C:\Windows\System32\Tasks\SidebarExecute
2014-10-27 21:32 - 2014-10-27 21:34 - 00000000 ____D () C:\Program Files (x86)\SpywareBlaster
2014-10-27 21:32 - 2014-10-27 21:32 - 00001093 _____ () C:\Users\Public\Desktop\SpywareBlaster.lnk
2014-10-27 21:32 - 2014-10-27 21:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
2014-10-27 21:32 - 2014-10-27 21:32 - 00000000 ____D () C:\ProgramData\Licenses
2014-10-27 21:23 - 2014-10-27 21:25 - 04095448 _____ (BrightFort LLC ) C:\Users\Admin\Downloads\spywareblastersetup50.exe
2014-10-27 17:51 - 2014-10-27 17:51 - 00029549 _____ () C:\ComboFix.txt
2014-10-27 17:29 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-10-27 17:29 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-10-27 17:29 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-10-27 17:29 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-10-27 17:29 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-10-27 17:29 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-10-27 17:29 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-10-27 17:29 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-10-27 17:28 - 2014-10-27 17:51 - 00000000 ____D () C:\Qoobox
2014-10-27 17:27 - 2014-10-27 17:49 - 00000000 ____D () C:\Windows\erdnt
2014-10-27 16:50 - 2012-05-04 18:29 - 00772504 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2014-10-27 16:30 - 2014-10-27 16:30 - 05591695 ____R (Swearware) C:\Users\Admin\Desktop\ComboFix.exe
2014-10-27 10:11 - 2012-05-04 18:29 - 00687504 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2014-10-27 10:08 - 2014-10-27 10:08 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-10-26 18:35 - 2014-10-25 09:51 - 00008957 _____ () C:\Windows\system32\Drivers\etc\hosts - vir
2014-10-26 18:27 - 2014-10-26 18:30 - 00005136 _____ () C:\Users\Admin\Desktop\Rkill.txt
2014-10-26 18:27 - 2014-10-26 18:27 - 01944824 _____ (Bleeping Computer, LLC) C:\Users\Admin\Desktop\rkill.exe
2014-10-26 18:16 - 2014-10-26 18:16 - 00001796 _____ () C:\sc-cleaner.txt
2014-10-26 18:14 - 2014-10-26 18:14 - 00441592 _____ (Bleeping Computer, LLC) C:\Users\Admin\Desktop\sc-cleaner.exe
2014-10-26 17:06 - 2014-10-26 17:06 - 00000004 _____ () C:\Users\Admin\AppData\Roaming\appdataFr2.bin
2014-10-26 10:38 - 2014-10-26 10:38 - 02347384 _____ (ESET) C:\Users\Admin\Downloads\esetsmartinstaller_deu.exe
2014-10-26 10:38 - 2014-10-26 10:38 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-10-25 23:08 - 2014-10-25 23:08 - 00000000 ____D () C:\Program Files (x86)\Tweaking.com - Windows Repair
2014-10-25 21:54 - 2014-11-01 11:50 - 00001120 _____ () C:\Windows\setupact.log
2014-10-25 21:54 - 2014-10-25 21:54 - 00000000 _____ () C:\Windows\setuperr.log
2014-10-25 21:53 - 2014-10-28 13:29 - 00206268 _____ () C:\Windows\PFRO.log
2014-10-25 20:48 - 2014-10-27 09:54 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-10-25 16:57 - 2014-10-27 10:21 - 00000000 ____D () C:\Windows\pss
2014-10-25 15:52 - 2014-10-25 15:52 - 00000000 ____D () C:\Windows\ERUNT
2014-10-25 14:03 - 2014-10-07 03:54 - 00378552 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-25 14:03 - 2014-10-07 03:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-10-25 14:03 - 2014-09-25 23:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-10-25 14:03 - 2014-09-25 23:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-10-25 14:03 - 2014-09-25 23:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-10-25 14:03 - 2014-09-19 02:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-25 14:03 - 2014-09-19 02:55 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-10-25 14:03 - 2014-09-19 02:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-10-25 14:03 - 2014-09-19 02:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-10-25 14:03 - 2014-09-19 02:30 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-25 14:03 - 2014-09-19 02:25 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-10-25 14:03 - 2014-09-19 02:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-10-25 14:03 - 2014-09-19 02:06 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-25 14:03 - 2014-09-19 02:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-10-25 14:03 - 2014-09-19 02:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-10-25 14:03 - 2014-09-19 01:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-10-25 14:03 - 2014-09-19 01:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-10-25 14:03 - 2014-09-19 01:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-10-25 