| |
| |||||||
Log-Analyse und Auswertung: Windows 7: Mysearchcom öffnet sich Mozilla Firefox BrowserWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
25.01.2015, 20:57
| #1 |
 |  Windows 7: Mysearchcom öffnet sich Mozilla Firefox Browser Habe mir leider scheinbar einen Virus eingefangen - Malewarebytes Anti Maleware hat das Problem leider nicht gelöst |
|
25.01.2015, 20:58
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Windows 7: Mysearchcom öffnet sich Mozilla Firefox Browser Hallo und
__________________ Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden? Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520 Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten! Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht! Zudem bitte auch ein Log mit Farbars Tool machen: Scan mit Farbar's Recovery Scan Tool (FRST) Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
 Lesestoff:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit. Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
26.01.2015, 08:11
| #3 |
| | Windows 7: Mysearchcom öffnet sich Mozilla Firefox BrowserCode:
ATTFilter <?xml version="1.0" encoding="UTF-16" ?>
<mbam-log>
<header>
<date>2015/01/25 20:27:49 +0100</date>
<logfile>mbam-log-2015-01-25 (20-26-36).xml</logfile>
<isadmin>yes</isadmin>
</header>
<engine>
<version>2.00.4.1028</version>
<malware-database>v2015.01.05.04</malware-database>
<rootkit-database>v2014.12.30.01</rootkit-database>
<license>free</license>
<file-protection>disabled</file-protection>
<web-protection>disabled</web-protection>
<self-protection>disabled</self-protection>
</engine>
<system>
<osversion>Windows 7 Service Pack 1</osversion>
<arch>x86</arch>
<username>Petra</username>
<filesys>NTFS</filesys>
</system>
<summary>
<type>threat</type>
<result>completed</result>
<objects>322733</objects>
<time>1456</time>
<processes>0</processes>
<modules>0</modules>
<keys>0</keys>
<values>0</values>
<datas>0</datas>
<folders>0</folders>
<files>0</files>
<sectors>0</sectors>
</summary>
<options>
<memory>enabled</memory>
<startup>enabled</startup>
<filesystem>enabled</filesystem>
<archives>enabled</archives>
<rootkits>disabled</rootkits>
<deeprootkit>disabled</deeprootkit>
<heuristics>enabled</heuristics>
<pup>enabled</pup>
<pum>enabled</pum>
</options>
<items>
</items>
</mbam-log>
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 24-01-2015 01 Ran by Petra (administrator) on PETRA-PC on 26-01-2015 07:16:48 Running from C:\Users\Petra\Downloads Loaded Profiles: Petra (Available profiles: Petra) Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 9 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Lenovo) C:\Windows\System32\ibmpmsvc.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (Lenovo) C:\Program Files\Lenovo\Access Connections\AcPrfMgrSvc.exe (Andrea Electronics Corporation) C:\Windows\System32\AEADISRV.EXE (Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (Hewlett-Packard Company) C:\Program Files\HP\Common\HPSupportSolutionsFrameworkService.exe (Secunia) C:\Program Files\Secunia\PSI\psia.exe (Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Lenovo) C:\Program Files\Lenovo\Access Connections\AcSvc.exe (Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation) C:\Windows\System32\FXSSVC.exe (Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Analog Devices, Inc.) C:\Program Files\Analog Devices\Core\smax4pnp.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Apple Inc.) C:\Program Files\QuickTime\QTTask.exe () C:\Program Files\VTech\DownloadManager\System\AgentMonitor.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6700\Bin\ScanToPCActivationApp.exe (Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe (Secunia) C:\Program Files\Secunia\PSI\psi_tray.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Dropbox, Inc.) C:\Users\Petra\AppData\Roaming\Dropbox\bin\Dropbox.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6700\Bin\HPNetworkCommunicator.exe (Lenovo Group Limited) C:\Program Files\ThinkPad\Utilities\SCHTASK.EXE (Intel Corporation) C:\Windows\System32\igfxext.exe (Lenovo) C:\Program Files\Lenovo\Access Connections\SvcGuiHlpr.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6700\Bin\HPNetworkCommunicatorCom.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe (Lenovo.) C:\Program Files\ThinkPad\Utilities\DOZESVC.EXE (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe (Intel Corporation) C:\Windows\System32\igfxext.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Lenovo) C:\Program Files\ThinkPad\Utilities\PWMDBSVC.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe (Microsoft Corporation) C:\Windows\System32\prevhost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-08-07] (Intel Corporation) HKLM\...\Run: [AcWin7Hlpr] => C:\Program Files\Lenovo\Access Connections\AcTBenabler.exe [64608 2012-05-30] (Lenovo) HKLM\...\Run: [PWMTRV] => rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWMTR32V.DLL,PwrMgrBkGndMonitor HKLM\...\Run: [SoundMAXPnP] => C:\Program Files\Analog Devices\Core\smax4pnp.exe [1314816 2009-05-18] (Analog Devices, Inc.) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2342200 2012-07-05] (Synaptics Incorporated) HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation) HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [974432 2014-08-22] (Microsoft Corporation) HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.) HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard) HKLM\...\Run: [] => [X] HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-12-03] (Adobe Systems Incorporated) HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.) HKLM\...\Run: [AgentMonitor] => C:\Program Files\VTech\DownloadManager\System\AgentMonitor.exe [401280 2014-06-20] () HKU\S-1-5-21-4103409644-2115618623-1480157512-1001\...\Run: [HP Officejet 6700 (NET)] => C:\Program Files\HP\HP Officejet 6700\Bin\ScanToPCActivationApp.exe [1837672 2012-10-17] (Hewlett-Packard Co.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk ShortcutTarget: Bluetooth.lnk -> C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe (Broadcom Corporation.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia) Startup: C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Petra\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 6700 (Netzwerk).lnk ShortcutTarget: Tintenwarnungen überwachen - HP Officejet 6700 (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet 6700\Bin\HPStatusBL.dll (Hewlett-Packard Co.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-21-4103409644-2115618623-1480157512-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome HKU\S-1-5-21-4103409644-2115618623-1480157512-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch SearchScopes: HKU\S-1-5-21-4103409644-2115618623-1480157512-1001 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = SearchScopes: HKU\S-1-5-21-4103409644-2115618623-1480157512-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=WDCXWD800BEVS-08RST3_WD-WXC808A2355423554&ts=1422126191&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-4103409644-2115618623-1480157512-1001 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=WDCXWD800BEVS-08RST3_WD-WXC808A2355423554&ts=1422126191&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-4103409644-2115618623-1480157512-1001 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=WDCXWD800BEVS-08RST3_WD-WXC808A2355423554&ts=1422126191&type=default&q={searchTerms} BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) DPF: {D27CDB6E-AE6D-11CF-96B8-720720720720} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab Tcpip\Parameters: [DhcpNameServer] 10.0.0.138 10.0.0.138 FireFox: ======== FF ProfilePath: C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\co30ngci.default-1422215147327 FF Homepage: hxxp://www.google.at/ FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_257.dll () FF Plugin: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) StartMenuInternet: FIREFOX.EXE - firefox.exe Chrome: ======= CHR Profile: C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Docs) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-05-31] CHR Extension: (Google Drive) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-24] CHR Extension: (YouTube) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-24] CHR Extension: (Google-Suche) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-24] CHR Extension: (Google Mail) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-24] StartMenuInternet: Google Chrome - Chrome.exe ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AcPrfMgrSvc; C:\Program Files\Lenovo\Access Connections\AcPrfMgrSvc.exe [134240 2012-05-30] (Lenovo) R2 AcSvc; C:\Program Files\Lenovo\Access Connections\AcSvc.exe [273504 2012-05-30] (Lenovo) R2 HPSupportSolutionsFrameworkService; C:\Program Files\Hp\Common\HPSupportSolutionsFrameworkService.exe [89864 2014-12-11] (Hewlett-Packard Company) R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22192 2014-08-22] (Microsoft Corporation) R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [288120 2014-08-22] (Microsoft Corporation) S3 PwmEWSvc; C:\Program Files\ThinkPad\Utilities\PWMEWSVC.EXE [1665120 2012-05-16] (Lenovo Group Limited) R2 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia) S2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia) S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2015-01-25] (Malwarebytes Corporation) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [231800 2014-07-17] (Microsoft Corporation) R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_x86.sys [16024 2013-12-06] (Secunia) S3 SmbDrv; C:\Windows\system32\drivers\Smb_driver_AMDASF.sys [22840 2012-07-05] (Synaptics Incorporated) S3 SmbDrvI; C:\Windows\system32\drivers\Smb_driver_Intel.sys [23608 2012-07-05] (Synaptics Incorporated) R3 SWNC8U01; C:\Windows\System32\DRIVERS\SWNC8U01.sys [102144 2007-01-12] (Sierra Wireless Inc.) R3 SWUMX01; C:\Windows\System32\DRIVERS\swumx01.sys [70656 2007-01-12] (Sierra Wireless Inc.) R1 wStLibG; C:\Windows\System32\drivers\wStLibG.sys [52920 2014-04-21] (StdLib) U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation) S3 catchme; \??\C:\Users\Petra\AppData\Local\Temp\catchme.sys [X] S3 HSF_DPV; system32\DRIVERS\HSX_DPV.sys [X] S3 HSXHWAZL; system32\DRIVERS\HSXHWAZL.sys [X] S2 mdmxsdk; system32\DRIVERS\mdmxsdk.sys [X] S1 MpKsl232a813f; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{9D2D426B-D821-4D92-9878-16F1FE6B4474}\MpKsl232a813f.sys [X] U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-14] (Microsoft Corporation) S3 winachsf; system32\DRIVERS\HSX_CNXT.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-26 07:16 - 2015-01-26 07:17 - 00016282 _____ () C:\Users\Petra\Downloads\FRST.txt 2015-01-26 07:16 - 2015-01-26 07:16 - 00000000 ___DC () C:\FRST 2015-01-26 07:15 - 2015-01-26 07:15 - 01120768 _____ (Farbar) C:\Users\Petra\Downloads\FRST.exe 2015-01-26 07:05 - 2015-01-26 07:05 - 00065536 ___HT () C:\Users\Petra\~Outlook.pst.tmp 2015-01-24 20:02 - 2015-01-24 20:02 - 00001167 _____ () C:\Users\Petra\Desktop\Format Factory.lnk 2015-01-24 20:02 - 2015-01-24 20:02 - 00000000 ____D () C:\Users\Public\Documents\Baidu 2015-01-24 20:02 - 2015-01-24 20:02 - 00000000 ____D () C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FormatFactory 2015-01-24 20:02 - 2015-01-24 20:02 - 00000000 ____D () C:\ProgramData\Baidu 2015-01-24 20:01 - 2015-01-24 20:01 - 00000000 ___DC () C:\Program Files\FreeTime 2015-01-24 19:58 - 2015-01-24 20:00 - 52876065 _____ (Free Time) C:\Users\Petra\Downloads\FFSetup3.5.1.exe 2015-01-24 19:36 - 2015-01-24 19:38 - 00000000 ____D () C:\Users\Petra\AppData\Local\Audible 2015-01-24 19:36 - 2015-01-24 19:36 - 00255352 _____ (Audible, Inc.) C:\Windows\system32\awrdscdc.ax 2015-01-24 19:36 - 2015-01-24 19:36 - 00001922 _____ () C:\Users\Petra\Desktop\Audible Manager.lnk 2015-01-24 19:36 - 2015-01-24 19:36 - 00000327 _____ () C:\Users\Petra\Downloads\admhelper 2015-01-24 19:35 - 2015-01-24 19:36 - 00000000 ___DC () C:\Program Files\Audible 2015-01-24 19:35 - 2015-01-24 19:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AudibleManager 2015-01-24 19:35 - 2015-01-24 19:35 - 01730272 _____ (Audible Inc.) C:\Users\Petra\Downloads\ActiveSetupN.exe 2015-01-24 19:35 - 2015-01-24 19:35 - 00000000 ____D () C:\Users\Public\Documents\Audible 2015-01-24 19:35 - 2015-01-24 19:35 - 00000000 ____D () C:\Users\Petra\Documents\Audible 2015-01-24 19:35 - 2001-08-17 22:43 - 00024576 ____N (Microsoft Corporation) C:\Windows\system32\msxml3a.dll 2015-01-23 18:51 - 2014-08-06 11:48 - 84653241 _____ () C:\Users\Petra\Desktop\Heidi_Folge_09_deutsch.mp4 2015-01-23 18:51 - 2014-07-01 14:48 - 22476897 _____ () C:\Users\Petra\Desktop\Heidi Folge 6 deutsch_youtube_original.m4a 2015-01-23 18:51 - 2014-07-01 14:47 - 22011301 _____ () C:\Users\Petra\Desktop\Heidi Folge 7 deutsch_youtube_original.m4a 2015-01-19 19:54 - 2015-01-19 19:57 - 33095216 _____ () C:\Users\Petra\Downloads\Millionenshow.zip 2015-01-17 10:26 - 2015-01-17 10:26 - 00000000 ___DC () C:\Program Files\Mozilla Firefox 2015-01-16 22:08 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_33.dll 2015-01-16 22:07 - 2015-01-16 22:08 - 00037683 _____ () C:\Windows\DirectX.log 2015-01-16 22:06 - 2015-01-16 22:06 - 00001109 _____ () C:\Users\Public\Desktop\Cinebook Designer.lnk 2015-01-16 22:06 - 2015-01-16 22:06 - 00000000 ____D () C:\Users\Petra\AppData\Local\Cinebook 2015-01-16 22:06 - 2015-01-16 22:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cinebook 2015-01-16 22:05 - 2015-01-16 22:05 - 00000000 ___DC () C:\Program Files\Cinebook 2015-01-16 22:05 - 2015-01-16 22:05 - 00000000 ____D () C:\ProgramData\Cinebook 2015-01-16 22:02 - 2015-01-16 22:05 - 81900272 _____ ( ) C:\Users\Petra\Downloads\Cinebook_Fotobuch.exe 2015-01-14 11:55 - 2014-12-19 03:43 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll 2015-01-14 11:55 - 2014-12-19 02:34 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys 2015-01-14 11:55 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe 2015-01-14 11:55 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-01-14 11:55 - 2014-12-11 18:47 - 00046592 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe 2015-01-14 11:55 - 2014-12-06 04:50 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll 2015-01-10 09:26 - 2015-01-25 20:07 - 00000840 _____ () C:\Windows\setupact.log 2015-01-10 09:26 - 2015-01-10 09:26 - 00000000 _____ () C:\Windows\setuperr.log 2015-01-09 13:48 - 2015-01-09 13:48 - 00000326 _____ () C:\Users\Petra\Desktop\HP Druckerdiagnosetools.url 2015-01-09 13:48 - 2015-01-09 13:48 - 00000000 ___DC () C:\Program Files\Hewlett-Packard 2015-01-06 07:42 - 2015-01-26 07:16 - 01795072 _____ () C:\Users\Petra\Outlook.pst 2015-01-04 09:01 - 2015-01-04 09:01 - 00002187 _____ () C:\Users\Public\Desktop\Free YouTube Download.lnk 2015-01-04 08:58 - 2015-01-04 08:58 - 03533856 _____ (DVDVideoSoft Ltd. ) C:\Users\Petra\Downloads\FreeYouTubeDownload.exe 2015-01-04 08:48 - 2015-01-04 08:48 - 00001035 _____ () C:\Users\Public\Desktop\VLC media player.lnk 2015-01-04 08:48 - 2015-01-04 08:48 - 00000000 ___DC () C:\Program Files\VideoLAN 2015-01-04 08:48 - 2015-01-04 08:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN 2015-01-04 08:45 - 2015-01-04 08:45 - 01174352 _____ () C:\Users\Petra\Downloads\VLC media player 32 Bit - CHIP-Installer.exe 2015-01-04 08:43 - 2015-01-23 19:00 - 00000000 ____D () C:\Users\Petra\AppData\Roaming\vlc 2015-01-03 17:28 - 2015-01-04 10:22 - 00000000 ____D () C:\Users\Petra\AppData\Roaming\FirefoxToolbar 2015-01-03 17:27 - 2015-01-06 07:39 - 00000000 ___DC () C:\Program Files\Settings Manager 2015-01-03 17:13 - 2015-01-03 17:13 - 00002283 _____ () C:\Users\Public\Desktop\Free YouTube