|
Plagegeister aller Art und deren Bekämpfung: Mal wieder "Positive Ads"Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
11.02.2015, 17:28 | #1 |
| Mal wieder "Positive Ads" Servus, mich nervt "Positive Finds Ads" seit gestern. Ich bekomme die nervigen Werbeeinblendungen ausschließlich im Browser Chrome (Betriebssystem Windows 8.1 Pro). Ich habe zunächst den Eintrag unter "Programme deinstallieren" gelöscht, in Chrome selber hatte ich unter Einstellungen - Erweiterungen keinen Eintrag, den ich hätte löschen können. Da das Entfernen der Software nichts gebracht hatte, habe ich mir blöderweise das Programm "Spy Hunter" für 35 Euronen zugelegt... naja... hinterher ist man schlauer... Spy Hunter hat zwar einige Bedrohungen erkannt, das waren aber vorwiegend Cookies. Es waren auch zwei Einträge zum Thema "Positive Finds Ads" darunter - also alles gelöscht, neu gebootet und festgestellt, dass das Problem weiterhin auftritt. Im Anschluss habe ich Malwarebytes Anti-Malware, AdwCleaner v4.110 und das Junkware Removal Tool durchlaufen lassen. Letzteres findet immer wieder Einträge zu "www.superfish.com", die ich immer löschen lasse, die aber nach dem nächsten Reboot wieder auftauchen. Hier die aktuellen Logs: Junkware Removal Tool ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.4.2 (02.02.2015:1) OS: Windows 8.1 Pro x86 Ran by Daniel on 11.02.2015 at 17:00:04,00 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys ~~~ Files Successfully deleted: [File] C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1030316957-1957585848-888588088-1001 Successfully deleted: [File] "C:\Users\Daniel\appdata\local\google\chrome\user data\default\local storage\http_www.superfish.com_0.localstorage" Successfully deleted: [File] "C:\Users\Daniel\appdata\local\google\chrome\user data\default\local storage\http_www.superfish.com_0.localstorage-journal" ~~~ Folders ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 11.02.2015 at 17:06:19,24 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Adware Cleaner # AdwCleaner v4.110 - Bericht erstellt 11/02/2015 um 14:44:49 # Aktualisiert 05/02/2015 von Xplode # Datenbank : 2015-02-09.1 [Server] # Betriebssystem : Windows 8.1 Pro (x86) # Benutzername : Daniel - DANIEL # Gestarted von : C:\Users\Daniel\Downloads\AdwCleaner_4.110.exe # Option : Suchlauf ***** [ Dienste ] ***** ***** [ Dateien / Ordner ] ***** ***** [ Geplante Tasks ] ***** ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** ***** [ Internetbrowser ] ***** -\\ Internet Explorer v11.0.9600.17416 -\\ Google Chrome v40.0.2214.111 ************************* AdwCleaner[R0].txt - [3316 Bytes] - [11/02/2015 14:09:45] AdwCleaner[R1].txt - [1433 Bytes] - [11/02/2015 14:25:56] AdwCleaner[R2].txt - [749 Bytes] - [11/02/2015 14:44:49] AdwCleaner[S0].txt - [3249 Bytes] - [11/02/2015 14:12:57] AdwCleaner[S1].txt - [1222 Bytes] - [11/02/2015 14:40:54] ########## EOF - C:\AdwCleaner\AdwCleaner[R2].txt - [925 Bytes] ########## Malwarebyte Anti-Malware Version: 2.00.4.1028 Malware Datenbank: v2015.02.11.04 Rootkit Datenbank: v2015.02.03.01 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 8.1 CPU: x86 Dateisystem: NTFS Benutzer: Daniel Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 389477 Verstrichene Zeit: 22 Min, 19 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente erkannt) Module: 0 (Keine schädliche Elemente erkannt) Registrierungsschlüssel: 0 (Keine schädliche Elemente erkannt) Registrierungswerte: 0 (Keine schädliche Elemente erkannt) Registrierungsdaten: 0 (Keine schädliche Elemente erkannt) Ordner: 2 PUP.Optional.Extutil.A, C:\Users\Daniel\AppData\Local\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B, In Quarantäne, [84ac3de0c6c451e57e195b0d5da68d73], PUP.Optional.Managera.A, C:\Users\Daniel\AppData\Local\Temp\38fdaae5-8e0e-493c-88ec-e05c3be06e42, In Quarantäne, [c07009149af07abc7e1af07846bd8d73], Dateien: 6 PUP.Optional.Conduit.A, C:\Users\Daniel\Downloads\DVD_Shrink_TSV4546OM.exe, Keine Aktion durch Benutzer, [062a8c9152389b9bb28377fa10f125db], PUP.Optional.Extutil.A, C:\Users\Daniel\AppData\Local\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B\bk.js, In Quarantäne, [84ac3de0c6c451e57e195b0d5da68d73], PUP.Optional.Extutil.A, C:\Users\Daniel\AppData\Local\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B\cs.js, In Quarantäne, [84ac3de0c6c451e57e195b0d5da68d73], PUP.Optional.Extutil.A, C:\Users\Daniel\AppData\Local\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B\manifest.json, In Quarantäne, [84ac3de0c6c451e57e195b0d5da68d73], PUP.Optional.Managera.A, C:\Users\Daniel\AppData\Local\Temp\38fdaae5-8e0e-493c-88ec-e05c3be06e42\cs.js, In Quarantäne, [c07009149af07abc7e1af07846bd8d73], PUP.Optional.Managera.A, C:\Users\Daniel\AppData\Local\Temp\38fdaae5-8e0e-493c-88ec-e05c3be06e42\manifest.json, In Quarantäne, [c07009149af07abc7e1af07846bd8d73], Physische Sektoren: 0 (Keine schädliche Elemente erkannt) (end) So, ich hoffe, dass mir hier geholfen werden kann und bedanke mich schon mal im Voraus !!!! LG Daniel |
11.02.2015, 17:32 | #2 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Mal wieder "Positive Ads" Hi und
__________________Scan mit Farbar's Recovery Scan Tool (FRST) Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
Lesestoff: Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit. Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
11.02.2015, 17:54 | #3 |
| Mal wieder "Positive Ads" Das ging ja schnell...
__________________Ich bekomme vom System den Hinweis "Der Computer wurde durch Windows geschützt. Von Windows Smartscreen wurde der Start....". Kann ich das irgendwie abschalten? Firewall & Virenscanner habe ich bereits deaktiviert. LG Daniel Halt, hab es schon gefunden... sorry... der Scan läuft... FRST FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-02-2015 01 Ran by Daniel (administrator) on DANIEL on 11-02-2015 17:48:57 Running from C:\ Loaded Profiles: Daniel (Available profiles: Daniel & UpdatusUser) Platform: Microsoft Windows 8.1 Pro (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: Opera) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (devolo AG) C:\Program Files\devolo\dlan\devolonetsvc.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Portrait Displays, Inc.) C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe (Deutsche Telekom AG) C:\Program Files\Telekom\Mediencenter\DTAG.Mediencenter.BackgroundService.exe (Google Inc.) C:\Program Files\Google\Update\1.3.26.9\GoogleCrashHandler.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe (Deutsche Telekom AG) C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe (Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.6.0.32\nis.exe (Portrait Displays, Inc.) C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe (TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.6.0.32\nis.exe (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Portrait Displays, Inc) C:\Program Files\Acer Display\eDisplay Management\dthtml.exe () C:\Users\Daniel\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8610\Bin\ScanToPCActivationApp.exe (Portrait Displays Inc.) C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe () C:\Users\Daniel\AppData\Local\Amazon Music\Amazon Music Helper.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\AppleIEDAV.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\iCloudDrive.exe () C:\Program Files\Portrait Displays\Pivot Pro Plugin\wpCtrl.exe () C:\Program Files\Portrait Displays\Pivot Pro Plugin\Floater.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Nero AG) C:\Program Files\Nero\Update\NASvc.exe (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) C:\Windows\System32\RuntimeBroker.exe (Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.exe (Microsoft Corporation) C:\Program Files\Windows NT\Accessories\wordpad.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\WINWORD.EXE (Microsoft Corporation) C:\Windows\splwow64.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [6609440 2008-10-31] (Realtek Semiconductor) HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2008-10-31] (Realtek Semiconductor Corp.) HKLM\...\Run: [PivotSoftware] => C:\Program Files\Portrait Displays\Pivot Pro Plugin\Pivot_startup.exe [110192 2010-05-13] () HKLM\...\Run: [DT ACR] => C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe [121648 2012-04-13] (Portrait Displays, Inc.) HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.) HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.) HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard) HKLM\...\Run: [] => [X] HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Run: [AmazonMP3DownloaderHelper] => C:\Users\Daniel\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [400704 2013-05-22] () HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Run: [iCloudServices] => C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-10-17] (Apple Inc.) HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Run: [ApplePhotoStreams] => C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2014-11-21] (Apple Inc.) HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Run: [HP Officejet Pro 8610 (NET)] => C:\Program Files\HP\HP Officejet Pro 8610\Bin\ScanToPCActivationApp.exe [2427400 2014-03-06] (Hewlett-Packard Co.) HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Run: [Amazon Music] => C:\Users\Daniel\AppData\Local\Amazon Music\Amazon Music Helper.exe [6277952 2014-11-19] () HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Run: [AppleIEDAV] => C:\Program Files\Common Files\Apple\Internet Services\AppleIEDAV.exe [1080104 2014-08-04] (Apple Inc.) HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Run: [iCloudDrive] => C:\Program Files\Common Files\Apple\Internet Services\iCloudDrive.exe [43816 2014-10-20] (Apple Inc.) HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Policies\Explorer: [NoSaveSettings] 0 ShellIconOverlayIdentifiers: [01Mediencenter_InSync] -> {77BC4082-DB5F-439A-8DC8-F9E24A63B0DE} => C:\Users\Daniel\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG) ShellIconOverlayIdentifiers: [02Mediencenter_ToSync] -> {528EE335-5034-4EFC-834E-63E5F02D2BC2} => C:\Users\Daniel\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG) ShellIconOverlayIdentifiers: [03Mediencenter_Failed] -> {6066ADF0-9EB0-43E5-ADB6-990F5A3B979C} => C:\Users\Daniel\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG) BootExecute: autocheck autochk /m /P \Device\HarddiskVolume4autocheck autochk * ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-1030316957-1957585848-888588088-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/ SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader) BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files\Norton Internet Security\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation) BHO: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files\Norton Internet Security\Engine\21.6.0.32\IPS\IPSBHO.DLL (Symantec Corporation) BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation) Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1 FireFox: ======== FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF Plugin: @java.com/DTPlugin,version=10.17.2 -> C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.17.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin: @real.com/nppl3260;version=17.0.15.10 -> c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF Plugin: @real.com/nprndlhtml5videoshim;version=17.0.15 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.) FF Plugin: @real.com/nprpplugin;version=17.0.15.10 -> c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer Cloud) FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-1030316957-1957585848-888588088-1001: amazon.com/AmazonMP3DownloaderPlugin -> C:\Users\Daniel\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.) FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.0.2.1\coFFPlgn FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.0.2.1\coFFPlgn [2015-02-11] FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2014-11-16] FF HKLM\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.0.2.1\IPSFF FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.0.2.1\IPSFF [2013-10-09] FF HKLM\...\Firefox\Extensions: [{338950EA-82DB-44C1-930D-0C28E023C9F0}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext Chrome: ======= CHR HomePage: Default -> hxxp://www.google.de/ CHR StartupUrls: Default -> "hxxp://www.google.de/" CHR Profile: C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Docs) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-10-27] CHR Extension: (Google Drive) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2012-11-27] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-11] CHR Extension: (YouTube) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-11-27] CHR Extension: (Google-Suche) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-11-27] CHR Extension: (Norton Identity Safe) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdalibjnif [2014-09-11] CHR Extension: (Google Wallet) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-27] CHR Extension: (Google Mail) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-11-27] CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No Path CHR HKLM\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files\Norton Internet Security\Engine\21.6.0.32\Exts\Chrome.crx [2014-10-05] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 DevoloNetworkService; C:\Program Files\devolo\dlan\devolonetsvc.exe [3647992 2014-05-14] (devolo AG) R2 DTSRVC; C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe [138032 2012-04-13] (Portrait Displays, Inc.) R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) R2 MCSWASVR; C:\Program Files\Telekom\Mediencenter\DTAG.Mediencenter.BackgroundService.exe [12800 2012-08-13] (Deutsche Telekom AG) [File not signed] R2 NAUpdate; C:\Program Files\Nero\Update\NASvc.exe [786256 2014-07-15] (Nero AG) R2 Netzmanager Service; C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe [2635776 2012-07-20] (Deutsche Telekom AG) [File not signed] R2 NIS; C:\Program Files\Norton Internet Security\Engine\21.6.0.32\NIS.exe [276376 2014-09-21] (Symantec Corporation) R2 PdiService; C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe [113456 2012-04-13] (Portrait Displays, Inc.) S3 ScDeviceEnum; C:\WINDOWS\System32\ScDeviceEnum.dll [105472 2013-08-22] (Microsoft Corporation) R2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [770944 2015-02-11] (Enigma Software Group USA, LLC.) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [288128 2014-09-22] (Microsoft Corporation) S3 WEPHOSTSVC; C:\WINDOWS\system32\wephostsvc.dll [20992 2013-08-22] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [22192 2014-09-22] (Microsoft Corporation) S3 workfolderssvc; C:\WINDOWS\system32\workfolderssvc.dll [1222144 2014-07-24] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R3 AnyDVD; C:\WINDOWS\System32\Drivers\AnyDVD.sys [124504 2013-03-18] (SlySoft, Inc.) R1 BasicRender; C:\WINDOWS\System32\drivers\BasicRender.sys [25600 2014-02-22] (Microsoft Corporation) R1 BHDrvx86; C:\Program Files\Norton Internet Security\NortonData\21.0.2.1\Definitions\BASHDefs\20150203.001\BHDrvx86.sys [1164504 2015-02-03] (Symantec Corporation) R1 ccSet_NIS; C:\WINDOWS\system32\drivers\NIS\1506000.020\ccSetx86.sys [127064 2013-09-26] (Symantec Corporation) R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [378672 2014-12-12] (Symantec Corporation) R1 ElbyCDIO; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [30616 2013-03-04] (Elaborate Bytes AG) R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [111408 2014-12-12] (Symantec Corporation) R3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [16432 2015-02-11] (Enigma Software Group USA, LLC.) S3 EsgScanner; C:\WINDOWS\System32\DRIVERS\EsgScanner.sys [19984 2015-02-11] () S3 GPIO; C:\WINDOWS\System32\drivers\iaiogpio.sys [22016 2013-07-23] (Intel Corporation) R1 IDSVix86; C:\Program Files\Norton Internet Security\NortonData\21.0.2.1\Definitions\IPSDefs\20150210.001\IDSvix86.sys [503512 2015-02-07] (Symantec Corporation) R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [23256 2014-11-21] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [114904 2015-02-11] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [51928 2014-11-21] (Malwarebytes Corporation) R3 NAVENG; C:\Program Files\Norton Internet Security\NortonData\21.0.2.1\Definitions\VirusDefs\20150210.038\NAVENG.SYS [95704 2015-01-24] (Symantec Corporation) R3 NAVEX15; C:\Program Files\Norton Internet Security\NortonData\21.0.2.1\Definitions\VirusDefs\20150210.038\NAVEX15.SYS [1636696 2015-01-24] (Symantec Corporation) R2 NPF_devolo; C:\WINDOWS\system32\drivers\npf_devolo.sys [35840 2014-05-14] (CACE Technologies) [File not signed] R3 PdiPorts; C:\WINDOWS\System32\Drivers\PdiPorts.sys [17328 2012-04-13] (Portrait Displays, Inc.) R3 SRTSP; C:\WINDOWS\System32\Drivers\NIS\1506000.020\SRTSP.SYS [664792 2014-08-26] (Symantec Corporation) R1 SRTSPX; C:\WINDOWS\system32\drivers\NIS\1506000.020\SRTSPX.SYS [32984 2014-08-26] (Symantec Corporation) R0 SymDS; C:\WINDOWS\System32\drivers\NIS\1506000.020\SYMDS.SYS [367704 2013-08-01] (Symantec Corporation) R0 SymEFA; C:\WINDOWS\System32\drivers\NIS\1506000.020\SYMEFA.SYS [936152 2014-03-04] (Symantec Corporation) S0 SymELAM; C:\WINDOWS\System32\drivers\NIS\1506000.020\SYMELAM.SYS [21520 2013-08-01] (Symantec Corporation) R3 SymEvent; C:\WINDOWS\system32\Drivers\SYMEVENT.SYS [142936 2013-09-24] (Symantec Corporation) R1 SymIRON; C:\WINDOWS\system32\drivers\NIS\1506000.020\Ironx86.SYS [209624 2014-08-06] (Symantec Corporation) R1 SymNetS; C:\WINDOWS\System32\Drivers\NIS\1506000.020\SYMNETS.SYS [447704 2014-02-18] (Symantec Corporation) S3 TelekomNM3; C:\Program Files\Netzmanager\NMInfraIS2\Driver\TelekomNM3.sys [35040 2010-09-16] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [84800 2014-09-22] (Microsoft Corporation) R0 Wof; C:\WINDOWS\system32\Drivers\Wof.sys [138584 2014-03-13] (Microsoft Corporation) R3 WUDFSensorLP; C:\WINDOWS\System32\drivers\WUDFRd.sys [188416 2014-05-31] (Microsoft Corporation) R3 WUDFWpdMtp; C:\WINDOWS\system32\DRIVERS\WUDFRd.sys [188416 2014-05-31] (Microsoft Corporation) S3 pccsmcfd; \SystemRoot\system32\DRIVERS\pccsmcfd.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-11 17:48 - 2015-02-11 17:49 - 00000000 ____D () C:\FRST 2015-02-11 17:48 - 2015-02-11 17:48 - 00020673 _____ () C:\FRST.txt 2015-02-11 17:47 - 2015-02-11 17:47 - 01124864 _____ (Farbar) C:\FRST.exe 2015-02-11 17:39 - 2015-02-11 17:39 - 01124864 _____ (Farbar) C:\Users\Daniel\Downloads\FRST.exe 2015-02-11 17:24 - 2015-02-11 17:24 - 00002360 _____ () C:\Malware.txt 2015-02-11 17:06 - 2015-02-11 17:06 - 00001055 _____ () C:\Users\Daniel\Desktop\JRT.txt 2015-02-11 16:47 - 2015-02-11 16:47 - 02347384 _____ (ESET) C:\Users\Daniel\Downloads\esetsmartinstaller_deu.exe 2015-02-11 16:47 - 2015-02-11 16:47 - 00000000 ____D () C:\Program Files\ESET 2015-02-11 14:09 - 2015-02-11 14:46 - 00000000 ____D () C:\AdwCleaner 2015-02-11 13:55 - 2015-02-11 14:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup_disabledByAcp 2015-02-11 13:47 - 2015-02-11 13:47 - 00001217 _____ () C:\Users\Public\Desktop\RegHunter.lnk 2015-02-11 13:47 - 2015-02-11 13:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RegHunter 2015-02-11 13:46 - 2015-02-11 13:46 - 00000000 ____D () C:\Program Files\Common Files\Wise Installation Wizard 2015-02-11 13:29 - 2015-02-11 13:29 - 00000000 __SHD () C:\Users\Daniel\AppData\Local\EmieBrowserModeList 2015-02-11 10:55 - 2015-02-11 10:55 - 01388274 _____ (Thisisu) C:\Users\Daniel\Downloads\JRT.exe 2015-02-11 10:53 - 2015-02-11 10:54 - 02112512 _____ () C:\Users\Daniel\Downloads\AdwCleaner_4.110.exe 2015-02-11 10:53 - 2015-02-11 10:53 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\Enigma Software Group 2015-02-11 10:52 - 2015-02-11 10:52 - 00001294 _____ () C:\Users\Daniel\Desktop\SpyHunter.lnk 2015-02-11 10:52 - 2015-02-11 10:52 - 00000000 ____D () C:\sh4ldr 2015-02-11 10:50 - 2015-02-11 13:47 - 00000000 ____D () C:\Program Files\Enigma Software Group 2015-02-11 10:50 - 2015-02-11 10:50 - 00019984 _____ () C:\WINDOWS\system32\Drivers\EsgScanner.sys 2015-02-11 10:49 - 2015-02-11 10:49 - 03044736 _____ (Enigma Software Group USA, LLC.) C:\Users\Daniel\Downloads\SpyHunter-Installer.exe 2015-02-11 10:40 - 2015-02-11 16:48 - 00114904 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2015-02-11 10:40 - 2015-02-11 15:42 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2015-02-11 10:40 - 2015-02-11 10:40 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-02-11 10:40 - 2015-02-11 10:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-02-11 10:40 - 2015-02-11 10:40 - 00000000 ____D () C:\ProgramData\Malwarebytes 2015-02-11 10:40 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys 2015-02-11 10:40 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys 2015-02-11 10:40 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys 2015-02-11 10:38 - 2015-02-11 10:39 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Daniel\Downloads\mbam-setup-2.0.4.1028.exe 2015-02-10 13:38 - 2015-02-10 13:38 - 00002214 _____ () C:\Users\Public\Desktop\tax 2015.lnk 2015-02-10 13:38 - 2015-02-10 13:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\tax 2015 2015-01-18 10:07 - 2014-12-19 06:46 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys 2015-01-18 10:07 - 2014-12-12 02:34 - 00074240 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWbPrxy.exe 2015-01-18 10:07 - 2014-12-12 01:46 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys 2015-01-18 10:07 - 2014-12-09 04:42 - 00187904 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll 2015-01-18 10:07 - 2014-12-08 20:46 - 00485544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll 2015-01-18 10:07 - 2014-12-08 20:46 - 00108944 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll 2015-01-18 10:07 - 2014-12-08 20:42 - 00448792 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll 2015-01-18 10:07 - 2014-12-08 20:42 - 00372408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll 2015-01-18 10:07 - 2014-12-08 20:42 - 00033584 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe 2015-01-18 10:07 - 2014-12-06 03:36 - 00273408 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll 2015-01-18 10:07 - 2014-12-06 02:28 - 00314880 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll 2015-01-18 10:07 - 2014-12-06 02:23 - 00194048 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll 2015-01-18 10:07 - 2014-10-29 04:12 - 00413136 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe 2015-01-18 10:07 - 2014-10-29 04:12 - 00136296 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe 2015-01-18 10:07 - 2014-10-29 04:07 - 00424544 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll 2015-01-18 10:07 - 2014-10-29 04:07 - 00370424 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll 2015-01-18 10:07 - 2014-10-29 04:07 - 00344536 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll 2015-01-18 10:07 - 2014-10-29 04:07 - 00213336 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe 2015-01-18 10:07 - 2014-10-29 02:59 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll 2015-01-18 10:07 - 2014-10-29 02:01 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll 2015-01-18 10:07 - 2014-10-29 01:49 - 00694272 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-11 17:18 - 2012-12-19 13:55 - 00001120 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job 2015-02-11 17:00 - 2013-08-22 09:17 - 00000000 ____D () C:\WINDOWS\system32\sru 2015-02-11 16:43 - 2015-01-09 21:26 - 00000000 ____D () C:\Users\Daniel\AppData\Local\2EF11234-024A-4F20-928E-971B64C955C4.aplzod 2015-02-11 16:28 - 2013-08-22 09:17 - 00000000 ____D () C:\WINDOWS\Microsoft.NET 2015-02-11 16:12 - 2015-01-09 21:24 - 00000000 ___RD () C:\Users\Daniel\iCloudDrive 2015-02-11 16:12 - 2013-10-21 19:29 - 00000000 ___DO () C:\Users\Daniel\SkyDrive 2015-02-11 16:11 - 2013-08-22 08:23 - 00393281 _____ () C:\WINDOWS\setupact.log 2015-02-11 16:11 - 2013-08-22 08:23 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT 2015-02-11 16:11 - 2012-12-19 13:55 - 00001116 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job 2015-02-11 14:44 - 2012-12-31 09:34 - 00000125 ___SH () C:\ProgramData\.zreglib 2015-02-11 14:42 - 2013-09-29 19:54 - 00054932 _____ () C:\WINDOWS\PFRO.log 2015-02-11 13:58 - 2013-08-22 07:13 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI 2015-02-11 11:10 - 2013-08-22 09:17 - 00000000 ____D () C:\WINDOWS\Vss 2015-02-11 11:07 - 2013-10-21 18:43 - 01929770 _____ () C:\WINDOWS\WindowsUpdate.log 2015-02-11 10:52 - 2013-10-21 18:24 - 00000000 ____D () C:\Users\Daniel 2015-02-10 22:28 - 2013-09-30 05:08 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI 2015-02-10 13:44 - 2013-02-03 19:38 - 00000000 ____D () C:\Users\Daniel\Documents\tax 2015-02-10 13:44 - 2013-02-03 19:31 - 00000724 _____ () C:\WINDOWS\wiso.ini 2015-02-10 13:38 - 2013-02-03 19:31 - 00000000 ____D () C:\Users\Daniel\AppData\Local\Buhl 2015-02-10 13:34 - 2013-02-03 17:22 - 00000000 ____D () C:\Program Files\Buhl finance 2015-02-10 13:34 - 2012-12-26 10:38 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information 2015-02-10 08:31 - 2013-08-22 09:17 - 00000000 ____D () C:\WINDOWS\AppReadiness 2015-02-09 11:14 - 2012-11-27 16:47 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\vlc 2015-02-09 10:18 - 2013-09-05 06:35 - 00000000 ____D () C:\WINDOWS\system32\MRT 2015-02-09 10:03 - 2012-12-14 21:17 - 110348472 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2015-02-09 09:23 - 2012-11-27 14:59 - 00000000 ____D () C:\Program Files\JDownloader 2015-02-07 18:33 - 2013-10-27 09:16 - 00002179 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2015-02-07 18:09 - 2012-07-26 07:43 - 00000000 ____D () C:\WINDOWS\CbsTemp 2015-02-07 17:26 - 2013-08-22 07:13 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM 2015-02-03 20:31 - 2014-08-16 20:49 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe 2015-02-03 20:31 - 2014-08-16 20:49 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl 2015-01-25 13:58 - 2014-12-06 09:38 - 00000000 ____D () C:\ProgramData\Netzmanager 2015-01-24 21:53 - 2013-07-01 21:18 - 01010176 ___SH () C:\Users\Daniel\Documents\Thumbs.db ==================== Files in the root of some directories ======= 2012-12-07 20:16 - 2014-12-21 20:16 - 0078336 _____ () C:\Users\Daniel\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2013-01-22 09:14 - 2013-04-28 19:03 - 0000021 _____ () C:\Users\Daniel\AppData\Local\mc.pixel.data 2012-12-31 09:34 - 2015-02-11 14:44 - 0000125 ___SH () C:\ProgramData\.zreglib 2012-11-27 20:15 - 2012-11-27 20:15 - 0000057 _____ () C:\ProgramData\Ament.ini Files to move or delete: ==================== C:\Users\Daniel\CDmage.exe Some content of TEMP: ==================== C:\Users\Daniel\AppData\Local\Temp\amazonicon_v10.exe C:\Users\Daniel\AppData\Local\Temp\amazoninstallernircmdc.exe C:\Users\Daniel\AppData\Local\Temp\DseShExt-x86.dll C:\Users\Daniel\AppData\Local\Temp\isotousb_setup.exe C:\Users\Daniel\AppData\Local\Temp\Mediencenter_3.9.1055.64.exe C:\Users\Daniel\AppData\Local\Temp\RHSetup.exe C:\Users\Daniel\AppData\Local\Temp\sdan.exe C:\Users\Daniel\AppData\Local\Temp\sdapk.exe C:\Users\Daniel\AppData\Local\Temp\sdaspwn.exe C:\Users\Daniel\AppData\Local\Temp\SDShelEx-win32.dll C:\Users\Daniel\AppData\Local\Temp\stubhelper.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\WINDOWS\explorer.exe => File is digitally signed C:\WINDOWS\system32\winlogon.exe => File is digitally signed C:\WINDOWS\system32\wininit.exe => File is digitally signed C:\WINDOWS\system32\svchost.exe => File is digitally signed C:\WINDOWS\system32\services.exe => File is digitally signed C:\WINDOWS\system32\User32.dll => File is digitally signed C:\WINDOWS\system32\userinit.exe => File is digitally signed C:\WINDOWS\system32\rpcss.dll => File is digitally signed C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-02-11 16:25 ==================== End Of Log ============================ --- --- --- Addition Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 11-02-2015 01 Ran by Daniel at 2015-02-11 17:50:36 Running from C:\ Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AV: Norton Internet Security (Disabled - Up to date) {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB} AS: Norton Internet Security (Enabled - Up to date) {631E4324-D31C-783F-EC5C-35AD42B18466} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FW: Norton Internet Security (Enabled) {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Acer eDisplay Management (HKLM\...\{A586DC50-B18D-48FB-B7CC-A598200457C2}) (Version: 1.37.007 - Portrait Displays, Inc.) Adobe AIR (HKLM\...\Adobe AIR) (Version: 3.9.0.1030 - Adobe Systems Incorporated) Adobe Reader XI (11.0.10) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated) Amazon MP3-Downloader 1.0.18 (HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Amazon MP3-Downloader) (Version: 1.0.18 - Amazon Services LLC) Amazon Music (HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Amazon Amazon Music) (Version: 3.7.0.693 - Amazon Services LLC) Amazon Music Importer (HKLM\...