| |
| |||||||
Log-Analyse und Auswertung: Avira hat Maleware gefunden : ADWARE/Adware.GenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
31.01.2015, 17:43
| #1 |
 |  Avira hat Maleware gefunden : ADWARE/Adware.Gen Hallo, Auf dem Laptop meiner Mutter hat Avira diesen Virusfund angezeigt: ADWARE/Adware.Gen Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 17:14 on 31/01/2015 (Susanne)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-01-2015 01
Ran by Susanne (administrator) on SUSANNE-LAPTOP on 31-01-2015 17:18:16
Running from C:\Users\Susanne\Desktop
Loaded Profiles: Susanne (Available profiles: Susanne)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(X10) C:\Program Files (x86)\Common Files\X10\Common\X10nets.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Eastman Kodak Company) C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Wistron) C:\Program Files (x86)\Launch Manager\HotkeyApp.exe
(Wistron Corp.) C:\Program Files (x86)\Launch Manager\OSD.exe
(Wistron Corp.) C:\Program Files (x86)\Launch Manager\WButton.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Ask) C:\Program Files (x86)\Ask.com\Updater\Updater.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Wistron Corp.) C:\Program Files (x86)\Launch Manager\WisLMSvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(XTab system) C:\Program Files (x86)\XTab\ProtectService.exe
(SearchProtect) C:\Program Files (x86)\XTab\CmdShell.exe
(XTab system) C:\Program Files (x86)\XTab\HPNotify.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_296.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_296.exe
() C:\Program Files (x86)\PC Speed Up\PCSUService.exe
() C:\Program Files (x86)\PC Speed Up\PCSUNotifier.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
() C:\Users\Susanne\Desktop\Defogger.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1890088 2009-12-11] (Synaptics Incorporated)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11548264 2010-11-03] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2181224 2010-11-03] (Realtek Semiconductor)
HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft IntelliPoint\ipoint.exe [2328944 2011-01-07] (Microsoft Corporation)
HKLM\...\Run: [EKIJ5000StatusMonitor] => C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe [2045440 2010-09-02] (Eastman Kodak Company)
HKLM-x32\...\Run: [HotkeyApp] => C:\Program Files (x86)\Launch Manager\HotkeyApp.exe [200704 2009-12-14] (Wistron)
HKLM-x32\...\Run: [LMgrVolOSD] => C:\Program Files (x86)\Launch Manager\OSD.exe [348960 2009-12-11] (Wistron Corp.)
HKLM-x32\...\Run: [LMgrOSD] => "C:\Program Files (x86)\Launch Manager\OSDCtrl.exe"
HKLM-x32\...\Run: [Wbutton] => C:\Program Files (x86)\Launch Manager\Wbutton.exe [436264 2010-06-21] (Wistron Corp.)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-04-27] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [CLMLServer] => C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-11-02] (CyberLink)
HKLM-x32\...\Run: [YouCam Mirage] => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [136488 2010-10-29] (CyberLink)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [ApnUpdater] => C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1568976 2012-06-20] (Ask)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-16] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1769490675-1898107201-2895629493-1000\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2011-04-10] (Google Inc.)
HKU\S-1-5-21-1769490675-1898107201-2895629493-1000\...\Run: [Facebook Update] => C:\Users\Susanne\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-15] (Facebook Inc.)
HKU\S-1-5-21-1769490675-1898107201-2895629493-1000\...\Run: [GoogleChromeAutoLaunch_BEAD1C12587041F9E622982A20D4E70C] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [843592 2015-01-25] (Google Inc.)
HKU\S-1-5-21-1769490675-1898107201-2895629493-1000\...\Run: [PCSpeedUp] => C:\Program Files (x86)\PC Speed Up\PCSUNotifier.exe [342472 2014-12-10] ()
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2013-04-05] (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://istart.webssearches.com/?type=hp&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://istart.webssearches.com/?type=hp&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635&q={searchTerms}
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1769490675-1898107201-2895629493-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://istart.webssearches.com/?type=hp&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635
HKU\S-1-5-21-1769490675-1898107201-2895629493-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1769490675-1898107201-2895629493-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://istart.webssearches.com/web/?utm_source=b&utm_medium=cvs&utm_campaign=install_ie&utm_content=ds&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635&ts=1422719176&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1769490675-1898107201-2895629493-1000 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://istart.webssearches.com/web/?utm_source=b&utm_medium=cvs&utm_campaign=install_ie&utm_content=ds&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635&ts=1422719176&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1769490675-1898107201-2895629493-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?utm_source=b&utm_medium=cvs&utm_campaign=install_ie&utm_content=ds&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635&ts=1422719176&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1769490675-1898107201-2895629493-1000 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = hxxp://istart.webssearches.com/web/?utm_source=b&utm_medium=cvs&utm_campaign=install_ie&utm_content=ds&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635&ts=1422719176&type=default&q={searchTerms}
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: DVDVideoSoft WebPageAdjuster Class -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: No Name -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> No File
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Avira SearchFree Toolbar plus Web Protection -> {D4027C7F-154A-4066-A1AD-4243D8127440} -> C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: DVDVideoSoft WebPageAdjuster Class -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
BHO-x32: WinToFlash Suggestor -> {FC36B0BD-27F0-4cdd-8AB1-50651EFC3EFD} -> C:\Program Files (x86)\WinToFlash Suggestor\WinToFlashSuggestor.dll (Novicorp LLC)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKU\S-1-5-21-1769490675-1898107201-2895629493-1000 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKU\S-1-5-21-1769490675-1898107201-2895629493-1000 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Winsock: Catalog9 01 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 19 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 01 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 02 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 03 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 04 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 05 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 06 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 07 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 08 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 19 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://istart.webssearches.com/?type=sc&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635
FireFox:
========
FF ProfilePath: C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default
FF NewTab: chrome://quick_start/content/index.html
FF DefaultSearchEngine: webssearches
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: webssearches
FF Homepage: hxxp://istart.webssearches.com/?type=hp&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635
FF Keyword.URL: hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=AVR-3&o=APN10395&locale=de_DE&apn_uid=41da7c6b-d96d-473c-88a6-8affe28bb4b3&apn_ptnrs=%5EABT&apn_sauid=E51822E6-62A6-4715-B897-D55EDD04ED6E&apn_dtid=%5EYYYYYY%5EYY%5EDE&&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-1769490675-1898107201-2895629493-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Susanne\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF user.js: detected! => C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\user.js
FF SearchPlugin: C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\searchplugins\webssearches.xml
FF Extension: Fast Start - C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\Extensions\faststartff@gmail.com [2015-01-31]
FF Extension: FF Toolbar - C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\Extensions\fftoolbar2014@etech.com [2015-01-31]
FF Extension: SparPilot - Gutscheine & mehr... - C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\Extensions\sparpilot@sparpilot.com [2015-01-31]
FF Extension: DivX Web Player - C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\Extensions\DivXWebPlayer@divx.com.xpi [2011-06-17]
FF Extension: WinToFlash Suggestor - C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\Extensions\{285ACFBB-8E53-4feb-90E6-F02A128927F3}.xpi [2012-05-25]
FF HKLM-x32\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2013-02-16]
FF HKLM-x32\...\Firefox\Extensions: [fftoolbar2014@etech.com] - C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\fftoolbar2014@etech.com
FF HKLM-x32\...\Firefox\Extensions: [faststartff@gmail.com] - C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com
StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://istart.webssearches.com/?type=sc&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635
Chrome:
=======
CHR HomePage: Default -> hxxp://istart.webssearches.com/?type=hp&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635
CHR StartupUrls: Default -> "hxxp://istart.webssearches.com/?type=hp&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635"
CHR DefaultSearchKeyword: Default -> webssearches
CHR DefaultSearchURL: Default -> hxxp://istart.webssearches.com/web/?type=ds&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635&q={searchTerms}
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.93\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.220.4) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Java(TM) Platform SE 6 U22) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.0.50917.0\npctrl.dll No File
CHR Plugin: (Chrome NaCl) - C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.93\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.93\pdf.dll ()
CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.57\npGoogleUpdate3.dll No File
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Profile: C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Avira Toolbar) - C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaangaohdajkgeopjhpbnlpkehbhmbj [2013-02-17]
CHR Extension: (WinToFlash Suggestor) - C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\acaoakiamfeidcmgooclgeleejkbaecf [2013-02-17]
CHR Extension: (DVDVideoSoft Browser Extension) - C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp [2013-02-17]
CHR HKU\S-1-5-21-1769490675-1898107201-2895629493-1000\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2013-02-16]
CHR HKLM-x32\...\Chrome\Extension: [aaaangaohdajkgeopjhpbnlpkehbhmbj] - C:\Users\Susanne\AppData\Local\APN\GoogleCRXs\aaaangaohdajkgeopjhpbnlpkehbhmbj_7.15.4.0.crx [2012-08-19]
CHR HKLM-x32\...\Chrome\Extension: [acaoakiamfeidcmgooclgeleejkbaecf] - C:\Program Files (x86)\WinToFlash Suggestor\WinToFlashSuggestor.crx [2012-05-25]
StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe hxxp://istart.webssearches.com/?type=sc&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [992560 2014-12-16] (Avira Operations GmbH & Co. KG)
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [97432 2007-04-13] () [File not signed]
R2 PCSUService; C:\Program Files (x86)\PC Speed Up\PCSUService.exe [437704 2014-12-10] ()
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2010-02-10] () [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R3 WisLMSvc; C:\Program Files (x86)\Launch Manager\WisLMSvc.exe [118560 2009-10-23] (Wistron Corp.)
R2 x10nets; C:\Program Files (x86)\Common Files\X10\Common\X10nets.exe [20480 2009-11-07] (X10) [File not signed]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-28] (Avira Operations GmbH & Co. KG)
S3 mod7764; C:\Windows\System32\DRIVERS\mod77-64.sys [913888 2009-09-24] (DiBcom SA)
S3 NxpCap64; C:\Windows\System32\DRIVERS\NxpCap64.sys [1888864 2010-02-04] (NXP Semiconductors Germany GmbH) [File not signed]
S3 TrdCap64; C:\Windows\System32\DRIVERS\TrdCap64.sys [1887528 2010-06-09] (Trident Microsystems, Inc.)
R3 X10Hid; C:\Windows\System32\Drivers\x10hid.sys [15896 2009-05-13] (X10 Wireless Technology, Inc.)