to MP3 Converter.lnk 2015-01-03 17:12 - 2015-01-04 09:01 - 00000000 ___DC () C:\Program Files\Free Codec Pack 2015-01-03 17:12 - 2015-01-04 09:01 - 00000000 ___DC () C:\Program Files\DVDVideoSoft 2015-01-03 17:12 - 2015-01-04 09:00 - 00000000 ____D () C:\Users\Petra\AppData\Roaming\RHEng 2015-01-03 17:09 - 2015-01-03 17:10 - 03533800 _____ (DVDVideoSoft Ltd. ) C:\Users\Petra\Downloads\FreeYouTubeToMP3-1215Converter.exe 2015-01-03 16:46 - 2015-01-03 16:46 - 00001000 _____ () C:\Users\Public\Desktop\KdGConvert.lnk 2015-01-03 16:46 - 2015-01-03 16:46 - 00000000 ___DC () C:\Program Files\KdGConvert 2015-01-03 16:46 - 2015-01-03 16:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KdGConvert 2015-01-03 16:44 - 2015-01-03 16:44 - 08472030 _____ (Universal Ware ) C:\Users\Petra\Downloads\Setup_KdGConvert.exe 2015-01-03 16:21 - 2015-01-03 16:21 - 00000000 ____D () C:\Users\Petra\AppData\Local\DownloadManager 2015-01-03 16:17 - 2015-01-03 16:17 - 00001186 _____ () C:\Users\Public\Desktop\VTech Download Manager.lnk 2015-01-03 16:17 - 2015-01-03 16:17 - 00000000 ___DC () C:\Program Files\VTech 2015-01-03 16:17 - 2015-01-03 16:17 - 00000000 ____D () C:\ProgramData\VTech 2015-01-03 16:17 - 2015-01-03 16:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VTech 2015-01-03 16:09 - 2015-01-03 16:09 - 15475904 _____ (VTech) C:\Users\Petra\Downloads\KidiGo_DE_ger_Setup.exe 2014-12-29 11:53 - 2015-01-16 20:29 - 00000000 ____D () C:\Windows\AutoKMS 2014-12-29 11:51 - 2014-12-29 11:52 - 00000000 ____D () C:\ProgramData\Microsoft Toolkit 2014-12-29 11:50 - 2014-12-29 11:51 - 37915356 _____ () C:\Users\Petra\Downloads\Toolkit.zip ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-26 07:17 - 2013-11-06 19:51 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-01-26 07:13 - 2013-11-26 18:36 - 00000000 ____D () C:\Users\Petra\AppData\Local\CrashDumps 2015-01-26 07:11 - 2013-03-29 15:22 - 01855447 _____ () C:\Windows\WindowsUpdate.log 2015-01-26 07:05 - 2013-03-29 15:33 - 00000000 ____D () C:\Users\Petra 2015-01-26 07:00 - 2013-05-31 06:17 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-01-25 20:57 - 2009-07-14 05:34 - 00028944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-01-25 20:57 - 2009-07-14 05:34 - 00028944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-01-25 20:25 - 2014-08-21 10:05 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-01-25 20:09 - 2013-06-24 09:30 - 00000000 ___RD () C:\Users\Petra\Dropbox 2015-01-25 20:08 - 2013-06-24 09:27 - 00000000 ____D () C:\Users\Petra\AppData\Roaming\Dropbox 2015-01-25 20:07 - 2014-08-20 07:18 - 00238980 _____ () C:\Windows\PFRO.log 2015-01-25 20:07 - 2013-05-31 06:17 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-01-25 20:07 - 2010-11-21 01:55 - 00000000 ____D () C:\Windows\ShellNew 2015-01-25 20:07 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-01-25 09:17 - 2013-03-29 19:39 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2015-01-25 09:17 - 2013-03-29 19:39 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2015-01-24 20:02 - 2014-08-24 11:08 - 00001254 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk 2015-01-24 20:02 - 2013-05-31 06:22 - 00002342 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2015-01-24 20:01 - 2014-08-24 11:08 - 00001266 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2015-01-24 19:41 - 2010-11-20 22:01 - 01628044 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-01-20 19:59 - 2013-04-01 19:08 - 00000000 ____D () C:\ProgramData\tmp 2015-01-18 09:05 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Microsoft.NET 2015-01-18 08:57 - 2014-08-24 11:08 - 00000000 ___DC () C:\Program Files\Mozilla Maintenance Service 2015-01-18 08:57 - 2009-07-14 05:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2015-01-16 08:44 - 2013-11-24 12:28 - 00000000 ____D () C:\Users\Petra\AppData\Roaming\HpUpdate 2015-01-15 17:40 - 2014-08-23 18:59 - 00000000 ____D () C:\Windows\system32\MRT 2015-01-15 17:33 - 2012-08-23 09:03 - 110348472 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-01-10 09:26 - 2009-07-14 05:33 - 00413376 _____ () C:\Windows\system32\FNTCACHE.DAT 2015-01-09 13:49 - 2013-03-29 15:33 - 00110408 _____ () C:\Users\Petra\AppData\Local\GDIPFONTCACHEV1.DAT 2015-01-07 14:29 - 2013-11-24 20:14 - 00000000 ____D () C:\Users\Petra\Desktop\Julia 2015-01-06 11:20 - 2009-07-14 05:52 - 00000000 ____D () C:\Program Files\Microsoft Games 2015-01-06 07:39 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Registration 2015-01-04 09:02 - 2014-05-05 19:11 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2015-01-04 09:01 - 2013-05-20 20:01 - 00001210 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk 2015-01-04 09:01 - 2013-05-20 20:00 - 00000000 ____D () C:\Users\Petra\AppData\Roaming\DVDVideoSoft 2015-01-04 09:01 - 2013-05-20 20:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft 2015-01-04 09:01 - 2013-05-20 20:00 - 00000000 ____D () C:\Program Files\Common Files\DVDVideoSoft 2015-01-04 08:44 - 2014-11-23 19:46 - 00000000 ___DC () C:\Program Files\VidPlaya 2014-12-31 12:13 - 2012-08-23 08:47 - 00249488 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe ==================== Files in the root of some directories ======= 2014-02-10 21:19 - 2014-02-10 21:19 - 49940480 ____C () C:\Program Files\GUT8DC9.tmp 2014-04-13 09:33 - 2014-07-19 10:46 - 0000089 _____ () C:\Users\Petra\AppData\Roaming\WB.CFG 2014-07-24 19:29 - 2014-07-24 19:29 - 0004608 _____ () C:\Users\Petra\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2014-12-20 17:47 - 2014-12-20 17:47 - 0006171 _____ () C:\Users\Petra\AppData\Local\recently-used.xbel 2013-11-24 12:26 - 2013-11-24 12:26 - 0000057 _____ () C:\ProgramData\Ament.ini Some content of TEMP: ==================== C:\Users\Petra\AppData\Local\temp\881D388e20.exe C:\Users\Petra\AppData\Local\temp\bitool.dll C:\Users\Petra\AppData\Local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpbuxd0l.dll C:\Users\Petra\AppData\Local\temp\FreeYouTubeDownload.exe C:\Users\Petra\AppData\Local\temp\smt_mystartsearch.exe C:\Users\Petra\AppData\Local\temp\tmd_34011266.exe C:\Users\Petra\AppData\Local\temp\tmd_34013884.exe C:\Users\Petra\AppData\Local\temp\tmd_34014278.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-01-24 08:14 ==================== End Of Log ============================ --- --- --- --- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 24-01-2015 01
Ran by Petra at 2015-01-26 07:17:39
Running from C:\Users\Petra\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 16 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.257 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Apple Application Support (HKLM\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Audacity 2.0.4 (HKLM\...\Audacity_is1) (Version: 2.0.4 - Audacity Team)
AudibleManager (HKLM\...\AudibleManager) (Version: 1995135712.48.56.5836010 - Audible, Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 4.09 - Piriform)
Cinebook PhotoGenie 5.3 (HKLM\...\Cinebook Fotobuch_is1) (Version: - )
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
DriverTuner 3.1.0.1 (HKLM\...\{520C1D80-935C-42B9-9340-E883849D804F}_is1) (Version: 3.1.0.1 - LionSea SoftWare)
Dropbox (HKU\S-1-5-21-4103409644-2115618623-1480157512-1001\...\Dropbox) (Version: 3.0.3 - Dropbox, Inc.)
Energie-Manager (HKLM\...\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}) (Version: 6.32 - )
FormatFactory 3.5.1.0 (HKLM\...\FormatFactory) (Version: 3.5.1.0 - Format Factory)
FOTO AT Fotowelt (HKLM\...\FOTO AT Fotowelt) (Version: 5.1.7 - CEWE Stiftung u Co. KGaA)
Foxit Reader (HKLM\...\Foxit Reader_is1) (Version: 5.4.5.124 - Foxit Corporation)
Free Audio CD Burner version 2.0.25.430 (HKLM\...\Free Audio CD Burner_is1) (Version: 2.0.25.430 - DVDVideoSoft Ltd.)
Free AVI Video Converter version 5.0.45.716 (HKLM\...\Free AVI Video Converter_is1) (Version: 5.0.45.716 - DVDVideoSoft Ltd.)
Free YouTube Download version 3.2.51.1215 (HKLM\...\Free YouTube Download_is1) (Version: 3.2.51.1215 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.12.52.1215 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.52.1215 - DVDVideoSoft Ltd.)
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Google Chrome (HKLM\...\Google Chrome) (Version: 40.0.2214.91 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
HERMA Label Designer plus 1.1 (HKLM\...\{7DA64485-2CEE-4F7B-84AB-B287236703B6}) (Version: 1.00.0000 - HERMA GmbH)
HP FWUpdateEDO2 (HKLM\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Officejet 6700 - Grundlegende Software für das Gerät (HKLM\...\{7D1EFB03-7D84-446E-8B90-6ECD7EDF4D55}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Officejet 6700 Hilfe (HKLM\...\{E1AE0CB7-1333-4728-8520-CB3F88A252B4}) (Version: 140.0.2.2 - Hewlett Packard)
HP Support Solutions Framework (HKLM\...\{96D12EC9-720B-45FB-904C-36D6307A1C76}) (Version: 11.51.0048 - Hewlett-Packard Company)
HP Update (HKLM\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (Version: 1.00.0001 - Microsoft) Hidden
I.R.I.S. OCR (HKLM\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
Image Resizer for Windows (HKLM\...\{69d72156-6582-4556-8637-06f40aa7f85b}) (Version: 3.0.4802.35565 - Brice Lambson)
Image Resizer for Windows (Version: 3.0.4802.35565 - Brice Lambson) Hidden
Inkscape 0.48.5 (HKLM\...\Inkscape) (Version: 0.48.5 - )
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1930 - Intel Corporation)
Intel(R) TV Wizard (HKLM\...\TVWiz) (Version: - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - Intel Corporation)
Java 7 Update 71 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F03217071FF}) (Version: 7.0.710 - Oracle)
Junk Mail filter update (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
KdGConvert Version 1.0 (HKLM\...\{79AA560F-5CC6-4A0E-81A3-E604FF280D45}_is1) (Version: 1.0 - Universal Ware)
LAME v3.99.3 (for Windows) (HKLM\...\LAME_is1) (Version: - )
Lenovo Patch Utility (HKLM\...\{6E6E7725-C7BC-4C39-8B3F-14B67331A120}) (Version: 1.3.0.9 - Lenovo Group Limited)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Mozilla Firefox 35.0 (x86 de) (HKLM\...\Mozilla Firefox 35.0 (x86 de)) (Version: 35.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 32.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser and SDK (HKLM\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
NVIDIA Grafiktreiber 296.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 296.88 - NVIDIA Corporation)
NVIDIA nView Desktop Manager (HKLM\...\NVIDIA nView Desktop Manager) (Version: 121.20 - NVIDIA Corporation)
PVSonyDll (Version: 1.00.0001 - NVIDIA Corporation) Hidden
QuickTime 7 (HKLM\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Ravensburger tiptoi (HKLM\...\Ravensburger tiptoi) (Version: - )
Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Secunia PSI (3.0.0.9016) (HKLM\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
SF-Etikett 12.01 (HKLM\...\{62946C1C-0052-4DDA-A1D4-90B87AC82546}) (Version: 12.01.000 - Frank Stolzer)
Sierra Wireless HSDPA MiniCard (HKLM\...\{D2A6CB42-8327-4167-AB04-F4A15658F2BF}) (Version: 7.0.2.1300 - Sierra Wireless Inc)
Studie zur Verbesserung von HP Officejet 6700 Produkten (HKLM\...\{1012904D-3F7E-44A6-B425-5AF21272BECE}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
ThinkPad Bluetooth with Enhanced Data Rate Software (HKLM\...\{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}) (Version: 6.2.1.3100 - Broadcom Corporation)
ThinkPad Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.55 - )
ThinkPad UltraNav Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.5.0 - )
ThinkVantage Access Connections (HKLM\...\{A62AEB2B-E2A0-4E77-8AAE-9645FE3B5487}) (Version: 5.95 - Lenovo)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
VTech Download Agent Library (Version: 1.00.0000 - VTech) Hidden
VTech Download Manager (HKLM\...\VTechDownloadManager) (Version: - VTech)
Windows Driver Package - Broadcom (BTHUSB) Bluetooth (04/08/2010 6.3.5.430) (HKLM\...\2004BB9EB6CEA02846881BEF1F51C11F7A90C9D6) (Version: 04/08/2010 6.3.5.430 - Broadcom)
Windows Driver Package - Broadcom HIDClass (07/28/2009 6.2.0.9800) (HKLM\...\BF20603967CFDCB2BBF91950E8A56DFBC5C833FE) (Version: 07/28/2009 6.2.0.9800 - Broadcom)
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-4103409644-2115618623-1480157512-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Petra\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4103409644-2115618623-1480157512-1001_Classes\CLSID\{090746F9-9F39-42C0-920A-4852C2EDE704}\InprocServer32 -> C:\Users\Petra\AppData\Local\Temp\{D430101B-77E4-471D-A522-50A29D54A5C4}\APAX.dll No File
CustomCLSID: HKU\S-1-5-21-4103409644-2115618623-1480157512-1001_Classes\CLSID\{49BBAA3C-C574-419E-8378-783C362E9C15}\InprocServer32 -> C:\Program Files\HP\Common\FWUpdateEDO2.dll (Hewlett-Packard Co.)
CustomCLSID: HKU\S-1-5-21-4103409644-2115618623-1480157512-1001_Classes\CLSID\{69026072-B4B5-4446-9732-CDA579736741}\InprocServer32 -> C:\Users\Petra\AppData\Local\Temp\{D430101B-77E4-471D-A522-50A29D54A5C4}\APAX.dll No File
CustomCLSID: HKU\S-1-5-21-4103409644-2115618623-1480157512-1001_Classes\CLSID\{780927D9-C564-4C09-8892-43E6EF2A8AFB}\InprocServer32 -> C:\Users\Petra\AppData\Local\Temp\{D430101B-77E4-471D-A522-50A29D54A5C4}\APAX.dll No File
CustomCLSID: HKU\S-1-5-21-4103409644-2115618623-1480157512-1001_Classes\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\localserver32 -> C:\Users\Petra\AppData\Local\Temp\881D388e20.exe ()
CustomCLSID: HKU\S-1-5-21-4103409644-2115618623-1480157512-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4103409644-2115618623-1480157512-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4103409644-2115618623-1480157512-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4103409644-2115618623-1480157512-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4103409644-2115618623-1480157512-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4103409644-2115618623-1480157512-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4103409644-2115618623-1480157512-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4103409644-2115618623-1480157512-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
==================== Restore Points =========================
24-01-2015 18:54:52 Windows Update
25-01-2015 19:00:09 Windows-Sicherung
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:04 - 2014-08-20 14:59 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {0599E4F8-7BBB-4A66-8892-A05B5A7AEE42} - System32\Tasks\DriverTuner Startup => C:\Program Files\DriverTuner\DriverTuner.exe [2013-07-11] (LionSea)
Task: {229CCB71-88EE-423D-819E-B1E5C28698B9} - System32\Tasks\HPCustParticipation HP Officejet 6700 => C:\Program Files\HP\HP Officejet 6700\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)
Task: {580E5D36-E892-4C4D-B8A1-51680034BCED} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-12-17] (Piriform Ltd)
Task: {636B383B-A570-47E5-A408-EC52B96D8BD6} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-25] (Adobe Systems Incorporated)
Task: {647A52DD-F4F7-4082-8264-1CAADB9A9698} - System32\Tasks\PMTask => C:\Program Files\ThinkPad\Utilities\PWMIDTSV.EXE [2012-05-16] (Lenovo Group Limited)
Task: {7F3B0187-334A-4572-B5BF-06237BBB559A} - \AutoKMS No Task File <==== ATTENTION
Task: {8EF2D1BB-18FE-4968-AB23-74C1FCCABA39} - System32\Tasks\{4EBB497D-0D97-4440-88B0-70D6FD9EE5D6} => pcalua.exe -a C:\PROGRA~1\SearchProtect\Main\bin\uninstall.exe -c /S <==== ATTENTION
Task: {A231CBC3-E282-45A8-94CD-1FC3D554BE03} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {AB4F4E56-3BE2-4F17-B796-8129E80341DE} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {BC46DDA0-2DF1-425B-BD9F-967237C0DA06} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-05-31] (Google Inc.)