14:03 - 2014-09-19 01:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-10-25 14:03 - 2014-09-19 01:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-25 14:03 - 2014-09-19 01:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-10-25 14:03 - 2014-09-19 01:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-25 14:03 - 2014-09-19 00:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-10-25 14:02 - 2014-09-29 01:58 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-25 14:02 - 2014-09-25 23:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-25 14:02 - 2014-09-25 23:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-10-25 14:02 - 2014-09-25 23:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-10-25 14:02 - 2014-09-25 23:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-25 14:02 - 2014-09-19 03:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-25 14:02 - 2014-09-19 02:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-25 14:02 - 2014-09-19 02:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-25 14:02 - 2014-09-19 02:40 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-25 14:02 - 2014-09-19 02:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-25 14:02 - 2014-09-19 02:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-25 14:02 - 2014-09-19 02:31 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-25 14:02 - 2014-09-19 02:27 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-25 14:02 - 2014-09-19 02:26 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-25 14:02 - 2014-09-19 02:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-10-25 14:02 - 2014-09-19 02:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-25 14:02 - 2014-09-19 02:18 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-25 14:02 - 2014-09-19 02:14 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-25 14:02 - 2014-09-19 02:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-10-25 14:02 - 2014-09-19 02:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-25 14:02 - 2014-09-19 02:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-25 14:02 - 2014-09-19 01:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-10-25 14:02 - 2014-09-19 01:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-25 14:02 - 2014-09-19 01:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-10-25 14:02 - 2014-09-19 01:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-10-25 14:02 - 2014-09-19 01:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-25 14:02 - 2014-09-19 01:40 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-10-25 14:02 - 2014-09-19 01:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-10-25 14:02 - 2014-09-19 01:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-25 14:02 - 2014-09-19 01:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-10-25 14:02 - 2014-09-19 01:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-10-25 14:02 - 2014-09-19 00:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-10-25 14:02 - 2014-09-19 00:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-25 14:02 - 2014-09-19 00:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-10-25 14:02 - 2014-06-18 23:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-25 14:02 - 2014-06-18 23:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2014-10-25 14:02 - 2014-06-18 23:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2014-10-25 14:02 - 2014-06-18 23:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-25 14:02 - 2014-06-18 23:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2014-10-25 14:02 - 2014-06-18 23:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-25 14:01 - 2014-10-10 03:05 - 00507392 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-25 14:01 - 2014-10-10 03:05 - 00276480 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-10-25 14:01 - 2014-10-10 03:00 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-10-25 14:01 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-10-25 14:01 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-10-25 14:01 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-10-25 14:01 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-10-25 14:01 - 2014-07-09 03:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-10-25 14:01 - 2014-07-09 02:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-10-25 14:01 - 2014-07-09 02:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-10-25 14:01 