S3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [32792 2009-05-13] (X10 Wireless Technology, Inc.)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-31 17:18 - 2015-01-31 17:18 - 00025502 _____ () C:\Users\Susanne\Desktop\FRST.txt
2015-01-31 17:18 - 2015-01-31 17:18 - 00000000 ____D () C:\FRST
2015-01-31 17:17 - 2015-01-31 17:17 - 02130944 _____ (Farbar) C:\Users\Susanne\Downloads\FRST64.exe
2015-01-31 17:17 - 2015-01-31 17:17 - 02130944 _____ (Farbar) C:\Users\Susanne\Desktop\FRST64.exe
2015-01-31 17:14 - 2015-01-31 17:14 - 00000476 _____ () C:\Users\Susanne\Desktop\defogger_disable.log
2015-01-31 17:14 - 2015-01-31 17:14 - 00000000 _____ () C:\Users\Susanne\defogger_reenable
2015-01-31 17:10 - 2015-01-31 17:11 - 00000000 ___SD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.1.1
2015-01-31 17:10 - 2015-01-31 17:10 - 00001116 _____ () C:\Users\Public\Desktop\OpenOffice 4.1.1.lnk
2015-01-31 17:08 - 2015-01-31 17:09 - 00000000 ____D () C:\Program Files (x86)\OpenOffice 4
2015-01-31 17:07 - 2015-01-31 17:07 - 00000000 ____D () C:\Users\Susanne\Desktop\OpenOffice 4.1.1 (de) Installation Files
2015-01-31 17:06 - 2015-01-31 17:06 - 00050477 _____ () C:\Users\Susanne\Downloads\Defogger.exe
2015-01-31 17:06 - 2015-01-31 17:06 - 00050477 _____ () C:\Users\Susanne\Desktop\Defogger.exe
2015-01-31 17:00 - 2015-01-31 17:00 - 00001148 _____ () C:\Users\Susanne\Desktop\Goodgames Empire.lnk
2015-01-31 17:00 - 2015-01-31 17:00 - 00000000 ____D () C:\Users\Susanne\AppData\Roaming\dlg
2015-01-31 16:48 - 2015-01-31 16:48 - 00000000 ____D () C:\Users\Susanne\Documents\PCSpeedUp
2015-01-31 16:47 - 2015-01-31 16:49 - 00000000 ____D () C:\Program Files (x86)\PC Speed Up
2015-01-31 16:47 - 2015-01-31 16:47 - 00002724 _____ () C:\Windows\System32\Tasks\PC SpeedUp Service Deactivator
2015-01-31 16:47 - 2015-01-31 16:47 - 00001056 _____ () C:\Users\Susanne\Desktop\PC Speed Up.lnk
2015-01-31 16:47 - 2015-01-31 16:47 - 00000344 _____ () C:\Windows\Tasks\PC SpeedUp Service Deactivator.job
2015-01-31 16:47 - 2015-01-31 16:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WIntEnhance
2015-01-31 16:47 - 2015-01-31 16:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Speed Up
2015-01-31 16:47 - 2015-01-31 16:47 - 00000000 ____D () C:\Program Files (x86)\WIntEnhance
2015-01-31 16:47 - 2015-01-31 16:47 - 00000000 ____D () C:\Program Files (x86)\Wajam
2015-01-31 16:46 - 2015-01-31 17:10 - 00000000 ____D () C:\Program Files (x86)\XTab
2015-01-31 16:35 - 2015-01-31 16:35 - 00621024 _____ () C:\Users\Susanne\Downloads\download-apache-openoffice.exe
2015-01-27 10:58 - 2015-01-27 10:58 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-13 20:07 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-13 20:07 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-13 20:07 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-13 20:07 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-13 20:07 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-13 20:07 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-13 20:07 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-13 20:07 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-13 20:07 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-13 20:07 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-13 20:07 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-13 20:07 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-13 20:07 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-31 17:16 - 2011-04-10 16:56 - 00074728 _____ () C:\Users\Susanne\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-31 17:14 - 2011-04-10 15:29 - 00000000 ____D () C:\Users\Susanne
2015-01-31 16:45 - 2011-04-10 16:03 - 00001350 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-01-31 16:45 - 2011-04-10 16:03 - 00001338 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-01-31 16:45 - 2011-04-10 15:30 - 00001637 _____ () C:\Users\Susanne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-01-31 16:45 - 2011-04-10 15:27 - 00002375 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-01-31 16:45 - 2011-04-10 15:27 - 00001663 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2015-01-31 16:38 - 2010-05-12 09:18 - 00699682 _____ () C:\Windows\system32\perfh007.dat
2015-01-31 16:38 - 2010-05-12 09:18 - 00149790 _____ () C:\Windows\system32\perfc007.dat
2015-01-31 16:38 - 2009-07-14 06:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-31 16:38 - 2009-07-14 05:45 - 00018928 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-31 16:38 - 2009-07-14 05:45 - 00018928 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-31 16:34 - 2011-04-10 15:23 - 01443656 _____ () C:\Windows\WindowsUpdate.log
2015-01-31 16:29 - 2011-04-10 15:27 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-31 16:29 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-31 16:29 - 2009-07-14 05:51 - 00207110 _____ () C:\Windows\setupact.log
2015-01-30 20:34 - 2011-10-29 10:24 - 00001146 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1769490675-1898107201-2895629493-1000UA.job
2015-01-30 20:34 - 2011-10-29 10:24 - 00001124 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1769490675-1898107201-2895629493-1000Core.job
2015-01-30 20:26 - 2013-09-28 17:51 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-30 20:25 - 2011-04-10 15:27 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-29 16:38 - 2011-04-10 15:34 - 00000000 ____D () C:\Users\Susanne\AppData\Local\Google
2015-01-28 18:33 - 2011-04-10 15:29 - 00000000 ____D () C:\Users\Susanne\AppData\Local\VirtualStore
2015-01-27 13:28 - 2013-02-03 12:58 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-25 16:26 - 2013-09-28 17:51 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-25 16:26 - 2013-09-28 17:51 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-25 16:26 - 2012-02-07 17:14 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-25 14:57 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-01-24 09:58 - 2014-02-27 22:00 - 01594964 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-01-17 00:38 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2015-01-14 20:45 - 2013-08-17 21:05 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-14 20:39 - 2010-07-07 16:49 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-08 09:55 - 2010-07-07 16:48 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
==================== Files in the root of some directories =======
2014-04-08 15:56 - 2014-04-08 15:56 - 6000640 _____ () C:\Program Files (x86)\GUTE292.tmp
2011-04-25 21:36 - 2014-03-17 14:29 - 0006656 _____ () C:\Users\Susanne\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
Some content of TEMP:
====================
C:\Users\Susanne\AppData\Local\Temp\AskSLib.dll
C:\Users\Susanne\AppData\Local\Temp\AutoRun.exe
C:\Users\Susanne\AppData\Local\Temp\AutoRunGUI.dll
C:\Users\Susanne\AppData\Local\Temp\avgnt.exe
C:\Users\Susanne\AppData\Local\Temp\COMAP.EXE
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-01-24 00:30
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 31-01-2015 01
Ran by Susanne at 2015-01-31 17:19:11
Running from C:\Users\Susanne\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
ActiveX-kontroll för fjärranslutningar för Windows Live Mesh (HKLM-x32\...\{376D59B1-42D9-4FA2-B6CC-E346B6BE14F5}) (Version: 15.4.5722.2 - Microsoft Corporation)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.5.0.16600 - Adobe Systems Inc.)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Reader 9.4.0 MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-A91000000001}) (Version: 9.4.0 - Adobe Systems Incorporated)
Ashampoo Burning Studio (HKLM-x32\...\Ashampoo Burning Studio_is1) (Version: 9.23.0 - ashampoo GmbH & Co. KG)
Ashampoo Photo Commander (HKLM-x32\...\Ashampoo Photo Commander_is1) (Version: 8.3.2 - ashampoo GmbH & Co. KG)
Ashampoo Photo Optimizer (HKLM-x32\...\Ashampoo Photo Optimizer_is1) (Version: 3.12.0 - ashampoo GmbH & Co. KG)
Ashampoo Snap (HKLM-x32\...\Ashampoo Snap_is1) (Version: 3.4.1 - ashampoo GmbH & Co. KG)
Ask Toolbar (HKLM-x32\...\{86D4B82A-ABED-442A-BE86-96357B70F4FE}) (Version: 1.15.4.0 - Ask.com) <==== ATTENTION
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.27 - Atheros Communications Inc.)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
Avira SearchFree Toolbar plus Web Protection Updater (HKU\S-1-5-21-1769490675-1898107201-2895629493-1000\...\{79A765E1-C399-405B-85AF-466F52E918B0}) (Version: 1.3.0.23930 - Ask.com) <==== ATTENTION
Canon iP4500 series (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP4500_series) (Version: - )
Canon iP4500 series Benutzerregistrierung (HKLM-x32\...\Canon iP4500 series Benutzerregistrierung) (Version: - )
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Control ActiveX de Windows Live Mesh para conexiones remotas (HKLM-x32\...\{04668DF2-D32F-4555-9C7E-35523DCD6544}) (Version: 15.4.5722.2 - Microsoft Corporation)
Contrôle ActiveX Windows Live Mesh pour connexions à distance (HKLM-x32\...\{55D003F4-9599-44BF-BA9E-95D060730DD3}) (Version: 15.4.5722.2 - Microsoft Corporation)
Controlo ActiveX do Windows Live Mesh para Ligações Remotas (HKLM-x32\...\{E54EEB5D-41ED-40FE-B4A8-8565DB81469B}) (Version: 15.4.5722.2 - Microsoft Corporation)
Corel Shell Extension - 64Bit (Version: 14.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Content (x32 Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Draw (x32 Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Filters (x32 Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - ICA (x32 Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - IPM - No VBA (x32 Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang BR (x32 Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang DE (x32 Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang EN (x32 Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang ES (x32 Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang FR (x32 Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang IT (x32 Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang NL (x32 Version: 4.0 - Uw bedrijfsnaam) Hidden
CorelDRAW Essentials 4 - PHOTO-PAINT (x32 Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Windows Shell Extension (HKLM-x32\...\_{CF0ADC18-6D8F-4353-8EAA-DF45456B7853}) (Version: - Corel Corporation)
CorelDRAW Essentials 4 - Windows Shell Extension (x32 Version: 1.1 - Corel Corporation) Hidden
CorelDRAW Essentials 4 (HKLM-x32\...\_{C0237AA4-1BFB-46EA-860D-7B0EB365CA13}) (Version: - Corel Corporation)
CorelDRAW Essentials 4 (x32 Version: 4.0 - Corel Corporation) Hidden
CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.3418 - CyberLink Corp.)
CyberLink MediaShow (HKLM-x32\...\InstallShield_{80E158EA-7181-40FE-A701-301CE6BE64AB}) (Version: 5.0.1410a - CyberLink Corp.)
CyberLink MediaShow Espresso (HKLM-x32\...\InstallShield_{E3739848-5329-48E3-8D28-5BBD6E8BE384}) (Version: 5.5.1412_24021a - CyberLink Corp.)
CyberLink PhotoNow (HKLM-x32\...\InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.1.0.6904 - CyberLink Corp.)
CyberLink Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.3802 - CyberLink Corp.)
CyberLink PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 8.0.3224a - CyberLink Corp.)
CyberLink PowerDVD 10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.2225 - CyberLink Corp.)
CyberLink PowerDVD Copy (HKLM-x32\...\InstallShield_{E3D04529-6EDB-11D8-A372-0050BAE317E1}) (Version: 1.5.1306 - CyberLink Corp.)
CyberLink PowerProducer (HKLM-x32\...\InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version: 5.0.2.2429 - CyberLink Corp.)
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.1.3428 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Facebook Video Calling 3.1.0.521 (HKLM-x32\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
Formant ActiveX programu Windows Live Mesh odpowiedzialny za obsługę połączeń zdalnych (HKLM-x32\...\{B04A0E2F-1E4C-4E61-B18E-3B2BD6779CA7}) (Version: 15.4.5722.2 - Microsoft Corporation)
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Free YouTube to MP3 Converter version 3.12.0.128 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.0.128 - DVDVideoSoft Ltd.)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.93 - Google Inc.)
Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google+ Auto Backup (HKLM-x32\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google)
Haali Media Splitter (HKLM-x32\...\HaaliMkx) (Version: - )
Intel(R) Graphics Media Accelerator Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2189 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.0.1014 - Intel Corporation)
Java(TM) 6 Update 22 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416022FF}) (Version: 6.0.220 - Oracle)
Java(TM) 6 Update 22 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216022FF}) (Version: 6.0.220 - Oracle)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Kontrolnik Windows Live Mesh ActiveX za oddaljene povezave (HKLM-x32\...\{CA227A9D-09BE-4BFB-9764-48FED2DA5454}) (Version: 15.4.5722.2 - Microsoft Corporation)
Launch Manager (HKLM-x32\...\{D0846526-66DD-4DC9-A02C-98F9A2806812}) (Version: 1.5.1.2 - Wistron Corp.)
Medion Home Cinema (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 8.0.2213 - CyberLink Corp.)
Medion Home Cinema (x32 Version: 8.0.2213 - CyberLink Corp.) Hidden
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft IntelliPoint 8.0 (HKLM\...\{2BF35D84-6377-4F70-9F39-97CF67E67FFF}) (Version: 8.01.249.0 - Microsoft)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 12.0.1 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 12.0.1 (x86 de)) (Version: 12.0.1 - Mozilla)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
PC Speed Up (HKLM\...\PCSU-SL_is1) (Version: 3.8.3.0 - Speedchecker Limited) <==== ATTENTION
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
PIXMA Extended Survey Program (HKLM-x32\...\CANONIJPLM100) (Version: - )
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Pošta Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6237 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30121 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4fed-B2B9-173F09590E16}) (Version: 1.00.0148 - REALTEK Semiconductor Corp.)
Recuva (HKLM\...\Recuva) (Version: 1.46 - Piriform)
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.0.26.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.26.0 - Renesas Electronics Corporation) Hidden
Rossmann Fotowelt Software 4.13 (HKLM-x32\...\Rossmann Fotowelt Software) (Version: 4.13 - ORWO Net)
SimCity 4 Deluxe (HKLM-x32\...\{3F0D0ABE-CDAF-431A-00BC-CBBE018EA74E}) (Version: - )
Sun ODF Plugin for Microsoft Office 3.2 (HKLM-x32\...\{BD136CE7-6666-4273-A056-8D92F8625AAB}) (Version: 3.2.9483 - Sun Microsystems)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 14.0.19.0 - Synaptics Incorporated)
Uzak Bağlantılar İçin Windows Live Mesh ActiveX Denetimi (HKLM-x32\...\{241E7104-937A-4366-AD57-8FDDDB003939}) (Version: 15.4.5722.2 - Microsoft Corporation)
Versandhelfer (HKLM-x32\...\dpdhl.versandhelfer.medionlap.CDA82DC3FEDD13302C6424313D9A2999F162D21A.1) (Version: 0.9.511 - Deutsche Post AG)
Versandhelfer (x32 Version: 0.9.511 - Deutsche Post AG) Hidden
Wajam (HKLM-x32\...\WIntEnhance) (Version: 2.23.2.5 (i2.6) - WIntEnhance) <==== ATTENTION
webssearches uninstall (HKLM-x32\...\webssearches uninstall) (Version: - webssearches) <==== ATTENTION
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (HKLM-x32\...\{C32CE55C-12BA-4951-8797-0967FDEF556F}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{C63A1E60-B6A4-440B-89A5-1FC6E4AC1C94}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX-kontroll for eksterne tilkoblinger (HKLM-x32\...\{09B7C7EB-3140-4B5E-842F-9C79A7137139}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX-objekt til fjernforbindelser (HKLM-x32\...\{57220148-3B2B-412A-A2E0-82B9DF423696}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX-vezérlő távoli kapcsolatokhoz (HKLM-x32\...\{6E29C4F7-C2C2-4B18-A15C-E09B92065F15}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Meshin etäyhteyksien ActiveX-komponentti (HKLM-x32\...\{4CF6F287-5121-483C-A5A2-07BDE19D8B4E}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Media Encoder 9 Series (HKLM-x32\...\Windows Media Encoder 9) (Version: - )
WinRAR 4.00 (32-Bit) (HKLM-x32\...\WinRAR archiver) (Version: 4.00.0 - win.rar GmbH)
WinToFlash Suggestor (HKLM-x32\...\WinToFlash Suggestor) (Version: 1.2.5.0 - Think Tank Labs, LLC) <==== ATTENTION
X10 Hardware(TM) (HKLM-x32\...\X10Hardware) (Version: - )
Στοιχείο ελέγχου ActiveX του Windows Live Mesh για απομακρυσμένες συνδέσεις (HKLM-x32\...\{F665F3B8-01B4-46A9-8E47-FF8DC2208C9F}) (Version: 15.4.5722.2 - Microsoft Corporation)
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
08-01-2015 19:07:37 Windows Update
13-01-2015 20:06:46 Windows Update
14-01-2015 20:35:33 Windows Update
24-01-2015 00:05:57 Windows Update
24-01-2015 09:51:09 Windows Update
27-01-2015 10:46:18 Windows Update
30-01-2015 20:26:27 Windows Update
31-01-2015 17:07:57 OpenOffice 4.1.1 wird installiert
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {0C9B518C-8226-4F00-8C84-AB8A68C88A56} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-25] (Adobe Systems Incorporated)
Task: {3440AA8F-D146-4FED-96AD-D45C9DB3E050} - System32\Tasks\PC SpeedUp Service Deactivator => C:\Program Files (x86)\PC Speed Up\PCSUSD.exe [2014-12-10] () <==== ATTENTION
Task: {54CCCC6B-1A30-4D4B-82D9-5AE82C36A311} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-25] (Google Inc.)