Task: {CD5D49D7-9A74-4A3C-AC7C-910A15B6F829} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-05-31] (Google Inc.)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2011-01-24 11:35 - 2011-01-24 11:35 - 00132384 _____ () C:\Program Files\ThinkPad\Bluetooth Software\btkeyind.dll
2012-05-30 16:32 - 2012-05-30 16:32 - 00086016 _____ () C:\Program Files\Lenovo\Access Connections\AcWrpc.dll
2012-08-23 10:20 - 2012-05-16 05:32 - 00094208 _____ () C:\Program Files\ThinkPad\Utilities\GR\PWMRT32V.DLL
2014-10-13 02:49 - 2014-06-20 07:42 - 00401280 ____C () C:\Program Files\VTech\DownloadManager\System\AgentMonitor.exe
2014-10-13 02:49 - 2014-03-04 12:20 - 00117760 ____C () C:\Program Files\VTech\DownloadManager\System\QtSolutions_SOAP-2.7.dll
2014-10-13 02:49 - 2014-04-22 03:14 - 00065536 ____C () C:\Program Files\VTech\DownloadManager\System\QHttpServer.dll
2014-10-13 02:49 - 2014-05-06 06:39 - 00861184 ____C () C:\Program Files\VTech\DownloadManager\System\plugins\platforms\qwindows.dll
2014-10-13 02:49 - 2014-05-06 06:38 - 00021504 ____C () C:\Program Files\VTech\DownloadManager\System\plugins\imageformats\qgif.dll
2014-10-13 02:49 - 2014-05-06 06:38 - 00020992 ____C () C:\Program Files\VTech\DownloadManager\System\plugins\imageformats\qico.dll
2014-10-13 02:49 - 2014-05-06 06:38 - 00204800 ____C () C:\Program Files\VTech\DownloadManager\System\plugins\imageformats\qjpeg.dll
2014-10-13 02:49 - 2014-05-06 11:44 - 00218112 ____C () C:\Program Files\VTech\DownloadManager\System\plugins\imageformats\qmng.dll
2014-10-13 02:49 - 2014-05-06 06:58 - 00015872 ____C () C:\Program Files\VTech\DownloadManager\System\plugins\imageformats\qsvg.dll
2014-10-13 02:49 - 2014-05-06 11:44 - 00015360 ____C () C:\Program Files\VTech\DownloadManager\System\plugins\imageformats\qtga.dll
2014-10-13 02:49 - 2014-05-06 11:44 - 00307712 ____C () C:\Program Files\VTech\DownloadManager\System\plugins\imageformats\qtiff.dll
2014-10-13 02:49 - 2014-05-06 11:44 - 00014848 ____C () C:\Program Files\VTech\DownloadManager\System\plugins\imageformats\qwbmp.dll
2014-10-13 02:49 - 2014-05-06 07:31 - 00015872 ____C () C:\Program Files\VTech\DownloadManager\System\plugins\sensors\qtsensors_dummy.dll
2014-10-13 02:49 - 2014-05-06 06:38 - 00036352 ____C () C:\Program Files\VTech\DownloadManager\System\plugins\bearer\qgenericbearer.dll
2014-10-13 02:49 - 2014-05-06 06:38 - 00038912 ____C () C:\Program Files\VTech\DownloadManager\System\plugins\bearer\qnativewifibearer.dll
2014-10-22 01:22 - 2014-10-22 01:22 - 00750080 _____ () C:\Users\Petra\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-01-25 20:08 - 2015-01-25 20:08 - 00043008 _____ () c:\users\petra\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpbuxd0l.dll
2014-10-22 01:22 - 2014-10-22 01:22 - 00047616 _____ () C:\Users\Petra\AppData\Roaming\Dropbox\bin\libEGL.dll
2014-10-22 01:22 - 2014-10-22 01:22 - 00863744 _____ () C:\Users\Petra\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2014-10-22 01:22 - 2014-10-22 01:22 - 00200704 _____ () C:\Users\Petra\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\office14\Cultures\office.odf
2013-02-14 15:46 - 2013-02-14 15:46 - 01044048 _____ () C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll
2015-01-17 10:26 - 2015-01-17 10:26 - 03925104 ____C () C:\Program Files\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-4103409644-2115618623-1480157512-500 - Administrator - Disabled)
Gast (S-1-5-21-4103409644-2115618623-1480157512-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-4103409644-2115618623-1480157512-1002 - Limited - Enabled)
Petra (S-1-5-21-4103409644-2115618623-1480157512-1001 - Administrator - Enabled) => C:\Users\Petra
==================== Faulty Device Manager Devices =============
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Name: MpKsl232a813f
Description: MpKsl232a813f
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: MpKsl232a813f
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Event log errors: =========================
Application errors:
==================
Error: (01/26/2015 07:13:51 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbam.exe, Version: 1.0.1.711, Zeitstempel: 0x542b53ec
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x3232fa40
ID des fehlerhaften Prozesses: 0x1524
Startzeit der fehlerhaften Anwendung: 0xmbam.exe0
Pfad der fehlerhaften Anwendung: mbam.exe1
Pfad des fehlerhaften Moduls: mbam.exe2
Berichtskennung: mbam.exe3
Error: (01/25/2015 08:09:23 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (01/25/2015 08:06:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 35.0.0.5486, Zeitstempel: 0x54af7153
Name des fehlerhaften Moduls: mozalloc.dll, Version: 35.0.0.5486, Zeitstempel: 0x54af69d4
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0x96c
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Error: (01/25/2015 06:48:25 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (01/25/2015 06:45:02 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (01/25/2015 10:07:03 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (01/25/2015 08:24:09 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (01/24/2015 08:02:08 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FormatFactory.exe, Version: 3.5.1.0, Zeitstempel: 0x547593ed
Name des fehlerhaften Moduls: mfc120u.dll, Version: 12.0.21005.1, Zeitstempel: 0x524fabbd
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0024e428
ID des fehlerhaften Prozesses: 0xe48
Startzeit der fehlerhaften Anwendung: 0xFormatFactory.exe0
Pfad der fehlerhaften Anwendung: FormatFactory.exe1
Pfad des fehlerhaften Moduls: FormatFactory.exe2
Berichtskennung: FormatFactory.exe3
Error: (01/24/2015 08:01:52 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 35.0.0.5486, Zeitstempel: 0x54af7153
Name des fehlerhaften Moduls: mozalloc.dll, Version: 35.0.0.5486, Zeitstempel: 0x54af69d4
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0xb60
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Error: (01/24/2015 06:42:59 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (01/25/2015 10:05:27 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 25.01.2015 um 09:23:18 unerwartet heruntergefahren.
Error: (01/23/2015 06:51:00 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.
Error: (01/23/2015 06:50:58 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.
Error: (01/22/2015 05:40:49 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Definitionsupdate für Microsoft Security Essentials – KB2310138 (Definition 1.191.3014.0)
Error: (01/22/2015 05:40:35 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 1.191.2930.0
Aktualisierungsquelle: %NT-AUTORITÄT59
Aktualisierungsphase: 4.6.0305.00
Quellpfad: 4.6.0305.01
Signaturtyp: %NT-AUTORITÄT602
Aktualisierungstyp: %NT-AUTORITÄT604
Benutzer: NT-AUTORITÄT\SYSTEM
Aktuelle Modulversion: %NT-AUTORITÄT605
Vorherige Modulversion: %NT-AUTORITÄT606
Fehlercode: %NT-AUTORITÄT607
Fehlerbeschreibung: %NT-AUTORITÄT608
Error: (01/19/2015 10:29:37 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Power Manager DBC Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (01/19/2015 07:27:45 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Windows Update" wurde nicht richtig gestartet.
Error: (01/17/2015 11:47:44 AM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "WORKGROUP :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 10.0.0.6
registriert werden. Der Computer mit IP-Adresse 10.0.0.5 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.
Error: (01/17/2015 11:46:37 AM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "WORKGROUP :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 10.0.0.6
registriert werden. Der Computer mit IP-Adresse 10.0.0.5 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.
Error: (01/17/2015 11:12:12 AM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "WORKGROUP :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 10.0.0.6
registriert werden. Der Computer mit IP-Adresse 10.0.0.5 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.
Microsoft Office Sessions:
=========================
Error: (01/26/2015 07:13:51 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbam.exe1.0.1.711542b53ecunknown0.0.0.000000000c00000053232fa40152401d038d4b1975518C:\Program Files\ Malwarebytes Anti-Malware \mbam.exeunknown7f33535a-a522-11e4-91aa-00a0d5ffff85
Error: (01/25/2015 08:09:23 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (01/25/2015 08:06:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe35.0.0.548654af7153mozalloc.dll35.0.0.548654af69d4800000030000142596c01d038d1fcca2baaC:\Program Files\Mozilla Firefox\plugin-container.exeC:\Program Files\Mozilla Firefox\mozalloc.dll40b1dd9b-a4c5-11e4-9ae7-00a0d5ffff85
Error: (01/25/2015 06:48:25 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\drivertuner\DPInst64.exe
Error: (01/25/2015 06:45:02 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"C:\Program Files\HP\HP Officejet 6700\DriverStore\Pipeline\amd64\hpinkins5C12.exe
Error: (01/25/2015 10:07:03 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (01/25/2015 08:24:09 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (01/24/2015 08:02:08 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: FormatFactory.exe3.5.1.0547593edmfc120u.dll12.0.21005.1524fabbdc00000050024e428e4801d038083e45b17dC:\Program Files\FreeTime\FormatFactory\FormatFactory.exeC:\Program Files\FreeTime\FormatFactory\mfc120u.dll7e546300-a3fb-11e4-8529-00a0d5ffff85
Error: (01/24/2015 08:01:52 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe35.0.0.548654af7153mozalloc.dll35.0.0.548654af69d48000000300001425b6001d038078aa3ed5eC:\Program Files\Mozilla Firefox\plugin-container.exeC:\Program Files\Mozilla Firefox\mozalloc.dll744fd0df-a3fb-11e4-8529-00a0d5ffff85
Error: (01/24/2015 06:42:59 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 Duo CPU T7250 @ 2.00GHz
Percentage of memory in use: 45%
Total physical RAM: 3062.3 MB
Available physical RAM: 1668.81 MB
Total Pagefile: 6122.88 MB
Available Pagefile: 4597.33 MB
Total Virtual: 2047.88 MB
Available Virtual: 1879.95 MB
==================== Drives ================================
Drive c: (Windows) (Fixed) (Total:66.71 GB) (Free:25.21 GB) NTFS
Drive f: (PRIVAT) (Fixed) (Total:465.64 GB) (Free:347.01 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 74.5 GB) (Disk ID: 37B70E1B)
Partition 1: (Active) - (Size=7.8 GB) - (Type=27)
Partition 2: (Not Active) - (Size=66.7 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (Size: 465.8 GB) (Disk ID: F5282A0E)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=0C)
==================== End Of Log ============================
|
|
26.01.2015, 09:17
| #4 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: Mysearchcom öffnet sich Mozilla Firefox Browser Zukünftig bitte beachten: Zitat:
Bitte alle Tools direkt auf den Desktop downloaden bzw. dorthin verschieben und vom Desktop starten, da unsere Anleitungen daraufhin ausgelegt sind. Zudem lassen sich dann am Ende der Bereinigung alle verwendeten Tools sehr einfach entfernen. Alle Tools bis zum Ende der Bereinigung auf dem Desktop lassen, evtl. benötigen wir manche öfter. Dann bitte jetzt Combofix ausführen: Scan mit Combofix
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
26.01.2015, 10:26
| #5 |
| | Windows 7: Mysearchcom öffnet sich Mozilla Firefox BrowserCode:
ATTFilter ComboFix 15-01-22.02 - Petra 26.01.2015 10:14:38.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.43.1031.18.3062.1677 [GMT 1:00]
ausgeführt von:: c:\users\Petra\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
SP: Microsoft Security Essentials *Disabled/Updated* {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Petra\AppData\Local\Temp\881D388e20.exe
c:\windows\iun6002.exe
c:\windows\system32\settings.ini
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-12-26 bis 2015-01-26 ))))))))))))))))))))))))))))))
.
.