\com.amazon.music.uploader) (Version: 2.1.0 - Amazon Services LLC) Amazon Music Importer (Version: 2.1.0 - Amazon Services LLC) Hidden Any Video Converter 5.7.7 (HKLM\...\Any Video Converter_is1) (Version: - Any-Video-Converter.com) AnyDVD (HKLM\...\AnyDVD) (Version: 7.1.7.0 - SlySoft) Apple Application Support (HKLM\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{235EBB33-3DA1-46DF-AADE-9955123409CB}) (Version: 8.0.5.6 - Apple Inc.) Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) AusweisApp (HKLM\...\{6E2E92F9-A81B-426F-8F35-4F3718A7D0AF}) (Version: 1.11.0 - OpenLimit SignCubes AG) Avidemux 2.6 (32-bit) (HKLM\...\Avidemux 2.6) (Version: 2.6.6.8941 - ) Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.) CDex - Open Source Digital Audio CD Extractor (HKLM\...\CDex) (Version: 1.76.0.2015 - Georgy Berdyshev) devolo Cockpit (HKLM\...\dlancockpit) (Version: 4.2.2.0 - devolo AG) DHTML Editing Component (HKLM\...\{2EA870FA-585F-4187-903D-CB9FFD21E2E0}) (Version: 6.02.0001 - Microsoft Corporation) DVD Flick 1.3.0.7 (HKLM\...\DVD Flick_is1) (Version: 1.3.0.7 - Dennis Meuwissen) DVD Shrink 3.2 (Version: - DVD Shrink) Hidden Google Chrome (HKLM\...\Google Chrome) (Version: 40.0.2214.111 - Google Inc.) Google Earth Plug-in (HKLM\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google) Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden Google+ Auto Backup (HKLM\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google) HP Officejet Pro 8610 - Grundlegende Software für das Gerät (HKLM\...\{4A990817-F950-4770-AC83-7CC57EA18F65}) (Version: 32.2.188.47710 - Hewlett-Packard Co.) HP Officejet Pro 8610 Hilfe (HKLM\...\{2466D8D5-4856-4492-BDEF-48A640F58866}) (Version: 32.0.0 - Hewlett Packard) HP Update (HKLM\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard) HPDiagnosticAlert (Version: 1.00.0000 - Microsoft) Hidden I.R.I.S. OCR (HKLM\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP) iCloud (HKLM\...\{760BB327-3973-4608-85C8-88162E2FF3B6}) (Version: 4.0.6.28 - Apple Inc.) iTunes (HKLM\...\{5D928931-D1D2-4A93-A82D-BF60D0E7CFA5}) (Version: 12.0.1.26 - Apple Inc.) Java 7 Update 17 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217017FF}) (Version: 7.0.170 - Oracle) JDownloader 0.9 (HKLM\...\5513-1208-7298-9440) (Version: 0.9 - AppWork GmbH) Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation) Mediencenter 3.9.1055.64 (HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Mediencenter) (Version: 3.9.1055.64 - Deutsche Telekom AG) Mediencenter Assistent (HKLM\...\Mediencenter Software) (Version: 2.7.0.1451 - Telekom) Medieval CUE Splitter (HKLM\...\{B96D2269-568B-4CBF-9332-12FAE8B158F7}) (Version: 1.2.0 - Medieval Software) Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation) Microsoft WSE 3.0 Runtime (HKLM\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.) MP3-Tag-Editor 3.14.0 (HKLM\...\{DB363BBA-6375-4306-85F9-528CD666FC30}) (Version: 3.14.0 - Gisbert Müller) MSVC80_x86_v2 (Version: 1.0.3.0 - Nokia) Hidden MSVC90_x86 (Version: 1.0.1.2 - Nokia) Hidden Music Wizard Professional 8.0.9 (HKLM\...\MUSICWIZARD_is1) (Version: - Stefan Hollesch) Nero BurningROM 12 (HKLM\...\{3D9167B2-87EB-4713-90B4-E46F2CAFE28D}) (Version: 12.0.00300 - Nero AG) Nero CoverDesigner (HKLM\...\{F1676432-361C-44EE-9596-24C1BB5608B8}) (Version: 12.0.00900 - Nero AG) Nero Prerequisite Installer 2.0 (HKLM\...\{F4C242B4-2973-43F3-93F2-ED1B47AE8848}) (Version: 12.0.02000 - Nero AG) Netzmanager (HKLM\...\Netzmanager) (Version: 1.081 - Deutsche Telekom AG) Netzmanager (Version: 1.081 - Deutsche Telekom AG, Marmiko IT-Solutions GmbH) Hidden Norton Internet Security (HKLM\...\NIS) (Version: 21.6.0.32 - Symantec Corporation) NVIDIA Grafiktreiber 307.68 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 307.68 - NVIDIA Corporation) NVIDIA Update 1.10.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.10.8 - NVIDIA Corporation) Picasa 3 (HKLM\...\Picasa 3) (Version: 3.9 - Google, Inc.) Pivot Pro Plugin (Version: 9.50.110 - Portrait Displays, Inc.) Hidden Prerequisite installer (Version: 12.0.0008 - Nero AG) Hidden Ravensburger tiptoi (HKLM\...\Ravensburger tiptoi) (Version: - ) RealDownloader (Version: 17.0.15.4 - RealNetworks, Inc.) Hidden RealDownloader (Version: 17.0.15.7 - RealNetworks) Hidden RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0 - RealNetworks, Inc) Hidden RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0 - RealNetworks, Inc) Hidden Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: - Realtek Semiconductor Corp.) RealUpgrade 1.1 (Version: 1.1.0 - RealNetworks, Inc.) Hidden RegHunter (HKLM\...\{A16BBEAB-AAEF-434A-BFDD-297708709FCC}) (Version: 1.3.3.1613 - Enigma Software Group USA, LLC) SDK (Version: 2.32.010 - Portrait Displays, Inc.) Hidden Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft) SpyHunter 4 (HKLM\...\SpyHunter) (Version: 4.18.9.4384 - Enigma Software Group, LLC) Studie zur Verbesserung von HP Officejet Pro 8610 (HKLM\...\{8E4E3EA0-9332-47B7-98D4-3DC850317C81}) (Version: 32.2.188.47710 - Hewlett-Packard Co.) tax 2015 (HKLM\...\{4CF96070-DEE5-43B5-B6A7-23AC07BC0C77}) (Version: 22.00.8811 - Buhl Data Service GmbH) TeamViewer 9 (HKLM\...\TeamViewer 9) (Version: 9.0.28223 - TeamViewer) Total Commander (Remove or Repair) (HKLM\...\Totalcmd) (Version: 8.01 - Ghisler Software GmbH) Turbo Lister 2 (HKLM\...\{8927E07C-97F7-4A54-88FB-D976F50DD46E}) (Version: 2.00.0000 - eBay Inc.) UpdateService (Version: 1.0.0 - RealNetworks, Inc.) Hidden UseNeXT by Tangysoft (HKLM\...\UseNeXT by Tangysoft_is1) (Version: - Tangysoft Ltd.) Video Downloader (Version: 1.0.0 - RealNetworks) Hidden VLC media player 2.0.5 (HKLM\...\VLC media player) (Version: 2.0.5 - VideoLAN) Winamp (HKLM\...\Winamp) (Version: 5.63 - Nullsoft, Inc) Winamp Erkennungs-Plug-in (HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc) WinRAR 4.20 (32-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH) Zahlenzauber 1 (HKLM\...\Zahlenzauber 1_is1) (Version: - Oldenbourg Verlag) Zahlenzauber 2 (HKLM\...\Zahlenzauber 2_is1) (Version: - Oldenbourg Verlag) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) CustomCLSID: HKU\S-1-5-21-1030316957-1957585848-888588088-1001_Classes\CLSID\{268502F4-815D-4358-A8D6-B783FDB58EF0}\InprocServer32 -> C:\Users\Daniel\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.ContextMenuHandler.dll (Deutsche Telekom AG) CustomCLSID: HKU\S-1-5-21-1030316957-1957585848-888588088-1001_Classes\CLSID\{34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE}\InprocServer32 -> C:\Users\Daniel\AppData\Local\Microsoft\Internet Explorer\Downloaded Program Files\JordanApplet.dll (IPLabs GmbH) CustomCLSID: HKU\S-1-5-21-1030316957-1957585848-888588088-1001_Classes\CLSID\{3f04dadf-6ea4-44d1-a507-03cad176f443}\InprocServer32 -> C:\Users\Daniel\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.) CustomCLSID: HKU\S-1-5-21-1030316957-1957585848-888588088-1001_Classes\CLSID\{528EE335-5034-4EFC-834E-63E5F02D2BC2}\InprocServer32 -> C:\Users\Daniel\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG) CustomCLSID: HKU\S-1-5-21-1030316957-1957585848-888588088-1001_Classes\CLSID\{6066ADF0-9EB0-43E5-ADB6-990F5A3B979C}\InprocServer32 -> C:\Users\Daniel\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG) CustomCLSID: HKU\S-1-5-21-1030316957-1957585848-888588088-1001_Classes\CLSID\{77BC4082-DB5F-439A-8DC8-F9E24A63B0DE}\InprocServer32 -> C:\Users\Daniel\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG) ==================== Restore Points ========================= 25-01-2015 11:46:43 Windows Update 07-02-2015 17:42:33 Windows Update 10-02-2015 13:33:55 Installiert tax 2015 11-02-2015 13:46:30 Installed RegHunter ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2013-08-22 07:13 - 2013-08-22 07:13 - 00000824 ____N C:\WINDOWS\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {15B96CC9-1C62-4640-B718-AF0AE6D2AF60} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1030316957-1957585848-888588088-1001 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2014-10-30] (RealNetworks, Inc.) Task: {267EC242-A09F-4B76-8B2B-B2968BFEABD6} - System32\Tasks\RealDownloader Update Check => C:\Program Files\RealNetworks\RealDownloader\downloader2.exe [2014-10-29] () Task: {316304DE-C98B-4C2F-8168-42CCC03D6FA1} - System32\Tasks\HPCustParticipation HP Officejet Pro 8610 => C:\Program Files\HP\HP Officejet Pro 8610\Bin\HPCustPartic.exe [2014-03-06] (Hewlett-Packard Co.) Task: {382B533B-988A-4AAD-956E-E38B2E96AB21} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-12-19] (Google Inc.) Task: {400793B0-F552-4268-BA24-7F9FF4F7A390} - \Optimize Start Menu Cache Files-S-1-5-21-1030316957-1957585848-888588088-1001 No Task File <==== ATTENTION Task: {4028C731-8BCB-4341-A41A-42410F75C544} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-12-19] (Google Inc.) Task: {5F10BE7B-0050-4AC9-A10F-C75C6267DEB9} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {8C8B04A5-5EA5-4A0F-B744-BE05B340DFB1} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1030316957-1957585848-888588088-1001 => C:\Program Files\RealNetworks\RealDownloader\RealUpgrade.exe [2014-10-26] (RealNetworks, Inc.) Task: {94A68A17-B81E-4436-96FC-D5568DE86A64} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1030316957-1957585848-888588088-1001 => C:\Program Files\RealNetworks\RealDownloader\RealUpgrade.exe [2014-10-26] (RealNetworks, Inc.) Task: {9D4F4624-C31D-4A74-B30A-2AB5BD71C45C} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated) Task: {A09293A2-66BD-412C-95AB-C66AB0DDC1CC} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files\Norton Internet Security\Engine\21.6.0.32\SymErr.exe [2014-01-30] (Symantec Corporation) Task: {A42035CE-FB42-43C7-A841-5C1E5CB37AEC} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1030316957-1957585848-888588088-1001 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2014-10-30] (RealNetworks, Inc.) Task: {AE38AA98-0974-41EA-B869-B26E7A10DF77} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-1030316957-1957585848-888588088-1001 => C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe [2014-10-26] (RealNetworks, Inc.) Task: {AE664ED8-DD94-4D0E-BF2F-ADEC02A08D6D} - System32\Tasks\Norton WSC Integration => C:\Program Files\Norton Internet Security\Engine\21.6.0.32\WSCStub.exe [2014-09-21] (Symantec Corporation) Task: {B5A04F61-768F-4BED-AEE4-95603C830CC6} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-02-09] (Microsoft Corporation) Task: {B843DB97-0E46-46F6-902D-A4450A3822BE} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files\Norton Internet Security\Engine\21.6.0.32\SymErr.exe [2014-01-30] (Symantec Corporation) Task: {F52E58CF-D27F-4D7C-9099-0ABEFA35BC21} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated) Task: {FF65185D-7111-4387-A339-7AE1FFF311B5} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============== 2014-01-20 13:17 - 2014-01-20 13:17 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll 2014-10-11 13:05 - 2014-10-11 13:05 - 01044776 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll 2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF 2012-12-29 10:46 - 2012-04-13 11:56 - 00180224 _____ () C:\Program Files\Common Files\Portrait Displays\Shared\PresetsCOM.dll 2012-12-29 10:47 - 2012-04-13 12:18 - 00121648 _____ () C:\Program Files\Common Files\Portrait Displays\Plugins\CC\gui.dll 2013-05-22 19:50 - 2013-05-22 19:50 - 00400704 _____ () C:\Users\Daniel\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe 2012-12-29 10:46 - 2012-04-13 12:19 - 00244528 _____ () C:\Program Files\Common Files\Portrait Displays\Shared\dthook.dll 2014-12-06 12:20 - 2014-11-19 01:55 - 06277952 _____ () C:\Users\Daniel\AppData\Local\Amazon Music\Amazon Music Helper.exe 2012-12-29 10:47 - 2010-05-13 16:34 - 00674928 _____ () C:\Program Files\Portrait Displays\Pivot Pro Plugin\wpctrl.exe 2012-12-29 10:47 - 2010-05-13 16:34 - 00711792 _____ () C:\Program Files\Portrait Displays\Pivot Pro Plugin\floater.exe 2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\office14\Cultures\office.odf ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) AlternateDataStreams: C:\Users\Daniel\SkyDrive:ms-properties ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (whitelisted) =============== (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-1030316957-1957585848-888588088-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper DNS Servers: 192.168.2.1 ==================== MSCONFIG/TASK MANAGER disabled items == (Currently there is no automatic fix for this section.) HKLM\...\StartupApproved\StartupFolder: => "PlexRadar.lnk" HKLM\...\StartupApproved\StartupFolder: => "t@x aktuell.lnk" HKLM\...\StartupApproved\Run: => "HP Software Update" HKLM\...\StartupApproved\Run: => "Adobe ARM" HKLM\...\StartupApproved\Run: => "TkBellExe" HKLM\...\StartupApproved\Run: => "iTunesHelper" HKLM\...\StartupApproved\Run: => "SunJavaUpdateSched" HKLM\...\StartupApproved\Run: => "Smart File Advisor" HKLM\...\StartupApproved\Run: => "BingDesktop" HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\StartupApproved\StartupFolder: => "PlexRadar.lnk" HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\StartupApproved\Run: => "Google Update" HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\StartupApproved\Run: => "SDP" HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\StartupApproved\Run: => "PC Suite Tray" ==================== Accounts: ============================= Administrator (S-1-5-21-1030316957-1957585848-888588088-500 - Administrator - Disabled) Daniel (S-1-5-21-1030316957-1957585848-888588088-1001 - Administrator - Enabled) => C:\Users\Daniel Gast (S-1-5-21-1030316957-1957585848-888588088-501 - Limited - Disabled) HomeGroupUser$ (S-1-5-21-1030316957-1957585848-888588088-1006 - Limited - Enabled) UpdatusUser (S-1-5-21-1030316957-1957585848-888588088-1004 - Limited - Enabled) => C:\Users\UpdatusUser ==================== Faulty Device Manager Devices ============= Name: Description: Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. ==================== Event log errors: ========================= Application errors: ================== System errors: ============= Microsoft Office Sessions: ========================= ==================== Memory info =========================== Processor: Pentium(R) Dual-Core CPU E5200 @ 2.50GHz Percentage of memory in use: 61% Total physical RAM: 3071.24 MB Available physical RAM: 1194.09 MB Total Pagefile: 3679.24 MB Available Pagefile: 1593.84 MB Total Virtual: 2047.88 MB Available Virtual: 1860.83 MB ==================== Drives ================================ Drive c: (Daniel) (Fixed) (Total:232.88 GB) (Free:120.89 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Drive d: (Volume) (Fixed) (Total:465.76 GB) (Free:43.4 GB) NTFS Drive j: (Musik) (Fixed) (Total:232.88 GB) (Free:52.5 GB) NTFS Drive k: (Daten) (Fixed) (Total:698.64 GB) (Free:34.46 GB) NTFS ==================== MBR & Partition Table ================== ==================== End Of Log ============================ |
11.02.2015, 22:26 | #4 | |