Task: {705A2CAB-5D3F-4DBF-BF53-929099A1E54F} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1769490675-1898107201-2895629493-1000UA => C:\Users\Susanne\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-15] (Facebook Inc.)
Task: {8AA2CCFD-E08A-44C2-B1BD-1B50B21AAD45} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => c:\Program Files\Microsoft IntelliPoint\IPoint.exe [2011-01-07] (Microsoft Corporation)
Task: {8EA45CDE-8A78-4644-B7AA-93CC8B0341AA} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1769490675-1898107201-2895629493-1000Core => C:\Users\Susanne\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-15] (Facebook Inc.)
Task: {D9BE450F-4EF4-485C-B924-7D3F30A3240D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-25] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1769490675-1898107201-2895629493-1000Core.job => C:\Users\Susanne\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1769490675-1898107201-2895629493-1000UA.job => C:\Users\Susanne\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\PC SpeedUp Service Deactivator.job => C:\Program Files (x86)\PC Speed Up\PCSUSD.exe <==== ATTENTION
==================== Loaded Modules (whitelisted) =============
2013-08-18 16:39 - 2007-04-13 17:20 - 00097432 _____ () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
2011-05-22 00:20 - 2011-03-02 11:40 - 00164864 _____ () C:\Program Files (x86)\WinRAR\rarext64.dll
2010-11-06 16:39 - 2010-02-10 12:34 - 00244904 ____N () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
2015-01-31 16:47 - 2014-12-10 16:04 - 00437704 _____ () C:\Program Files (x86)\PC Speed Up\PCSUService.exe
2015-01-31 16:47 - 2014-12-10 16:04 - 00342472 _____ () C:\Program Files (x86)\PC Speed Up\PCSUNotifier.exe
2015-01-31 17:06 - 2015-01-31 17:06 - 00050477 _____ () C:\Users\Susanne\Desktop\Defogger.exe
2009-11-02 22:20 - 2009-11-02 22:20 - 00619816 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
2009-11-02 22:23 - 2009-11-02 22:23 - 00013096 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
2014-10-17 16:56 - 2014-10-17 16:56 - 00170496 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\3d576cbc4ffc5ad06fd61510c5d8f326\IsdiInterop.ni.dll
2010-11-02 17:18 - 2010-03-04 04:08 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2015-01-27 10:58 - 2015-01-27 10:58 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2015-01-25 16:26 - 2015-01-25 16:26 - 16844976 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll
2015-01-31 16:47 - 2014-12-10 16:04 - 00583712 _____ () C:\Program Files (x86)\PC Speed Up\sqlite3.dll
2015-01-31 16:47 - 2014-12-10 16:04 - 00440776 _____ () C:\Program Files (x86)\PC Speed Up\PopupNotification.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BsScanner => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\BsScanner => ""="Service"
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-1769490675-1898107201-2895629493-500 - Administrator - Disabled)
Gast (S-1-5-21-1769490675-1898107201-2895629493-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1769490675-1898107201-2895629493-1002 - Limited - Enabled)
Susanne (S-1-5-21-1769490675-1898107201-2895629493-1000 - Administrator - Enabled) => C:\Users\Susanne
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (01/31/2015 05:12:59 PM) (Source: VSS) (EventID: 12298) (User: )
Description: Volumeschattenkopie-Dienstfehler: Die E/A-Schreibvorgänge können während des Schattenkopie-Erstellungszeitraums auf Volume "C:\" nicht gespeichert werden.
Der Volumeindex im Schattenkopiesatz ist 0. Fehlerdetails: Offen[0x00000000, Der Vorgang wurde erfolgreich beendet.
], Leerung[0x00000000, Der Vorgang wurde erfolgreich beendet.
], Freigabe[0x80042314, Der Schattenkopieanbieter hat beim Warten auf den Schreibvorgang auf das Volume, von dem eine Schattenkopie erstellt wird, das Zeitlimit überschritten. Ursache hierfür könnte eine durch eine Anwendung oder einen Systemdienst verursachte hohe Aktivität auf dem Volume sein. Wiederholen Sie den Vorgang später, wenn das Volume nicht so stark ausgelastet ist.
], Ausführung[0x00000000, Der Vorgang wurde erfolgreich beendet.
].
Vorgang:
Asynchroner Vorgang wird ausgeführt
Kontext:
Aktueller Status: DoSnapshotSet
Error: (01/31/2015 05:12:58 PM) (Source: VSS) (EventID: 12310) (User: )
Description: Volumeschattenkopie-Dienstfehler: Die Schattenkopie kann nicht zugesichert werden - Vorgang hat das Zeitlimit überschritten.
Fehlerkontext: DeviceIoControl(\\?\Volume{8f7fb857-63c8-11e0-bcfa-806e6f6e6963} - 00000000000000C4,0x0053c010,00000000001907E0,0,00000000001917F0,4096,[0]).
Vorgang:
Schattenkopien werden übertragen
Kontext:
Ausführungskontext: System Provider
Error: (01/27/2015 04:54:32 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: wwanapi.dll, Version: 6.1.7600.16385, Zeitstempel: 0x4a5be0a8
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000333eb
ID des fehlerhaften Prozesses: 0x764
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3
Error: (11/26/2014 08:35:51 PM) (Source: Google Update) (EventID: 20) (User: Susanne-Laptop)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook.com/omaha/update.php
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned
Error: (09/02/2014 06:14:29 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ipmGui.exe, Version: 14.0.6.522, Zeitstempel: 0x53bec647
Name des fehlerhaften Moduls: ipmGui.exe, Version: 14.0.6.522, Zeitstempel: 0x53bec647
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000795b
ID des fehlerhaften Prozesses: 0x1310
Startzeit der fehlerhaften Anwendung: 0xipmGui.exe0
Pfad der fehlerhaften Anwendung: ipmGui.exe1
Pfad des fehlerhaften Moduls: ipmGui.exe2
Berichtskennung: ipmGui.exe3
Error: (03/27/2014 03:53:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 27.0.1.5156, Zeitstempel: 0x52fc0faa
Name des fehlerhaften Moduls: xul.dll, Version: 27.0.1.5156, Zeitstempel: 0x52fc0f79
Ausnahmecode: 0xc0000005
Fehleroffset: 0x001560c7
ID des fehlerhaften Prozesses: 0x284
Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0
Pfad der fehlerhaften Anwendung: firefox.exe1
Pfad des fehlerhaften Moduls: firefox.exe2
Berichtskennung: firefox.exe3
Error: (03/25/2014 08:35:43 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: SMBarBroker.exe, Version: 1.0.3.0, Zeitstempel: 0x4fbe54bd
Name des fehlerhaften Moduls: SMBarBroker.exe, Version: 1.0.3.0, Zeitstempel: 0x4fbe54bd
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000048ba
ID des fehlerhaften Prozesses: 0x11b4
Startzeit der fehlerhaften Anwendung: 0xSMBarBroker.exe0
Pfad der fehlerhaften Anwendung: SMBarBroker.exe1
Pfad des fehlerhaften Moduls: SMBarBroker.exe2
Berichtskennung: SMBarBroker.exe3
Error: (03/23/2014 07:45:41 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: SHELL32.dll, Version: 6.1.7601.18222, Zeitstempel: 0x51f1ddfa
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000003f0998
ID des fehlerhaften Prozesses: 0x694
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3
Error: (01/18/2014 05:43:15 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 26.0.0.5087, Zeitstempel: 0x52a0d273
Name des fehlerhaften Moduls: xul.dll, Version: 26.0.0.5087, Zeitstempel: 0x52a0d20a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0014e1a8
ID des fehlerhaften Prozesses: 0xcd0
Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0
Pfad der fehlerhaften Anwendung: firefox.exe1
Pfad des fehlerhaften Moduls: firefox.exe2
Berichtskennung: firefox.exe3
Error: (12/29/2013 05:11:56 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 25.0.1.5064, Zeitstempel: 0x5282f204
Name des fehlerhaften Moduls: xul.dll, Version: 25.0.1.5064, Zeitstempel: 0x5282f10e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00118f87
ID des fehlerhaften Prozesses: 0x938
Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0
Pfad der fehlerhaften Anwendung: firefox.exe1
Pfad des fehlerhaften Moduls: firefox.exe2
Berichtskennung: firefox.exe3
System errors:
=============
Error: (01/25/2015 06:14:44 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Diagnosediensthost" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (01/25/2015 06:14:44 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "WdiServiceHost" konnte sich nicht als "NT AUTHORITY\LocalService" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%50
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (01/25/2015 06:14:44 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "WinHTTP-Web Proxy Auto-Discovery-Dienst" ist vom Dienst "DHCP-Client" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1069
Error: (01/25/2015 06:14:44 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "DHCP-Client" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (01/25/2015 06:14:44 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "Dhcp" konnte sich nicht als "NT Authority\LocalService" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%50
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (01/25/2015 06:14:44 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Netzwerklistendienst" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (01/25/2015 06:14:44 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "netprofm" konnte sich nicht als "NT AUTHORITY\LocalService" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%50
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (01/25/2015 06:14:44 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Netzwerkverbindungen" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1115
Error: (01/25/2015 06:14:44 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Anwendungsinformationen" ist vom Dienst "Benutzerprofildienst" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1062
Error: (01/25/2015 06:14:44 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "WisLMSvc" wurde aufgrund folgenden Fehlers nicht gestartet:
%%109
Microsoft Office Sessions:
=========================
Error: (01/31/2015 05:12:59 PM) (Source: VSS) (EventID: 12298) (User: )
Description: C:\00x00000000, Der Vorgang wurde erfolgreich beendet.
0x00000000, Der Vorgang wurde erfolgreich beendet.
0x80042314, Der Schattenkopieanbieter hat beim Warten auf den Schreibvorgang auf das Volume, von dem eine Schattenkopie erstellt wird, das Zeitlimit überschritten. Ursache hierfür könnte eine durch eine Anwendung oder einen Systemdienst verursachte hohe Aktivität auf dem Volume sein. Wiederholen Sie den Vorgang später, wenn das Volume nicht so stark ausgelastet ist.
0x00000000, Der Vorgang wurde erfolgreich beendet.