2015-01-26 09:21 . 2015-01-26 09:22 -------- d-----w- c:\users\Petra\AppData\Local\temp
2015-01-26 09:21 . 2015-01-26 09:21 -------- d-----w- c:\users\Public\AppData\Local\temp
2015-01-26 09:21 . 2015-01-26 09:21 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-01-26 07:17 . 2015-01-26 07:17 4070576 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe
2015-01-26 06:37 . 2015-01-26 06:36 96680 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2015-01-26 06:36 . 2015-01-26 06:36 -------- dc----w- c:\program files\Java
2015-01-26 06:16 . 2015-01-26 06:18 -------- dc----w- C:\FRST
2015-01-25 19:19 . 2014-12-02 11:01 9054624 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{AA7A41F2-DF71-4257-8D98-4339ACDB8F0E}\mpengine.dll
2015-01-24 19:02 . 2015-01-24 19:02 -------- d-----w- c:\programdata\Baidu
2015-01-24 19:01 . 2015-01-24 19:01 -------- dc----w- c:\program files\FreeTime
2015-01-24 18:36 . 2015-01-24 18:38 -------- d-----w- c:\users\Petra\AppData\Local\Audible
2015-01-24 18:36 . 2015-01-24 18:36 255352 ----a-w- c:\windows\system32\awrdscdc.ax
2015-01-24 18:35 . 2001-08-17 21:43 24576 ------w- c:\windows\system32\msxml3a.dll
2015-01-24 18:35 . 2015-01-24 18:36 -------- dc----w- c:\program files\Audible
2015-01-24 17:55 . 2014-12-02 11:01 9054624 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2015-01-22 16:40 . 2014-09-16 18:24 908840 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CF2980BD-B303-47E9-8BE7-30D339983FEC}\gapaengine.dll
2015-01-16 21:08 . 2007-03-12 15:42 3495784 ----a-w- c:\windows\system32\d3dx9_33.dll
2015-01-16 21:06 . 2015-01-16 21:06 -------- d-----w- c:\users\Petra\AppData\Local\Cinebook
2015-01-16 21:05 . 2015-01-16 21:05 -------- d-----w- c:\programdata\Cinebook
2015-01-16 21:05 . 2015-01-16 21:05 -------- dc----w- c:\program files\Cinebook
2015-01-14 10:55 . 2014-12-12 05:11 3971512 ----a-w- c:\windows\system32\ntkrnlpa.exe
2015-01-14 10:55 . 2014-12-12 05:11 3916728 ----a-w- c:\windows\system32\ntoskrnl.exe
2015-01-14 10:55 . 2014-12-11 17:47 46592 ----a-w- c:\windows\system32\TSWbPrxy.exe
2015-01-14 10:55 . 2014-12-19 02:43 164864 ----a-w- c:\windows\system32\profsvc.dll
2015-01-14 10:55 . 2014-12-19 01:34 116224 ----a-w- c:\windows\system32\drivers\mrxdav.sys
2015-01-14 10:55 . 2014-12-06 03:50 242688 ----a-w- c:\windows\system32\nlasvc.dll
2015-01-09 12:48 . 2015-01-09 12:48 -------- dc----w- c:\program files\Hewlett-Packard
2015-01-04 07:48 . 2015-01-04 07:48 -------- dc----w- c:\program files\VideoLAN
2015-01-04 07:43 . 2015-01-23 18:00 -------- d-----w- c:\users\Petra\AppData\Roaming\vlc
2015-01-03 16:28 . 2015-01-04 09:22 -------- d-----w- c:\users\Petra\AppData\Roaming\FirefoxToolbar
2015-01-03 16:27 . 2015-01-06 06:39 -------- dc----w- c:\program files\Settings Manager
2015-01-03 16:12 . 2015-01-04 08:01 -------- dc----w- c:\program files\Free Codec Pack
2015-01-03 16:12 . 2015-01-04 08:01 -------- dc----w- c:\program files\DVDVideoSoft
2015-01-03 16:12 . 2015-01-04 08:00 -------- d-----w- c:\users\Petra\AppData\Roaming\RHEng
2015-01-03 15:46 . 2015-01-03 15:46 -------- dc----w- c:\program files\KdGConvert
2015-01-03 15:21 . 2015-01-03 15:21 -------- d-----w- c:\users\Petra\AppData\Local\DownloadManager
2015-01-03 15:17 . 2015-01-03 15:17 -------- dc----w- c:\program files\VTech
2015-01-03 15:17 . 2015-01-03 15:17 -------- d-----w- c:\programdata\VTech
2014-12-29 10:53 . 2015-01-16 19:29 -------- d-----w- c:\windows\AutoKMS
2014-12-29 10:51 . 2014-12-29 10:52 -------- d-----w- c:\programdata\Microsoft Toolkit
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-01-26 07:18 . 2013-03-29 18:39 71344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2015-01-26 07:18 . 2013-03-29 18:39 701616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2015-01-25 19:25 . 2014-08-21 09:05 114904 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-12-31 11:13 . 2012-08-23 07:47 249488 ------w- c:\windows\system32\MpSigStub.exe
2014-12-04 04:38 . 2014-12-10 06:46 337920 ----a-w- c:\windows\system32\generaltel.dll
2014-12-04 04:38 . 2014-12-10 06:46 610304 ----a-w- c:\windows\system32\invagent.dll
2014-12-04 04:38 . 2014-12-10 06:46 315392 ----a-w- c:\windows\system32\devinv.dll
2014-12-04 04:38 . 2014-12-10 06:46 728576 ----a-w- c:\windows\system32\appraiser.dll
2014-12-04 04:38 . 2014-12-10 06:46 159744 ----a-w- c:\windows\system32\aepic.dll
2014-12-04 04:38 . 2014-12-10 06:46 202752 ----a-w- c:\windows\system32\aepdu.dll
2014-12-04 04:34 . 2014-12-10 06:46 873984 ----a-w- c:\windows\system32\aeinv.dll
2014-12-01 23:28 . 2014-12-10 06:46 1160872 ----a-w- c:\windows\system32\aitstatic.exe
2014-11-24 20:44 . 2014-12-10 06:45 367104 ----a-w- c:\windows\system32\html.iec
2014-11-24 20:40 . 2014-12-10 06:45 1810944 ----a-w- c:\windows\system32\jscript9.dll
2014-11-24 20:35 . 2014-12-10 06:46 1129472 ----a-w- c:\windows\system32\wininet.dll
2014-11-24 20:34 . 2014-12-10 06:46 1427968 ----a-w- c:\windows\system32\inetcpl.cpl
2014-11-24 20:33 . 2014-12-10 06:45 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2014-11-24 20:33 . 2014-12-10 06:46 421376 ----a-w- c:\windows\system32\vbscript.dll
2014-11-24 20:32 . 2014-12-10 06:46 11776 ----a-w- c:\windows\system32\mshta.exe
2014-11-24 20:32 . 2014-12-10 06:45 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2014-11-23 08:03 . 2014-11-23 08:03 397312 ----a-w- c:\windows\iwexec.exe
2014-11-23 08:02 . 2014-11-23 08:03 83144 ----a-w- c:\windows\system32\picclp32.ocx
2014-11-23 08:02 . 2014-11-23 08:03 415504 ----a-w- c:\windows\system32\msrepl35.dll
2014-11-23 08:02 . 2014-11-23 08:03 35328 ----a-w- c:\windows\system32\Lttwn90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 288256 ----a-w- c:\windows\system32\Ltkrn90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 212480 ----a-w- c:\windows\system32\Pcdlib32.dll
2014-11-23 08:02 . 2014-11-23 08:03 98304 ----a-w- c:\windows\system32\Ltfil90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 88576 ----a-w- c:\windows\system32\Lffpx90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 64512 ----a-w- c:\windows\system32\Lffax90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 46592 ----a-w- c:\windows\system32\Lfica90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 39936 ----a-w- c:\windows\system32\Lfgif90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 35840 ----a-w- c:\windows\system32\Lflma90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 338944 ----a-w- c:\windows\system32\Lffpx7.dll
2014-11-23 08:02 . 2014-11-23 08:03 31232 ----a-w- c:\windows\system32\Lfpct90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 31232 ----a-w- c:\windows\system32\Lflmb90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 31232 ----a-w- c:\windows\system32\Lfeps90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 30720 ----a-w- c:\windows\system32\Lfpcx90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 29184 ----a-w- c:\windows\system32\Lfpsd90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 28160 ----a-w- c:\windows\system32\Lfwmf90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 28160 ----a-w- c:\windows\system32\Lftga90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 27648 ----a-w- c:\windows\system32\Lfwpg90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 27136 ----a-w- c:\windows\system32\Lfimg90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 26624 ----a-w- c:\windows\system32\Lfpcd90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 26624 ----a-w- c:\windows\system32\Lfcal90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 26112 ----a-w- c:\windows\system32\Lfras90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 26112 ----a-w- c:\windows\system32\Lfmsp90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 25600 ----a-w- c:\windows\system32\Lfwfx90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 25600 ----a-w- c:\windows\system32\Lfmac90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 236032 ----a-w- c:\windows\system32\Lfdic90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 235008 ----a-w- c:\windows\system32\Lfcmp90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 220160 ----a-w- c:\windows\system32\Ltdis90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 146432 ----a-w- c:\windows\system32\Ltefx90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 142336 ----a-w- c:\windows\system32\Ltdlg90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 133632 ----a-w- c:\windows\system32\Lfpng90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 122880 ----a-w- c:\windows\system32\Lfkodak.dll
2014-11-23 08:02 . 2014-11-23 08:03 118272 ----a-w- c:\windows\system32\Lftif90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 107008 ----a-w- c:\windows\system32\Ltimg90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 89360 ----a-w- c:\windows\system32\Vb5db.dll
2014-11-23 08:02 . 2014-11-23 08:03 557328 ----a-w- c:\windows\system32\dao360.dll
2014-11-23 08:02 . 2014-11-23 08:03 33792 ----a-w- c:\windows\system32\Lfbmp90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 28672 ----a-w- c:\windows\system32\Lfawd90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 24576 ----a-w- c:\windows\system32\Lfavi90n.dll
2014-11-23 08:02 . 2014-11-23 08:03 164144 ----a-w- c:\windows\system32\comct232.ocx
2014-11-21 05:14 . 2014-08-21 09:05 51928 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-11-21 05:14 . 2014-08-21 09:05 75480 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-11-21 05:14 . 2014-08-21 09:05 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-11-19 03:31 . 2014-11-19 03:31 1217192 ----a-w- c:\windows\system32\FM20.DLL
2014-11-11 02:44 . 2014-12-10 06:46 1011200 ----a-w- c:\windows\system32\WindowsCodecs.dll
2014-11-11 02:44 . 2014-11-19 06:52 186880 ----a-w- c:\windows\system32\pku2u.dll
2014-11-11 02:44 . 2014-11-19 06:52 550912 ----a-w- c:\windows\system32\kerberos.dll
2014-11-11 01:32 . 2014-12-10 06:46 74752 ----a-w- c:\windows\system32\drivers\tdx.sys
2014-11-08 02:45 . 2014-12-10 06:46 2048 ----a-w- c:\windows\system32\tzres.dll
2014-10-30 01:45 . 2014-12-10 06:45 155136 ----a-w- c:\windows\system32\charmap.exe
2014-02-10 20:19 . 2014-02-10 20:19 49940480 -c--a-w- c:\program files\GUT8DC9.tmp
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2014-12-15 21:26 297128 ----a-w- c:\program files\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 131480 ----a-w- c:\users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 131480 ----a-w- c:\users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 131480 ----a-w- c:\users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Officejet 6700 (NET)"="c:\program files\HP\HP Officejet 6700\Bin\ScanToPCActivationApp.exe" [2012-10-17 1837672]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-08-07 186904]
"AcWin7Hlpr"="c:\program files\Lenovo\Access Connections\AcTBenabler.exe" [2012-05-30 64608]
"PWMTRV"="c:\progra~1\ThinkPad\UTILIT~1\PWMTR32V.DLL" [2012-05-16 4395104]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2009-05-18 1314816]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2012-07-05 2342200]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 150552]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2014-08-22 974432]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-09-13 59720]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2013-05-30 96056]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-12-03 1021128]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2014-10-02 421888]
"AgentMonitor"="c:\program files\VTech\DownloadManager\System\AgentMonitor.exe" [2014-06-20 401280]
.
c:\users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Petra\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-12-9 39207112]
Tintenwarnungen überwachen - HP Officejet 6700 (Netzwerk).lnk - c:\windows\system32\RunDll32.exe "c:\program files\HP\HP Officejet 6700\bin\HPStatusBL.dll",RunDLLEntry SERIALNUMBER=CN36RB5H2205RQ;CONNECTION=NW;MONITOR=1; [2009-7-14 44544]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2011-1-24 804128]
Secunia PSI Tray.lnk - c:\program files\Secunia\PSI\psi_tray.exe [2013-12-6 565464]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableSecureUIAPath"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R1 MpKsl232a813f;MpKsl232a813f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9D2D426B-D821-4D92-9878-16F1FE6B4474}\MpKsl232a813f.sys [x]
R2 Secunia Update Agent;Secunia Update Agent;c:\program files\Secunia\PSI\sua.exe [2013-12-06 662232]
R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2010-04-08 45736]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 29472]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2014-07-17 95920]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe [2014-08-22 288120]
R3 PwmEWSvc;Cisco EnergyWise Enabler;c:\program files\ThinkPad\Utilities\PWMEWSVC.EXE [2012-05-16 1665120]
R3 SmbDrv;SmbDrv;c:\windows\system32\drivers\Smb_driver_AMDASF.sys [2012-07-05 22840]
R3 SmbDrvI;SmbDrvI;c:\windows\system32\drivers\Smb_driver_Intel.sys [2012-07-05 23608]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2013-03-30 1343400]
S0 DozeHDD;DozeHDD;c:\windows\System32\DRIVERS\DozeHDD.sys [2012-05-16 25416]
S1 wStLibG;wStLibG;c:\windows\system32\drivers\wStLibG.sys [2014-04-21 52920]
S2 HPSupportSolutionsFrameworkService;HP Support Solutions Framework Service;c:\program files\Hp\Common\HPSupportSolutionsFrameworkService.exe [2014-12-11 89864]
S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files\Secunia\PSI\PSIA.exe [2013-12-06 1229528]
S3 DozeSvc;Lenovo Doze Mode Service;c:\program files\ThinkPad\Utilities\DOZESVC.EXE [2012-05-16 280640]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [2015-01-25 114904]
S3 netw5v32;Intel(R) Wireless WiFi Link 5000-Serie - Adaptertreiber für Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
S3 Power Manager DBC Service;Power Manager DBC Service;c:\program files\ThinkPad\Utilities\PWMDBSVC.EXE [2012-05-16 1662560]
S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf_x86.sys [2013-12-06 16024]
S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
S3 SWNC8U01;Sierra Wireless MUX NDIS Driver (UMTS01);c:\windows\system32\DRIVERS\SWNC8U01.sys [2007-01-12 102144]
S3 SWUMX01;Sierra Wireless USB MUX Driver (UMTS01);c:\windows\system32\DRIVERS\swumx01.sys [2007-01-12 70656]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - MBAMSWISSARMY
*NewlyCreated* - MPKSLC6051E11
*Deregistered* - MpKslc6051e11
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS fdrespub AppIDSvc QWAVE wcncsvc SensrSvc FontCache Mcx2Svc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-01-24 06:47 1086280 ----a-w- c:\program files\Google\Chrome\Application\40.0.2214.91\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2015-01-26 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-11-06 07:18]
.
2015-01-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-05-31 05:17]
.
2015-01-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-05-31 05:17]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = www.google.com
mStart Page = www.google.com
uSearchAssistant = www.google.com
IE: An OneNote s&enden - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
IE: Free YouTube to MP3 Converter - c:\program files\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie.htm
IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - c:\program files\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
TCP: DhcpNameServer = 10.0.0.138 10.0.0.138
FF - ProfilePath - c:\users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\co30ngci.default-1422215147327\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.at/
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-10 - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2015-01-26 10:24:05
ComboFix-quarantined-files.txt 2015-01-26 09:24
.
Vor Suchlauf: 12 Verzeichnis(se), 26.465.714.176 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 27.132.469.248 Bytes frei
.
- - End Of File - - DC2A8FEF0627421E33D55628BA518EDC
A36C5E4F47E84449FF07ED3517B43A31
|
|
26.01.2015, 10:35
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: Mysearchcom öffnet sich Mozilla Firefox Browser Adware/Junkware/Toolbars entfernen (alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!) 1. Schritt: adwCleaner Downloade Dir bitte  AdwCleaner auf deinen Desktop.