/// Winkelfunktion /// TB-Süch-Tiger™ | Mal wieder "Positive Ads" Zukünftig bitte beachten: Zitat:
Bitte alle Tools direkt auf den Desktop downloaden bzw. dorthin verschieben und vom Desktop starten, da unsere Anleitungen daraufhin ausgelegt sind. Zudem lassen sich dann am Ende der Bereinigung alle verwendeten Tools sehr einfach entfernen. Alle Tools bis zum Ende der Bereinigung auf dem Desktop lassen, evtl. benötigen wir manche öfter. Poste bitte auch die adwCleaner-Logs mit den Funden
__________________ Logfiles bitte immer in CODE-Tags posten |
16.02.2015, 17:49 | #5 |
| Mal wieder "Positive Ads" Hallo, sorry, es hat ein wenig gedauert. War froh meinen PC ein paar Tage nicht anmachen zu müssen... Hier nochmals die gewünschten Dateien. Ich hoffe, es passt nun: FRST: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 15-02-2015 Ran by Daniel (administrator) on DANIEL on 16-02-2015 17:41:24 Running from C:\Users\Daniel\Downloads Loaded Profiles: Daniel & UpdatusUser (Available profiles: Daniel & UpdatusUser) Platform: Microsoft Windows 8.1 Pro (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: Opera) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (devolo AG) C:\Program Files\devolo\dlan\devolonetsvc.exe (Portrait Displays, Inc.) C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe (Deutsche Telekom AG) C:\Program Files\Telekom\Mediencenter\DTAG.Mediencenter.BackgroundService.exe (Deutsche Telekom AG) C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe (Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.6.0.32\nis.exe (Portrait Displays, Inc.) C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe (TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Google Inc.) C:\Program Files\Google\Update\1.3.26.9\GoogleCrashHandler.exe (Nero AG) C:\Program Files\Nero\Update\NASvc.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe (Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.6.0.32\nis.exe (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Portrait Displays, Inc) C:\Program Files\Acer Display\eDisplay Management\dthtml.exe () C:\Users\Daniel\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8610\Bin\ScanToPCActivationApp.exe () C:\Program Files\Portrait Displays\Pivot Pro Plugin\wpCtrl.exe () C:\Users\Daniel\AppData\Local\Amazon Music\Amazon Music Helper.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\AppleIEDAV.exe () C:\Program Files\Portrait Displays\Pivot Pro Plugin\Floater.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\iCloudDrive.exe (Portrait Displays Inc.) C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreamsDownloader.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Farbar) C:\Users\Daniel\Downloads\FRST (1).exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [6609440 2008-10-31] (Realtek Semiconductor) HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2008-10-31] (Realtek Semiconductor Corp.) HKLM\...\Run: [PivotSoftware] => C:\Program Files\Portrait Displays\Pivot Pro Plugin\Pivot_startup.exe [110192 2010-05-13] () HKLM\...\Run: [DT ACR] => C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe [121648 2012-04-13] (Portrait Displays, Inc.) HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.) HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.) HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard) HKLM\...\Run: [] => [X] HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Run: [AmazonMP3DownloaderHelper] => C:\Users\Daniel\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [400704 2013-05-22] () HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Run: [iCloudServices] => C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-10-17] (Apple Inc.) HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Run: [ApplePhotoStreams] => C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2014-11-21] (Apple Inc.) HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Run: [HP Officejet Pro 8610 (NET)] => C:\Program Files\HP\HP Officejet Pro 8610\Bin\ScanToPCActivationApp.exe [2427400 2014-03-06] (Hewlett-Packard Co.) HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Run: [Amazon Music] => C:\Users\Daniel\AppData\Local\Amazon Music\Amazon Music Helper.exe [6277952 2014-11-19] () HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Run: [AppleIEDAV] => C:\Program Files\Common Files\Apple\Internet Services\AppleIEDAV.exe [1080104 2014-08-04] (Apple Inc.) HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Run: [iCloudDrive] => C:\Program Files\Common Files\Apple\Internet Services\iCloudDrive.exe [43816 2014-10-20] (Apple Inc.) HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Policies\Explorer: [NoSaveSettings] 0 HKU\S-1-5-21-1030316957-1957585848-888588088-1004\...\Run: [Google Update] => "C:\Users\Daniel\AppData\Local\Google\Update\GoogleUpdate.exe" /c HKU\S-1-5-21-1030316957-1957585848-888588088-1004\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [515584 2013-08-22] (Microsoft Corporation) ShellIconOverlayIdentifiers: [01Mediencenter_InSync] -> {77BC4082-DB5F-439A-8DC8-F9E24A63B0DE} => C:\Users\Daniel\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG) ShellIconOverlayIdentifiers: [02Mediencenter_ToSync] -> {528EE335-5034-4EFC-834E-63E5F02D2BC2} => C:\Users\Daniel\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG) ShellIconOverlayIdentifiers: [03Mediencenter_Failed] -> {6066ADF0-9EB0-43E5-ADB6-990F5A3B979C} => C:\Users\Daniel\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG) BootExecute: autocheck autochk /m /P \Device\HarddiskVolume4autocheck autochk * ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-1030316957-1957585848-888588088-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/ HKU\S-1-5-21-1030316957-1957585848-888588088-1004\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.startfenster.com HKU\S-1-5-21-1030316957-1957585848-888588088-1004\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/ SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader) BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files\Norton Internet Security\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation) BHO: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files\Norton Internet Security\Engine\21.6.0.32\IPS\IPSBHO.DLL (Symantec Corporation) BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation) Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1 FireFox: ======== FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF Plugin: @java.com/DTPlugin,version=10.17.2 -> C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.17.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin: @real.com/nppl3260;version=17.0.15.10 -> c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF Plugin: @real.com/nprndlhtml5videoshim;version=17.0.15 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.) FF Plugin: @real.com/nprpplugin;version=17.0.15.10 -> c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer Cloud) FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-1030316957-1957585848-888588088-1001: amazon.com/AmazonMP3DownloaderPlugin -> C:\Users\Daniel\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.) FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.0.2.1\coFFPlgn FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.0.2.1\coFFPlgn [2015-02-16] FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2014-11-16] FF HKLM\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.0.2.1\IPSFF FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.0.2.1\IPSFF [2013-10-09] FF HKLM\...\Firefox\Extensions: [{338950EA-82DB-44C1-930D-0C28E023C9F0}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext Chrome: ======= CHR HomePage: Default -> hxxp://www.google.de/ CHR StartupUrls: Default -> "hxxp://www.google.de/" CHR Profile: C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Docs) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-10-27] CHR Extension: (Google Drive) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2012-11-27] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-11] CHR Extension: (YouTube) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-11-27] CHR Extension: (Google-Suche) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-11-27] CHR Extension: (Norton Identity Safe) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdalibjnif [2014-09-11] CHR Extension: (Google Wallet) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-27] CHR Extension: (Google Mail) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-11-27] CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No Path CHR HKLM\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files\Norton Internet Security\Engine\21.6.0.32\Exts\Chrome.crx [2014-10-05] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 DevoloNetworkService; C:\Program Files\devolo\dlan\devolonetsvc.exe [3647992 2014-05-14] (devolo AG) R2 DTSRVC; C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe [138032 2012-04-13] (Portrait Displays, Inc.) R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) R2 MCSWASVR; C:\Program Files\Telekom\Mediencenter\DTAG.Mediencenter.BackgroundService.exe [12800 2012-08-13] (Deutsche Telekom AG) [File not signed] R2 NAUpdate; C:\Program Files\Nero\Update\NASvc.exe [786256 2014-07-15] (Nero AG) R2 Netzmanager Service; C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe [2635776 2012-07-20] (Deutsche Telekom AG) [File not signed] R2 NIS; C:\Program Files\Norton Internet Security\Engine\21.6.0.32\NIS.exe [276376 2014-09-21] (Symantec Corporation) R2 PdiService; C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe [113456 2012-04-13] (Portrait Displays, Inc.) S3 ScDeviceEnum; C:\WINDOWS\System32\ScDeviceEnum.dll [105472 2013-08-22] (Microsoft Corporation) R2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [770944 2015-02-11] (Enigma Software Group USA, LLC.) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [288128 2014-09-22] (Microsoft Corporation) S3 WEPHOSTSVC; C:\WINDOWS\system32\wephostsvc.dll [20992 2013-08-22] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [22192 2014-09-22] (Microsoft Corporation) S3 workfolderssvc; C:\WINDOWS\system32\workfolderssvc.dll [1222144 2014-07-24] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R3 AnyDVD; C:\WINDOWS\System32\Drivers\AnyDVD.sys [124504 2013-03-18] (SlySoft, Inc.) R1 BasicRender; C:\WINDOWS\System32\drivers\BasicRender.sys [25600 2014-02-22] (Microsoft Corporation) R1 BHDrvx86; C:\Program Files\Norton Internet Security\NortonData\21.0.2.1\Definitions\BASHDefs\20150203.001\BHDrvx86.sys [1164504 2015-02-03] (Symantec Corporation) R1 ccSet_NIS; C:\WINDOWS\system32\drivers\NIS\1506000.020\ccSetx86.sys [127064 2013-09-26] (Symantec Corporation) R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [378672 2014-12-12] (Symantec Corporation) R1 ElbyCDIO; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [30616 2013-03-04] (Elaborate Bytes AG) R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [111408 2014-12-12] (Symantec Corporation) S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [16432 2015-02-11] (Enigma Software Group USA, LLC.) S3 EsgScanner; C:\WINDOWS\System32\DRIVERS\EsgScanner.sys [19984 2015-02-11] () S3 GPIO; C:\WINDOWS\System32\drivers\iaiogpio.sys [22016 2013-07-23] (Intel Corporation) R1 IDSVix86; C:\Program Files\Norton Internet Security\NortonData\21.0.2.1\Definitions\IPSDefs\20150213.001\IDSvix86.sys [503512 2015-02-07] (Symantec Corporation) R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [23256 2014-11-21] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [114904 2015-02-16] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [51928 2014-11-21] (Malwarebytes Corporation) R3 NAVENG; C:\Program Files\Norton Internet Security\NortonData\21.0.2.1\Definitions\VirusDefs\20150215.024\NAVENG.SYS [95704 2015-01-24] (Symantec Corporation) R3 NAVEX15; C:\Program Files\Norton Internet Security\NortonData\21.0.2.1\Definitions\VirusDefs\20150215.024\NAVEX15.SYS [1636696 2015-01-24] (Symantec Corporation) R2 NPF_devolo; C:\WINDOWS\system32\drivers\npf_devolo.sys [35840 2014-05-14] (CACE Technologies) [File not signed] R3 PdiPorts; C:\WINDOWS\System32\Drivers\PdiPorts.sys [17328 2012-04-13] (Portrait Displays, Inc.) R3 SRTSP; C:\WINDOWS\System32\Drivers\NIS\1506000.020\SRTSP.SYS [664792 2014-08-26] (Symantec Corporation) R1 SRTSPX; C:\WINDOWS\system32\drivers\NIS\1506000.020\SRTSPX.SYS [32984 2014-08-26] (Symantec Corporation) R0 SymDS; C:\WINDOWS\System32\drivers\NIS\1506000.020\SYMDS.SYS [367704 2013-08-01] (Symantec Corporation) R0 SymEFA; C:\WINDOWS\System32\drivers\NIS\1506000.020\SYMEFA.SYS [936152 2014-03-04] (Symantec Corporation) S0 SymELAM; C:\WINDOWS\System32\drivers\NIS\1506000.020\SYMELAM.SYS [21520 2013-08-01] (Symantec Corporation) R3 SymEvent; C:\WINDOWS\system32\Drivers\SYMEVENT.SYS [142936 2013-09-24] (Symantec Corporation) R1 SymIRON; C:\WINDOWS\system32\drivers\NIS\1506000.020\Ironx86.SYS [209624 2014-08-06] (Symantec Corporation) R1 SymNetS; C:\WINDOWS\System32\Drivers\NIS\1506000.020\SYMNETS.SYS [447704 2014-02-18] (Symantec Corporation) S3 TelekomNM3; C:\Program Files\Netzmanager\NMInfraIS2\Driver\TelekomNM3.sys [35040 2010-09-16] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [84800 2014-09-22] (Microsoft Corporation) R0 Wof; C:\WINDOWS\system32\Drivers\Wof.sys [138584 2014-03-13] (Microsoft Corporation) R3 WUDFSensorLP; C:\WINDOWS\System32\drivers\WUDFRd.sys [188416 2014-05-31] (Microsoft Corporation) R3 WUDFWpdMtp; C:\WINDOWS\system32\DRIVERS\WUDFRd.sys [188416 2014-05-31] (Microsoft Corporation) S3 pccsmcfd; \SystemRoot\system32\DRIVERS\pccsmcfd.