Vorgang:
Asynchroner Vorgang wird ausgeführt
Kontext:
Aktueller Status: DoSnapshotSet
Error: (01/31/2015 05:12:58 PM) (Source: VSS) (EventID: 12310) (User: )
Description: DeviceIoControl(\\?\Volume{8f7fb857-63c8-11e0-bcfa-806e6f6e6963} - 00000000000000C4,0x0053c010,00000000001907E0,0,00000000001917F0,4096,[0])
Vorgang:
Schattenkopien werden übertragen
Kontext:
Ausführungskontext: System Provider
Error: (01/27/2015 04:54:32 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Explorer.EXE6.1.7601.175674d672ee4wwanapi.dll6.1.7600.163854a5be0a8c000000500000000000333eb76401d03a495ba92785C:\Windows\Explorer.EXEC:\Windows\system32\wwanapi.dllc8316a2c-a63c-11e4-9815-00262dc2f22d
Error: (11/26/2014 08:35:51 PM) (Source: Google Update) (EventID: 20) (User: Susanne-Laptop)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook.com/omaha/update.php
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned
Error: (09/02/2014 06:14:29 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: ipmGui.exe14.0.6.52253bec647ipmGui.exe14.0.6.52253bec647c00000050000795b131001cfc6d06ad37c2eC:\program files (x86)\avira\antivir desktop\ipmGui.exeC:\program files (x86)\avira\antivir desktop\ipmGui.exe98fe0dbd-32c4-11e4-8913-00262dc2f22d
Error: (03/27/2014 03:53:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: firefox.exe27.0.1.515652fc0faaxul.dll27.0.1.515652fc0f79c0000005001560c728401cf49c83a76148cC:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Program Files (x86)\Mozilla Firefox\xul.dll8aa8704d-b5bf-11e3-9cdb-00262dc2f22d
Error: (03/25/2014 08:35:43 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: SMBarBroker.exe1.0.3.04fbe54bdSMBarBroker.exe1.0.3.04fbe54bdc0000005000048ba11b401cf486167e9257fC:\Program Files (x86)\WinToFlash Suggestor\SMBarBroker.exeC:\Program Files (x86)\WinToFlash Suggestor\SMBarBroker.exea719b0ac-b454-11e3-83dd-00262dc2f22d
Error: (03/23/2014 07:45:41 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Explorer.EXE6.1.7601.175674d672ee4SHELL32.dll6.1.7601.1822251f1ddfac000000500000000003f099869401cf46c7259dad1eC:\Windows\Explorer.EXEC:\Windows\system32\SHELL32.dll54bfa6b3-b2bb-11e3-b12f-00262dc2f22d
Error: (01/18/2014 05:43:15 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: firefox.exe26.0.0.508752a0d273xul.dll26.0.0.508752a0d20ac00000050014e1a8cd001cf146a4014e57fC:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Program Files (x86)\Mozilla Firefox\xul.dlla01c7d85-805f-11e3-a1b8-00262dc2f22d
Error: (12/29/2013 05:11:56 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: firefox.exe25.0.1.50645282f204xul.dll25.0.1.50645282f10ec000000500118f8793801cf04af8acad10cC:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Program Files (x86)\Mozilla Firefox\xul.dllefe75a8b-70a3-11e3-8d61-00262dc2f22d
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i3 CPU M 380 @ 2.53GHz
Percentage of memory in use: 46%
Total physical RAM: 3893.49 MB
Available physical RAM: 2072.16 MB
Total Pagefile: 7785.16 MB
Available Pagefile: 5565.7 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: (Boot) (Fixed) (Total:546.25 GB) (Free:442.54 GB) NTFS
Drive d: (Recover) (Fixed) (Total:48.83 GB) (Free:4.97 GB) NTFS
Drive f: () (Removable) (Total:1.88 GB) (Free:0.3 GB) FAT
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 596.2 GB) (Disk ID: 2BD2C32A)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=546.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=48.8 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=1023 MB) - (Type=12)
========================================================
Disk: 1 (Size: 1.9 GB) (Disk ID: 91F72D24)
Partition 1: (Active) - (Size=1.9 GB) - (Type=06)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-01-31 17:37:11
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 SAMSUNG_ rev.2AJ1 596,17GB
Running: rp7ugrz5.exe; Driver: C:\Users\Susanne\AppData\Local\Temp\uxliykog.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 586 fffff800035a708a 7 bytes [00, 00, 00, 00, 00, 00, 03]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 594 fffff800035a7092 4 bytes [00, 00, 01, 02]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2492] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d91465 2 bytes [D9, 75]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2492] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d914bb 2 bytes [D9, 75]
.text ... * 2
.text C:\Program Files (x86)\XTab\ProtectService.exe[4240] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d91465 2 bytes [D9, 75]
.text C:\Program Files (x86)\XTab\ProtectService.exe[4240] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d914bb 2 bytes [D9, 75]
.text ... * 2
.text C:\Program Files (x86)\XTab\cmdshell.exe[1612] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d91465 2 bytes [D9, 75]
.text C:\Program Files (x86)\XTab\cmdshell.exe[1612] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d914bb 2 bytes [D9, 75]
.text ... * 2
.text C:\Program Files (x86)\XTab\HPNotify.exe[1272] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d91465 2 bytes [D9, 75]
.text C:\Program Files (x86)\XTab\HPNotify.exe[1272] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d914bb 2 bytes [D9, 75]
.text ... * 2
.text C:\Program Files (x86)\PC Speed Up\PCSUService.exe[5816] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d91465 2 bytes [D9, 75]
.text C:\Program Files (x86)\PC Speed Up\PCSUService.exe[5816] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d914bb 2 bytes [D9, 75]
.text ... * 2
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
|
|
31.01.2015, 18:26
| #2 |
| /// the machine /// TB-Ausbilder    | Avira hat Maleware gefunden : ADWARE/Adware.Gen hi,
__________________Lade Dir bitte von hier  Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
Scan mit Combofix
__________________ |
|
01.02.2015, 08:41
| #3 |
| | Avira hat Maleware gefunden : ADWARE/Adware.Gen Hey,
__________________Ich konnte mit dem Revo Uninstaller "AviraSearchfree toolbar..." und "PC Speed Up" nicht finden. Code:
ATTFilter ComboFix 15-01-29.01 - Susanne 01.02.2015 8:19.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.3893.2232 [GMT 1:00]
ausgeführt von:: c:\users\Susanne\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Install.exe
c:\windows\msdownld.tmp
.
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_PCSUService
.
.
((((((((((((((((((((((( Dateien erstellt von 2015-01-01 bis 2015-02-01 ))))))))))))))))))))))))))))))
.
.
2015-02-01 07:25 . 2015-02-01 07:25 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-02-01 07:04 . 2015-02-01 07:04 -------- d-----w- c:\program files (x86)\VS Revo Group
2015-01-31 16:18 . 2015-01-31 16:21 -------- d-----w- C:\FRST
2015-01-31 16:08 . 2015-01-31 16:09 -------- d-----w- c:\program files (x86)\OpenOffice 4
2015-01-31 16:00 . 2015-01-31 16:00 -------- d-----w- c:\users\Susanne\AppData\Roaming\dlg
2015-01-31 15:47 . 2015-01-31 16:59 -------- d-----w- c:\program files (x86)\PC Speed Up
2015-01-30 19:28 . 2014-12-02 10:26 11870360 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{11E126CF-5208-49D8-8C1F-3764214912BB}\mpengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-01-25 15:26 . 2013-09-28 16:51 701616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2015-01-25 15:26 . 2012-02-07 16:14 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-01-14 19:39 . 2010-07-07 15:49 113365784 ----a-w- c:\windows\system32\MRT.exe
2015-01-08 08:55 . 2010-07-07 15:48 298120 ------w- c:\windows\system32\MpSigStub.exe
2014-12-13 05:09 . 2014-12-17 18:46 144384 ----a-w- c:\windows\system32\ieUnatt.exe
2014-12-13 03:33 . 2014-12-17 18:46 115712 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2014-12-04 02:50 . 2014-12-11 19:17 413184 ----a-w- c:\windows\system32\generaltel.dll
2014-12-04 02:50 . 2014-12-11 19:17 741376 ----a-w- c:\windows\system32\invagent.dll
2014-12-04 02:50 . 2014-12-11 19:17 396800 ----a-w- c:\windows\system32\devinv.dll
2014-12-04 02:50 . 2014-12-11 19:17 830976 ----a-w- c:\windows\system32\appraiser.dll
2014-12-04 02:50 . 2014-12-11 19:17 192000 ----a-w- c:\windows\system32\aepic.dll
2014-12-04 02:50 . 2014-12-11 19:17 227328 ----a-w- c:\windows\system32\aepdu.dll
2014-12-04 02:44 . 2014-12-11 19:17 1083392 ----a-w- c:\windows\system32\aeinv.dll
2014-12-01 23:28 . 2014-12-11 19:17 1232040 ----a-w- c:\windows\system32\aitstatic.exe
2014-11-27 01:43 . 2014-12-13 18:13 389296 ----a-w- c:\windows\system32\iedkcs32.dll
2014-11-22 03:13 . 2014-12-13 18:13 25059840 ----a-w- c:\windows\system32\mshtml.dll
2014-11-22 03:06 . 2014-12-13 18:13 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2014-11-22 03:06 . 2014-12-13 18:13 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll
2014-11-22 02:50 . 2014-12-13 18:13 66560 ----a-w- c:\windows\system32\iesetup.dll
2014-11-22 02:50 . 2014-12-13 18:13 580096 ----a-w- c:\windows\system32\vbscript.dll
2014-11-22 02:49 . 2014-12-13 18:13 48640 ----a-w- c:\windows\system32\ieetwproxystub.dll
2014-11-22 02:49 . 2014-12-13 18:13 2885120 ----a-w- c:\windows\system32\iertutil.dll
2014-11-22 02:48 . 2014-12-13 18:13 88064 ----a-w- c:\windows\system32\MshtmlDac.dll
2014-11-22 02:41 . 2014-12-13 18:13 54784 ----a-w- c:\windows\system32\jsproxy.dll
2014-11-22 02:40 . 2014-12-13 18:13 34304 ----a-w- c:\windows\system32\iernonce.dll
2014-11-22 02:37 . 2014-12-13 18:13 633856 ----a-w- c:\windows\system32\ieui.dll
2014-11-22 02:35 . 2014-12-13 18:13 114688 ----a-w- c:\windows\system32\ieetwcollector.exe
2014-11-22 02:34 . 2014-12-13 18:13 814080 ----a-w- c:\windows\system32\jscript9diag.dll
2014-11-22 02:34 . 2014-12-13 18:13 6039552 ----a-w- c:\windows\system32\jscript9.dll
2014-11-22 02:26 . 2014-12-13 18:13 968704 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2014-11-22 02:22 . 2014-12-13 18:13 490496 ----a-w- c:\windows\system32\dxtmsft.dll
2014-11-22 02:20 . 2014-12-13 18:13 2724864 ----a-w- c:\windows\SysWow64\mshtml.tlb
2014-11-22 02:14 . 2014-12-13 18:13 77824 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2014-11-22 02:09 . 2014-12-13 18:13 199680 ----a-w- c:\windows\system32\msrating.dll
2014-11-22 02:08 . 2014-12-13 18:13 92160 ----a-w- c:\windows\system32\mshtmled.dll
2014-11-22 02:07 . 2014-12-13 18:13 501248 ----a-w- c:\windows\SysWow64\vbscript.dll
2014-11-22 02:07 . 2014-12-13 18:13 62464 ----a-w- c:\windows\SysWow64\iesetup.dll
2014-11-22 02:06 . 2014-12-13 18:13 47616 ----a-w- c:\windows\SysWow64\ieetwproxystub.dll
2014-11-22 02:05 . 2014-12-13 18:13 64000 ----a-w- c:\windows\SysWow64\MshtmlDac.dll
2014-11-22 02:05 . 2014-12-13 18:13 316928 ----a-w- c:\windows\system32\dxtrans.dll
2014-11-22 01:54 . 2014-12-13 18:13 620032 ----a-w- c:\windows\SysWow64\jscript9diag.dll
2014-11-22 01:49 . 2014-12-13 18:13 718848 ----a-w- c:\windows\system32\ie4uinit.exe
2014-11-22 01:49 . 2014-12-13 18:13 800768 ----a-w- c:\windows\system32\msfeeds.dll
2014-11-22 01:47 . 2014-12-13 18:13 1359360 ----a-w- c:\windows\system32\mshtmlmedia.dll
2014-11-22 01:46 . 2014-12-13 18:13 2125312 ----a-w- c:\windows\system32\inetcpl.cpl
2014-11-22 01:43 . 2014-12-13 18:13 14412800 ----a-w- c:\windows\system32\ieframe.dll
2014-11-22 01:40 . 2014-12-13 18:13 60416 ----a-w- c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2014-11-22 01:29 . 2014-12-13 18:13 4299264 ----a-w- c:\windows\SysWow64\jscript9.dll
2014-11-22 01:28 . 2014-12-13 18:13 2358272 ----a-w- c:\windows\system32\wininet.dll
2014-11-22 01:22 . 2014-12-13 18:13 2052096 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2014-11-22 01:21 . 2014-12-13 18:13 1155072 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2014-11-22 01:15 . 2014-12-13 18:13 1548288 ----a-w- c:\windows\system32\urlmon.dll
2014-11-22 01:03 . 2014-12-13 18:13 800768 ----a-w- c:\windows\system32\ieapfltr.dll
2014-11-22 01:00 . 2014-12-13 18:13 1888256 ----a-w- c:\windows\SysWow64\wininet.dll
2014-11-11 03:09 . 2014-12-11 19:13 1424384 ----a-w- c:\windows\system32\WindowsCodecs.dll
2014-11-11 03:08 . 2014-11-18 18:32 241152 ----a-w- c:\windows\system32\pku2u.dll
2014-11-11 03:08 . 2014-11-18 18:32 728064 ----a-w- c:\windows\system32\kerberos.dll
2014-11-11 02:44 . 2014-12-11 19:13 1230336 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll
2014-11-11 02:44 . 2014-11-18 18:32 186880 ----a-w- c:\windows\SysWow64\pku2u.dll
2014-11-11 02:44 . 2014-11-18 18:32 550912 ----a-w- c:\windows\SysWow64\kerberos.dll
2014-11-11 01:46 . 2014-12-11 19:13 119296 ----a-w- c:\windows\system32\drivers\tdx.sys
2014-11-08 03:16 . 2014-12-11 19:09 2048 ----a-w- c:\windows\system32\tzres.dll
2014-11-08 02:45 . 2014-12-11 19:09 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2014-04-08 14:56 . 2014-04-08 14:56 6000640 ----a-w- c:\program files (x86)\GUTE292.tmp
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2013-01-28 14:49 281760 ----a-w- c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-04-10 39408]
"GoogleChromeAutoLaunch_BEAD1C12587041F9E622982A20D4E70C"="c:\program files (x86)\Google\Chrome\Application\chrome.exe" [2015-01-25 843592]
"PCSpeedUp"="c:\program files (x86)\PC Speed Up\PCSUNotifier.exe" [2014-12-10 342472]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HotkeyApp"="c:\program files (x86)\Launch Manager\HotkeyApp.exe" [2009-12-14 200704]
"LMgrVolOSD"="c:\program files (x86)\Launch Manager\OSD.exe" [2009-12-11 348960]
"Wbutton"="c:\program files (x86)\Launch Manager\Wbutton.exe" [2010-06-21 436264]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-04-27 113288]
"CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2009-11-02 103720]
"YouCam Mirage"="c:\program files (x86)\CyberLink\YouCam\YCMMirage.exe" [2010-10-29 136488]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-12-16 702768]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 mod7764;Tv Tuner device;c:\windows\system32\DRIVERS\mod77-64.sys;c:\windows\SYSNATIVE\DRIVERS\mod77-64.sys [x]
R3 NxpCap64;CTX capture service;c:\windows\system32\DRIVERS\NxpCap64.sys;c:\windows\SYSNATIVE\DRIVERS\NxpCap64.sys [x]
R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
R3 TrdCap64;CTX's capture service;c:\windows\system32\DRIVERS\TrdCap64.sys;c:\windows\SYSNATIVE\DRIVERS\TrdCap64.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 WisLMSvc;WisLMSvc;c:\program files (x86)\Launch Manager\WisLMSvc.exe;c:\program files (x86)\Launch Manager\WisLMSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys;c:\windows\SYSNATIVE\DRIVERS\Impcd.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys;c:\windows\SYSNATIVE\DRIVERS\rtl8192se.sys [x]
S3 X10Hid;X10 Hid Device;c:\windows\System32\Drivers\x10hid.sys;c:\windows\SYSNATIVE\Drivers\x10hid.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-01-27 11:26 1086280 ----a-w- c:\program files (x86)\Google\Chrome\Application\40.0.2214.93\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2015-02-01 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-28 15:26]
.