2. Schritt: JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
3. Schritt: Frisches Log mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ --> Windows 7: Mysearchcom öffnet sich Mozilla Firefox Browser |
|
26.01.2015, 10:59
| #7 |
| | Windows 7: Mysearchcom öffnet sich Mozilla Firefox BrowserCode:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.1 (12.28.2014:1)
OS: Windows 7 Home Premium x86
Ran by Petra on 26.01.2015 at 10:51:24,67
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\update clearthink
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\util clearthink
~~~ Files
Successfully deleted: [File] C:\Windows\System32\Tasks\DriverTuner Startup
~~~ Folders
Successfully deleted: [Empty Folder] C:\Users\Petra\appdata\local\{36CD1033-D499-442E-A36A-53E1BE07330C}
Successfully deleted: [Empty Folder] C:\Users\Petra\appdata\local\{3EE89E6B-8B3A-4419-894F-8088E96A3CDC}
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 26.01.2015 at 10:53:38,67
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
ATTFilter # AdwCleaner v4.109 - Bericht erstellt am 26/01/2015 um 10:44:18
# Aktualisiert 24/01/2015 von Xplode
# Database : 2015-01-25.1 [Live]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (32 bits)
# Benutzername : Petra - PETRA-PC
# Gestartet von : C:\Users\Petra\Downloads\AdwCleaner_4.109.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\baidu
Ordner Gelöscht : C:\ProgramData\b089358267e0237d
Ordner Gelöscht : C:\Program Files\Settings Manager
Ordner Gelöscht : C:\Program Files\Vidplaya
Ordner Gelöscht : C:\Users\Petra\AppData\Local\DownloadManager
Ordner Gelöscht : C:\Users\Petra\AppData\Roaming\FirefoxToolbar
Ordner Gelöscht : C:\Users\Petra\AppData\Roaming\RHEng
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
Verknüpfung Desinfiziert : C:\Users\Public\Desktop\Google Chrome.lnk
Verknüpfung Desinfiziert : C:\Users\Public\Desktop\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk
Verknüpfung Desinfiziert : C:\Users\Petra\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
Verknüpfung Desinfiziert : C:\Users\Petra\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKLM\SOFTWARE\SupDp
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
***** [ Browser ] *****
-\\ Internet Explorer v0.0.0.0
-\\ Mozilla Firefox v35.0 (x86 de)
-\\ Google Chrome v40.0.2214.91
[C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://feed.snapdo.com/?publisher=SnapdoSoftonicYB&dpid=SnapdoSoftonicYB&co=AT&userid=fc84b881-dbc4-fd8c-c066-be1e7643f9a2&searchtype=ds&q={searchTerms}&installDate=21/12/2013
[C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://feed.snapdo.com/?publisher=SnapdoSoftonicYB&dpid=SnapdoSoftonicYB&co=AT&userid=fc84b881-dbc4-fd8c-c066-be1e7643f9a2&searchtype=ds&q={searchTerms}&installDate=21/12/2013
[C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dvd_14_15_ff&cd=2XzuyEtN2Y1L1QzutDtD0AtD0DyD0F0F0F0FzzyDyDyC0EzytN0D0Tzu0SzztAtAtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StCyDtBzzyCyCtA0FtG0EtCtDyDtGyBzzyCtDtGtB0EyEyBtGyB0A0EtA0C0Ezz0DzztB0CyB2QtN1M1F1B2Z1V1N2Y1L1Qzu2StAtBzz0Fzy0D0EtDtGtDtByB0CtGtDyE0FyDtG0DyEtB0FtGtB0A0ByCyC0Ezy0E0AyBtBtA2Q&cr=294409713&ir=
[C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.buenosearch.com/?q={searchTerms}&babsrc=SP_ss&mntrId=285C00A0D5FFFF85&affID=128492&tsp=5221
[C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M53BE9289-5B71-404B-A9D4-15DB387ADCFE&SearchSource=58&CUI=&UM=5&UP=SP1E90BFB9-87F8-45E5-BA13-C8B6775B64F9&q={searchTerms}&SSPV=
[C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.doko-search.com/?q={searchTerms}&babsrc=SP_ss_mib2&mntrId=285C00A0D5FFFF85&affID=128492&tsp=5221
[C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.doko-search.com/?q={searchTerms}&babsrc=SP_ss_mib2&mntrId=285C00A0D5FFFF85&affID=128492&tsp=5221
[C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M53BE9289-5B71-404B-A9D4-15DB387ADCFE&SearchSource=58&CUI=&UM=5&UP=SP1E90BFB9-87F8-45E5-BA13-C8B6775B64F9&q={searchTerms}&SSPV=
[C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.mystartsearch.com/web/?type=ds&ts=1422126110&from=smt&uid=WDCXWD800BEVS-08RST3_WD-WXC808A2355423554&q={searchTerms}
[C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.mystartsearch.com/web/?type=ds&ts=1422126110&from=smt&uid=WDCXWD800BEVS-08RST3_WD-WXC808A2355423554&q={searchTerms}
[C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gelöscht [Homepage] : hxxp://www.mystartsearch.com/?type=hp&ts=1420357278&from=wpc&uid=WDCXWD800BEVS-08RST3_WD-WXC808A2355423554
[C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gelöscht [Startup_URLs] : hxxp://www.mystartsearch.com/?type=hp&ts=1420357278&from=wpc&uid=WDCXWD800BEVS-08RST3_WD-WXC808A2355423554
[C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gelöscht [Homepage] : hxxp://www.mystartsearch.com/?type=hp&ts=1420357278&from=wpc&uid=WDCXWD800BEVS-08RST3_WD-WXC808A2355423554
[C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gelöscht [Startup_URLs] : hxxp://www.mystartsearch.com/?type=hp&ts=1420357278&from=wpc&uid=WDCXWD800BEVS-08RST3_WD-WXC808A2355423554
*************************
AdwCleaner[R0].txt - [5960 octets] - [26/01/2015 10:42:33]
AdwCleaner[S0].txt - [6495 octets] - [26/01/2015 10:44:18]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [6555 octets] ##########
FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 24-01-2015 01
Ran by Petra (administrator) on PETRA-PC on 26-01-2015 10:56:13
Running from C:\Users\Petra\Desktop
Loaded Profiles: Petra (Available profiles: Petra)
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Lenovo) C:\Windows\System32\ibmpmsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(Lenovo) C:\Program Files\Lenovo\Access Connections\AcPrfMgrSvc.exe
(Andrea Electronics Corporation) C:\Windows\System32\AEADISRV.EXE
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(Hewlett-Packard Company) C:\Program Files\HP\Common\HPSupportSolutionsFrameworkService.exe
(Secunia) C:\Program Files\Secunia\PSI\psia.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Lenovo) C:\Program Files\Lenovo\Access Connections\AcSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\System32\FXSSVC.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Analog Devices, Inc.) C:\Program Files\Analog Devices\Core\smax4pnp.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Apple Inc.) C:\Program Files\QuickTime\QTTask.exe
() C:\Program Files\VTech\DownloadManager\System\AgentMonitor.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6700\Bin\ScanToPCActivationApp.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
(Secunia) C:\Program Files\Secunia\PSI\psi_tray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Dropbox, Inc.) C:\Users\Petra\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6700\Bin\HPNetworkCommunicatorCom.exe
(Lenovo Group Limited) C:\Program Files\ThinkPad\Utilities\SCHTASK.EXE
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6700\Bin\HPNetworkCommunicator.exe
(Lenovo) C:\Program Files\Lenovo\Access Connections\SvcGuiHlpr.exe
(Lenovo.) C:\Program Files\ThinkPad\Utilities\DOZESVC.EXE
(Thisisu) C:\Users\Petra\Downloads\JRT.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\prevhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-08-07] (Intel Corporation)
HKLM\...\Run: [AcWin7Hlpr] => C:\Program Files\Lenovo\Access Connections\AcTBenabler.exe [64608 2012-05-30] (Lenovo)
HKLM\...\Run: [PWMTRV] => rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWMTR32V.DLL,PwrMgrBkGndMonitor
HKLM\...\Run: [SoundMAXPnP] => C:\Program Files\Analog Devices\Core\smax4pnp.exe [1314816 2009-05-18] (Analog Devices, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2342200 2012-07-05] (Synaptics Incorporated)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [974432 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-12-03] (Adobe Systems Incorporated)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKLM\...\Run: [AgentMonitor] => C:\Program Files\VTech\DownloadManager\System\AgentMonitor.exe [401280 2014-06-20] ()
HKU\S-1-5-21-4103409644-2115618623-1480157512-1001\...\Run: [HP Officejet 6700 (NET)] => C:\Program Files\HP\HP Officejet 6700\Bin\ScanToPCActivationApp.exe [1837672 2012-10-17] (Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia)
Startup: C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Petra\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 6700 (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet 6700 (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet 6700\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-4103409644-2115618623-1480157512-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-4103409644-2115618623-1480157512-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
DPF: {D27CDB6E-AE6D-11CF-96B8-720720720720} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138 10.0.0.138
FireFox:
========
FF ProfilePath: C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\co30ngci.default-1422215147327
FF Homepage: hxxp://www.google.at/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_296.dll ()
FF Plugin: @java.com/DTPlugin,version=10.75.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.75.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
StartMenuInternet: FIREFOX.EXE - firefox.exe
Chrome:
=======
CHR Profile: C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-05-31]
CHR Extension: (Google Drive) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-24]
CHR Extension: (YouTube) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-24]
CHR Extension: (Google-Suche) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-24]
CHR Extension: (Google Mail) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-24]
StartMenuInternet: Google Chrome - Chrome.exe
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AcPrfMgrSvc; C:\Program Files\Lenovo\Access Connections\AcPrfMgrSvc.exe [134240 2012-05-30] (Lenovo)
R2 AcSvc; C:\Program Files\Lenovo\Access Connections\AcSvc.exe [273504 2012-05-30] (Lenovo)
R2 HPSupportSolutionsFrameworkService; C:\Program Files\Hp\Common\HPSupportSolutionsFrameworkService.exe [89864 2014-12-11] (Hewlett-Packard Company)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22192 2014-08-22] (Microsoft Corporation)
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [288120 2014-08-22] (Microsoft Corporation)
S3 PwmEWSvc; C:\Program Files\ThinkPad\Utilities\PWMEWSVC.EXE [1665120 2012-05-16] (Lenovo Group Limited)
R2 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
S2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2015-01-25] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [231800 2014-07-17] (Microsoft Corporation)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_x86.sys [16024 2013-12-06] (Secunia)
S3 SmbDrv; C:\Windows\system32\drivers\Smb_driver_AMDASF.sys [22840 2012-07-05] (Synaptics Incorporated)
S3 SmbDrvI; C:\Windows\system32\drivers\Smb_driver_Intel.sys [23608 2012-07-05] (Synaptics Incorporated)
R3 SWNC8U01; C:\Windows\System32\DRIVERS\SWNC8U01.sys [102144 2007-01-12] (Sierra Wireless Inc.)
R3 SWUMX01; C:\Windows\System32\DRIVERS\swumx01.sys [70656 2007-01-12] (Sierra Wireless Inc.)
R1 wStLibG; C:\Windows\System32\drivers\wStLibG.sys [52920 2014-04-21] (StdLib)
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Petra\AppData\Local\Temp\catchme.sys [X]
S3 HSF_DPV; system32\DRIVERS\HSX_DPV.sys [X]
S3 HSXHWAZL; system32\DRIVERS\HSXHWAZL.sys [X]
S2 mdmxsdk; system32\DRIVERS\mdmxsdk.sys [X]
S1 MpKsl232a813f; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{9D2D426B-D821-4D92-9878-16F1FE6B4474}\MpKsl232a813f.sys [X]
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-14] (Microsoft Corporation)
S3 winachsf; system32\DRIVERS\HSX_CNXT.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-26 10:56 - 2015-01-26 10:56 - 00014610 _____ () C:\Users\Petra\Desktop\FRST.txt
2015-01-26 10:53 - 2015-01-26 10:53 - 00001177 _____ () C:\Users\Petra\Desktop\JRT.txt
2015-01-26 10:51 - 2015-01-26 10:51 - 00001142 _____ () C:\Users\Petra\Desktop\ComboFix.exe - Verknüpfung.lnk
2015-01-26 10:50 - 2015-01-26 10:50 - 01707939 _____ (Thisisu) C:\Users\Petra\Downloads\JRT.exe
2015-01-26 10:41 - 2015-01-26 10:44 - 00000000 ___DC () C:\AdwCleaner
2015-01-26 10:41 - 2015-01-26 10:41 - 02194432 _____ () C:\Users\Petra\Desktop\AdwCleaner_4.109.exe
2015-01-26 10:26 - 2015-01-26 10:53 - 00065536 ___HT () C:\Users\Petra\~Outlook.pst.tmp
2015-01-26 10:24 - 2015-01-26 10:24 - 00020692 ____C () C:\ComboFix.txt
2015-01-26 10:13 - 2015-01-26 10:24 - 00000000 ___DC () C:\Qoobox
2015-01-26 10:13 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-01-26 10:13 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-01-26 10:13 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-01-26 10:13 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-01-26 10:13 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-01-26 10:13 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2015-01-26 10:13 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2015-01-26 10:13 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2015-01-26 10:10 - 2015-01-26 10:10 - 05609462 ____R (Swearware) C:\Users\Petra\Downloads\ComboFix.exe
2015-01-26 08:17 - 2015-01-26 08:17 - 04070576 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerInstaller.exe
2015-01-26 07:37 - 2015-01-26 07:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-01-26 07:37 - 2015-01-26 07:36 - 00272808 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2015-01-26 07:37 - 2015-01-26 07:36 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2015-01-26 07:37 - 2015-01-26 07:36 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2015-01-26 07:37 - 2015-01-26 07:36 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2015-01-26 07:36 - 2015-01-26 07:36 - 00000000 ___DC () C:\Program Files\Java
2015-01-26 07:17 - 2015-01-26 07:18 - 00032852 _____ () C:\Users\Petra\Downloads\Addition.txt
2015-01-26 07:16 - 2015-01-26 10:56 - 00000000 ___DC () C:\FRST
2015-01-26 07:15 - 2015-01-26 07:15 - 01120768 _____ (Farbar) C:\Users\Petra\Desktop\FRST.exe
2015-01-24 20:02 - 2015-01-24 20:02 - 00001167 _____ () C:\Users\Petra\Desktop\Format Factory.lnk
2015-01-24 20:02 - 2015-01-24 20:02 - 00000000 ____D () C:\Users\Public\Documents\Baidu
2015-01-24 20:02 - 2015-01-24 20:02 - 00000000 ____D () C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FormatFactory
2015-01-24 20:01 - 2015-01-24 20:01 - 00000000 ___DC () C:\Program Files\FreeTime
2015-01-24 19:58 - 2015-01-24 20:00 - 52876065 _____ (Free Time) C:\Users\Petra\Downloads\FFSetup3.5.1.exe
2015-01-24 19:36 - 2015-01-24 19:38 - 00000000 ____D () C:\Users\Petra\AppData\Local\Audible
2015-01-24 19:36 - 2015-01-24 19:36 - 00255352 _____ (Audible, Inc.) C:\Windows\system32\awrdscdc.ax
2015-01-24 19:36 - 2015-01-24 19:36 - 00001922 _____ () C:\Users\Petra\Desktop\Audible Manager.lnk
2015-01-24 19:36 - 2015-01-24 19:36 - 00000327 _____ () C:\Users\Petra\Downloads\admhelper
2015-01-24 19:35 - 2015-01-24 19:36 - 00000000 ___DC () C:\Program Files\Audible
2015-01-24 19:35 - 2015-01-24 19:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AudibleManager
2015-01-24 19:35 - 2015-01-24 19:35 - 01730272 _____ (Audible Inc.) C:\Users\Petra\Downloads\ActiveSetupN.exe
2015-01-24 19:35 - 2015-01-24 19:35 - 00000000 ____D () C:\Users\Public\Documents\Audible
2015-01-24 19:35 - 2015-01-24 19:35 - 00000000 ____D () C:\Users\Petra\Documents\Audible
2015-01-24 19:35 - 2001-08-17 22:43 - 00024576 ____N (Microsoft Corporation) C:\Windows\system32\msxml3a.dll
2015-01-23 18:51 - 2014-08-06 11:48 - 84653241 _____ () C:\Users\Petra\Desktop\Heidi_Folge_09_deutsch.mp4
2015-01-23 18:51 - 2014-07-01 14:48 - 22476897 _____ () C:\Users\Petra\Desktop\Heidi Folge 6 deutsch_youtube_original.m4a
2015-01-23 18:51 - 2014-07-01 14:47 - 22011301 _____ () C:\Users\Petra\Desktop\Heidi Folge 7 deutsch_youtube_original.m4a
2015-01-19 19:54 - 2015-01-19 19:57 - 33095216 _____ () C:\Users\Petra\Downloads\Millionenshow.zip
2015-01-17 10:26 - 2015-01-17 10:26 - 00000000 ___DC () C:\Program Files\Mozilla Firefox
2015-01-16 22:08 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_33.dll
2015-01-16 22:07 - 2015-01-16 22:08 - 00037683 _____ () C:\Windows\DirectX.log
2015-01-16 22:06 - 2015-01-16 22:06 - 00001109 _____ () C:\Users\Public\Desktop\Cinebook Designer.lnk
2015-01-16 22:06 - 2015-01-16 22:06 - 00000000 ____D () C:\Users\Petra\AppData\Local\Cinebook
2015-01-16 22:06 - 2015-01-16 22:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cinebook
2015-01-16 22:05 - 2015-01-16 22:05 - 00000000 ___DC () C:\Program Files\Cinebook
2015-01-16 22:05 - 2015-01-16 22:05 - 00000000 ____D () C:\ProgramData\Cinebook
2015-01-16 22:02 - 2015-01-16 22:05 - 81900272 _____ ( ) C:\Users\Petra\Downloads\Cinebook_Fotobuch.exe