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-16 17:41 - 2015-02-16 17:41 - 00020968 _____ () C:\Users\Daniel\Downloads\FRST.txt 2015-02-16 17:39 - 2015-02-16 17:39 - 01125888 _____ (Farbar) C:\Users\Daniel\Downloads\FRST (1).exe 2015-02-16 17:39 - 2015-02-16 17:39 - 00001169 _____ () C:\Users\Daniel\Desktop\FRST (1) - Verknüpfung.lnk 2015-02-11 17:50 - 2015-02-11 17:51 - 00021199 _____ () C:\Addition.txt 2015-02-11 17:48 - 2015-02-16 17:41 - 00000000 ____D () C:\FRST 2015-02-11 17:48 - 2015-02-11 17:51 - 00031649 _____ () C:\FRST.txt 2015-02-11 17:47 - 2015-02-11 17:47 - 01124864 _____ (Farbar) C:\FRST.exe 2015-02-11 17:39 - 2015-02-11 17:39 - 01124864 _____ (Farbar) C:\Users\Daniel\Downloads\FRST.exe 2015-02-11 17:24 - 2015-02-11 17:24 - 00002360 _____ () C:\Malware.txt 2015-02-11 17:06 - 2015-02-11 17:06 - 00001055 _____ () C:\Users\Daniel\Desktop\JRT.txt 2015-02-11 16:47 - 2015-02-11 16:47 - 02347384 _____ (ESET) C:\Users\Daniel\Downloads\esetsmartinstaller_deu.exe 2015-02-11 14:09 - 2015-02-11 14:46 - 00000000 ____D () C:\AdwCleaner 2015-02-11 13:55 - 2015-02-11 14:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup_disabledByAcp 2015-02-11 13:47 - 2015-02-11 13:47 - 00001217 _____ () C:\Users\Public\Desktop\RegHunter.lnk 2015-02-11 13:47 - 2015-02-11 13:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RegHunter 2015-02-11 13:46 - 2015-02-11 13:46 - 00000000 ____D () C:\Program Files\Common Files\Wise Installation Wizard 2015-02-11 13:29 - 2015-02-11 13:29 - 00000000 __SHD () C:\Users\Daniel\AppData\Local\EmieBrowserModeList 2015-02-11 10:55 - 2015-02-11 10:55 - 01388274 _____ (Thisisu) C:\Users\Daniel\Downloads\JRT.exe 2015-02-11 10:53 - 2015-02-11 10:54 - 02112512 _____ () C:\Users\Daniel\Downloads\AdwCleaner_4.110.exe 2015-02-11 10:53 - 2015-02-11 10:53 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\Enigma Software Group 2015-02-11 10:52 - 2015-02-11 10:52 - 00001294 _____ () C:\Users\Daniel\Desktop\SpyHunter.lnk 2015-02-11 10:52 - 2015-02-11 10:52 - 00000000 ____D () C:\sh4ldr 2015-02-11 10:50 - 2015-02-11 13:47 - 00000000 ____D () C:\Program Files\Enigma Software Group 2015-02-11 10:50 - 2015-02-11 10:50 - 00019984 _____ () C:\WINDOWS\system32\Drivers\EsgScanner.sys 2015-02-11 10:49 - 2015-02-11 10:49 - 03044736 _____ (Enigma Software Group USA, LLC.) C:\Users\Daniel\Downloads\SpyHunter-Installer.exe 2015-02-11 10:40 - 2015-02-16 17:33 - 00114904 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2015-02-11 10:40 - 2015-02-11 15:42 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2015-02-11 10:40 - 2015-02-11 10:40 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-02-11 10:40 - 2015-02-11 10:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-02-11 10:40 - 2015-02-11 10:40 - 00000000 ____D () C:\ProgramData\Malwarebytes 2015-02-11 10:40 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys 2015-02-11 10:40 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys 2015-02-11 10:40 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys 2015-02-11 10:38 - 2015-02-11 10:39 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Daniel\Downloads\mbam-setup-2.0.4.1028.exe 2015-02-10 13:38 - 2015-02-10 13:38 - 00002214 _____ () C:\Users\Public\Desktop\tax 2015.lnk 2015-02-10 13:38 - 2015-02-10 13:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\tax 2015 2015-01-18 10:07 - 2014-12-19 06:46 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys 2015-01-18 10:07 - 2014-12-12 02:34 - 00074240 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWbPrxy.exe 2015-01-18 10:07 - 2014-12-12 01:46 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys 2015-01-18 10:07 - 2014-12-09 04:42 - 00187904 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll 2015-01-18 10:07 - 2014-12-08 20:46 - 00485544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll 2015-01-18 10:07 - 2014-12-08 20:46 - 00108944 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll 2015-01-18 10:07 - 2014-12-08 20:42 - 00448792 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll 2015-01-18 10:07 - 2014-12-08 20:42 - 00372408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll 2015-01-18 10:07 - 2014-12-08 20:42 - 00033584 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe 2015-01-18 10:07 - 2014-12-06 03:36 - 00273408 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll 2015-01-18 10:07 - 2014-12-06 02:28 - 00314880 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll 2015-01-18 10:07 - 2014-12-06 02:23 - 00194048 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll 2015-01-18 10:07 - 2014-10-29 04:12 - 00413136 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe 2015-01-18 10:07 - 2014-10-29 04:12 - 00136296 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe 2015-01-18 10:07 - 2014-10-29 04:07 - 00424544 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll 2015-01-18 10:07 - 2014-10-29 04:07 - 00370424 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll 2015-01-18 10:07 - 2014-10-29 04:07 - 00344536 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll 2015-01-18 10:07 - 2014-10-29 04:07 - 00213336 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe 2015-01-18 10:07 - 2014-10-29 02:59 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll 2015-01-18 10:07 - 2014-10-29 02:01 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll 2015-01-18 10:07 - 2014-10-29 01:49 - 00694272 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-16 17:39 - 2013-09-30 05:08 - 01785518 _____ () C:\WINDOWS\system32\PerfStringBackup.INI 2015-02-16 17:38 - 2013-10-21 19:29 - 00000000 ___DO () C:\Users\Daniel\SkyDrive 2015-02-16 17:38 - 2012-11-27 14:59 - 00000000 ____D () C:\Program Files\JDownloader 2015-02-16 17:36 - 2015-01-09 21:24 - 00000000 ___RD () C:\Users\Daniel\iCloudDrive 2015-02-16 17:34 - 2012-12-19 13:55 - 00001116 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job 2015-02-16 17:18 - 2012-12-19 13:55 - 00001120 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job 2015-02-16 17:17 - 2013-08-22 09:17 - 00000000 ____D () C:\WINDOWS\Microsoft.NET 2015-02-16 17:05 - 2013-08-22 07:13 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM 2015-02-16 17:04 - 2013-08-22 08:23 - 00393435 _____ () C:\WINDOWS\setupact.log 2015-02-16 17:04 - 2013-08-22 08:23 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT 2015-02-11 22:00 - 2013-08-22 09:17 - 00000000 ____D () C:\WINDOWS\system32\sru 2015-02-11 20:52 - 2015-01-09 21:26 - 00000000 ____D () C:\Users\Daniel\AppData\Local\2EF11234-024A-4F20-928E-971B64C955C4.aplzod 2015-02-11 14:44 - 2012-12-31 09:34 - 00000125 ___SH () C:\ProgramData\.zreglib 2015-02-11 14:42 - 2013-09-29 19:54 - 00054932 _____ () C:\WINDOWS\PFRO.log 2015-02-11 13:58 - 2013-08-22 07:13 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI 2015-02-11 11:10 - 2013-08-22 09:17 - 00000000 ____D () C:\WINDOWS\Vss 2015-02-11 11:07 - 2013-10-21 18:43 - 01929770 _____ () C:\WINDOWS\WindowsUpdate.log 2015-02-11 10:52 - 2013-10-21 18:24 - 00000000 ____D () C:\Users\Daniel 2015-02-10 13:44 - 2013-02-03 19:38 - 00000000 ____D () C:\Users\Daniel\Documents\tax 2015-02-10 13:44 - 2013-02-03 19:31 - 00000724 _____ () C:\WINDOWS\wiso.ini 2015-02-10 13:38 - 2013-02-03 19:31 - 00000000 ____D () C:\Users\Daniel\AppData\Local\Buhl 2015-02-10 13:34 - 2013-02-03 17:22 - 00000000 ____D () C:\Program Files\Buhl finance 2015-02-10 13:34 - 2012-12-26 10:38 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information 2015-02-10 08:31 - 2013-08-22 09:17 - 00000000 ____D () C:\WINDOWS\AppReadiness 2015-02-09 11:14 - 2012-11-27 16:47 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\vlc 2015-02-09 10:18 - 2013-09-05 06:35 - 00000000 ____D () C:\WINDOWS\system32\MRT 2015-02-09 10:03 - 2012-12-14 21:17 - 110348472 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2015-02-07 18:33 - 2013-10-27 09:16 - 00002179 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2015-02-07 18:09 - 2012-07-26 07:43 - 00000000 ____D () C:\WINDOWS\CbsTemp 2015-02-03 20:31 - 2014-08-16 20:49 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe 2015-02-03 20:31 - 2014-08-16 20:49 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl 2015-01-25 13:58 - 2014-12-06 09:38 - 00000000 ____D () C:\ProgramData\Netzmanager 2015-01-24 21:53 - 2013-07-01 21:18 - 01010176 ___SH () C:\Users\Daniel\Documents\Thumbs.db ==================== Files in the root of some directories ======= 2012-12-07 20:16 - 2014-12-21 20:16 - 0078336 _____ () C:\Users\Daniel\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2013-01-22 09:14 - 2013-04-28 19:03 - 0000021 _____ () C:\Users\Daniel\AppData\Local\mc.pixel.data 2012-12-31 09:34 - 2015-02-11 14:44 - 0000125 ___SH () C:\ProgramData\.zreglib 2012-11-27 20:15 - 2012-11-27 20:15 - 0000057 _____ () C:\ProgramData\Ament.ini Files to move or delete: ==================== C:\Users\Daniel\CDmage.exe Some content of TEMP: ==================== C:\Users\Daniel\AppData\Local\Temp\amazonicon_v10.exe C:\Users\Daniel\AppData\Local\Temp\amazoninstallernircmdc.exe C:\Users\Daniel\AppData\Local\Temp\DseShExt-x86.dll C:\Users\Daniel\AppData\Local\Temp\isotousb_setup.exe C:\Users\Daniel\AppData\Local\Temp\Mediencenter_3.9.1055.64.exe C:\Users\Daniel\AppData\Local\Temp\RHSetup.exe C:\Users\Daniel\AppData\Local\Temp\sdan.exe C:\Users\Daniel\AppData\Local\Temp\sdapk.exe C:\Users\Daniel\AppData\Local\Temp\sdaspwn.exe C:\Users\Daniel\AppData\Local\Temp\SDShelEx-win32.dll C:\Users\Daniel\AppData\Local\Temp\stubhelper.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\WINDOWS\explorer.exe => File is digitally signed C:\WINDOWS\system32\winlogon.exe => File is digitally signed C:\WINDOWS\system32\wininit.exe => File is digitally signed C:\WINDOWS\system32\svchost.exe => File is digitally signed C:\WINDOWS\system32\services.exe => File is digitally signed C:\WINDOWS\system32\User32.dll => File is digitally signed C:\WINDOWS\system32\userinit.exe => File is digitally signed C:\WINDOWS\system32\rpcss.dll => File is digitally signed C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-02-16 17:15 ==================== End Of Log ============================ Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 15-02-2015 Ran by Daniel at 2015-02-16 17:42:19 Running from C:\Users\Daniel\Downloads Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AV: Norton Internet Security (Disabled - Up to date) {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB} AS: Norton Internet Security (Enabled - Up to date) {631E4324-D31C-783F-EC5C-35AD42B18466} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FW: Norton Internet Security (Enabled) {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Acer eDisplay Management (HKLM\...\{A586DC50-B18D-48FB-B7CC-A598200457C2}) (Version: 1.37.007 - Portrait Displays, Inc.) Adobe AIR (HKLM\...\Adobe AIR) (Version: 3.9.0.1030 - Adobe Systems Incorporated) Adobe Reader XI (11.0.10) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated) Amazon MP3-Downloader 1.0.18 (HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Amazon MP3-Downloader) (Version: 1.0.18 - Amazon Services LLC) Amazon Music (HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Amazon Amazon Music) (Version: 3.7.0.693 - Amazon Services LLC) Amazon Music Importer (HKLM\...\com.amazon.music.uploader) (Version: 2.1.0 - Amazon Services LLC) Amazon Music Importer (Version: 2.1.0 - Amazon Services LLC) Hidden Any Video Converter 5.7.7 (HKLM\...\Any Video Converter_is1) (Version: - Any-Video-Converter.com) AnyDVD (HKLM\...\AnyDVD) (Version: 7.1.7.0 - SlySoft) Apple Application Support (HKLM\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{235EBB33-3DA1-46DF-AADE-9955123409CB}) (Version: 8.0.5.6 - Apple Inc.) Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) AusweisApp (HKLM\...\{6E2E92F9-A81B-426F-8F35-4F3718A7D0AF}) (Version: 1.11.0 - OpenLimit SignCubes AG) Avidemux 2.6 (32-bit) (HKLM\...\Avidemux 2.6) (Version: 2.6.6.8941 - ) Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.) CDex - Open Source Digital Audio CD Extractor (HKLM\...\CDex) (Version: 1.76.0.2015 - Georgy Berdyshev) devolo Cockpit (HKLM\...\dlancockpit) (Version: 4.2.2.0 - devolo AG) DHTML Editing Component (HKLM\...\{2EA870FA-585F-4187-903D-CB9FFD21E2E0}) (Version: 6.02.0001 - Microsoft Corporation) DVD Flick 1.3.0.7 (HKLM\...\DVD Flick_is1) (Version: 1.3.0.7 - Dennis Meuwissen) DVD Shrink 3.2 (Version: - DVD Shrink) Hidden Google Chrome (HKLM\...\Google Chrome) (Version: 40.0.2214.111 - Google Inc.) Google Chrome (HKU\S-1-5-21-1030316957-1957585848-888588088-1004\...\Google Chrome) (Version: 23.0.1271.97 - Google Inc.) Google Earth Plug-in (HKLM\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google) Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden Google+ Auto Backup (HKLM\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google) HP Officejet Pro 8610 - Grundlegende Software für das Gerät (HKLM\...\{4A990817-F950-4770-AC83-7CC57EA18F65}) (Version: 32.2.188.47710 - Hewlett-Packard Co.) HP Officejet Pro 8610 Hilfe (HKLM\...\{2466D8D5-4856-4492-BDEF-48A640F58866}) (Version: 32.0.0 - Hewlett Packard) HP Update (HKLM\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard) HPDiagnosticAlert (Version: 1.00.0000 - Microsoft) Hidden I.R.I.S. OCR (HKLM\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP) iCloud (HKLM\...\{760BB327-3973-4608-85C8-88162E2FF3B6}) (Version: 4.0.6.28 - Apple Inc.) iTunes (HKLM\...\{5D928931-D1D2-4A93-A82D-BF60D0E7CFA5}) (Version: 12.0.1.26 - Apple Inc.) Java 7 Update 17 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217017FF}) (Version: 7.0.170 - Oracle) JDownloader 0.9 (HKLM\...\5513-1208-7298-9440) (Version: 0.9 - AppWork GmbH) Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation) Mediencenter 3.9.1055.64 (HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Mediencenter) (Version: 3.9.1055.64 - Deutsche Telekom AG) Mediencenter Assistent (HKLM\...\Mediencenter Software) (Version: 2.7.0.1451 - Telekom) Medieval CUE Splitter (HKLM\...\{B96D2269-568B-4CBF-9332-12FAE8B158F7}) (Version: 1.2.0 - Medieval Software) Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation) Microsoft WSE 3.0 Runtime (HKLM\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.) MP3-Tag-Editor 3.14.0 (HKLM\...\{DB363BBA-6375-4306-85F9-528CD666FC30}) (Version: 3.14.0 - Gisbert Müller) MSVC80_x86_v2 (Version: 1.0.3.0 - Nokia) Hidden MSVC90_x86 (Version: 1.0.1.2 - Nokia) Hidden Music Wizard Professional 8.0.9 (HKLM\...\MUSICWIZARD_is1) (Version: - Stefan Hollesch) Nero BurningROM 12 (HKLM\...\{3D9167B2-87EB-4713-90B4-E46F2CAFE28D}) (Version: 12.0.00300 - Nero AG) Nero CoverDesigner (HKLM\...\{F1676432-361C-44EE-9596-24C1BB5608B8}) (Version: 12.0.00900 - Nero AG) Nero Prerequisite Installer 2.0 (HKLM\...\{F4C242B4-2973-43F3-93F2-ED1B47AE8848}) (Version: 12.0.02000 - Nero AG) Netzmanager (HKLM\...\Netzmanager) (Version: 1.081 - Deutsche Telekom AG) Netzmanager (Version: 1.081 - Deutsche Telekom AG, Marmiko IT-Solutions GmbH) Hidden Norton Internet Security (HKLM\...\NIS) (Version: 21.6.0.32 - Symantec Corporation) NVIDIA Grafiktreiber 307.68 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 307.68 - NVIDIA Corporation) NVIDIA Update 1.10.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.10.8 - NVIDIA Corporation) Picasa 3 (HKLM\...