2015-01-31 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1769490675-1898107201-2895629493-1000Core.job
- c:\users\Susanne\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-29 18:29]
.
2015-02-01 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1769490675-1898107201-2895629493-1000UA.job
- c:\users\Susanne\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-29 18:29]
.
2015-02-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-04-10 12:14]
.
2015-02-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-04-10 12:14]
.
2015-01-31 c:\windows\Tasks\PC SpeedUp Service Deactivator.job
- c:\program files (x86)\PC Speed Up\PCSUSD.exe [2015-01-31 15:04]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2013-01-28 14:49 342176 ----a-w- c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-03 11548264]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-11-03 2181224]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-01-07 2328944]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-11 162328]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-11 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-11 417304]
"EKIJ5000StatusMonitor"="c:\windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe" [2010-09-02 2045440]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://istart.webssearches.com/?type=hp&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635
mDefault_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635&q={searchTerms}
mDefault_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635
mStart Page = hxxp://istart.webssearches.com/?type=hp&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635&q={searchTerms}
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Free YouTube Download - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm
IE: Free YouTube to MP3 Converter - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4
IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\
FF - prefs.js: browser.search.selectedEngine - webssearches
FF - prefs.js: browser.startup.homepage - hxxp://istart.webssearches.com/?type=hp&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635
FF - prefs.js: keyword.URL -
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - (no file)
Wow6432Node-HKLM-Run-LMgrOSD - c:\program files (x86)\Launch Manager\OSDCtrl.exe
Wow6432Node-HKU-Default-RunOnce-SPReview - c:\windows\System32\SPReview\SPReview.exe
SafeBoot-BsScanner
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_296_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_296_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_296_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_296_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_296.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.16"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_296.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_296.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_296.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Canon\IJPLM\IJPLMSVC.EXE
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files (x86)\CyberLink\Shared files\RichVideo.exe
c:\progra~2\COMMON~1\X10\Common\x10nets.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2015-02-01 08:34:29 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2015-02-01 07:34
.
Vor Suchlauf: 7 Verzeichnis(se), 475.954.061.312 Bytes frei
Nach Suchlauf: 11 Verzeichnis(se), 477.830.868.992 Bytes frei
.
- - End Of File - - 10ADA7CF3A8642D09401DD8381D8F102
|
|
01.02.2015, 12:26
| #4 |
| /// the machine /// TB-Ausbilder | Avira hat Maleware gefunden : ADWARE/Adware.Gen Deinstalliere diese Sachen dann normal über Windows. Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
07.02.2015, 14:30
| #5 |
| | Avira hat Maleware gefunden : ADWARE/Adware.Gen Hey sorry das es so lange gedauert hat, ich hatte leider keinen Zugang zu dem Laptop. Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 07.02.2015 Suchlauf-Zeit: 13:35:53 Logdatei: mbam.txt Administrator: Ja Version: 2.00.4.1028 Malware Datenbank: v2015.02.07.05 Rootkit Datenbank: v2015.02.03.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Susanne Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 352224 Verstrichene Zeit: 18 Min, 17 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 1 PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe, 1972, , [406148d393f7e5518f8808abc140748c] Module: 1 PUP.Optional.Conduit.A, C:\Program Files (x86)\ORBTR\orbiter.dll, , [0d9423f88efcc17569a018b159a85aa6], Registrierungsschlüssel: 14 PUP.Optional.SearchProtect.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\CltMngSvc, , [406148d393f7e5518f8808abc140748c], PUP.Optional.SearchProtect.A, HKU\S-1-5-21-1769490675-1898107201-2895629493-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}, , [673a35e6eb9f191d2b6706fa8e75ac54], PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, , [fda479a2b3d7171f9551dd27a55e23dd], PUP.Optional.SearchProtect.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\SearchProtect, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\INSTALLEDSDB\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}, , [e7ba31eaff8b65d1fddd0cfc0bfae51b], PUP.Optional.SearchProtect, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\INSTALLEDSDB\{cf2797aa-b7ec-e311-8ed9-005056c00008}, , [0d94a477fa90d462e1f8ff096a9b9d63], PUP.Optional.IHProtect.A, HKLM\SOFTWARE\WOW6432NODE\IHProtect, , [f7aa9487a8e241f559368efc788b0000], PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\WOW6432NODE\webssearchesSoftware, , [940da7745a30bc7a3a93655d2bd8926e], PUP.Optional.SearchProtect.A, HKLM\SOFTWARE\WOW6432NODE\SEARCHPROTECT, , [6a37d3480a805ed8350b95170003e020], PUP.Optional.Orbiter.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Orbiter, , [3e631803d5b5ec4ad418bd51976e0af6], PUP.Optional.SearchProtect, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SPPD, , [88197c9f305af73fa835c2e3a75c0af6], PUP.Optional.DVDVideoSoftTB.A, HKU\S-1-5-21-1769490675-1898107201-2895629493-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\nikpibnbobmbdbheedjfogjlikpgpnhp, , [7d24011aafdb61d50bc66a3139cae917], PUP.Optional.Qone8, HKU\S-1-5-21-1769490675-1898107201-2895629493-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, , [bfe226f56822bc7ae6c932befe06e818], PUP.Optional.FastStart.A, HKU\S-1-5-21-1769490675-1898107201-2895629493-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS, , [b2ef8e8df39751e51e556c31c24124dc], Registrierungswerte: 5 PUP.Optional.FFToolbar.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|fftoolbar2014@etech.com, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\fftoolbar2014@etech.com, , [20818d8e0189fd39072293f7e41f55ab] PUP.Optional.FastStart.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|faststartff@gmail.com, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com, , [6041c358bbcf90a647c8ce36fb0ab44c] PUP.Optional.SearchProtect.A, HKLM\SOFTWARE\WOW6432NODE\SEARCHPROTECT|InstallDir, C:\PROGRA~2\SearchProtect, , [6a37d3480a805ed8350b95170003e020] PUP.Optional.SearchProtect, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SPPD|ImagePath, \??\C:\Windows\system32\drivers\SPPD.sys, , [88197c9f305af73fa835c2e3a75c0af6] PUP.Optional.FastStart.A, HKU\S-1-5-21-1769490675-1898107201-2895629493-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS|appid, faststartff@gmail.com, , [b2ef8e8df39751e51e556c31c24124dc] Registrierungsdaten: 12 PUP.Optional.SearchProtect.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS|AppInit_DLLs, C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC64Loader.dll, Gut: (), Schlecht: (C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC64Loader.dll),,[3f62d34868228fa7080fb7fc2ad7b749] PUP.Optional.SearchProtect.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS|AppInit_DLLs, C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC32Loader.dll, Gut: (), Schlecht: (C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC32Loader.dll),,[970ab06b3159a88e3ed9baf98b76d030] PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX.EXE\SHELL\OPEN\COMMAND, "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" hxxp://istart.webssearches.com/?type=sc&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635, Gut: (firefox.exe), Schlecht: ("C:\Program Files (x86)\Mozilla Firefox\firefox.exe" hxxp://istart.webssearches.com/?type=sc&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635),,[673a84976d1db1851c949e0d82839967] PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://istart.webssearches.com/?type=hp&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/?type=hp&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635),,[bee36ab12d5d1b1b95206d3ed1348878] PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),,[f3ae6ab1f991112551413184fa0b20e0] PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET\FIREFOX.EXE\SHELL\OPEN\COMMAND, "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" hxxp://istart.webssearches.com/?type=sc&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635, Gut: (firefox.exe), Schlecht: ("C:\Program Files (x86)\Mozilla Firefox\firefox.exe" hxxp://istart.webssearches.com/?type=sc&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635),,[960b26f5bcce3402139d8b209f6659a7] PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://istart.webssearches.com/web/?type=ds&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/web/?type=ds&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635&q={searchTerms}),,[079a1b006f1bf046f7bd2289cf364eb2] PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://istart.webssearches.com/?type=hp&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/?type=hp&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635),,[bfe28299f7930a2c3d7652598184b749] PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://istart.webssearches.com/?type=hp&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/?type=hp&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635),,[28796fac01896bcb03b2edbe8085cf31] PUP.Optional.WebsSearches, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://istart.webssearches.com/web/?type=ds&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/web/?type=ds&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635&q={searchTerms}),,[9110ea313654e056ec418e1b3acb966a] PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),,[950cca513d4d77bf108205b0ee17a060] PUP.Optional.Trovi.A, HKU\S-1-5-21-1769490675-1898107201-2895629493-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.trovi.com/?gd=&ctid=CT3331213&octid=EB_ORIGINAL_CTID&ISID=ME84000BC-3075-4755-AB52-AAC34950907C&SearchSource=55&CUI=&UM=8&UP=SPEA65FACC-C79D-451E-85B0-E70A1B1E4BEE&SSPV=, Gut: (www.google.com), Schlecht: (hxxp://www.trovi.com/?gd=&ctid=CT3331213&octid=EB_ORIGINAL_CTID&ISID=ME84000BC-3075-4755-AB52-AAC34950907C&SearchSource=55&CUI=&UM=8&UP=SPEA65FACC-C79D-451E-85B0-E70A1B1E4BEE&SSPV=),,[e0c176a565252f079f59baf0ee1710f0] Ordner: 84 PUP.Optional.Conduit.A, C:\Program Files (x86)\ORBTR, , [dfc2e6357a10e452844e7418ad56d32d], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\bin, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\rep, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\rep, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\bin, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Consent, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\rep, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Users\Susanne\AppData\Local\SearchProtect, , [c9d839e2fb8fe1555f923032fc07b050], PUP.Optional.SearchProtect.A, C:\Users\Susanne\AppData\Local\SearchProtect\SearchProtect, , [c9d839e2fb8fe1555f923032fc07b050], PUP.Optional.SearchProtect.A, C:\Users\Susanne\AppData\Local\SearchProtect\SearchProtect\rep, , [c9d839e2fb8fe1555f923032fc07b050], PUP.Optional.SearchProtect.A, C:\Users\Susanne\AppData\Local\SearchProtect\SearchProtect\STG, , [c9d839e2fb8fe1555f923032fc07b050], PUP.Optional.SearchProtect.A, C:\Users\Susanne\AppData\Local\SearchProtect\UI, , [c9d839e2fb8fe1555f923032fc07b050], PUP.Optional.SearchProtect.A, C:\Users\Susanne\AppData\Local\SearchProtect\UI\rep, , [c9d839e2fb8fe1555f923032fc07b050], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\content, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\content\include, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\content\include\tools, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\content\js, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\content\js\lib, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\content\js\module, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\content\js\pack, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\en, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\en-US, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\es, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\es-419, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\fr, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\fr-BE, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\fr-CA, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\fr-CH, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\fr-LU, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\it, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\it-CH, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\pl, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\pt-BR, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\ru, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\ru-MO, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\tr, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\vi, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\zh-CN, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\zh-TW, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\skin, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\defaults, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\defaults\preferences, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\modules, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.Extutil.A, C:\Users\Susanne\AppData\Local\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B, , [574af2296e1c48ee7f8dd5902cd706fa], PUP.Optional.Managera.A, C:\Users\Susanne\AppData\Local\Temp\38fdaae5-8e0e-493c-88ec-e05c3be06e42, , [762bea31c2c852e463aafc697390ec14], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\images, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\_locales, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\_locales\de, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\_locales\en, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\_locales\es, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\_locales\fr, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\_locales\it, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\_locales\ja, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\_locales\nl, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\_locales\pl, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\_locales\pt, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\_locales\ru, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\_locales\tr, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\_locales\zh_CN, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\_locales\zh_TW, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.WinToFlashSuggestor.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\acaoakiamfeidcmgooclgeleejkbaecf, , [acf5be5d622841f5d863b5c6d52e966a], PUP.Optional.WinToFlashSuggestor.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\acaoakiamfeidcmgooclgeleejkbaecf\1.2.5_0, , [acf5be5d622841f5d863b5c6d52e966a], PUP.Optional.FFToolbar.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\fftoolbar2014@etech.com, , [6839fb20fd8d46f0767b572a03007a86], PUP.Optional.FFToolbar.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\fftoolbar2014@etech.com\chrome, , [6839fb20fd8d46f0767b572a03007a86], PUP.Optional.FFToolbar.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\fftoolbar2014@etech.com\chrome\content, , [6839fb20fd8d46f0767b572a03007a86], PUP.Optional.FFToolbar.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\fftoolbar2014@etech.com\chrome\skin, , [6839fb20fd8d46f0767b572a03007a86], PUP.Optional.Avaxvavya.A, C:\Users\Susanne\AppData\Local\avaxvavya, , [2879f52694f685b16ae673120300fd03], Dateien: 238 PUP.Optional.Conduit.A, C:\Program Files (x86)\ORBTR\orbiter.dll, , [0d9423f88efcc17569a018b159a85aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe, , [406148d393f7e5518f8808abc140748c], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe, , [0d94b8631e6c181ef91e347f768bf808], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe, , [c7dac556503a221456c1cee54fb2b44c], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\VC32.dll, , [4d548b90e0aae4528f889023a45d5aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64Loader.dll, , [3f62d34868228fa7080fb7fc2ad7b749], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\VC32Loader.dll, , [970ab06b3159a88e3ed9baf98b76d030], PUP.Optional.SearchProtect, C:\Users\Susanne\AppData\Local\avaxvavya\avaxvavya.exe, , [9b0652c94d3d8ea82e528e8429d911ef], PUP.Optional.SearchProtect.A, C:\Users\Susanne\AppData\Local\avaxvavya\pbqrmvbub, , [4f521506c6c41e183add7241d1304cb4], PUP.Optional.SearchProtect.A, C:\Windows\AppPatch\AppPatch64\VCLdr64.dll, , [80212af15e2c979f24f3149f4cb53cc4], PUP.Optional.SearchProtect.A, C:\Windows\AppPatch\nbin\VC32Loader.dll, , [841dbb6095f5af8728efbaf9c33e22de], PUP.Optional.Avaxvavya.A, C:\Windows\System32\Tasks\avaxvavya, , [7e23958649419b9b31e7fb8ba65de41c], PUP.Optional.Trovi.