2015-01-14 11:55 - 2014-12-19 03:43 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 11:55 - 2014-12-19 02:34 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 11:55 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-01-14 11:55 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 11:55 - 2014-12-11 18:47 - 00046592 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 11:55 - 2014-12-06 04:50 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-10 09:26 - 2015-01-26 10:45 - 00000896 _____ () C:\Windows\setupact.log
2015-01-10 09:26 - 2015-01-10 09:26 - 00000000 _____ () C:\Windows\setuperr.log
2015-01-09 13:48 - 2015-01-09 13:48 - 00000326 _____ () C:\Users\Petra\Desktop\HP Druckerdiagnosetools.url
2015-01-09 13:48 - 2015-01-09 13:48 - 00000000 ___DC () C:\Program Files\Hewlett-Packard
2015-01-06 07:42 - 2015-01-26 10:55 - 01795072 _____ () C:\Users\Petra\Outlook.pst
2015-01-04 09:01 - 2015-01-04 09:01 - 00002187 _____ () C:\Users\Public\Desktop\Free YouTube Download.lnk
2015-01-04 08:58 - 2015-01-04 08:58 - 03533856 _____ (DVDVideoSoft Ltd. ) C:\Users\Petra\Downloads\FreeYouTubeDownload.exe
2015-01-04 08:48 - 2015-01-04 08:48 - 00001035 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2015-01-04 08:48 - 2015-01-04 08:48 - 00000000 ___DC () C:\Program Files\VideoLAN
2015-01-04 08:48 - 2015-01-04 08:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2015-01-04 08:45 - 2015-01-04 08:45 - 01174352 _____ () C:\Users\Petra\Downloads\VLC media player 32 Bit - CHIP-Installer.exe
2015-01-04 08:43 - 2015-01-23 19:00 - 00000000 ____D () C:\Users\Petra\AppData\Roaming\vlc
2015-01-03 17:13 - 2015-01-03 17:13 - 00002283 _____ () C:\Users\Public\Desktop\Free YouTube to MP3 Converter.lnk
2015-01-03 17:12 - 2015-01-04 09:01 - 00000000 ___DC () C:\Program Files\Free Codec Pack
2015-01-03 17:12 - 2015-01-04 09:01 - 00000000 ___DC () C:\Program Files\DVDVideoSoft
2015-01-03 17:09 - 2015-01-03 17:10 - 03533800 _____ (DVDVideoSoft Ltd. ) C:\Users\Petra\Downloads\FreeYouTubeToMP3-1215Converter.exe
2015-01-03 16:46 - 2015-01-03 16:46 - 00001000 _____ () C:\Users\Public\Desktop\KdGConvert.lnk
2015-01-03 16:46 - 2015-01-03 16:46 - 00000000 ___DC () C:\Program Files\KdGConvert
2015-01-03 16:46 - 2015-01-03 16:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KdGConvert
2015-01-03 16:44 - 2015-01-03 16:44 - 08472030 _____ (Universal Ware ) C:\Users\Petra\Downloads\Setup_KdGConvert.exe
2015-01-03 16:17 - 2015-01-03 16:17 - 00001186 _____ () C:\Users\Public\Desktop\VTech Download Manager.lnk
2015-01-03 16:17 - 2015-01-03 16:17 - 00000000 ___DC () C:\Program Files\VTech
2015-01-03 16:17 - 2015-01-03 16:17 - 00000000 ____D () C:\ProgramData\VTech
2015-01-03 16:17 - 2015-01-03 16:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VTech
2015-01-03 16:09 - 2015-01-03 16:09 - 15475904 _____ (VTech) C:\Users\Petra\Downloads\KidiGo_DE_ger_Setup.exe
2014-12-29 11:53 - 2015-01-16 20:29 - 00000000 ____D () C:\Windows\AutoKMS
2014-12-29 11:51 - 2014-12-29 11:52 - 00000000 ____D () C:\ProgramData\Microsoft Toolkit
2014-12-29 11:50 - 2014-12-29 11:51 - 37915356 _____ () C:\Users\Petra\Downloads\Toolkit.zip
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-26 10:54 - 2013-05-31 06:17 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-26 10:53 - 2013-03-29 15:33 - 00000000 ____D () C:\Users\Petra
2015-01-26 10:53 - 2009-07-14 05:34 - 00028944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-26 10:53 - 2009-07-14 05:34 - 00028944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-26 10:50 - 2013-03-29 15:22 - 01889956 _____ () C:\Windows\WindowsUpdate.log
2015-01-26 10:48 - 2013-06-24 09:30 - 00000000 ___RD () C:\Users\Petra\Dropbox
2015-01-26 10:48 - 2013-06-24 09:27 - 00000000 ____D () C:\Users\Petra\AppData\Roaming\Dropbox
2015-01-26 10:48 - 2013-05-31 06:17 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-26 10:45 - 2014-08-20 07:18 - 00239988 _____ () C:\Windows\PFRO.log
2015-01-26 10:45 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-26 10:44 - 2014-08-24 11:08 - 00001030 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-01-26 10:44 - 2014-08-24 11:08 - 00001018 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-01-26 10:44 - 2013-05-31 06:22 - 00001247 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-01-26 10:44 - 2013-05-31 06:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-01-26 10:22 - 2009-07-14 03:04 - 00000215 ____C () C:\Windows\system.ini
2015-01-26 10:17 - 2013-11-06 19:51 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-26 10:13 - 2014-08-20 14:30 - 00000000 ____D () C:\Windows\erdnt
2015-01-26 08:18 - 2013-03-29 19:39 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-01-26 08:18 - 2013-03-29 19:39 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-01-26 07:38 - 2014-08-24 19:07 - 00008258 _____ () C:\Windows\SecuniaPackage.log
2015-01-26 07:13 - 2013-11-26 18:36 - 00000000 ____D () C:\Users\Petra\AppData\Local\CrashDumps
2015-01-25 20:25 - 2014-08-21 10:05 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-25 20:07 - 2010-11-21 01:55 - 00000000 ____D () C:\Windows\ShellNew
2015-01-24 19:41 - 2010-11-20 22:01 - 01628044 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-20 19:59 - 2013-04-01 19:08 - 00000000 ____D () C:\ProgramData\tmp
2015-01-18 09:05 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-01-18 08:57 - 2014-08-24 11:08 - 00000000 ___DC () C:\Program Files\Mozilla Maintenance Service
2015-01-18 08:57 - 2009-07-14 05:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-01-16 08:44 - 2013-11-24 12:28 - 00000000 ____D () C:\Users\Petra\AppData\Roaming\HpUpdate
2015-01-15 17:40 - 2014-08-23 18:59 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-15 17:33 - 2012-08-23 09:03 - 110348472 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-10 09:26 - 2009-07-14 05:33 - 00413376 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-09 13:49 - 2013-03-29 15:33 - 00110408 _____ () C:\Users\Petra\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-07 14:29 - 2013-11-24 20:14 - 00000000 ____D () C:\Users\Petra\Desktop\Julia
2015-01-06 11:20 - 2009-07-14 05:52 - 00000000 ____D () C:\Program Files\Microsoft Games
2015-01-06 07:39 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Registration
2015-01-04 09:02 - 2014-05-05 19:11 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2015-01-04 09:01 - 2013-05-20 20:01 - 00001210 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
2015-01-04 09:01 - 2013-05-20 20:00 - 00000000 ____D () C:\Users\Petra\AppData\Roaming\DVDVideoSoft
2015-01-04 09:01 - 2013-05-20 20:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2015-01-04 09:01 - 2013-05-20 20:00 - 00000000 ____D () C:\Program Files\Common Files\DVDVideoSoft
2014-12-31 12:13 - 2012-08-23 08:47 - 00249488 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
==================== Files in the root of some directories =======
2014-02-10 21:19 - 2014-02-10 21:19 - 49940480 ____C () C:\Program Files\GUT8DC9.tmp
2014-04-13 09:33 - 2014-07-19 10:46 - 0000089 _____ () C:\Users\Petra\AppData\Roaming\WB.CFG
2014-07-24 19:29 - 2014-07-24 19:29 - 0004608 _____ () C:\Users\Petra\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-12-20 17:47 - 2014-12-20 17:47 - 0006171 _____ () C:\Users\Petra\AppData\Local\recently-used.xbel
2013-11-24 12:26 - 2013-11-24 12:26 - 0000057 _____ () C:\ProgramData\Ament.ini
Some content of TEMP:
====================
C:\Users\Petra\AppData\Local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpnix6uc.dll
C:\Users\Petra\AppData\Local\temp\Quarantine.exe
C:\Users\Petra\AppData\Local\temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-01-24 08:14
==================== End Of Log ============================
--- --- --- --- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 24-01-2015 01
Ran by Petra at 2015-01-26 10:57:18
Running from C:\Users\Petra\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Microsoft Security Essentials (Disabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AS: Microsoft Security Essentials (Disabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 16 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Apple Application Support (HKLM\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Audacity 2.0.4 (HKLM\...\Audacity_is1) (Version: 2.0.4 - Audacity Team)
AudibleManager (HKLM\...\AudibleManager) (Version: 1995135712.48.56.5836010 - Audible, Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 4.09 - Piriform)
Cinebook PhotoGenie 5.3 (HKLM\...\Cinebook Fotobuch_is1) (Version: - )
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
DriverTuner 3.1.0.1 (HKLM\...\{520C1D80-935C-42B9-9340-E883849D804F}_is1) (Version: 3.1.0.1 - LionSea SoftWare)
Dropbox (HKU\S-1-5-21-4103409644-2115618623-1480157512-1001\...\Dropbox) (Version: 3.0.3 - Dropbox, Inc.)
Energie-Manager (HKLM\...\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}) (Version: 6.32 - )
FormatFactory 3.5.1.0 (HKLM\...\FormatFactory) (Version: 3.5.1.0 - Format Factory)
FOTO AT Fotowelt (HKLM\...\FOTO AT Fotowelt) (Version: 5.1.7 - CEWE Stiftung u Co. KGaA)
Foxit Reader (HKLM\...\Foxit Reader_is1) (Version: 5.4.5.124 - Foxit Corporation)
Free Audio CD Burner version 2.0.25.430 (HKLM\...\Free Audio CD Burner_is1) (Version: 2.0.25.430 - DVDVideoSoft Ltd.)
Free AVI Video Converter version 5.0.45.716 (HKLM\...\Free AVI Video Converter_is1) (Version: 5.0.45.716 - DVDVideoSoft Ltd.)
Free YouTube Download version 3.2.51.1215 (HKLM\...\Free YouTube Download_is1) (Version: 3.2.51.1215 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.12.52.1215 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.52.1215 - DVDVideoSoft Ltd.)
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Google Chrome (HKLM\...\Google Chrome) (Version: 40.0.2214.91 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
HERMA Label Designer plus 1.1 (HKLM\...\{7DA64485-2CEE-4F7B-84AB-B287236703B6}) (Version: 1.00.0000 - HERMA GmbH)
HP FWUpdateEDO2 (HKLM\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Officejet 6700 - Grundlegende Software für das Gerät (HKLM\...\{7D1EFB03-7D84-446E-8B90-6ECD7EDF4D55}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Officejet 6700 Hilfe (HKLM\...\{E1AE0CB7-1333-4728-8520-CB3F88A252B4}) (Version: 140.0.2.2 - Hewlett Packard)
HP Support Solutions Framework (HKLM\...\{96D12EC9-720B-45FB-904C-36D6307A1C76}) (Version: 11.51.0048 - Hewlett-Packard Company)
HP Update (HKLM\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (Version: 1.00.0001 - Microsoft) Hidden
I.R.I.S. OCR (HKLM\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
Image Resizer for Windows (HKLM\...\{69d72156-6582-4556-8637-06f40aa7f85b}) (Version: 3.0.4802.35565 - Brice Lambson)
Image Resizer for Windows (Version: 3.0.4802.35565 - Brice Lambson) Hidden
Inkscape 0.48.5 (HKLM\...\Inkscape) (Version: 0.48.5 - )
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1930 - Intel Corporation)
Intel(R) TV Wizard (HKLM\...\TVWiz) (Version: - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - Intel Corporation)
Java 7 Update 75 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F03217075FF}) (Version: 7.0.750 - Oracle)
Junk Mail filter update (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
KdGConvert Version 1.0 (HKLM\...\{79AA560F-5CC6-4A0E-81A3-E604FF280D45}_is1) (Version: 1.0 - Universal Ware)
LAME v3.99.3 (for Windows) (HKLM\...\LAME_is1) (Version: - )
Lenovo Patch Utility (HKLM\...\{6E6E7725-C7BC-4C39-8B3F-14B67331A120}) (Version: 1.3.0.9 - Lenovo Group Limited)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Mozilla Firefox 35.0 (x86 de) (HKLM\...\Mozilla Firefox 35.0 (x86 de)) (Version: 35.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 32.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser and SDK (HKLM\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
NVIDIA Grafiktreiber 296.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 296.88 - NVIDIA Corporation)
NVIDIA nView Desktop Manager (HKLM\...\NVIDIA nView Desktop Manager) (Version: 121.20 - NVIDIA Corporation)
PVSonyDll (Version: 1.00.0001 - NVIDIA Corporation) Hidden
QuickTime 7 (HKLM\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Ravensburger tiptoi (HKLM\...\Ravensburger tiptoi) (Version: - )
Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Secunia PSI (3.0.0.9016) (HKLM\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
SF-Etikett 12.01 (HKLM\...\{62946C1C-0052-4DDA-A1D4-90B87AC82546}) (Version: 12.01.000 - Frank Stolzer)
Sierra Wireless HSDPA MiniCard (HKLM\...\{D2A6CB42-8327-4167-AB04-F4A15658F2BF}) (Version: 7.0.2.1300 - Sierra Wireless Inc)
Studie zur Verbesserung von HP Officejet 6700 Produkten (HKLM\...\{1012904D-3F7E-44A6-B425-5AF21272BECE}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
ThinkPad Bluetooth with Enhanced Data Rate Software (HKLM\...\{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}) (Version: 6.2.1.3100 - Broadcom Corporation)
ThinkPad Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.55 - )
ThinkPad UltraNav Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.5.0 - )
ThinkVantage Access Connections (HKLM\...\{A62AEB2B-E2A0-4E77-8AAE-9645FE3B5487}) (Version: 5.95 - Lenovo)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
VTech Download Agent Library (Version: 1.00.0000 - VTech) Hidden
VTech Download Manager (HKLM\...\VTechDownloadManager) (Version: - VTech)
Windows Driver Package - Broadcom (BTHUSB) Bluetooth (04/08/2010 6.3.5.430) (HKLM\...\2004BB9EB6CEA02846881BEF1F51C11F7A90C9D6) (Version: 04/08/2010 6.3.5.430 - Broadcom)
Windows Driver Package - Broadcom HIDClass (07/28/2009 6.2.0.9800) (HKLM\...\BF20603967CFDCB2BBF91950E8A56DFBC5C833FE) (Version: 07/28/2009 6.2.0.9800 - Broadcom)
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-4103409644-2115618623-1480157512-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Petra\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4103409644-2115618623-1480157512-1001_Classes\CLSID\{090746F9-9F39-42C0-920A-4852C2EDE704}\InprocServer32 -> C:\Users\Petra\AppData\Local\Temp\{D430101B-77E4-471D-A522-50A29D54A5C4}\APAX.dll No File
CustomCLSID: HKU\S-1-5-21-4103409644-2115618623-1480157512-1001_Classes\CLSID\{49BBAA3C-C574-419E-8378-783C362E9C15}\InprocServer32 -> C:\Program Files\HP\Common\FWUpdateEDO2.dll (Hewlett-Packard Co.)
CustomCLSID: HKU\S-1-5-21-4103409644-2115618623-1480157512-1001_Classes\CLSID\{69026072-B4B5-4446-9732-CDA579736741}\InprocServer32 -> C:\Users\Petra\AppData\Local\Temp\{D430101B-77E4-471D-A522-50A29D54A5C4}\APAX.dll No File
CustomCLSID: HKU\S-1-5-21-4103409644-2115618623-1480157512-1001_Classes\CLSID\{780927D9-C564-4C09-8892-43E6EF2A8AFB}\InprocServer32 -> C:\Users\Petra\AppData\Local\Temp\{D430101B-77E4-471D-A522-50A29D54A5C4}\APAX.dll No File
CustomCLSID: HKU\S-1-5-21-4103409644-2115618623-1480157512-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4103409644-2115618623-1480157512-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4103409644-2115618623-1480157512-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4103409644-2115618623-1480157512-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4103409644-2115618623-1480157512-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4103409644-2115618623-1480157512-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4103409644-2115618623-1480157512-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4103409644-2115618623-1480157512-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
==================== Restore Points =========================
24-01-2015 18:54:52 Windows Update
25-01-2015 19:00:09 Windows-Sicherung
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:04 - 2015-01-26 10:22 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {0599E4F8-7BBB-4A66-8892-A05B5A7AEE42} - \DriverTuner Startup No Task File <==== ATTENTION
Task: {229CCB71-88EE-423D-819E-B1E5C28698B9} - System32\Tasks\HPCustParticipation HP Officejet 6700 => C:\Program Files\HP\HP Officejet 6700\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)
Task: {580E5D36-E892-4C4D-B8A1-51680034BCED} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-12-17] (Piriform Ltd)
Task: {636B383B-A570-47E5-A408-EC52B96D8BD6} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-26] (Adobe Systems Incorporated)
Task: {647A52DD-F4F7-4082-8264-1CAADB9A9698} - System32\Tasks\PMTask => C:\Program Files\ThinkPad\Utilities\PWMIDTSV.EXE [2012-05-16] (Lenovo Group Limited)
Task: {7F3B0187-334A-4572-B5BF-06237BBB559A} - \AutoKMS No Task File <==== ATTENTION
Task: {8EF2D1BB-18FE-4968-AB23-74C1FCCABA39} - System32\Tasks\{4EBB497D-0D97-4440-88B0-70D6FD9EE5D6} => pcalua.exe -a C:\PROGRA~1\SearchProtect\Main\bin\uninstall.exe -c /S <==== ATTENTION
Task: {A231CBC3-E282-45A8-94CD-1FC3D554BE03} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {AB4F4E56-3BE2-4F17-B796-8129E80341DE} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {BC46DDA0-2DF1-425B-BD9F-967237C0DA06} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-05-31] (Google Inc.)