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-10-25 14:01 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-10-25 14:01 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-10-25 14:01 - 2014-07-08 23:38 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-10-25 14:01 - 2014-07-08 23:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-10-25 13:56 - 2014-09-25 03:08 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-10-25 13:56 - 2014-09-25 02:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2014-10-25 13:49 - 2014-09-18 03:00 - 03241472 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-25 13:49 - 2014-09-18 02:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-25 13:48 - 2014-08-29 03:07 - 05780480 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-25 13:48 - 2014-08-29 03:07 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-10-25 13:48 - 2014-08-29 03:07 - 00322560 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2014-10-25 13:48 - 2014-08-29 03:07 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-10-25 13:48 - 2014-08-29 03:06 - 01125888 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-10-25 13:48 - 2014-08-29 02:44 - 04922368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-25 13:48 - 2014-08-29 02:44 - 01050112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-10-25 13:48 - 2014-08-29 02:44 - 00269312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2014-10-25 13:48 - 2014-08-29 02:44 - 00037376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-10-25 13:45 - 2014-09-04 06:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-25 13:45 - 2014-09-04 06:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-25 13:45 - 2014-07-17 03:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-25 13:45 - 2014-07-17 03:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-10-25 13:45 - 2014-07-17 03:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-25 13:45 - 2014-07-17 03:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-10-25 13:45 - 2014-07-17 03:07 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-10-25 13:45 - 2014-07-17 03:07 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-10-25 13:45 - 2014-07-17 02:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
2014-10-25 13:45 - 2014-07-17 02:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-10-25 13:45 - 2014-07-17 02:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-10-25 13:45 - 2014-07-17 02:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-10-25 13:45 - 2014-07-17 02:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-10-25 13:42 - 2014-09-13 02:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-25 13:42 - 2014-09-13 02:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-25 13:07 - 2014-10-28 12:47 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-25 13:07 - 2014-10-25 13:07 - 00001116 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-25 13:07 - 2014-10-25 13:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-10-25 13:07 - 2014-10-25 13:07 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-10-25 13:07 - 2014-10-25 13:07 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-10-25 13:07 - 2014-10-01 10:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-25 13:07 - 2014-10-01 10:11 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-10-25 13:07 - 2014-10-01 10:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-10-25 12:39 - 2014-10-25 12:39 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Admin\Downloads\revosetup.exe
2014-10-25 12:39 - 2014-10-25 12:39 - 00001224 _____ () C:\Users\Admin\Desktop\Revo Uninstaller.lnk
2014-10-25 12:39 - 2014-10-25 12:39 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-10-25 12:01 - 2014-10-25 12:01 - 00002772 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-10-25 11:42 - 2014-10-28 13:28 - 00000000 ____D () C:\AdwCleaner
2014-10-25 11:39 - 2014-10-26 20:52 - 00035083 _____ () C:\Users\Admin\Desktop\Addition.txt
2014-10-25 11:37 - 2014-11-01 12:04 - 00016226 _____ () C:\Users\Admin\Desktop\FRST.txt
2014-10-25 11:37 - 2014-11-01 12:04 - 00000000 ____D () C:\FRST
2014-10-25 11:07 - 2014-10-30 11:15 - 02113536 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe
2014-10-25 11:06 - 2014-10-25 11:07 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\Admin\Downloads\mbam-setup-2.0.3.1025.exe
2014-10-25 11:05 - 2014-10-25 11:05 - 00709564 _____ () C:\Users\Admin\Desktop\delfix_10.8.exe