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\searchplugins\trovi.xml, , [505141da2f5b62d453cecfb7b84bf60a], PUP.Optional.Conduit.A, C:\Program Files (x86)\ORBTR\uninstall.exe, , [dfc2e6357a10e452844e7418ad56d32d], PUP.Optional.Conduit.A, C:\Program Files (x86)\ORBTR\Orbt.ext, , [dfc2e6357a10e452844e7418ad56d32d], PUP.Optional.WinToFlashSuggestor.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\{285ACFBB-8E53-4feb-90E6-F02A128927F3}.xpi, , [e1c0ed2e37530f278575820f17ecfe02], PUP.Optional.WebsSearches.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\searchplugins\webssearches.xml, , [336e84971575241220b01ca652b1738d], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\EULA.txt, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\CRASH_REPORT_P4524_T1284_D2015_02_07_T13_29_01.txt, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\bin\SPtool.dll, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\bin\uninstall.exe, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\rep\cfi.bin, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\rep\edk.bin, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\rep\pni.bin, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\rep\SystemRepository.dat, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\rep\trn.bin, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\RN32.dll, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPtool64.exe, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64.dll, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings.html, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\style.css, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Consent\consent.css, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Consent\consent.html, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Consent\consent.js, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Consent\defaults.js, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgUninstall.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\hez-def-grey.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Apply-default.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Apply-onclick.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Apply-Rollover.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bg-dia.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bg-uninstall.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bg-with-logo.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bg.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgNotif.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgSettings.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgSettingsDS.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\btnBlue.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\btnClose.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\btnSilver.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\button-bg.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\checkbox.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\checkbox_checked.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\checkbox_def.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\close-win-def.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\close-win-over-click.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\gray-bg.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\hez-def.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\hez-selected.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\hez.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\icon-win.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\info-icon.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\menu-rollover.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\menu-selected.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button-def.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button-selected.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button2.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Settings-icon.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\SP_DialogBG.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\text-field.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\v.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\x.png, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\defaults.js, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\DialogAPI.js, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\dialogUtils.js, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\jquery.1.7.1.min.js, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\json2.min.js, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\main.js, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\defaults.js, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\protection.css, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\protection.html, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\protection.js, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\defaults.js, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.css, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.html, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.js, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\defaults.js, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\settings.css, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\settings.html, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\settings.js, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\defaults.js, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.css, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.html, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.js, , [8a17a576c0ca3ff762bd48a7828204fc], PUP.Optional.SearchProtect, C:\Windows\AppPatch\Custom\Custom64\{cf2797aa-b7ec-e311-8ed9-005056c00008}.sdb, , [a5fcb16a8dfd95a1d607fb0d1ee722de], PUP.Optional.SearchProtect.A, C:\Users\Susanne\AppData\Local\SearchProtect\SearchProtect\rep\Cvc.dat, , [c9d839e2fb8fe1555f923032fc07b050], PUP.Optional.SearchProtect.A, C:\Users\Susanne\AppData\Local\SearchProtect\SearchProtect\rep\UserRepository.dat, , [c9d839e2fb8fe1555f923032fc07b050], PUP.Optional.SearchProtect.A, C:\Users\Susanne\AppData\Local\SearchProtect\SearchProtect\rep\UserSettings.dat, , [c9d839e2fb8fe1555f923032fc07b050], PUP.Optional.SearchProtect.A, C:\Users\Susanne\AppData\Local\SearchProtect\UI\rep\UIRepository.dat, , [c9d839e2fb8fe1555f923032fc07b050], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome.manifest, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\install.rdf, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\content\index.html, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\content\quick_start.js, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\content\quick_start.xul, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\content\include\speed_dial.js, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\content\include\tools\about_blank_hook.js, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\content\include\tools\misc.js, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\content\include\tools\popup_image_helper.js, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\content\include\tools\urlrequestor.js, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\content\js\js.js, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\content\js\lib\doT.min.js, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\content\js\lib\jquery-2.1.0.min.js, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\content\js\lib\jquery.autocomplete.js, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\content\js\module\hotSearch.js, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\content\js\module\mostgrid.js, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\content\js\module\search.js, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\content\js\module\stat.js, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\content\js\pack\common.js, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\content\js\pack\ga.js, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\content\js\pack\xagainit.js, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\en\locale.properties, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\en-US\locale.properties, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\es\locale.properties, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\es-419\locale.properties, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\fr\locale.properties, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\fr-BE\locale.properties, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\fr-CA\locale.properties, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\fr-CH\locale.properties, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\fr-LU\locale.properties, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\it\locale.properties, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\it-CH\locale.properties, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\pl\locale.properties, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\pt-BR\locale.properties, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\ru\locale.properties, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\ru-MO\locale.properties, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\tr\locale.properties, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\vi\locale.properties, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\zh-CN\locale.properties, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\locale\zh-TW\locale.properties, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\skin\default_logo.png, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\skin\googlelogo.png, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\skin\google_trends.png, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\skin\icon.png, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\skin\loading.gif, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\skin\logo.png, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\skin\newtab.ico, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\skin\simple.css, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\chrome\skin\style.css, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\defaults\preferences\fvd.js, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\defaults\preferences\preferences.js, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\modules\addonmanager.js, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\modules\aes.js, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\modules\config.js, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\modules\dialogs.js, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\modules\last_tab.js, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\modules\misc.js, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\modules\properties.js, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\modules\remoterequest.js, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\modules\restoreprefs.js, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.FastStart.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\faststartff@gmail.com\modules\settings.js, , [465b918aacdec3739357b7ac6b988977], PUP.Optional.Extutil.A, C:\Users\Susanne\AppData\Local\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B\bk.js, , [574af2296e1c48ee7f8dd5902cd706fa], PUP.Optional.Extutil.A, C:\Users\Susanne\AppData\Local\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B\cs.js, , [574af2296e1c48ee7f8dd5902cd706fa], PUP.Optional.Extutil.A, C:\Users\Susanne\AppData\Local\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B\manifest.json, , [574af2296e1c48ee7f8dd5902cd706fa], PUP.Optional.Managera.A, C:\Users\Susanne\AppData\Local\Temp\38fdaae5-8e0e-493c-88ec-e05c3be06e42\cs.js, , [762bea31c2c852e463aafc697390ec14], PUP.Optional.Managera.A, C:\Users\Susanne\AppData\Local\Temp\38fdaae5-8e0e-493c-88ec-e05c3be06e42\manifest.json, , [762bea31c2c852e463aafc697390ec14], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\background.html, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\background.js, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\dvs_freeyoutubedownload.css, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\dvs_freeyoutubedownload.js, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\dvs_logo.ico, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\dvs_logo_128.png, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\dvs_logo_32.png, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\dvs_logo_48.png, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\errorRunProgramm.html, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\manifest.json, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\np_dvs_plugin.dll, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\options.html, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\options.js, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\page_action.html, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\images\backbar.png, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\images\download.png, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\images\fs.png, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\images\headphone.png, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\images\logo.png, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\images\manager.png, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\images\YoutubeDownloader.png, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\images\YoutubeToMp3.png, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\_locales\de\messages.json, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\_locales\en\messages.json, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\_locales\es\messages.json, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\_locales\fr\messages.json, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\_locales\it\messages.json, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\_locales\ja\messages.json, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\_locales\nl\messages.json, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\_locales\pl\messages.json, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\_locales\pt\messages.json, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\_locales\ru\messages.json, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\_locales\tr\messages.json, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\_locales\zh_CN\messages.json, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.DVDVideoSoftTB.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0\_locales\zh_TW\messages.json, , [ddc4c853cdbd1f17b817f57ef90a22de], PUP.Optional.WinToFlashSuggestor.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\acaoakiamfeidcmgooclgeleejkbaecf\1.2.5_0\background.html, , [acf5be5d622841f5d863b5c6d52e966a], PUP.Optional.WinToFlashSuggestor.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\acaoakiamfeidcmgooclgeleejkbaecf\1.2.5_0\close-button.gif, , [acf5be5d622841f5d863b5c6d52e966a], PUP.Optional.WinToFlashSuggestor.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\acaoakiamfeidcmgooclgeleejkbaecf\1.2.5_0\config.js, , [acf5be5d622841f5d863b5c6d52e966a], PUP.Optional.WinToFlashSuggestor.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\acaoakiamfeidcmgooclgeleejkbaecf\1.2.5_0\icon-about.png, , [acf5be5d622841f5d863b5c6d52e966a], PUP.Optional.WinToFlashSuggestor.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\acaoakiamfeidcmgooclgeleejkbaecf\1.2.5_0\icon-contact.png, , [acf5be5d622841f5d863b5c6d52e966a], PUP.Optional.WinToFlashSuggestor.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\acaoakiamfeidcmgooclgeleejkbaecf\1.2.5_0\icon-homepage.png, , [acf5be5d622841f5d863b5c6d52e966a], PUP.Optional.WinToFlashSuggestor.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\acaoakiamfeidcmgooclgeleejkbaecf\1.2.5_0\icon-localdirectory.png, , [acf5be5d622841f5d863b5c6d52e966a], PUP.Optional.WinToFlashSuggestor.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\acaoakiamfeidcmgooclgeleejkbaecf\1.2.5_0\icon-options.png, , [acf5be5d622841f5d863b5c6d52e966a], PUP.Optional.WinToFlashSuggestor.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\acaoakiamfeidcmgooclgeleejkbaecf\1.2.5_0\inject.js, , [acf5be5d622841f5d863b5c6d52e966a], PUP.Optional.WinToFlashSuggestor.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\acaoakiamfeidcmgooclgeleejkbaecf\1.2.5_0\jquery.min.js, , [acf5be5d622841f5d863b5c6d52e966a], PUP.Optional.WinToFlashSuggestor.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\acaoakiamfeidcmgooclgeleejkbaecf\1.2.5_0\localDirectoryPopup.html, , [acf5be5d622841f5d863b5c6d52e966a], PUP.Optional.WinToFlashSuggestor.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\acaoakiamfeidcmgooclgeleejkbaecf\1.2.5_0\Logo.png, , [acf5be5d622841f5d863b5c6d52e966a], PUP.Optional.WinToFlashSuggestor.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\acaoakiamfeidcmgooclgeleejkbaecf\1.2.5_0\Logo128.png, , [acf5be5d622841f5d863b5c6d52e966a], PUP.Optional.WinToFlashSuggestor.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\acaoakiamfeidcmgooclgeleejkbaecf\1.2.5_0\Logo16.png, , [acf5be5d622841f5d863b5c6d52e966a], PUP.Optional.WinToFlashSuggestor.