Task: {CD5D49D7-9A74-4A3C-AC7C-910A15B6F829} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-05-31] (Google Inc.)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2012-05-30 16:32 - 2012-05-30 16:32 - 00086016 _____ () C:\Program Files\Lenovo\Access Connections\AcWrpc.dll
2014-10-13 02:49 - 2014-06-20 07:42 - 00401280 ____C () C:\Program Files\VTech\DownloadManager\System\AgentMonitor.exe
2014-10-13 02:49 - 2014-03-04 12:20 - 00117760 ____C () C:\Program Files\VTech\DownloadManager\System\QtSolutions_SOAP-2.7.dll
2014-10-13 02:49 - 2014-04-22 03:14 - 00065536 ____C () C:\Program Files\VTech\DownloadManager\System\QHttpServer.dll
2014-10-13 02:49 - 2014-05-06 06:39 - 00861184 ____C () C:\Program Files\VTech\DownloadManager\System\plugins\platforms\qwindows.dll
2014-10-13 02:49 - 2014-05-06 06:38 - 00021504 ____C () C:\Program Files\VTech\DownloadManager\System\plugins\imageformats\qgif.dll
2014-10-13 02:49 - 2014-05-06 06:38 - 00020992 ____C () C:\Program Files\VTech\DownloadManager\System\plugins\imageformats\qico.dll
2014-10-13 02:49 - 2014-05-06 06:38 - 00204800 ____C () C:\Program Files\VTech\DownloadManager\System\plugins\imageformats\qjpeg.dll
2014-10-13 02:49 - 2014-05-06 11:44 - 00218112 ____C () C:\Program Files\VTech\DownloadManager\System\plugins\imageformats\qmng.dll
2014-10-13 02:49 - 2014-05-06 06:58 - 00015872 ____C () C:\Program Files\VTech\DownloadManager\System\plugins\imageformats\qsvg.dll
2014-10-13 02:49 - 2014-05-06 11:44 - 00015360 ____C () C:\Program Files\VTech\DownloadManager\System\plugins\imageformats\qtga.dll
2014-10-13 02:49 - 2014-05-06 11:44 - 00307712 ____C () C:\Program Files\VTech\DownloadManager\System\plugins\imageformats\qtiff.dll
2014-10-13 02:49 - 2014-05-06 11:44 - 00014848 ____C () C:\Program Files\VTech\DownloadManager\System\plugins\imageformats\qwbmp.dll
2014-10-13 02:49 - 2014-05-06 07:31 - 00015872 ____C () C:\Program Files\VTech\DownloadManager\System\plugins\sensors\qtsensors_dummy.dll
2014-10-13 02:49 - 2014-05-06 06:38 - 00036352 ____C () C:\Program Files\VTech\DownloadManager\System\plugins\bearer\qgenericbearer.dll
2014-10-13 02:49 - 2014-05-06 06:38 - 00038912 ____C () C:\Program Files\VTech\DownloadManager\System\plugins\bearer\qnativewifibearer.dll
2011-01-24 11:35 - 2011-01-24 11:35 - 00132384 _____ () C:\Program Files\ThinkPad\Bluetooth Software\btkeyind.dll
2014-10-22 01:22 - 2014-10-22 01:22 - 00750080 _____ () C:\Users\Petra\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-01-26 10:48 - 2015-01-26 10:48 - 00043008 _____ () c:\users\petra\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpnix6uc.dll
2014-10-22 01:22 - 2014-10-22 01:22 - 00047616 _____ () C:\Users\Petra\AppData\Roaming\Dropbox\bin\libEGL.dll
2014-10-22 01:22 - 2014-10-22 01:22 - 00863744 _____ () C:\Users\Petra\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2014-10-22 01:22 - 2014-10-22 01:22 - 00200704 _____ () C:\Users\Petra\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\office14\Cultures\office.odf
2013-02-14 15:46 - 2013-02-14 15:46 - 01044048 _____ () C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll
2015-01-17 10:26 - 2015-01-17 10:26 - 03925104 ____C () C:\Program Files\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-4103409644-2115618623-1480157512-500 - Administrator - Disabled)
Gast (S-1-5-21-4103409644-2115618623-1480157512-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-4103409644-2115618623-1480157512-1002 - Limited - Enabled)
Petra (S-1-5-21-4103409644-2115618623-1480157512-1001 - Administrator - Enabled) => C:\Users\Petra
==================== Faulty Device Manager Devices =============
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Name: MpKsl232a813f
Description: MpKsl232a813f
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: MpKsl232a813f
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Event log errors: =========================
Application errors:
==================
System errors:
=============
Microsoft Office Sessions:
=========================
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 Duo CPU T7250 @ 2.00GHz
Percentage of memory in use: 41%
Total physical RAM: 3062.3 MB
Available physical RAM: 1805.79 MB
Total Pagefile: 6122.88 MB
Available Pagefile: 4821.06 MB
Total Virtual: 2047.88 MB
Available Virtual: 1890.09 MB
==================== Drives ================================
Drive c: (Windows) (Fixed) (Total:66.71 GB) (Free:25.37 GB) NTFS
Drive f: (PRIVAT) (Fixed) (Total:465.64 GB) (Free:347.37 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 74.5 GB) (Disk ID: 37B70E1B)
Partition 1: (Active) - (Size=7.8 GB) - (Type=27)
Partition 2: (Not Active) - (Size=66.7 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (Size: 465.8 GB) (Disk ID: F5282A0E)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=0C)
==================== End Of Log ============================
|
|
26.01.2015, 11:12
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: Mysearchcom öffnet sich Mozilla Firefox Browser Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter HKU\S-1-5-21-4103409644-2115618623-1480157512-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
Task: {0599E4F8-7BBB-4A66-8892-A05B5A7AEE42} - \DriverTuner Startup No Task File <==== ATTENTION
Task: {7F3B0187-334A-4572-B5BF-06237BBB559A} - \AutoKMS No Task File <==== ATTENTION
Task: {8EF2D1BB-18FE-4968-AB23-74C1FCCABA39} - System32\Tasks\{4EBB497D-0D97-4440-88B0-70D6FD9EE5D6} => pcalua.exe -a C:\PROGRA~1\SearchProtect\Main\bin\uninstall.exe -c /S <==== ATTENTION
C:\Windows\AutoKMS
C:\PROGRA~1\SearchProtect
C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
C:\Program Files\GUT8DC9.tmp
EmptyTemp:
Hosts:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ Logfiles bitte immer in CODE-Tags posten |
|
26.01.2015, 12:13
| #9 |
| | Windows 7: Mysearchcom öffnet sich Mozilla Firefox BrowserCode:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 24-01-2015 01
Ran by Petra at 2015-01-26 11:58:35 Run:1
Running from C:\Users\Petra\Desktop
Loaded Profiles: Petra (Available profiles: Petra)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
HKU\S-1-5-21-4103409644-2115618623-1480157512-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
Task: {0599E4F8-7BBB-4A66-8892-A05B5A7AEE42} - \DriverTuner Startup No Task File <==== ATTENTION
Task: {7F3B0187-334A-4572-B5BF-06237BBB559A} - \AutoKMS No Task File <==== ATTENTION
Task: {8EF2D1BB-18FE-4968-AB23-74C1FCCABA39} - System32\Tasks\{4EBB497D-0D97-4440-88B0-70D6FD9EE5D6} => pcalua.exe -a C:\PROGRA~1\SearchProtect\Main\bin\uninstall.exe -c /S <==== ATTENTION
C:\Windows\AutoKMS
C:\PROGRA~1\SearchProtect
C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
C:\Program Files\GUT8DC9.tmp
EmptyTemp:
Hosts:
*****************
"HKU\S-1-5-21-4103409644-2115618623-1480157512-1001\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{0599E4F8-7BBB-4A66-8892-A05B5A7AEE42}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0599E4F8-7BBB-4A66-8892-A05B5A7AEE42}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DriverTuner Startup" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{7F3B0187-334A-4572-B5BF-06237BBB559A}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7F3B0187-334A-4572-B5BF-06237BBB559A}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AutoKMS" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8EF2D1BB-18FE-4968-AB23-74C1FCCABA39}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8EF2D1BB-18FE-4968-AB23-74C1FCCABA39}" => Key deleted successfully.
C:\Windows\System32\Tasks\{4EBB497D-0D97-4440-88B0-70D6FD9EE5D6} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{4EBB497D-0D97-4440-88B0-70D6FD9EE5D6}" => Key deleted successfully.
C:\Windows\AutoKMS => Moved successfully.
"C:\PROGRA~1\SearchProtect" => File/Directory not found.
C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} => Moved successfully.
C:\Program Files\GUT8DC9.tmp => Moved successfully.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 84.4 MB temporary data.
The system needed a reboot.
==== End of Fixlog 11:58:51 ====
|
|
26.01.2015, 12:14
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: Mysearchcom öffnet sich Mozilla Firefox Browser Okay, dann Kontrollscans mit MBAM und ESET bitte: Downloade Dir bitte  Malwarebytes Anti-Malware
ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten |
|
26.01.2015, 18:09
| #11 |
| | Windows 7: Mysearchcom öffnet sich Mozilla Firefox BrowserCode:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=3df0e1a6fd7c2f4b905158f3479d9cd8
# engine=22150
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-01-26 05:02:19
# local_time=2015-01-26 06:02:19 (+0100, Mitteleuropäische Zeit)
# country="Austria"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Microsoft Security Essentials'
# compatibility_mode=5895 16777213 100 100 11791088 45272133 0 0
# scanned=192742
# found=38
# cleaned=0
# scan_time=12602
sh=DF5AFCFA723A9EFCB09246976FCB221F7602C997 ft=1 fh=c71c0011d7b6ffae vn="Win32/Toolbar.MyWebSearch.AO evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Petra\Desktop\Alte Firefox-Daten\8aa0dliy.default-1422213911142\extensions\9tffxtbr@InternetSpeedTracker_9t.com\plugins\NativeMessagingDispatcher.dll"
sh=DEC9EFA1F4CE8558C3FB07A2041FA04CC712DDCC ft=1 fh=4a32bee255015d64 vn="Variante von Win32/InstallCore.OX evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Petra\Downloads\foxit-pdf-reader.exe"
sh=6024C0B01B7022BD84ADB923784847D330CCFC7F ft=1 fh=611cfa167e864f1b vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Petra\Downloads\VLC media player 32 Bit - CHIP-Installer.exe"
sh=09D7C13322C32E3A6E321A2694094BC66E81B3A4 ft=1 fh=255fa89cab5626e7 vn="Win32/Toolbar.Babylon.M evtl. unerwünschte Anwendung" ac=I fn="F:\Petra\AppData\Local\Temp\BEB9.tmp"
sh=035EF1A19AFC0D423C85505DB17D2859FAC2250F ft=1 fh=b94a471135a3d38b vn="Variante von Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="F:\Petra\AppData\Roaming\BabSolution\Shared\BabMaint.exe"
sh=E2BA5F8A7BD2BAF32FF31730BAD873C8E7957030 ft=1 fh=6e8622963c31f56a vn="Variante von Win32/Toolbar.Babylon.P evtl. unerwünschte Anwendung" ac=I fn="F:\Petra\AppData\Roaming\BabSolution\Shared\BUSolution.dll"
sh=829D808C091045F45C513A6E4AB17055A52A9320 ft=1 fh=282fb76e1825b814 vn="Variante von Win32/Toolbar.Babylon.C evtl. unerwünschte Anwendung" ac=I fn="F:\Petra\AppData\Roaming\OpenCandy\797CDFBD146149328E144678946C4E7A\DeltaTB.exe"
sh=A58FE6880A76C1364B17A235951ABE9C95FC7299 ft=1 fh=1ab78df13745b7f5 vn="Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung" ac=I fn="F:\Program Files\Delta\delta\1.8.21.5\deltaApp.dll"
sh=D987048C3FF42F81F39E3B15E57F32AF7AA0BD00 ft=1 fh=47df87911e710cf9 vn="Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung" ac=I fn="F:\Program Files\Delta\delta\1.8.21.5\deltaEng.dll"
sh=781F353EA130DCB9C496D35204CB5AB96C4DCCBF ft=1 fh=7e2601b6c3711131 vn="Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung" ac=I fn="F:\Program Files\Delta\delta\1.8.21.5\deltasrv.exe"
sh=02515F710B884FF8B426B43DF8C9B05E943B6AED ft=1 fh=d9df6fa40224409d vn="Win32/Toolbar.Babylon.G evtl. unerwünschte Anwendung" ac=I fn="F:\Program Files\Delta\delta\1.8.21.5\deltaTlbr.dll"
sh=AE0BF6A9D8E66B04214FEBB5BF4B086E8AA34498 ft=1 fh=502ed3b2eef6754b vn="Win32/Toolbar.Montiera.B evtl. unerwünschte Anwendung" ac=I fn="F:\Program Files\Delta\delta\1.8.21.5\uninstall.exe"
sh=DFB461F520B77E9CF268FDFBFFBBB624C7EA5064 ft=1 fh=0fb3be40d7aae6ee vn="Win32/Toolbar.Escort.A evtl. unerwünschte Anwendung" ac=I fn="F:\Program Files\Delta\delta\1.8.21.5\bh\delta.dll"
sh=C6F59FF745E3EE5D9E53E924BC7603A5FDFD7D34 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2013-12-01 194952\Backup Files 2013-12-01 194952\Backup files 1.zip"
sh=98C2B53D2FD744EFE8FE5404EC34BAC16639DD71 ft=0 fh=0000000000000000 vn="Variante von Win32/DealPly.M evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2013-12-01 194952\Backup Files 2013-12-08 190001\Backup files 1.zip"
sh=717B30DC4EE28E26EBFEC2898F7B8E14141568E3 ft=0 fh=0000000000000000 vn="Win32/NextLive.A evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2013-12-01 194952\Backup Files 2013-12-29 190001\Backup files 1.zip"
sh=315FCF1C06E566087B05F421C8F86DE3B74DBFCF ft=0 fh=0000000000000000 vn="Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-01-05 190000\Backup Files 2014-01-05 190000\Backup files 1.zip"
sh=C3AED488F8A33A9FC48AE7C7B2583B6852186F80 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-03-24 082831\Backup Files 2014-03-24 082831\Backup files 1.zip"
sh=C7EBE776C686C6A81E10F0F733C98EBD2E3BEB3B ft=0 fh=0000000000000000 vn="Variante von Win32/DealPly.S evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-03-24 082831\Backup Files 2014-04-13 190003\Backup files 1.zip"
sh=3B982B18EA6A0AA19C8779629CA60D99F1181409 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-03-24 082831\Backup Files 2014-04-20 202025\Backup files 1.zip"
sh=8033E53B2E9BC23DFD104CD8A17BABC0E99B91FA ft=0 fh=0000000000000000 vn="Variante von Win32/Somoto.D evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-03-24 082831\Backup Files 2014-04-27 194013\Backup files 1.zip"
sh=AD6BAABC9515000C88E9D6C17329FD6FBCD8ACB7 ft=0 fh=0000000000000000 vn="Win32/Installium.A evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-03-24 082831\Backup Files 2014-05-11 195932\Backup files 1.zip"
sh=7EBF4D11C0B1379B8D1D69763A77C08D62E1FD93 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-05-18 191037\Backup Files 2014-05-18 191037\Backup files 1.zip"
sh=9366F9A85B947E6EA72FA8128DD530BE3CE96653 ft=0 fh=0000000000000000 vn="Variante von Win32/Somoto.D evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-05-18 191037\Backup Files 2014-05-18 191037\Backup files 2.zip"
sh=0A8FC9E042C3DB8EDB9269589AE900CB6F395039 ft=0 fh=0000000000000000 vn="Variante von Win32/KoyoteLab.A evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-05-18 191037\Backup Files 2014-05-18 191037\Backup files 3.zip"
sh=A4A1A00AC1D44A8354D4FBB444E86B0C95A7E5E0 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-07-20 195637\Backup Files 2014-07-20 195637\Backup files 1.zip"
sh=3E6B059E73B4D7904ED87AEC78D6D90BC4D2AAD6 ft=0 fh=0000000000000000 vn="Variante von Win32/Somoto.D evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-07-20 195637\Backup Files 2014-07-20 195637\Backup files 2.zip"
sh=8B26687D220240FE5988A3DB2BDC05052AA53738 ft=0 fh=0000000000000000 vn="Variante von Win32/KoyoteLab.A evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-07-20 195637\Backup Files 2014-07-20 195637\Backup files 5.zip"
sh=7A71A2E996021885C4E066E7451C29717B2987A5 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Conduit.R evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-07-20 195637\Backup Files 2014-08-11 084237\Backup files 1.zip"
sh=C64E986A5419EA45D9D64D60CAFEB0214265F4DB ft=0 fh=0000000000000000 vn="Variante von Win32/InstallCore.PS evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-07-20 195637\Backup Files 2014-08-11 084237\Backup files 2.zip"