\Picasa 3) (Version: 3.9 - Google, Inc.) Pivot Pro Plugin (Version: 9.50.110 - Portrait Displays, Inc.) Hidden Prerequisite installer (Version: 12.0.0008 - Nero AG) Hidden Ravensburger tiptoi (HKLM\...\Ravensburger tiptoi) (Version: - ) RealDownloader (Version: 17.0.15.4 - RealNetworks, Inc.) Hidden RealDownloader (Version: 17.0.15.7 - RealNetworks) Hidden RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0 - RealNetworks, Inc) Hidden RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0 - RealNetworks, Inc) Hidden Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: - Realtek Semiconductor Corp.) RealUpgrade 1.1 (Version: 1.1.0 - RealNetworks, Inc.) Hidden RegHunter (HKLM\...\{A16BBEAB-AAEF-434A-BFDD-297708709FCC}) (Version: 1.3.3.1613 - Enigma Software Group USA, LLC) SDK (Version: 2.32.010 - Portrait Displays, Inc.) Hidden Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft) SpyHunter 4 (HKLM\...\SpyHunter) (Version: 4.18.9.4384 - Enigma Software Group, LLC) Studie zur Verbesserung von HP Officejet Pro 8610 (HKLM\...\{8E4E3EA0-9332-47B7-98D4-3DC850317C81}) (Version: 32.2.188.47710 - Hewlett-Packard Co.) tax 2015 (HKLM\...\{4CF96070-DEE5-43B5-B6A7-23AC07BC0C77}) (Version: 22.00.8811 - Buhl Data Service GmbH) TeamViewer 9 (HKLM\...\TeamViewer 9) (Version: 9.0.28223 - TeamViewer) Total Commander (Remove or Repair) (HKLM\...\Totalcmd) (Version: 8.01 - Ghisler Software GmbH) Turbo Lister 2 (HKLM\...\{8927E07C-97F7-4A54-88FB-D976F50DD46E}) (Version: 2.00.0000 - eBay Inc.) UpdateService (Version: 1.0.0 - RealNetworks, Inc.) Hidden UseNeXT by Tangysoft (HKLM\...\UseNeXT by Tangysoft_is1) (Version: - Tangysoft Ltd.) Video Downloader (Version: 1.0.0 - RealNetworks) Hidden VLC media player 2.0.5 (HKLM\...\VLC media player) (Version: 2.0.5 - VideoLAN) Winamp (HKLM\...\Winamp) (Version: 5.63 - Nullsoft, Inc) Winamp Erkennungs-Plug-in (HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc) Winamp Erkennungs-Plug-in (HKU\S-1-5-21-1030316957-1957585848-888588088-1004\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc) WinRAR 4.20 (32-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH) Zahlenzauber 1 (HKLM\...\Zahlenzauber 1_is1) (Version: - Oldenbourg Verlag) Zahlenzauber 2 (HKLM\...\Zahlenzauber 2_is1) (Version: - Oldenbourg Verlag) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) CustomCLSID: HKU\S-1-5-21-1030316957-1957585848-888588088-1001_Classes\CLSID\{268502F4-815D-4358-A8D6-B783FDB58EF0}\InprocServer32 -> C:\Users\Daniel\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.ContextMenuHandler.dll (Deutsche Telekom AG) CustomCLSID: HKU\S-1-5-21-1030316957-1957585848-888588088-1001_Classes\CLSID\{34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE}\InprocServer32 -> C:\Users\Daniel\AppData\Local\Microsoft\Internet Explorer\Downloaded Program Files\JordanApplet.dll (IPLabs GmbH) CustomCLSID: HKU\S-1-5-21-1030316957-1957585848-888588088-1001_Classes\CLSID\{3f04dadf-6ea4-44d1-a507-03cad176f443}\InprocServer32 -> C:\Users\Daniel\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.) CustomCLSID: HKU\S-1-5-21-1030316957-1957585848-888588088-1001_Classes\CLSID\{528EE335-5034-4EFC-834E-63E5F02D2BC2}\InprocServer32 -> C:\Users\Daniel\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG) CustomCLSID: HKU\S-1-5-21-1030316957-1957585848-888588088-1001_Classes\CLSID\{6066ADF0-9EB0-43E5-ADB6-990F5A3B979C}\InprocServer32 -> C:\Users\Daniel\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG) CustomCLSID: HKU\S-1-5-21-1030316957-1957585848-888588088-1001_Classes\CLSID\{77BC4082-DB5F-439A-8DC8-F9E24A63B0DE}\InprocServer32 -> C:\Users\Daniel\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG) ==================== Restore Points ========================= 25-01-2015 11:46:43 Windows Update 07-02-2015 17:42:33 Windows Update 10-02-2015 13:33:55 Installiert tax 2015 11-02-2015 13:46:30 Installed RegHunter ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2013-08-22 07:13 - 2013-08-22 07:13 - 00000824 ____N C:\WINDOWS\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {15B96CC9-1C62-4640-B718-AF0AE6D2AF60} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1030316957-1957585848-888588088-1001 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2014-10-30] (RealNetworks, Inc.) Task: {267EC242-A09F-4B76-8B2B-B2968BFEABD6} - System32\Tasks\RealDownloader Update Check => C:\Program Files\RealNetworks\RealDownloader\downloader2.exe [2014-10-29] () Task: {316304DE-C98B-4C2F-8168-42CCC03D6FA1} - System32\Tasks\HPCustParticipation HP Officejet Pro 8610 => C:\Program Files\HP\HP Officejet Pro 8610\Bin\HPCustPartic.exe [2014-03-06] (Hewlett-Packard Co.) Task: {382B533B-988A-4AAD-956E-E38B2E96AB21} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-12-19] (Google Inc.) Task: {400793B0-F552-4268-BA24-7F9FF4F7A390} - \Optimize Start Menu Cache Files-S-1-5-21-1030316957-1957585848-888588088-1001 No Task File <==== ATTENTION Task: {4028C731-8BCB-4341-A41A-42410F75C544} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-12-19] (Google Inc.) Task: {5F10BE7B-0050-4AC9-A10F-C75C6267DEB9} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {8C8B04A5-5EA5-4A0F-B744-BE05B340DFB1} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1030316957-1957585848-888588088-1001 => C:\Program Files\RealNetworks\RealDownloader\RealUpgrade.exe [2014-10-26] (RealNetworks, Inc.) Task: {94A68A17-B81E-4436-96FC-D5568DE86A64} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1030316957-1957585848-888588088-1001 => C:\Program Files\RealNetworks\RealDownloader\RealUpgrade.exe [2014-10-26] (RealNetworks, Inc.) Task: {9D4F4624-C31D-4A74-B30A-2AB5BD71C45C} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated) Task: {A09293A2-66BD-412C-95AB-C66AB0DDC1CC} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files\Norton Internet Security\Engine\21.6.0.32\SymErr.exe [2014-01-30] (Symantec Corporation) Task: {A42035CE-FB42-43C7-A841-5C1E5CB37AEC} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1030316957-1957585848-888588088-1001 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2014-10-30] (RealNetworks, Inc.) Task: {AE38AA98-0974-41EA-B869-B26E7A10DF77} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-1030316957-1957585848-888588088-1001 => C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe [2014-10-26] (RealNetworks, Inc.) Task: {AE664ED8-DD94-4D0E-BF2F-ADEC02A08D6D} - System32\Tasks\Norton WSC Integration => C:\Program Files\Norton Internet Security\Engine\21.6.0.32\WSCStub.exe [2014-09-21] (Symantec Corporation) Task: {B843DB97-0E46-46F6-902D-A4450A3822BE} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files\Norton Internet Security\Engine\21.6.0.32\SymErr.exe [2014-01-30] (Symantec Corporation) Task: {D5EF9AD8-9EC9-475D-AEEA-760F78D5F458} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-02-09] (Microsoft Corporation) Task: {F52E58CF-D27F-4D7C-9099-0ABEFA35BC21} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated) Task: {FF65185D-7111-4387-A339-7AE1FFF311B5} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============== 2014-01-20 13:17 - 2014-01-20 13:17 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll 2014-10-11 13:05 - 2014-10-11 13:05 - 01044776 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll 2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF 2012-12-29 10:46 - 2012-04-13 12:19 - 00244528 _____ () C:\Program Files\Common Files\Portrait Displays\Shared\dthook.dll 2012-12-29 10:46 - 2012-04-13 11:56 - 00180224 _____ () C:\Program Files\Common Files\Portrait Displays\Shared\PresetsCOM.dll 2012-12-29 10:47 - 2012-04-13 12:18 - 00121648 _____ () C:\Program Files\Common Files\Portrait Displays\Plugins\CC\gui.dll 2013-05-22 19:50 - 2013-05-22 19:50 - 00400704 _____ () C:\Users\Daniel\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe 2012-12-29 10:47 - 2010-05-13 16:34 - 00674928 _____ () C:\Program Files\Portrait Displays\Pivot Pro Plugin\wpctrl.exe 2014-12-06 12:20 - 2014-11-19 01:55 - 06277952 _____ () C:\Users\Daniel\AppData\Local\Amazon Music\Amazon Music Helper.exe 2012-12-29 10:47 - 2010-05-13 16:34 - 00711792 _____ () C:\Program Files\Portrait Displays\Pivot Pro Plugin\floater.exe ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) AlternateDataStreams: C:\Users\Daniel\SkyDrive:ms-properties ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (whitelisted) =============== (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-1030316957-1957585848-888588088-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper HKU\S-1-5-21-1030316957-1957585848-888588088-1004\Control Panel\Desktop\\Wallpaper -> DNS Servers: 192.168.2.1 ==================== MSCONFIG/TASK MANAGER disabled items == (Currently there is no automatic fix for this section.) HKLM\...\StartupApproved\StartupFolder: => "PlexRadar.lnk" HKLM\...\StartupApproved\StartupFolder: => "t@x aktuell.lnk" HKLM\...\StartupApproved\Run: => "HP Software Update" HKLM\...\StartupApproved\Run: => "Adobe ARM" HKLM\...\StartupApproved\Run: => "TkBellExe" HKLM\...\StartupApproved\Run: => "iTunesHelper" HKLM\...\StartupApproved\Run: => "SunJavaUpdateSched" HKLM\...\StartupApproved\Run: => "Smart File Advisor" HKLM\...\StartupApproved\Run: => "BingDesktop" HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\StartupApproved\StartupFolder: => "PlexRadar.lnk" HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\StartupApproved\Run: => "Google Update" HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\StartupApproved\Run: => "SDP" HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\StartupApproved\Run: => "PC Suite Tray" ==================== Accounts: ============================= Administrator (S-1-5-21-1030316957-1957585848-888588088-500 - Administrator - Disabled) Daniel (S-1-5-21-1030316957-1957585848-888588088-1001 - Administrator - Enabled) => C:\Users\Daniel Gast (S-1-5-21-1030316957-1957585848-888588088-501 - Limited - Disabled) HomeGroupUser$ (S-1-5-21-1030316957-1957585848-888588088-1006 - Limited - Enabled) UpdatusUser (S-1-5-21-1030316957-1957585848-888588088-1004 - Limited - Enabled) => C:\Users\UpdatusUser ==================== Faulty Device Manager Devices ============= Name: Description: Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. ==================== Event log errors: ========================= Application errors: ================== Error: (02/16/2015 05:18:18 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1". Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error: (02/16/2015 05:18:13 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1". Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error: (02/16/2015 05:16:08 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1". Die abhängige Assemblierung "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". System errors: ============= Error: (02/16/2015 05:07:14 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: %%1069 Error: (02/16/2015 05:07:14 PM) (Source: Service Control Manager) (EventID: 7038) (User: ) Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%1326 Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC). Error: (02/16/2015 05:04:29 PM) (Source: Microsoft-Windows-Kernel-Processor-Power) (EventID: 6) (User: NT-AUTORITÄT) Description: Einige Features zur Energieverwaltung im Leistungsstatus wurden im Prozessor aufgrund eines bekannten Firmwareproblems deaktiviert. Wenden Sie sich an den Computerhersteller, um aktualisierte Firmware zu erhalten. Error: (02/11/2015 09:15:39 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: %%1069 Error: (02/11/2015 09:15:39 PM) (Source: Service Control Manager) (EventID: 7038) (User: ) Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%1326 Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC). Error: (02/11/2015 09:13:09 PM) (Source: Microsoft-Windows-Kernel-Processor-Power) (EventID: 6) (User: NT-AUTORITÄT) Description: Einige Features zur Energieverwaltung im Leistungsstatus wurden im Prozessor aufgrund eines bekannten Firmwareproblems deaktiviert. Wenden Sie sich an den Computerhersteller, um aktualisierte Firmware zu erhalten. Error: (02/11/2015 08:57:57 PM) (Source: DCOM) (EventID: 10010) (User: DANIEL) Description: {9E6E74C7-0E85-4D14-8851-7635E2C1C528} Error: (02/11/2015 08:57:26 PM) (Source: DCOM) (EventID: 10010) (User: DANIEL) Description: {9E6E74C7-0E85-4D14-8851-7635E2C1C528} Error: (02/11/2015 08:56:56 PM) (Source: DCOM) (EventID: 10010) (User: DANIEL) Description: {9E6E74C7-0E85-4D14-8851-7635E2C1C528} Error: (02/11/2015 08:56:26 PM) (Source: DCOM) (EventID: 10010) (User: DANIEL) Description: {9E6E74C7-0E85-4D14-8851-7635E2C1C528} Microsoft Office Sessions: ========================= Error: (02/16/2015 05:18:18 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\totalcmd\TCUNIN64.EXE Error: (02/16/2015 05:18:13 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"C:\Program Files\HP\HP Officejet Pro 8610\DriverStore\Yeti\V3\amd64\hpinkins7112.exe Error: (02/16/2015 05:16:08 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{6FCD4D5A-20B9-4D79-ABA5-4E7048944025}\recordingmanager.exe ==================== Memory info =========================== Processor: Pentium(R) Dual-Core CPU E5200 @ 2.50GHz Percentage of memory in use: 41% Total physical RAM: 3071.24 MB Available physical RAM: 1803.39 MB Total Pagefile: 3583.24 MB Available Pagefile: 2139.23 MB Total Virtual: 2047.88 MB Available Virtual: 1906.86 MB ==================== Drives ================================ Drive c: (Daniel) (Fixed) (Total:232.88 GB) (Free:120.5 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Drive d: (Volume) (Fixed) (Total:465.76 GB) (Free:43.38 GB) NTFS Drive j: (Musik) (Fixed) (Total:232.88 GB) (Free:52.5 GB) NTFS Drive k: (Daten) (Fixed) (Total:698.64 GB) (Free:34.46 GB) NTFS Drive m: () (Removable) (Total:29.8 GB) (Free:0.96 GB) FAT32 ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 232.9 GB) (Disk ID: F132F132) Partition 1: (Active) - (Size=232.9 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (MBR Code: Windows XP) (Size: 465.8 GB) (Disk ID: FEC30F37) Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS) ======================================================== Disk: 2 (Size: 232.9 GB) (Disk ID: 09E74DEE) Partition 1: (Not Active) - (Size=232.9 GB) - (Type=07 NTFS) ======================================================== Disk: 3 (Size: 698.6 GB) (Disk ID: 465232C5) Partition 1: (Not Active) - (Size=698.6 GB) - (Type=07 NTFS) ======================================================== Disk: 8 (Size: 29.8 GB) (Disk ID: 00000000) Partition: GPT Partition Type. ==================== End Of Log ============================ adwCleaner: Code:
ATTFilter # AdwCleaner v4.110 - Bericht erstellt 11/02/2015 um 14:44:49 # Aktualisiert 05/02/2015 von Xplode # Datenbank : 2015-02-09.1 [Server] # Betriebssystem : Windows 8.1 Pro (x86) # Benutzername : Daniel - DANIEL # Gestarted von : C:\Users\Daniel\Downloads\AdwCleaner_4.110.exe # Option : Suchlauf ***** [ Dienste ] ***** ***** [ Dateien / Ordner ] ***** ***** [ Geplante Tasks ] ***** ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** ***** [ Internetbrowser ] ***** -\\ Internet Explorer v11.0.9600.17416 -\\ Google Chrome v40.0.2214.111 ************************* AdwCleaner[R0].txt - [3316 Bytes] - [11/02/2015 14:09:45] AdwCleaner[R1].txt - [1433 Bytes] - [11/02/2015 14:25:56] AdwCleaner[R2].txt - [749 Bytes] - [11/02/2015 14:44:49] AdwCleaner[S0].txt - [3249 Bytes] - [11/02/2015 14:12:57] AdwCleaner[S1].txt - [1222 Bytes] - [11/02/2015 14:40:54] ########## EOF - C:\AdwCleaner\AdwCleaner[R2].txt - [925 Bytes] ########## Junkware Removal Tool: Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.4.2 (02.02.2015:1) OS: Windows 8.1 Pro x86 Ran by Daniel on 11.02.2015 at 17:00:04,00 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys ~~~ Files Successfully deleted: [File] C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1030316957-1957585848-888588088-1001 Successfully deleted: [File] "C:\Users\Daniel\appdata\local\google\chrome\user data\default\local storage\http_www.superfish.com_0.localstorage" Successfully deleted: [File] "C:\Users\Daniel\appdata\local\google\chrome\user data\default\local storage\http_www.superfish.com_0.localstorage-journal" ~~~ Folders ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 11.02.2015 at 17:06:19,24 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
16.02.2015, 17:54 | #6 |
| Mal wieder "Positive Ads" Habe gerade gesehen, dass ich wieder nur eine Verknüpfung zu meinem Downloadordner hatte. Hier nun die vom Desktop ausgeführten Scans: FRST: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 15-02-2015 Ran by Daniel (administrator) on DANIEL on 16-02-2015 17:50:42 Running from C:\Users\Daniel\Desktop Loaded Profiles: Daniel & UpdatusUser (Available profiles: Daniel & UpdatusUser) Platform: Microsoft Windows 8.1 Pro (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: Opera) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (devolo AG) C:\Program Files\devolo\dlan\devolonetsvc.exe (Portrait Displays, Inc.) C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe (Deutsche Telekom AG) C:\Program Files\Telekom\Mediencenter\DTAG.Mediencenter.BackgroundService.exe (Deutsche Telekom AG) C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe (Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.6.0.32\nis.exe (Portrait Displays, Inc.) C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe (TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Google Inc.) C:\Program Files\Google\Update\1.3.26.9\GoogleCrashHandler.exe (Nero AG) C:\Program Files\Nero\Update\NASvc.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe (Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.6.0.32\nis.exe (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Portrait Displays, Inc) C:\Program Files\Acer Display\eDisplay Management\dthtml.exe () C:\Users\Daniel\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8610\Bin\ScanToPCActivationApp.exe () C:\Program Files\Portrait Displays\Pivot Pro Plugin\wpCtrl.exe () C:\Users\Daniel\AppData\Local\Amazon Music\Amazon Music Helper.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\AppleIEDAV.exe () C:\Program Files\Portrait Displays\Pivot Pro Plugin\Floater.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\iCloudDrive.exe (Portrait Displays Inc.) C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreamsDownloader.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe (Microsoft Corporation) C:\Windows\System32\RuntimeBroker.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [6609440 2008-10-31] (Realtek Semiconductor) HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2008-10-31] (Realtek Semiconductor Corp.) HKLM\...\Run: [PivotSoftware] => C:\Program Files\Portrait Displays\Pivot Pro Plugin\Pivot_startup.exe [110192 2010-05-13] () HKLM\...\Run: [DT ACR] => C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe [121648 2012-04-13] (Portrait Displays, Inc.) HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.) HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.) HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard) HKLM\...\Run: [] => [X] HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Run: [AmazonMP3DownloaderHelper] => C:\Users\Daniel\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [400704 2013-05-22] () HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Run: [iCloudServices] => C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-10-17] (Apple Inc.) HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Run: [ApplePhotoStreams] => C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2014-11-21] (Apple Inc.) HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Run: [HP Officejet Pro 8610 (NET)] => C:\Program Files\HP\HP Officejet Pro 8610\Bin\ScanToPCActivationApp.exe [2427400 2014-03-06] (Hewlett-Packard Co.) HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Run: [Amazon Music] => C:\Users\Daniel\AppData\Local\Amazon Music\Amazon Music Helper.exe [6277952 2014-11-19] () HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Run: [AppleIEDAV] => C:\Program Files\Common Files\Apple\Internet Services\AppleIEDAV.exe [1080104 2014-08-04] (Apple Inc.) HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Run: [iCloudDrive] => C:\Program Files\Common Files\Apple\Internet Services\iCloudDrive.exe [43816 2014-10-20] (Apple Inc.) HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Policies\Explorer: [NoSaveSettings] 0 HKU\S-1-5-21-1030316957-1957585848-888588088-1004\...\Run: [Google Update] => "C:\Users\Daniel\AppData\Local\Google\Update\GoogleUpdate.exe" /c HKU\S-1-5-21-1030316957-1957585848-888588088-1004\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [515584 2013-08-22] (Microsoft Corporation) ShellIconOverlayIdentifiers: [01Mediencenter_InSync] -> {77BC4082-DB5F-439A-8DC8-F9E24A63B0DE} => C:\Users\Daniel\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG) ShellIconOverlayIdentifiers: [02Mediencenter_ToSync] -> {528EE335-5034-4EFC-834E-63E5F02D2BC2} => C:\Users\Daniel\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG) ShellIconOverlayIdentifiers: [03Mediencenter_Failed] -> {6066ADF0-9EB0-43E5-ADB6-990F5A3B979C} => C:\Users\Daniel\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG) BootExecute: autocheck autochk /m /P \Device\HarddiskVolume4autocheck autochk * ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-1030316957-1957585848-888588088-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/ HKU\S-1-5-21-1030316957-1957585848-888588088-1004\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.startfenster.com HKU\S-1-5-21-1030316957-1957585848-888588088-1004\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/ SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader) BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files\Norton Internet Security\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation) BHO: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files\Norton Internet Security\Engine\21.6.0.32\IPS\IPSBHO.DLL (Symantec Corporation) BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation) Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1 FireFox: ======== FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF Plugin: @java.com/DTPlugin,version=10.17.2 -> C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.17.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin: @real.com/nppl3260;version=17.0.15.10 -> c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF Plugin: @real.com/nprndlhtml5videoshim;version=17.0.15 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.) FF Plugin: @real.com/nprpplugin;version=17.0.15.10 -> c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer Cloud) FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-1030316957-1957585848-888588088-1001: amazon.com/AmazonMP3DownloaderPlugin -> C:\Users\Daniel\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.) FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.0.2.1\coFFPlgn FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.0.2.1\coFFPlgn [2015-02-16] FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2014-11-16] FF HKLM\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.0.2.1\IPSFF FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.0.2.1\IPSFF [2013-10-09] FF HKLM\...\Firefox\Extensions: [{338950EA-82DB-44C1-930D-0C28E023C9F0}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext Chrome: ======= CHR HomePage: Default -> hxxp://www.google.de/ CHR StartupUrls: Default -> "hxxp://www.google.de/" CHR Profile: C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Docs) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-10-27] CHR Extension: (Google Drive) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2012-11-27] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-11] CHR Extension: (YouTube) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-11-27] CHR Extension: (Google-Suche) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-11-27] CHR Extension: (Norton Identity Safe) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdalibjnif [2014-09-11] CHR Extension: (Google Wallet) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-27] CHR Extension: (Google Mail) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-11-27] CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No Path CHR HKLM\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files\Norton Internet Security\Engine\21.6.0.32\Exts\Chrome.crx [2014-10-05] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 DevoloNetworkService; C:\Program Files\devolo\dlan\devolonetsvc.exe [3647992 2014-05-14] (devolo AG) R2 DTSRVC; C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe [138032 2012-04-13] (Portrait Displays, Inc.) R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) R2 MCSWASVR; C:\Program Files\Telekom\Mediencenter\DTAG.Mediencenter.BackgroundService.exe [12800 2012-08-13] (Deutsche Telekom AG) [File not signed] R2 NAUpdate; C:\Program Files\Nero\Update\NASvc.exe [786256 2014-07-15] (Nero AG) R2 Netzmanager Service; C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe [2635776 2012-07-20] (Deutsche Telekom AG) [File not signed] R2 NIS; C:\Program Files\Norton Internet Security\Engine\21.6.0.32\NIS.exe [276376 2014-09-21] (Symantec Corporation) R2 PdiService; C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe [113456 2012-04-13] (Portrait Displays, Inc.) S3 ScDeviceEnum; C:\WINDOWS\System32\ScDeviceEnum.dll [105472 2013-08-22] (Microsoft Corporation) R2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [770944 2015-02-11] (Enigma Software Group USA, LLC.) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [288128 2014-09-22] (Microsoft Corporation) S3 WEPHOSTSVC; C:\WINDOWS\system32\wephostsvc.dll [20992 2013-08-22] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [22192 2014-09-22] (Microsoft Corporation) S3 workfolderssvc; C:\WINDOWS\system32\workfolderssvc.dll [1222144 2014-07-24] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R3 AnyDVD; C:\WINDOWS\System32\Drivers\AnyDVD.sys [124504 2013-03-18] (SlySoft, Inc.) R1 BasicRender; C:\WINDOWS\System32\drivers\BasicRender.sys [25600 2014-02-22] (Microsoft Corporation) R1 BHDrvx86; C:\Program Files\Norton Internet Security\NortonData\21.0.2.1\Definitions\BASHDefs\20150203.001\BHDrvx86.sys [1164504 2015-02-03] (Symantec Corporation) R1 ccSet_NIS; C:\WINDOWS\system32\drivers\NIS\1506000.020\ccSetx86.sys [127064 2013-09-26] (Symantec Corporation) R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [378672 2014-12-12] (Symantec Corporation) R1 ElbyCDIO; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [30616 2013-03-04] (Elaborate Bytes AG) R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [111408 2014-12-12] (Symantec Corporation) S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [16432 2015-02-11] (Enigma Software Group USA, LLC.) S3 EsgScanner; C:\WINDOWS\System32\DRIVERS\EsgScanner.sys [19984 2015-02-11] () S3 GPIO; C:\WINDOWS\System32\drivers\iaiogpio.sys [22016 2013-07-23] (Intel Corporation) R1 IDSVix86; C:\Program Files\Norton Internet Security\NortonData\21.0.2.1\Definitions\IPSDefs\20150213.001\IDSvix86.sys [503512 2015-02-07] (Symantec Corporation) R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [23256 2014-11-21] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [114904 2015-02-16] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [51928 2014-11-21] (Malwarebytes Corporation) R3 NAVENG; C:\Program Files\Norton Internet Security\NortonData\21.0.2.1\Definitions\VirusDefs\20150215.024\NAVENG.SYS [95704 2015-01-24] (Symantec Corporation) R3 NAVEX15; C:\Program Files\Norton Internet Security\NortonData\21.0.2.1\Definitions\VirusDefs\20150215.024\NAVEX15.SYS [1636696 2015-01-24] (Symantec Corporation) R2 NPF_devolo; C:\WINDOWS\system32\drivers\npf_devolo.sys [35840 2014-05-14] (CACE Technologies) [File not signed] R3 PdiPorts; C:\WINDOWS\System32\Drivers\PdiPorts.sys [17328 2012-04-13] (Portrait Displays, Inc.) R3 SRTSP; C:\WINDOWS\System32\Drivers\NIS\1506000.020\SRTSP.SYS [664792 2014-08-26] (Symantec Corporation) R1 SRTSPX; C:\WINDOWS\system32\drivers\NIS\1506000.020\SRTSPX.SYS [32984 2014-08-26] (Symantec Corporation) R0 SymDS; C:\WINDOWS\System32\drivers\NIS\1506000.020\SYMDS.SYS [367704 2013-08-01] (Symantec Corporation) R0 SymEFA; C:\WINDOWS\System32\drivers\NIS\1506000.020\SYMEFA.SYS [936152 2014-03-04] (Symantec Corporation) S0 SymELAM; C:\WINDOWS\System32\drivers\NIS\1506000.020\SYMELAM.SYS [21520 2013-08-01] (Symantec Corporation) R3 SymEvent; C:\WINDOWS\system32\Drivers\SYMEVENT.SYS [142936 2013-09-24] (Symantec Corporation) R1 SymIRON; C:\WINDOWS\system32\drivers\NIS\1506000.020\Ironx86.SYS [209624 2014-08-06] (Symantec Corporation) R1 SymNetS; C:\WINDOWS\System32\Drivers\NIS\1506000.020\SYMNETS.SYS [447704 2014-02-18] (Symantec Corporation) S3 TelekomNM3; C:\Program Files\Netzmanager\NMInfraIS2\Driver\TelekomNM3.sys [35040 2010-09-16] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [84800 2014-09-22] (Microsoft Corporation) R0 Wof; C:\WINDOWS\system32\Drivers\Wof.sys [138584 2014-03-13] (Microsoft Corporation) R3 WUDFSensorLP; C:\WINDOWS\System32\drivers\WUDFRd.sys [188416 2014-05-31] (Microsoft Corporation) R3 WUDFWpdMtp; C:\WINDOWS\system32\DRIVERS\WUDFRd.sys [188416 2014-05-31] (Microsoft Corporation) S3 pccsmcfd; \SystemRoot\system32\DRIVERS\pccsmcfd.