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\acaoakiamfeidcmgooclgeleejkbaecf\1.2.5_0\Logo48.png, , [acf5be5d622841f5d863b5c6d52e966a], PUP.Optional.WinToFlashSuggestor.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\acaoakiamfeidcmgooclgeleejkbaecf\1.2.5_0\manifest.json, , [acf5be5d622841f5d863b5c6d52e966a], PUP.Optional.WinToFlashSuggestor.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\acaoakiamfeidcmgooclgeleejkbaecf\1.2.5_0\md5.js, , [acf5be5d622841f5d863b5c6d52e966a], PUP.Optional.WinToFlashSuggestor.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\acaoakiamfeidcmgooclgeleejkbaecf\1.2.5_0\menu.css, , [acf5be5d622841f5d863b5c6d52e966a], PUP.Optional.WinToFlashSuggestor.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\acaoakiamfeidcmgooclgeleejkbaecf\1.2.5_0\menu.html, , [acf5be5d622841f5d863b5c6d52e966a], PUP.Optional.WinToFlashSuggestor.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\acaoakiamfeidcmgooclgeleejkbaecf\1.2.5_0\options.html, , [acf5be5d622841f5d863b5c6d52e966a], PUP.Optional.WinToFlashSuggestor.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\acaoakiamfeidcmgooclgeleejkbaecf\1.2.5_0\optionsPopup.html, , [acf5be5d622841f5d863b5c6d52e966a], PUP.Optional.WinToFlashSuggestor.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\acaoakiamfeidcmgooclgeleejkbaecf\1.2.5_0\share.png, , [acf5be5d622841f5d863b5c6d52e966a], PUP.Optional.WinToFlashSuggestor.A, C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\acaoakiamfeidcmgooclgeleejkbaecf\1.2.5_0\sharePopup.html, , [acf5be5d622841f5d863b5c6d52e966a], PUP.Optional.FFToolbar.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\fftoolbar2014@etech.com\chrome.manifest, , [6839fb20fd8d46f0767b572a03007a86], PUP.Optional.FFToolbar.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\fftoolbar2014@etech.com\install.rdf, , [6839fb20fd8d46f0767b572a03007a86], PUP.Optional.FFToolbar.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\fftoolbar2014@etech.com\chrome\content\toolbar.js, , [6839fb20fd8d46f0767b572a03007a86], PUP.Optional.FFToolbar.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\fftoolbar2014@etech.com\chrome\content\toolbar.xul, , [6839fb20fd8d46f0767b572a03007a86], PUP.Optional.FFToolbar.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\extensions\fftoolbar2014@etech.com\chrome\skin\icon.png, , [6839fb20fd8d46f0767b572a03007a86], PUP.Optional.Avaxvavya.A, C:\Users\Susanne\AppData\Local\avaxvavya\bahvxfk, , [2879f52694f685b16ae673120300fd03], PUP.Optional.Avaxvavya.A, C:\Users\Susanne\AppData\Local\avaxvavya\mkfvxfk, , [2879f52694f685b16ae673120300fd03], PUP.Optional.Avaxvavya.A, C:\Users\Susanne\AppData\Local\avaxvavya\pvpqbjobmlpfqlovvawq, , [2879f52694f685b16ae673120300fd03], PUP.Optional.Avaxvavya.A, C:\Users\Susanne\AppData\Local\avaxvavya\qokvxfk, , [2879f52694f685b16ae673120300fd03], PUP.Optional.Avaxvavya.A, C:\Users\Susanne\AppData\Local\avaxvavya\rfobmlpfqlovvawq, , [2879f52694f685b16ae673120300fd03], PUP.Optional.Avaxvavya.A, C:\Users\Susanne\AppData\Local\avaxvavya\rpboobmlpfqlovvawq, , [2879f52694f685b16ae673120300fd03], PUP.Optional.Avaxvavya.A, C:\Users\Susanne\AppData\Local\avaxvavya\ycfvxfk, , [2879f52694f685b16ae673120300fd03], PUP.Optional.Trovi.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.startup.homepage", "hxxp://www.trovi.com/?gd=&ctid=CT3331213&octid=EB_ORIGINAL_CTID&ISID=ME84000BC-3075-4755-AB52-AAC34950907C&SearchSource=55&CUI=&UM=8&UP=SPEA65FACC-C79D-451E-85B0-E70A1B1E4BEE&SSPV=");), ,[455c33e839518bab4901c52cc83dfa06] PUP.Optional.Trovi.A, C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "hxxp://www.trovi.com/?gd=&ctid=CT3331213&octid=EB_ORIGINAL_CTID&ISID=ME84000BC-3075-4755-AB52-AAC34950907C&SearchSource=69&CUI=&SSPV=&Lay=1&UM=8&UP=SPEA65FACC-C79D-451E-85B0-E70A1B1E4BEE");), ,[cbd6d14ad8b2d0661437e30e49bcdd23] Physische Sektoren: 0 (Keine schädliche Elemente erkannt) (end) Code:
ATTFilter # AdwCleaner v4.110 - Bericht erstellt 07/02/2015 um 14:06:56
# Aktualisiert 05/02/2015 von Xplode
# Datenbank : 2015-02-05.2 [Server]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)
# Benutzername : Susanne - SUSANNE-LAPTOP
# Gestarted von : C:\Users\Susanne\Downloads\AdwCleaner_4.110.exe
# Option : Löschen
***** [ Dienste ] *****
Dienst Gelöscht : CltMngSvc
[#] Dienst Gelöscht : SPPD
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Partner
Ordner Gelöscht : C:\Program Files (x86)\SearchProtect
Ordner Gelöscht : C:\Users\Susanne\AppData\Local\apn
[!] Ordner Gelöscht : C:\Users\Susanne\AppData\Local\SearchProtect
Ordner Gelöscht : C:\Users\Susanne\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\Extensions\sparpilot@sparpilot.com
Datei Gelöscht : C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\user.js
***** [ Geplante Tasks ] *****
***** [ Verknüpfungen ] *****
Verknüpfung Desinfiziert : C:\Users\Public\Desktop\Google Chrome.lnk
Verknüpfung Desinfiziert : C:\Users\Public\Desktop\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\Users\Susanne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Verknüpfung Desinfiziert : C:\Users\Susanne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Verknüpfung Desinfiziert : C:\Users\Susanne\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
Verknüpfung Desinfiziert : C:\Users\Susanne\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Verknüpfung Desinfiziert : C:\Users\Susanne\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk
***** [ Registrierungsdatenbank ] *****
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{ACAA314B-EEBA-48E4-AD47-84E31C44796C}]
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\acaoakiamfeidcmgooclgeleejkbaecf
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}
Schlüssel Gelöscht : HKLM\SOFTWARE\SearchProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\SPPDCOM
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Daten Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\VC32LO~1.DLL
Daten Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\VC64LO~1.DLL
***** [ Internetbrowser ] *****
-\\ Internet Explorer v11.0.9600.17496
-\\ Mozilla Firefox v35.0.1 (x86 de)
[e97tn43x.default\prefs.js] - Zeile Gelöscht : user_pref("browser.newtab.url", "hxxp://www.trovi.com/?gd=&ctid=CT3331213&octid=EB_ORIGINAL_CTID&ISID=ME84000BC-3075-4755-AB52-AAC34950907C&SearchSource=69&CUI=&SSPV=&Lay=1&UM=8&UP=SPEA65FACC-C79D-451[...]
[e97tn43x.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.defaultenginename", "webssearches");
[e97tn43x.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.order.1", "Ask.com");
[e97tn43x.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.searchengine.alias", "webssearches");
[e97tn43x.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.searchengine.iconURL", "hxxp://istart.webssearches.com/favicon.ico");
[e97tn43x.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.searchengine.name", "webssearches");
[e97tn43x.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.searchengine.url", "hxxp://istart.webssearches.com/web/?type=ds&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635&q={searchTerms}");
[e97tn43x.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.selectedEngine", "webssearches");
[e97tn43x.default\prefs.js] - Zeile Gelöscht : user_pref("browser.startup.homepage", "hxxp://www.trovi.com/?gd=&ctid=CT3331213&octid=EB_ORIGINAL_CTID&ISID=ME84000BC-3075-4755-AB52-AAC34950907C&SearchSource=55&CUI=&UM=8&UP=SPEA65FACC-C79D-451E-85B0[...]
[e97tn43x.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.enabledAddons", "DivXWebPlayer%40divx.com:2.0.2.039,fftoolbar2014%40etech.com:1.0.0.1025,faststartff%40gmail.com:4.3.0,%7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:35.0.1");
[e97tn43x.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.quick_start.enable_search1", false);
[e97tn43x.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false);
[e97tn43x.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.xpiState", "{\"app-profile\":{\"DivXWebPlayer@divx.com\":{\"d\":\"C:\\\\Users\\\\Susanne\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\e97tn43x.default\\\\extensions[...]
-\\ Google Chrome v40.0.2214.111
[C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://de.ask.com/web?q={searchTerms}
[C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://istart.webssearches.com/web/?type=ds&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635&q={searchTerms}
[C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://istart.webssearches.com/web/?type=ds&ts=1422719108&from=cvs&uid=SAMSUNGXHM641JI_S2BEJ9CZB00635&q={searchTerms}
[C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3331213&octid=EB_ORIGINAL_CTID&ISID=ME84000BC-3075-4755-AB52-AAC34950907C&SearchSource=58&CUI=&UM=8&UP=SPEA65FACC-C79D-451E-85B0-E70A1B1E4BEE&q={searchTerms}&SSPV=
*************************
AdwCleaner[R0].txt - [6782 Bytes] - [07/02/2015 14:03:30]
AdwCleaner[S0].txt - [7474 Bytes] - [07/02/2015 14:06:56]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [7533 Bytes] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.2 (02.02.2015:1)
OS: Windows 7 Home Premium x64
Ran by Susanne on 07.02.2015 at 14:12:54,21
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
Successfully deleted: [Empty Folder] C:\Users\Susanne\appdata\local\{07E7C378-1BEC-4A91-BA0A-06CC75750D87}
Successfully deleted: [Empty Folder] C:\Users\Susanne\appdata\local\{6C92DDE4-C147-4741-8CD3-BE993180A791}
Successfully deleted: [Empty Folder] C:\Users\Susanne\appdata\local\{8C2C927C-64F8-4750-9FFB-EF3ACAB5CC9D}
Successfully deleted: [Empty Folder] C:\Users\Susanne\appdata\local\{9488B77E-397C-4E91-89AF-08AC9A635CF3}
~~~ FireFox
Successfully deleted the following from C:\Users\Susanne\AppData\Roaming\mozilla\firefox\profiles\e97tn43x.default\prefs.js
user_pref("browser.search.searchengine.desc", "this is my first firefox searchEngine");
user_pref("browser.search.searchengine.ptid", "cvs");
user_pref("browser.search.searchengine.uid", "SAMSUNGXHM641JI_S2BEJ9CZB00635");
Emptied folder: C:\Users\Susanne\AppData\Roaming\mozilla\firefox\profiles\e97tn43x.default\minidumps [94 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 07.02.2015 at 14:16:46,43
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
ATTFilter
LastRegBack: 2015-02-06 13:13
==================== End Of Log ============================
|
|
08.02.2015, 08:54
| #6 |
| /// the machine /// TB-Ausbilder | Avira hat Maleware gefunden : ADWARE/Adware.GenESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ --> Avira hat Maleware gefunden : ADWARE/Adware.Gen |
|
08.02.2015, 15:46
| #7 |
| | Avira hat Maleware gefunden : ADWARE/Adware.GenCode:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=f2b534aa80194042b214f749722f6db5
# engine=22362
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-02-08 02:00:00
# local_time=2015-02-08 03:00:00 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 10709 167956178 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 91887 175033850 0 0
# scanned=232771
# found=5
# cleaned=0
# scan_time=6646
sh=ED3463A7DB95D4B0A40B18FF7D4C3A198AFE9C87 ft=1 fh=b73262d5706d13f5 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Susanne\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\45CY4YY6\Stub[1].exe"
sh=01B394BFD78AC1A88EF00B03878680F68FDD5291 ft=1 fh=80aefb8aa3c56326 vn="Variante von Win32/Conduit.SearchProtect.N evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Susanne\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K1UYB8LM\OrbiterInstaller[1].exe"
sh=43F36CBCD2BE0AB181A17FFD9806DEEA94D6D27A ft=1 fh=53c5f979c7bf21cf vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Susanne\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K1UYB8LM\Setup[1].exe"
sh=5CB2AFC6317224B4BA1C57D3F20BA10D21AB409E ft=1 fh=12065cd8c5b3c4d9 vn="Variante von Win32/DownloadGuide.D evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Susanne\Downloads\download-apache-openoffice.exe"
sh=2153D234D166D72F04F9870D9541869CCADAB151 ft=1 fh=67447e761e537db3 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="D:\TOOLS\Medion MediaPack\medion_mediapack_ext.exe"
Code:
ATTFilter Results of screen317's Security Check version 0.99.96
Windows 7 Service Pack 1 x64
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Avira Desktop
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Java(TM) 6 Update 22
Java version 32-bit out of Date!
Java 64-bit 8 Update 31
Adobe Flash Player 16.0.0.305
Adobe Reader 9 Adobe Reader out of Date!
Mozilla Firefox (35.0.1)
Mozilla Thunderbird 12.0.1 Thunderbird out of Date!
Google Chrome (40.0.2214.111)
Google Chrome (40.0.2214.94)
````````Process Check: objlist.exe by Laurent````````
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-02-2015
Ran by Susanne (administrator) on SUSANNE-LAPTOP on 08-02-2015 15:43:45
Running from C:\Users\Susanne\Desktop
Loaded Profiles: Susanne (Available profiles: Susanne)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(X10) C:\Program Files (x86)\Common Files\X10\Common\X10nets.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Eastman Kodak Company) C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Wistron) C:\Program Files (x86)\Launch Manager\HotkeyApp.exe
(Wistron Corp.) C:\Program Files (x86)\Launch Manager\OSD.exe
(Wistron Corp.) C:\Program Files (x86)\Launch Manager\WButton.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Wistron Corp.) C:\Program Files (x86)\Launch Manager\WisLMSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1890088 2009-12-11] (Synaptics Incorporated)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11548264 2010-11-03] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2181224 2010-11-03] (Realtek Semiconductor)
HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft IntelliPoint\ipoint.exe [2328944 2011-01-07] (Microsoft Corporation)
HKLM\...\Run: [EKIJ5000StatusMonitor] => C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe [2045440 2010-09-02] (Eastman Kodak Company)
HKLM-x32\...\Run: [HotkeyApp] => C:\Program Files (x86)\Launch Manager\HotkeyApp.exe [200704 2009-12-14] (Wistron)
HKLM-x32\...\Run: [LMgrVolOSD] => C:\Program Files (x86)\Launch Manager\OSD.exe [348960 2009-12-11] (Wistron Corp.)
HKLM-x32\...\Run: [Wbutton] => C:\Program Files (x86)\Launch Manager\Wbutton.exe [436264 2010-06-21] (Wistron Corp.)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-04-27] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [CLMLServer] => C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-11-02] (CyberLink)
HKLM-x32\...\Run: [YouCam Mirage] => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [136488 2010-10-29] (CyberLink)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-16] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1769490675-1898107201-2895629493-1000\...\Run: [GoogleChromeAutoLaunch_BEAD1C12587041F9E622982A20D4E70C] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [843592 2015-02-04] (Google Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-1769490675-1898107201-2895629493-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1769490675-1898107201-2895629493-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKU\S-1-5-21-1769490675-1898107201-2895629493-1000 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default
FF Keyword.URL:
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-1769490675-1898107201-2895629493-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Susanne\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Extension: DivX Web Player - C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\Extensions\DivXWebPlayer@divx.com.xpi [2011-06-17]
FF Extension: {656b6d6d-ecde-4af7-ba56-a0ecae97da0e} - C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\Extensions\{656b6d6d-ecde-4af7-ba56-a0ecae97da0e}.xpi [2015-02-01]
FF Extension: Adblock Plus - C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\e97tn43x.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-02-01]
StartMenuInternet: FIREFOX.EXE - firefox.exe
Chrome:
=======
CHR HomePage: Default -> hxxp://www.trovi.com/?gd=&ctid=CT3331213&octid=EB_ORIGINAL_CTID&ISID=ME84000BC-3075-4755-AB52-AAC34950907C&SearchSource=55&CUI=&UM=8&UP=SPEA65FACC-C79D-451E-85B0-E70A1B1E4BEE&SSPV=
CHR StartupUrls: Default -> "hxxp://www.trovi.com/?gd=&ctid=CT3331213&octid=EB_ORIGINAL_CTID&ISID=ME84000BC-3075-4755-AB52-AAC34950907C&SearchSource=55&CUI=&UM=8&UP=SPEA65FACC-C79D-451E-85B0-E70A1B1E4BEE&SSPV="
CHR DefaultSearchKeyword: Default -> trovi.search
CHR DefaultSuggestURL: Default -> hxxp://suggest.seccint.com/CSuggestJson.ashx?prefix={searchTerms}
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.220.4) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Java(TM) Platform SE 6 U22) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.0.50917.0\npctrl.dll No File
CHR Plugin: (Chrome NaCl) - C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\pdf.dll ()
CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.57\npGoogleUpdate3.dll No File
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Profile: C:\Users\Susanne\AppData\Local\Google\Chrome\User Data\Default
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [992560 2014-12-16] (Avira Operations GmbH & Co. KG)
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [97432 2007-04-13] () [File not signed]
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2010-02-10] () [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R3 WisLMSvc; C:\Program Files (x86)\Launch Manager\WisLMSvc.exe [118560 2009-10-23] (Wistron Corp.)