2014-10-25 11:03 - 2014-10-25 11:03 - 00448512 _____ (OldTimer Tools) C:\Users\Admin\Desktop\TFC.exe
2014-10-25 10:49 - 2014-10-31 15:13 - 00000000 ____D () C:\Users\Admin\Desktop\Wartung
2014-10-25 10:46 - 2014-10-25 10:46 - 00000822 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-10-25 10:46 - 2014-10-25 10:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-10-25 10:46 - 2014-10-25 10:46 - 00000000 ____D () C:\Program Files\CCleaner
2014-10-25 10:45 - 2014-10-25 10:46 - 04974864 _____ (Piriform Ltd) C:\Users\Admin\Downloads\ccsetup419.exe
2014-10-18 16:09 - 2014-10-18 16:09 - 00000000 ____D () C:\found.000
2014-10-17 22:21 - 2014-10-17 22:21 - 00000000 ___HD () C:\Users\Admin\AppData\Roaming\GoldenGate
2014-10-17 22:18 - 2014-10-17 22:18 - 00000171 _____ () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Play Games Online.url
2014-10-17 22:17 - 2014-10-17 22:17 - 00001771 _____ () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Gameo.lnk
2014-10-17 17:06 - 2014-10-17 17:06 - 00000000 ____D () C:\Users\Admin\{01662059-3E
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-11-01 12:05 - 2011-06-24 18:30 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1148584671-988621172-509042803-1000UA.job
2014-11-01 11:59 - 2009-07-14 05:45 - 00031680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-01 11:59 - 2009-07-14 05:45 - 00031680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-01 11:56 - 2011-06-20 23:49 - 01221613 _____ () C:\Windows\WindowsUpdate.log
2014-11-01 11:56 - 2010-11-21 07:50 - 00702598 _____ () C:\Windows\system32\perfh007.dat
2014-11-01 11:56 - 2010-11-21 07:50 - 00151390 _____ () C:\Windows\system32\perfc007.dat
2014-11-01 11:56 - 2009-07-14 06:13 - 01630758 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-01 11:50 - 2011-06-24 15:07 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-11-01 11:50 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-31 19:45 - 2011-09-13 20:56 - 00000338 _____ () C:\Windows\Tasks\HP Photo Creations Communicator.job
2014-10-31 19:36 - 2012-03-31 07:17 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-31 14:43 - 2011-06-24 17:20 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{C6295D87-0223-4913-87E0-549DC15EB489}
2014-10-30 12:25 - 2010-11-21 04:27 - 00275080 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-10-28 22:05 - 2011-06-24 18:30 - 00001068 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1148584671-988621172-509042803-1000Core.job
2014-10-28 13:12 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SchCache
2014-10-28 10:48 - 2009-07-14 04:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-10-28 10:07 - 2011-11-01 19:52 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Mozilla
2014-10-27 22:11 - 2013-05-08 19:39 - 00000000 ____D () C:\ProgramData\TEMP
2014-10-27 17:51 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2014-10-27 17:47 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-10-27 17:47 - 2009-07-14 03:34 - 00000027 _____ () C:\Windows\system32\Drivers\etc\HOSTS.MVP
2014-10-27 10:14 - 2013-11-09 10:03 - 00000000 ____D () C:\ProgramData\Oracle
2014-10-27 10:11 - 2011-06-25 18:05 - 00000000 ____D () C:\Program Files (x86)\Java
2014-10-27 10:08 - 2013-11-09 10:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-10-27 10:07 - 2014-05-23 18:10 - 00272296 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-10-27 10:07 - 2012-11-10 16:12 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-10-27 10:07 - 2012-11-10 16:12 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-10-26 22:06 - 2014-01-11 10:49 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google+ Auto Backup
2014-10-26 22:01 - 2011-06-24 15:07 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-10-26 22:01 - 2011-06-24 15:07 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-10-26 22:01 - 2011-06-24 15:07 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-26 22:00 - 2011-06-24 18:30 - 00004090 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1148584671-988621172-509042803-1000UA
2014-10-26 22:00 - 2011-06-24 18:30 - 00003694 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1148584671-988621172-509042803-1000Core
2014-10-26 21:58 - 2014-05-22 11:41 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2014-10-26 21:58 - 2013-12-11 12:23 - 00000008 __RSH () C:\Users\Admin\ntuser.pol
2014-10-26 21:58 - 2011-06-20 18:00 - 00000000 ____D () C:\Users\Admin