sh=3EE492C2711C7DF6C7B192E5A2D635E1D3E9F026 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="F:\PETRA-PC\Backup Set 2014-07-20 195637\Backup Files 2014-08-17 193538\Backup files 1.zip"
sh=A4042640C022F8B15169718AE98ADD6C9A2837F2 ft=0 fh=0000000000000000 vn="Variante von Win32/InstallCore.OX evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-08-24 194240\Backup Files 2014-08-24 194240\Backup files 2.zip"
sh=23E02BEFEBD2143918E554928B251C31E5A2222E ft=0 fh=0000000000000000 vn="Variante von Win32/InstallCore.OX evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-10-19 191008\Backup Files 2014-10-19 191008\Backup files 6.zip"
sh=2EEC2F9B3A18AC15BCBA1F82A5257329D3956455 ft=0 fh=0000000000000000 vn="Variante von Win32/InstallCore.OX evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-11-23 190002\Backup Files 2014-11-23 190002\Backup files 5.zip"
sh=E9F9ECE8D92FD3E1FA278494616AB0F286F85AC4 ft=0 fh=0000000000000000 vn="Variante von Win32/InstallCore.OX evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-12-28 190002\Backup Files 2014-12-28 190002\Backup files 6.zip"
sh=5B15C5EBCC209B37FE66963E7505D0B05E2D41C6 ft=0 fh=0000000000000000 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-12-28 190002\Backup Files 2015-01-04 190004\Backup files 2.zip"
sh=6E68F9C616CC38D5887EFB104B0495FE48C50298 ft=0 fh=0000000000000000 vn="Variante von Win32/InstallCore.OX evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2015-01-11 190003\Backup Files 2015-01-11 190003\Backup files 7.zip"
sh=1A6B1FBB625E981DCFD21587A55C52141DD81113 ft=0 fh=0000000000000000 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2015-01-11 190003\Backup Files 2015-01-11 190003\Backup files 8.zip"
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 26.01.2015 Suchlauf-Zeit: 12:20:39 Logdatei: mbam.txt Administrator: Ja Version: 2.00.4.1028 Malware Datenbank: v2015.01.26.04 Rootkit Datenbank: v2015.01.14.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x86 Dateisystem: NTFS Benutzer: Petra Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 325101 Verstrichene Zeit: 11 Min, 39 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente erkannt) Module: 0 (Keine schädliche Elemente erkannt) Registrierungsschlüssel: 0 (Keine schädliche Elemente erkannt) Registrierungswerte: 0 (Keine schädliche Elemente erkannt) Registrierungsdaten: 0 (Keine schädliche Elemente erkannt) Ordner: 0 (Keine schädliche Elemente erkannt) Dateien: 0 (Keine schädliche Elemente erkannt) Physische Sektoren: 0 (Keine schädliche Elemente erkannt) (end) Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 26.01.2015 Suchlauf-Zeit: 12:20:39 Logdatei: mbam.txt Administrator: Ja Version: 2.00.4.1028 Malware Datenbank: v2015.01.26.04 Rootkit Datenbank: v2015.01.14.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x86 Dateisystem: NTFS Benutzer: Petra Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 325101 Verstrichene Zeit: 11 Min, 39 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente erkannt) Module: 0 (Keine schädliche Elemente erkannt) Registrierungsschlüssel: 0 (Keine schädliche Elemente erkannt) Registrierungswerte: 0 (Keine schädliche Elemente erkannt) Registrierungsdaten: 0 (Keine schädliche Elemente erkannt) Ordner: 0 (Keine schädliche Elemente erkannt) Dateien: 0 (Keine schädliche Elemente erkannt) Physische Sektoren: 0 (Keine schädliche Elemente erkannt) (end) Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=3df0e1a6fd7c2f4b905158f3479d9cd8
# engine=22150
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-01-26 05:02:19
# local_time=2015-01-26 06:02:19 (+0100, Mitteleuropäische Zeit)
# country="Austria"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Microsoft Security Essentials'
# compatibility_mode=5895 16777213 100 100 11791088 45272133 0 0
# scanned=192742
# found=38
# cleaned=0
# scan_time=12602
sh=DF5AFCFA723A9EFCB09246976FCB221F7602C997 ft=1 fh=c71c0011d7b6ffae vn="Win32/Toolbar.MyWebSearch.AO evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Petra\Desktop\Alte Firefox-Daten\8aa0dliy.default-1422213911142\extensions\9tffxtbr@InternetSpeedTracker_9t.com\plugins\NativeMessagingDispatcher.dll"
sh=DEC9EFA1F4CE8558C3FB07A2041FA04CC712DDCC ft=1 fh=4a32bee255015d64 vn="Variante von Win32/InstallCore.OX evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Petra\Downloads\foxit-pdf-reader.exe"
sh=6024C0B01B7022BD84ADB923784847D330CCFC7F ft=1 fh=611cfa167e864f1b vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Petra\Downloads\VLC media player 32 Bit - CHIP-Installer.exe"
sh=09D7C13322C32E3A6E321A2694094BC66E81B3A4 ft=1 fh=255fa89cab5626e7 vn="Win32/Toolbar.Babylon.M evtl. unerwünschte Anwendung" ac=I fn="F:\Petra\AppData\Local\Temp\BEB9.tmp"
sh=035EF1A19AFC0D423C85505DB17D2859FAC2250F ft=1 fh=b94a471135a3d38b vn="Variante von Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="F:\Petra\AppData\Roaming\BabSolution\Shared\BabMaint.exe"
sh=E2BA5F8A7BD2BAF32FF31730BAD873C8E7957030 ft=1 fh=6e8622963c31f56a vn="Variante von Win32/Toolbar.Babylon.P evtl. unerwünschte Anwendung" ac=I fn="F:\Petra\AppData\Roaming\BabSolution\Shared\BUSolution.dll"
sh=829D808C091045F45C513A6E4AB17055A52A9320 ft=1 fh=282fb76e1825b814 vn="Variante von Win32/Toolbar.Babylon.C evtl. unerwünschte Anwendung" ac=I fn="F:\Petra\AppData\Roaming\OpenCandy\797CDFBD146149328E144678946C4E7A\DeltaTB.exe"
sh=A58FE6880A76C1364B17A235951ABE9C95FC7299 ft=1 fh=1ab78df13745b7f5 vn="Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung" ac=I fn="F:\Program Files\Delta\delta\1.8.21.5\deltaApp.dll"
sh=D987048C3FF42F81F39E3B15E57F32AF7AA0BD00 ft=1 fh=47df87911e710cf9 vn="Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung" ac=I fn="F:\Program Files\Delta\delta\1.8.21.5\deltaEng.dll"
sh=781F353EA130DCB9C496D35204CB5AB96C4DCCBF ft=1 fh=7e2601b6c3711131 vn="Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung" ac=I fn="F:\Program Files\Delta\delta\1.8.21.5\deltasrv.exe"
sh=02515F710B884FF8B426B43DF8C9B05E943B6AED ft=1 fh=d9df6fa40224409d vn="Win32/Toolbar.Babylon.G evtl. unerwünschte Anwendung" ac=I fn="F:\Program Files\Delta\delta\1.8.21.5\deltaTlbr.dll"
sh=AE0BF6A9D8E66B04214FEBB5BF4B086E8AA34498 ft=1 fh=502ed3b2eef6754b vn="Win32/Toolbar.Montiera.B evtl. unerwünschte Anwendung" ac=I fn="F:\Program Files\Delta\delta\1.8.21.5\uninstall.exe"
sh=DFB461F520B77E9CF268FDFBFFBBB624C7EA5064 ft=1 fh=0fb3be40d7aae6ee vn="Win32/Toolbar.Escort.A evtl. unerwünschte Anwendung" ac=I fn="F:\Program Files\Delta\delta\1.8.21.5\bh\delta.dll"
sh=C6F59FF745E3EE5D9E53E924BC7603A5FDFD7D34 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2013-12-01 194952\Backup Files 2013-12-01 194952\Backup files 1.zip"
sh=98C2B53D2FD744EFE8FE5404EC34BAC16639DD71 ft=0 fh=0000000000000000 vn="Variante von Win32/DealPly.M evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2013-12-01 194952\Backup Files 2013-12-08 190001\Backup files 1.zip"
sh=717B30DC4EE28E26EBFEC2898F7B8E14141568E3 ft=0 fh=0000000000000000 vn="Win32/NextLive.A evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2013-12-01 194952\Backup Files 2013-12-29 190001\Backup files 1.zip"
sh=315FCF1C06E566087B05F421C8F86DE3B74DBFCF ft=0 fh=0000000000000000 vn="Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-01-05 190000\Backup Files 2014-01-05 190000\Backup files 1.zip"
sh=C3AED488F8A33A9FC48AE7C7B2583B6852186F80 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-03-24 082831\Backup Files 2014-03-24 082831\Backup files 1.zip"
sh=C7EBE776C686C6A81E10F0F733C98EBD2E3BEB3B ft=0 fh=0000000000000000 vn="Variante von Win32/DealPly.S evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-03-24 082831\Backup Files 2014-04-13 190003\Backup files 1.zip"
sh=3B982B18EA6A0AA19C8779629CA60D99F1181409 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-03-24 082831\Backup Files 2014-04-20 202025\Backup files 1.zip"
sh=8033E53B2E9BC23DFD104CD8A17BABC0E99B91FA ft=0 fh=0000000000000000 vn="Variante von Win32/Somoto.D evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-03-24 082831\Backup Files 2014-04-27 194013\Backup files 1.zip"
sh=AD6BAABC9515000C88E9D6C17329FD6FBCD8ACB7 ft=0 fh=0000000000000000 vn="Win32/Installium.A evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-03-24 082831\Backup Files 2014-05-11 195932\Backup files 1.zip"
sh=7EBF4D11C0B1379B8D1D69763A77C08D62E1FD93 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-05-18 191037\Backup Files 2014-05-18 191037\Backup files 1.zip"
sh=9366F9A85B947E6EA72FA8128DD530BE3CE96653 ft=0 fh=0000000000000000 vn="Variante von Win32/Somoto.D evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-05-18 191037\Backup Files 2014-05-18 191037\Backup files 2.zip"
sh=0A8FC9E042C3DB8EDB9269589AE900CB6F395039 ft=0 fh=0000000000000000 vn="Variante von Win32/KoyoteLab.A evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-05-18 191037\Backup Files 2014-05-18 191037\Backup files 3.zip"
sh=A4A1A00AC1D44A8354D4FBB444E86B0C95A7E5E0 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-07-20 195637\Backup Files 2014-07-20 195637\Backup files 1.zip"
sh=3E6B059E73B4D7904ED87AEC78D6D90BC4D2AAD6 ft=0 fh=0000000000000000 vn="Variante von Win32/Somoto.D evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-07-20 195637\Backup Files 2014-07-20 195637\Backup files 2.zip"
sh=8B26687D220240FE5988A3DB2BDC05052AA53738 ft=0 fh=0000000000000000 vn="Variante von Win32/KoyoteLab.A evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-07-20 195637\Backup Files 2014-07-20 195637\Backup files 5.zip"
sh=7A71A2E996021885C4E066E7451C29717B2987A5 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Conduit.R evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-07-20 195637\Backup Files 2014-08-11 084237\Backup files 1.zip"
sh=C64E986A5419EA45D9D64D60CAFEB0214265F4DB ft=0 fh=0000000000000000 vn="Variante von Win32/InstallCore.PS evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-07-20 195637\Backup Files 2014-08-11 084237\Backup files 2.zip"
sh=3EE492C2711C7DF6C7B192E5A2D635E1D3E9F026 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="F:\PETRA-PC\Backup Set 2014-07-20 195637\Backup Files 2014-08-17 193538\Backup files 1.zip"
sh=A4042640C022F8B15169718AE98ADD6C9A2837F2 ft=0 fh=0000000000000000 vn="Variante von Win32/InstallCore.OX evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-08-24 194240\Backup Files 2014-08-24 194240\Backup files 2.zip"
sh=23E02BEFEBD2143918E554928B251C31E5A2222E ft=0 fh=0000000000000000 vn="Variante von Win32/InstallCore.OX evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-10-19 191008\Backup Files 2014-10-19 191008\Backup files 6.zip"
sh=2EEC2F9B3A18AC15BCBA1F82A5257329D3956455 ft=0 fh=0000000000000000 vn="Variante von Win32/InstallCore.OX evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-11-23 190002\Backup Files 2014-11-23 190002\Backup files 5.zip"
sh=E9F9ECE8D92FD3E1FA278494616AB0F286F85AC4 ft=0 fh=0000000000000000 vn="Variante von Win32/InstallCore.OX evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-12-28 190002\Backup Files 2014-12-28 190002\Backup files 6.zip"
sh=5B15C5EBCC209B37FE66963E7505D0B05E2D41C6 ft=0 fh=0000000000000000 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2014-12-28 190002\Backup Files 2015-01-04 190004\Backup files 2.zip"
sh=6E68F9C616CC38D5887EFB104B0495FE48C50298 ft=0 fh=0000000000000000 vn="Variante von Win32/InstallCore.OX evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2015-01-11 190003\Backup Files 2015-01-11 190003\Backup files 7.zip"
sh=1A6B1FBB625E981DCFD21587A55C52141DD81113 ft=0 fh=0000000000000000 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="F:\PETRA-PC\Backup Set 2015-01-11 190003\Backup Files 2015-01-11 190003\Backup files 8.zip"
|
|
26.01.2015, 21:28
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: Mysearchcom öffnet sich Mozilla Firefox Browser Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Users\Petra\Desktop\Alte Firefox-Daten\8aa0dliy.default-1422213911142\extensions\9tffxtbr@InternetSpeedTracker_9t.com\plugins\NativeMessagingDispatcher.dll
C:\Users\Petra\Downloads\foxit-pdf-reader.exe
C:\Users\Petra\Downloads\VLC media player 32 Bit - CHIP-Installer.exe
F:\Petra\AppData\Local\Temp\BEB9.tmp
F:\Petra\AppData\Roaming\BabSolution
F:\Petra\AppData\Roaming\OpenCandy
F:\Program Files\Delta
EmptyTemp:
Hosts:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ Logfiles bitte immer in CODE-Tags posten |
|
27.01.2015, 07:45
| #13 |
| | Windows 7: Mysearchcom öffnet sich Mozilla Firefox BrowserCode:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 24-01-2015 01
Ran by Petra at 2015-01-27 07:29:55 Run:2
Running from C:\Users\Petra\Desktop
Loaded Profiles: Petra (Available profiles: Petra)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
C:\Users\Petra\Desktop\Alte Firefox-Daten\8aa0dliy.default-1422213911142\extensions\9tffxtbr@InternetSpeedTracker_9t.com\plugins\NativeMessagingDispatcher.dll
C:\Users\Petra\Downloads\foxit-pdf-reader.exe
C:\Users\Petra\Downloads\VLC media player 32 Bit - CHIP-Installer.exe
F:\Petra\AppData\Local\Temp\BEB9.tmp
F:\Petra\AppData\Roaming\BabSolution
F:\Petra\AppData\Roaming\OpenCandy
F:\Program Files\Delta
EmptyTemp:
Hosts:
*****************
C:\Users\Petra\Desktop\Alte Firefox-Daten\8aa0dliy.default-1422213911142\extensions\9tffxtbr@InternetSpeedTracker_9t.com\plugins\NativeMessagingDispatcher.dll => Moved successfully.
C:\Users\Petra\Downloads\foxit-pdf-reader.exe => Moved successfully.
C:\Users\Petra\Downloads\VLC media player 32 Bit - CHIP-Installer.exe => Moved successfully.
Could not move "F:\Petra\AppData\Local\Temp\BEB9.tmp" => Scheduled to move on reboot.
F:\Petra\AppData\Roaming\BabSolution => Moved successfully.
F:\Petra\AppData\Roaming\OpenCandy => Moved successfully.
F:\Program Files\Delta => Moved successfully.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 121.2 MB temporary data.
=> Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2015-01-27 07:43:27)<=
F:\Petra\AppData\Local\Temp\BEB9.tmp => Is moved successfully.
==== End of Fixlog 07:43:28 ====
|
|
27.01.2015, 10:00
| #14 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: Mysearchcom öffnet sich Mozilla Firefox Browser Sieht soweit ok aus  Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) empfehle ich die Erweiterung Ghostery, diese verhindert weitgehend Usertracking bzw. das Anzeigen von Werbebannern. Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie ) Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird. Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
27.01.2015, 10:24
| #15 |
| | Windows 7: Mysearchcom öffnet sich Mozilla Firefox Browser Alle klar - vielen DANK - und danke für die Tipps !! "Alles" sollte es heißen |
|
| Themen zu Windows 7: Mysearchcom öffnet sich Mozilla Firefox Browser |
| anti, anti maleware, browse, browser, eingefangen, firefox, gefangen, gelöst, gen, malewarebytes, mozilla, mozilla firefox, problem, schei, virus, virus eingefangen, windows, windows 7, öffnet |
Linear-Darstellung