R2 x10nets; C:\Program Files (x86)\Common Files\X10\Common\X10nets.exe [20480 2009-11-07] (X10) [File not signed]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-28] (Avira Operations GmbH & Co. KG)
S3 mod7764; C:\Windows\System32\DRIVERS\mod77-64.sys [913888 2009-09-24] (DiBcom SA)
S3 NxpCap64; C:\Windows\System32\DRIVERS\NxpCap64.sys [1888864 2010-02-04] (NXP Semiconductors Germany GmbH) [File not signed]
S3 TrdCap64; C:\Windows\System32\DRIVERS\TrdCap64.sys [1887528 2010-06-09] (Trident Microsystems, Inc.)
R3 X10Hid; C:\Windows\System32\Drivers\x10hid.sys [15896 2009-05-13] (X10 Wireless Technology, Inc.)
S3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [32792 2009-05-13] (X10 Wireless Technology, Inc.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-08 15:43 - 2015-02-08 15:43 - 00015565 _____ () C:\Users\Susanne\Desktop\FRST.txt
2015-02-08 15:12 - 2015-02-08 15:12 - 00852594 _____ () C:\Users\Susanne\Downloads\SecurityCheck.exe
2015-02-08 15:12 - 2015-02-08 15:12 - 00852594 _____ () C:\Users\Susanne\Desktop\SecurityCheck.exe
2015-02-08 13:02 - 2015-02-08 13:02 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-02-08 13:01 - 2015-02-08 13:01 - 02347384 _____ (ESET) C:\Users\Susanne\Downloads\esetsmartinstaller_deu.exe
2015-02-07 14:22 - 2015-02-08 15:43 - 00000000 ____D () C:\Users\Susanne\Desktop\FRST-OlderVersion
2015-02-07 14:16 - 2015-02-07 14:16 - 00001547 _____ () C:\Users\Susanne\Desktop\JRT.txt
2015-02-07 14:12 - 2015-02-07 14:12 - 01388274 _____ (Thisisu) C:\Users\Susanne\Downloads\JRT.exe
2015-02-07 14:03 - 2015-02-07 14:07 - 00000000 ____D () C:\AdwCleaner
2015-02-07 14:02 - 2015-02-07 14:02 - 02112512 _____ () C:\Users\Susanne\Downloads\AdwCleaner_4.110.exe
2015-02-07 14:01 - 2015-02-07 14:02 - 00065305 _____ () C:\Users\Susanne\Desktop\mbam.txt
2015-02-07 14:01 - 2015-02-07 14:01 - 00065305 _____ () C:\mbam.txt
2015-02-07 13:34 - 2015-02-07 13:34 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-07 13:34 - 2015-02-07 13:34 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-02-07 13:34 - 2015-02-07 13:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-02-07 13:34 - 2015-02-07 13:34 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-02-07 13:34 - 2015-02-07 13:34 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-02-07 13:34 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-02-07 13:34 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-02-07 13:34 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-02-07 13:33 - 2015-02-07 13:33 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Susanne\Downloads\mbam-setup-2.0.4.1028.exe
2015-02-01 08:34 - 2015-02-01 08:34 - 00023745 _____ () C:\ComboFix.txt
2015-02-01 08:18 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-02-01 08:18 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-02-01 08:18 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-02-01 08:18 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-02-01 08:18 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-02-01 08:18 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2015-02-01 08:18 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2015-02-01 08:18 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2015-02-01 08:17 - 2015-02-01 08:34 - 00000000 ____D () C:\Qoobox
2015-02-01 08:17 - 2015-02-01 08:32 - 00000000 ____D () C:\Windows\erdnt
2015-02-01 08:16 - 2015-02-01 08:16 - 05611408 ____R (Swearware) C:\Users\Susanne\Desktop\ComboFix.exe
2015-02-01 08:16 - 2015-02-01 08:16 - 05611408 _____ (Swearware) C:\Users\Susanne\Downloads\ComboFix.exe
2015-02-01 08:04 - 2015-02-01 08:04 - 00001272 _____ () C:\Users\Susanne\Desktop\Revo Uninstaller.lnk
2015-02-01 08:04 - 2015-02-01 08:04 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-02-01 08:03 - 2015-02-01 08:03 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Susanne\Downloads\revosetup95.exe
2015-01-31 17:56 - 2015-02-07 14:08 - 00000000 ____D () C:\Windows\Minidump
2015-01-31 17:56 - 2015-01-31 17:56 - 00461000 _____ () C:\Windows\Minidump\013115-37861-01.dmp
2015-01-31 17:55 - 2015-01-31 17:55 - 657978033 _____ () C:\Windows\MEMORY.DMP
2015-01-31 17:37 - 2015-01-31 17:37 - 00003679 _____ () C:\Users\Susanne\Desktop\Gmer.txt
2015-01-31 17:26 - 2015-01-31 17:26 - 00380416 _____ () C:\Users\Susanne\Downloads\rp7ugrz5.exe
2015-01-31 17:26 - 2015-01-31 17:26 - 00380416 _____ () C:\Users\Susanne\Desktop\rp7ugrz5.exe
2015-01-31 17:19 - 2015-01-31 17:21 - 00038059 _____ () C:\Users\Susanne\Desktop\Addition.txt
2015-01-31 17:18 - 2015-02-08 15:43 - 00000000 ____D () C:\FRST
2015-01-31 17:17 - 2015-02-08 15:43 - 02132992 _____ (Farbar) C:\Users\Susanne\Desktop\FRST64.exe
2015-01-31 17:17 - 2015-01-31 17:17 - 02130944 _____ (Farbar) C:\Users\Susanne\Downloads\FRST64.exe
2015-01-31 17:14 - 2015-01-31 17:14 - 00000476 _____ () C:\Users\Susanne\Desktop\defogger_disable.log
2015-01-31 17:14 - 2015-01-31 17:14 - 00000000 _____ () C:\Users\Susanne\defogger_reenable
2015-01-31 17:10 - 2015-01-31 17:11 - 00000000 ___SD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.1.1
2015-01-31 17:10 - 2015-01-31 17:10 - 00001116 _____ () C:\Users\Public\Desktop\OpenOffice 4.1.1.lnk
2015-01-31 17:08 - 2015-01-31 17:09 - 00000000 ____D () C:\Program Files (x86)\OpenOffice 4
2015-01-31 17:07 - 2015-01-31 17:07 - 00000000 ____D () C:\Users\Susanne\Desktop\OpenOffice 4.1.1 (de) Installation Files
2015-01-31 17:06 - 2015-01-31 17:06 - 00050477 _____ () C:\Users\Susanne\Downloads\Defogger.exe
2015-01-31 17:06 - 2015-01-31 17:06 - 00050477 _____ () C:\Users\Susanne\Desktop\Defogger.exe
2015-01-31 17:00 - 2015-01-31 17:00 - 00001148 _____ () C:\Users\Susanne\Desktop\Goodgames Empire.lnk
2015-01-31 17:00 - 2015-01-31 17:00 - 00000000 ____D () C:\Users\Susanne\AppData\Roaming\dlg
2015-01-31 16:35 - 2015-01-31 16:35 - 00621024 _____ () C:\Users\Susanne\Downloads\download-apache-openoffice.exe
2015-01-27 10:58 - 2015-01-27 10:58 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-13 20:07 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-13 20:07 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-13 20:07 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-13 20:07 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-13 20:07 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-13 20:07 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-13 20:07 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-13 20:07 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-13 20:07 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-13 20:07 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-13 20:07 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-13 20:07 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-13 20:07 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-08 15:30 - 2011-04-10 15:27 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-08 15:26 - 2013-09-28 17:51 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-08 14:34 - 2011-10-29 10:24 - 00001146 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1769490675-1898107201-2895629493-1000UA.job
2015-02-08 14:16 - 2010-05-12 09:18 - 00699682 _____ () C:\Windows\system32\perfh007.dat
2015-02-08 14:16 - 2010-05-12 09:18 - 00149790 _____ () C:\Windows\system32\perfc007.dat
2015-02-08 14:16 - 2009-07-14 06:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-08 14:12 - 2011-04-10 15:23 - 01680422 _____ () C:\Windows\WindowsUpdate.log
2015-02-08 13:30 - 2011-04-10 15:27 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-08 13:03 - 2009-07-14 05:45 - 00018928 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-08 13:03 - 2009-07-14 05:45 - 00018928 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-08 12:55 - 2010-07-07 17:17 - 00253352 _____ () C:\Windows\PFRO.log
2015-02-08 12:55 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-08 12:55 - 2009-07-14 05:51 - 00209568 _____ () C:\Windows\setupact.log
2015-02-07 14:07 - 2011-04-10 16:03 - 00001069 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-02-07 14:07 - 2011-04-10 16:03 - 00001057 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-02-07 14:07 - 2011-04-10 15:30 - 00001003 _____ () C:\Users\Susanne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-02-07 14:07 - 2011-04-10 15:27 - 00001294 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2015-02-07 14:07 - 2011-04-10 15:27 - 00001286 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-02-06 20:34 - 2011-10-29 10:24 - 00001124 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1769490675-1898107201-2895629493-1000Core.job
2015-02-06 20:26 - 2013-09-28 17:51 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-06 20:26 - 2013-09-28 17:51 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-02-06 20:26 - 2012-02-07 17:14 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-06 13:25 - 2011-04-10 15:27 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-06 13:25 - 2011-04-10 15:27 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-02 19:14 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-02-01 08:28 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2015-02-01 08:06 - 2011-04-10 15:34 - 00000000 ____D () C:\Users\Susanne\AppData\Local\Google
2015-01-31 17:55 - 2009-07-14 05:45 - 00318744 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-31 17:16 - 2011-04-10 16:56 - 00074728 _____ () C:\Users\Susanne\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-31 17:14 - 2011-04-10 15:29 - 00000000 ____D () C:\Users\Susanne
2015-01-28 18:33 - 2011-04-10 15:29 - 00000000 ____D () C:\Users\Susanne\AppData\Local\VirtualStore
2015-01-27 13:28 - 2013-02-03 12:58 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-25 14:57 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-01-24 09:58 - 2014-02-27 22:00 - 01594964 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-01-17 00:38 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2015-01-14 20:45 - 2013-08-17 21:05 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-14 20:39 - 2010-07-07 16:49 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
==================== Files in the root of some directories =======
2014-04-08 15:56 - 2014-04-08 15:56 - 6000640 _____ () C:\Program Files (x86)\GUTE292.tmp
2011-04-25 21:36 - 2014-03-17 14:29 - 0006656 _____ () C:\Users\Susanne\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
Some content of TEMP:
====================
C:\Users\Susanne\AppData\Local\Temp\avgnt.exe
C:\Users\Susanne\AppData\Local\Temp\Quarantine.exe
C:\Users\Susanne\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-02-06 13:13
==================== End Of Log ============================
|
|
08.02.2015, 18:18
| #8 |
| /// the machine /// TB-Ausbilder | Avira hat Maleware gefunden : ADWARE/Adware.Gen Java, Adobe und Thunderbird updaten. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Users\Susanne\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\45CY4YY6\Stub[1].exe
C:\Users\Susanne\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K1UYB8LM\OrbiterInstaller[1].exe
C:\Users\Susanne\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K1UYB8LM\Setup[1].exe
C:\Users\Susanne\Downloads\download-apache-openoffice.exe
D:\TOOLS\Medion MediaPack\medion_mediapack_ext.exe
CHR HomePage: Default -> hxxp://www.trovi.com/?gd=&ctid=CT3331213&octid=EB_ORIGINAL_CTID&ISID=ME84000BC-3075-4755-AB52-AAC34950907C&SearchSource=55&CUI=&UM=8&UP=SPEA65FACC-C79D-451E-85B0-E70A1B1E4BEE&SSPV=
CHR StartupUrls: Default -> "hxxp://www.trovi.com/?gd=&ctid=CT3331213&octid=EB_ORIGINAL_CTID&ISID=ME84000BC-3075-4755-AB52-AAC34950907C&SearchSource=55&CUI=&UM=8&UP=SPEA65FACC-C79D-451E-85B0-E70A1B1E4BEE&SSPV="
CHR DefaultSearchKeyword: Default -> trovi.search
CHR DefaultSuggestURL: Default -> hxxp://suggest.seccint.com/CSuggestJson.ashx?prefix={searchTerms}
Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
09.02.2015, 12:25
| #9 |
| | Avira hat Maleware gefunden : ADWARE/Adware.Gen Ich hab dummerweise delfix ausgeführt bevor ich den Fixlog gepostet hab. Dabei wurde der natürlich gelöscht. Soll ich den Schritt nochmal machen oder geht das nicht? |
|
09.02.2015, 18:08
| #10 |
| /// the machine /// TB-Ausbilder | Avira hat Maleware gefunden : ADWARE/Adware.Gen Nee passt schon
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
dann auf 
und dann auf 
. 
WARNUNG an die MITLESER: 
Linear-Darstellung