2014-10-26 16:16 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-10-26 12:35 - 2012-01-11 22:37 - 00000000 ____D () C:\Users\Admin\AppData\Local\Microsoft Games
2014-10-26 10:15 - 2009-07-14 04:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-10-26 10:13 - 2009-07-14 05:45 - 00407104 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-26 10:10 - 2014-05-06 21:16 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-26 01:10 - 2011-06-24 16:07 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-26 01:05 - 2013-08-15 23:54 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-26 00:58 - 2011-06-21 12:42 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-25 21:53 - 2014-01-22 18:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-10-25 21:53 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\Performance
2014-10-25 17:07 - 2011-06-29 16:23 - 00000000 ____D () C:\Users\Admin\AppData\Temp
2014-10-25 16:53 - 2012-02-13 23:08 - 00000000 ____D () C:\Windows\Minidump
2014-10-25 15:33 - 2014-05-03 09:25 - 00000000 ____D () C:\temp
2014-10-25 14:36 - 2014-07-26 15:15 - 00000000 ____D () C:\Users\Admin\AppData\Local\FunctionLogPath
2014-10-25 12:42 - 2014-05-03 23:54 - 00000000 ____D () C:\ProgramData\2b58a7cbef08f6a2
2014-10-21 23:52 - 2010-11-21 08:01 - 00000000 ____D () C:\Program Files\Windows Journal
2014-10-21 23:42 - 2014-07-10 08:14 - 00000000 ____D () C:\Users\Admin\AppData\Local\WPFBChanger
2014-10-21 23:42 - 2014-06-05 05:13 - 00000000 ____D () C:\Users\Admin\AppData\Local\f2dd4267ec6c7612b89b6123980a1fab
2014-10-21 23:42 - 2011-07-25 14:08 - 00000000 ____D () C:\Users\Admin\AppData\Local\Eastman_Kodak_Company
2014-10-21 23:42 - 2011-06-26 04:17 - 00000000 ____D () C:\Users\Admin\AppData\Local\IM
2014-10-21 23:42 - 2011-06-24 13:27 - 00000000 ____D () C:\Users\Admin\AVM_Driver
2014-10-21 23:42 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-10-21 23:41 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2014-10-21 23:40 - 2012-01-08 23:47 - 00000000 ____D () C:\Users\Admin\AppData\Local\Greyfirst
2014-10-21 23:40 - 2011-06-24 15:07 - 00000000 ____D () C:\Users\Admin\AppData\Local\Google
2014-10-21 23:39 - 2014-05-03 23:53 - 00000000 ____D () C:\Users\Admin\AppData\Local\Comodo
2014-10-20 18:23 - 2013-12-19 00:26 - 00000193 _____ () C:\Users\Admin\AppData\Roaming\WB.CFG
2014-10-20 17:55 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Public\Libraries
2014-10-20 17:04 - 2011-11-08 17:10 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\FRITZ!
2014-10-20 15:22 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-10-18 19:35 - 2011-11-12 14:10 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\vlc
2014-10-03 15:51 - 2012-03-31 07:17 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-10-03 15:42 - 2012-03-31 07:17 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-10-03 15:42 - 2011-06-21 17:25 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-10-03 15:40 - 2014-09-28 07:38 - 17903792 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
Files to move or delete:
====================
C:\Users\Admin\photobooksmjpb2pah~1311301458036-5ec56f16-2b51-4723-bc50-88d0d8f055d7.js
C:\Users\Admin\photocardspah~1318247042883-e61ee557-bf45-42de-aea5-909a0eba5893.js
C:\Users\Admin\ShowScript.js
Some content of TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\Quarantine.exe
C:\Users\Admin\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-10-26 16:07
==================== End Of Log ============================
|
|
02.11.2014, 13:40
| #15 |
| /// the machine /// TB-Ausbilder | Win 7 (64): Links im Browser unterstrichen; eDeals, SlamDunk Savings u.v.m. Revo Uninstaller - Download - Filepony damit Chrome deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren. Dann: https://support.google.com/chrome/answer/3296214?hl=de Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:40405
S2 ArchiveBackupDebug.exe; C:\Users\Admin\AppData\Local\ArchiveBackupDebug\ArchiveBackupDebug.exe [X]
S2 DebuggerFreewareNet.exe; C:\Users\Admin\AppData\Local\DebuggerFreewareNet\DebuggerFreewareNet.exe [X]
S2 DebugLogTrash.exe; C:\Users\Admin\AppData\Local\DebugLogTrash\DebugLogTrash.exe [X]
S2 FunctionLogPath.exe; C:\Users\Admin\AppData\Local\FunctionLogPath\FunctionLogPath.exe [X]
S3 RgFltX64; \??\C:\Users\Admin\AppData\Local\DebuggerFreewareNet\RgFltX64.sys [X]
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Nochmal ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
dann auf 
und dann auf 
. 
WARNUNG an die MITLESER: 
Linear-Darstellung