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-16 17:50 - 2015-02-16 17:51 - 00020907 _____ () C:\Users\Daniel\Desktop\FRST.txt 2015-02-16 17:42 - 2015-02-16 17:42 - 00027180 _____ () C:\Users\Daniel\Downloads\Addition.txt 2015-02-16 17:41 - 2015-02-16 17:42 - 00032241 _____ () C:\Users\Daniel\Downloads\FRST.txt 2015-02-16 17:39 - 2015-02-16 17:39 - 01125888 _____ (Farbar) C:\Users\Daniel\Desktop\FRST.exe 2015-02-11 17:50 - 2015-02-11 17:51 - 00021199 _____ () C:\Addition.txt 2015-02-11 17:48 - 2015-02-16 17:50 - 00000000 ____D () C:\FRST 2015-02-11 17:48 - 2015-02-11 17:51 - 00031649 _____ () C:\FRST.txt 2015-02-11 17:47 - 2015-02-11 17:47 - 01124864 _____ (Farbar) C:\FRST.exe 2015-02-11 17:39 - 2015-02-11 17:39 - 01124864 _____ (Farbar) C:\Users\Daniel\Downloads\FRST.exe 2015-02-11 17:24 - 2015-02-11 17:24 - 00002360 _____ () C:\Malware.txt 2015-02-11 17:06 - 2015-02-11 17:06 - 00001055 _____ () C:\Users\Daniel\Desktop\JRT.txt 2015-02-11 16:47 - 2015-02-11 16:47 - 02347384 _____ (ESET) C:\Users\Daniel\Downloads\esetsmartinstaller_deu.exe 2015-02-11 14:09 - 2015-02-11 14:46 - 00000000 ____D () C:\AdwCleaner 2015-02-11 13:55 - 2015-02-11 14:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup_disabledByAcp 2015-02-11 13:47 - 2015-02-11 13:47 - 00001217 _____ () C:\Users\Public\Desktop\RegHunter.lnk 2015-02-11 13:47 - 2015-02-11 13:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RegHunter 2015-02-11 13:46 - 2015-02-11 13:46 - 00000000 ____D () C:\Program Files\Common Files\Wise Installation Wizard 2015-02-11 13:29 - 2015-02-11 13:29 - 00000000 __SHD () C:\Users\Daniel\AppData\Local\EmieBrowserModeList 2015-02-11 10:55 - 2015-02-11 10:55 - 01388274 _____ (Thisisu) C:\Users\Daniel\Downloads\JRT.exe 2015-02-11 10:53 - 2015-02-11 10:54 - 02112512 _____ () C:\Users\Daniel\Downloads\AdwCleaner_4.110.exe 2015-02-11 10:53 - 2015-02-11 10:53 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\Enigma Software Group 2015-02-11 10:52 - 2015-02-11 10:52 - 00001294 _____ () C:\Users\Daniel\Desktop\SpyHunter.lnk 2015-02-11 10:52 - 2015-02-11 10:52 - 00000000 ____D () C:\sh4ldr 2015-02-11 10:50 - 2015-02-11 13:47 - 00000000 ____D () C:\Program Files\Enigma Software Group 2015-02-11 10:50 - 2015-02-11 10:50 - 00019984 _____ () C:\WINDOWS\system32\Drivers\EsgScanner.sys 2015-02-11 10:49 - 2015-02-11 10:49 - 03044736 _____ (Enigma Software Group USA, LLC.) C:\Users\Daniel\Downloads\SpyHunter-Installer.exe 2015-02-11 10:40 - 2015-02-16 17:33 - 00114904 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2015-02-11 10:40 - 2015-02-11 15:42 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2015-02-11 10:40 - 2015-02-11 10:40 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-02-11 10:40 - 2015-02-11 10:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-02-11 10:40 - 2015-02-11 10:40 - 00000000 ____D () C:\ProgramData\Malwarebytes 2015-02-11 10:40 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys 2015-02-11 10:40 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys 2015-02-11 10:40 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys 2015-02-11 10:38 - 2015-02-11 10:39 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Daniel\Downloads\mbam-setup-2.0.4.1028.exe 2015-02-10 13:38 - 2015-02-10 13:38 - 00002214 _____ () C:\Users\Public\Desktop\tax 2015.lnk 2015-02-10 13:38 - 2015-02-10 13:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\tax 2015 2015-01-18 10:07 - 2014-12-19 06:46 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys 2015-01-18 10:07 - 2014-12-12 02:34 - 00074240 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWbPrxy.exe 2015-01-18 10:07 - 2014-12-12 01:46 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys 2015-01-18 10:07 - 2014-12-09 04:42 - 00187904 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll 2015-01-18 10:07 - 2014-12-08 20:46 - 00485544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll 2015-01-18 10:07 - 2014-12-08 20:46 - 00108944 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll 2015-01-18 10:07 - 2014-12-08 20:42 - 00448792 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll 2015-01-18 10:07 - 2014-12-08 20:42 - 00372408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll 2015-01-18 10:07 - 2014-12-08 20:42 - 00033584 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe 2015-01-18 10:07 - 2014-12-06 03:36 - 00273408 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll 2015-01-18 10:07 - 2014-12-06 02:28 - 00314880 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll 2015-01-18 10:07 - 2014-12-06 02:23 - 00194048 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll 2015-01-18 10:07 - 2014-10-29 04:12 - 00413136 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe 2015-01-18 10:07 - 2014-10-29 04:12 - 00136296 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe 2015-01-18 10:07 - 2014-10-29 04:07 - 00424544 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll 2015-01-18 10:07 - 2014-10-29 04:07 - 00370424 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll 2015-01-18 10:07 - 2014-10-29 04:07 - 00344536 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll 2015-01-18 10:07 - 2014-10-29 04:07 - 00213336 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe 2015-01-18 10:07 - 2014-10-29 02:59 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll 2015-01-18 10:07 - 2014-10-29 02:01 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll 2015-01-18 10:07 - 2014-10-29 01:49 - 00694272 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-16 17:39 - 2013-09-30 05:08 - 01785518 _____ () C:\WINDOWS\system32\PerfStringBackup.INI 2015-02-16 17:38 - 2013-10-21 19:29 - 00000000 ___DO () C:\Users\Daniel\SkyDrive 2015-02-16 17:38 - 2012-11-27 14:59 - 00000000 ____D () C:\Program Files\JDownloader 2015-02-16 17:36 - 2015-01-09 21:24 - 00000000 ___RD () C:\Users\Daniel\iCloudDrive 2015-02-16 17:34 - 2012-12-19 13:55 - 00001116 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job 2015-02-16 17:18 - 2012-12-19 13:55 - 00001120 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job 2015-02-16 17:17 - 2013-08-22 09:17 - 00000000 ____D () C:\WINDOWS\Microsoft.NET 2015-02-16 17:05 - 2013-08-22 07:13 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM 2015-02-16 17:04 - 2013-08-22 08:23 - 00393435 _____ () C:\WINDOWS\setupact.log 2015-02-16 17:04 - 2013-08-22 08:23 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT 2015-02-11 22:00 - 2013-08-22 09:17 - 00000000 ____D () C:\WINDOWS\system32\sru 2015-02-11 20:52 - 2015-01-09 21:26 - 00000000 ____D () C:\Users\Daniel\AppData\Local\2EF11234-024A-4F20-928E-971B64C955C4.aplzod 2015-02-11 14:44 - 2012-12-31 09:34 - 00000125 ___SH () C:\ProgramData\.zreglib 2015-02-11 14:42 - 2013-09-29 19:54 - 00054932 _____ () C:\WINDOWS\PFRO.log 2015-02-11 13:58 - 2013-08-22 07:13 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI 2015-02-11 11:10 - 2013-08-22 09:17 - 00000000 ____D () C:\WINDOWS\Vss 2015-02-11 11:07 - 2013-10-21 18:43 - 01929770 _____ () C:\WINDOWS\WindowsUpdate.log 2015-02-11 10:52 - 2013-10-21 18:24 - 00000000 ____D () C:\Users\Daniel 2015-02-10 13:44 - 2013-02-03 19:38 - 00000000 ____D () C:\Users\Daniel\Documents\tax 2015-02-10 13:44 - 2013-02-03 19:31 - 00000724 _____ () C:\WINDOWS\wiso.ini 2015-02-10 13:38 - 2013-02-03 19:31 - 00000000 ____D () C:\Users\Daniel\AppData\Local\Buhl 2015-02-10 13:34 - 2013-02-03 17:22 - 00000000 ____D () C:\Program Files\Buhl finance 2015-02-10 13:34 - 2012-12-26 10:38 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information 2015-02-10 08:31 - 2013-08-22 09:17 - 00000000 ____D () C:\WINDOWS\AppReadiness 2015-02-09 11:14 - 2012-11-27 16:47 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\vlc 2015-02-09 10:18 - 2013-09-05 06:35 - 00000000 ____D () C:\WINDOWS\system32\MRT 2015-02-09 10:03 - 2012-12-14 21:17 - 110348472 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2015-02-07 18:33 - 2013-10-27 09:16 - 00002179 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2015-02-07 18:09 - 2012-07-26 07:43 - 00000000 ____D () C:\WINDOWS\CbsTemp 2015-02-03 20:31 - 2014-08-16 20:49 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe 2015-02-03 20:31 - 2014-08-16 20:49 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl 2015-01-25 13:58 - 2014-12-06 09:38 - 00000000 ____D () C:\ProgramData\Netzmanager 2015-01-24 21:53 - 2013-07-01 21:18 - 01010176 ___SH () C:\Users\Daniel\Documents\Thumbs.db ==================== Files in the root of some directories ======= 2012-12-07 20:16 - 2014-12-21 20:16 - 0078336 _____ () C:\Users\Daniel\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2013-01-22 09:14 - 2013-04-28 19:03 - 0000021 _____ () C:\Users\Daniel\AppData\Local\mc.pixel.data 2012-12-31 09:34 - 2015-02-11 14:44 - 0000125 ___SH () C:\ProgramData\.zreglib 2012-11-27 20:15 - 2012-11-27 20:15 - 0000057 _____ () C:\ProgramData\Ament.ini Files to move or delete: ==================== C:\Users\Daniel\CDmage.exe Some content of TEMP: ==================== C:\Users\Daniel\AppData\Local\Temp\amazonicon_v10.exe C:\Users\Daniel\AppData\Local\Temp\amazoninstallernircmdc.exe C:\Users\Daniel\AppData\Local\Temp\DseShExt-x86.dll C:\Users\Daniel\AppData\Local\Temp\isotousb_setup.exe C:\Users\Daniel\AppData\Local\Temp\Mediencenter_3.9.1055.64.exe C:\Users\Daniel\AppData\Local\Temp\RHSetup.exe C:\Users\Daniel\AppData\Local\Temp\sdan.exe C:\Users\Daniel\AppData\Local\Temp\sdapk.exe C:\Users\Daniel\AppData\Local\Temp\sdaspwn.exe C:\Users\Daniel\AppData\Local\Temp\SDShelEx-win32.dll C:\Users\Daniel\AppData\Local\Temp\stubhelper.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\WINDOWS\explorer.exe => File is digitally signed C:\WINDOWS\system32\winlogon.exe => File is digitally signed C:\WINDOWS\system32\wininit.exe => File is digitally signed C:\WINDOWS\system32\svchost.exe => File is digitally signed C:\WINDOWS\system32\services.exe => File is digitally signed C:\WINDOWS\system32\User32.dll => File is digitally signed C:\WINDOWS\system32\userinit.exe => File is digitally signed C:\WINDOWS\system32\rpcss.dll => File is digitally signed C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-02-16 17:15 ==================== End Of Log ============================ Additional: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 15-02-2015 Ran by Daniel at 2015-02-16 17:51:23 Running from C:\Users\Daniel\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AV: Norton Internet Security (Disabled - Up to date) {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB} AS: Norton Internet Security (Enabled - Up to date) {631E4324-D31C-783F-EC5C-35AD42B18466} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FW: Norton Internet Security (Enabled) {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Acer eDisplay Management (HKLM\...\{A586DC50-B18D-48FB-B7CC-A598200457C2}) (Version: 1.37.007 - Portrait Displays, Inc.) Adobe AIR (HKLM\...\Adobe AIR) (Version: 3.9.0.1030 - Adobe Systems Incorporated) Adobe Reader XI (11.0.10) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated) Amazon MP3-Downloader 1.0.18 (HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Amazon MP3-Downloader) (Version: 1.0.18 - Amazon Services LLC) Amazon Music (HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Amazon Amazon Music) (Version: 3.7.0.693 - Amazon Services LLC) Amazon Music Importer (HKLM\...\com.amazon.music.uploader) (Version: 2.1.0 - Amazon Services LLC) Amazon Music Importer (Version: 2.1.0 - Amazon Services LLC) Hidden Any Video Converter 5.7.7 (HKLM\...\Any Video Converter_is1) (Version: - Any-Video-Converter.com) AnyDVD (HKLM\...\AnyDVD) (Version: 7.1.7.0 - SlySoft) Apple Application Support (HKLM\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{235EBB33-3DA1-46DF-AADE-9955123409CB}) (Version: 8.0.5.6 - Apple Inc.) Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) AusweisApp (HKLM\...\{6E2E92F9-A81B-426F-8F35-4F3718A7D0AF}) (Version: 1.11.0 - OpenLimit SignCubes AG) Avidemux 2.6 (32-bit) (HKLM\...\Avidemux 2.6) (Version: 2.6.6.8941 - ) Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.) CDex - Open Source Digital Audio CD Extractor (HKLM\...\CDex) (Version: 1.76.0.2015 - Georgy Berdyshev) devolo Cockpit (HKLM\...\dlancockpit) (Version: 4.2.2.0 - devolo AG) DHTML Editing Component (HKLM\...\{2EA870FA-585F-4187-903D-CB9FFD21E2E0}) (Version: 6.02.0001 - Microsoft Corporation) DVD Flick 1.3.0.7 (HKLM\...\DVD Flick_is1) (Version: 1.3.0.7 - Dennis Meuwissen) DVD Shrink 3.2 (Version: - DVD Shrink) Hidden Google Chrome (HKLM\...\Google Chrome) (Version: 40.0.2214.111 - Google Inc.) Google Chrome (HKU\S-1-5-21-1030316957-1957585848-888588088-1004\...\Google Chrome) (Version: 23.0.1271.97 - Google Inc.) Google Earth Plug-in (HKLM\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google) Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden Google+ Auto Backup (HKLM\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google) HP Officejet Pro 8610 - Grundlegende Software für das Gerät (HKLM\...\{4A990817-F950-4770-AC83-7CC57EA18F65}) (Version: 32.2.188.47710 - Hewlett-Packard Co.) HP Officejet Pro 8610 Hilfe (HKLM\...\{2466D8D5-4856-4492-BDEF-48A640F58866}) (Version: 32.0.0 - Hewlett Packard) HP Update (HKLM\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard) HPDiagnosticAlert (Version: 1.00.0000 - Microsoft) Hidden I.R.I.S. OCR (HKLM\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP) iCloud (HKLM\...\{760BB327-3973-4608-85C8-88162E2FF3B6}) (Version: 4.0.6.28 - Apple Inc.) iTunes (HKLM\...\{5D928931-D1D2-4A93-A82D-BF60D0E7CFA5}) (Version: 12.0.1.26 - Apple Inc.) Java 7 Update 17 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217017FF}) (Version: 7.0.170 - Oracle) JDownloader 0.9 (HKLM\...\5513-1208-7298-9440) (Version: 0.9 - AppWork GmbH) Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation) Mediencenter 3.9.1055.64 (HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Mediencenter) (Version: 3.9.1055.64 - Deutsche Telekom AG) Mediencenter Assistent (HKLM\...\Mediencenter Software) (Version: 2.7.0.1451 - Telekom) Medieval CUE Splitter (HKLM\...\{B96D2269-568B-4CBF-9332-12FAE8B158F7}) (Version: 1.2.0 - Medieval Software) Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation) Microsoft WSE 3.0 Runtime (HKLM\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.) MP3-Tag-Editor 3.14.0 (HKLM\...\{DB363BBA-6375-4306-85F9-528CD666FC30}) (Version: 3.14.0 - Gisbert Müller) MSVC80_x86_v2 (Version: 1.0.3.0 - Nokia) Hidden MSVC90_x86 (Version: 1.0.1.2 - Nokia) Hidden Music Wizard Professional 8.0.9 (HKLM\...\MUSICWIZARD_is1) (Version: - Stefan Hollesch) Nero BurningROM 12 (HKLM\...\{3D9167B2-87EB-4713-90B4-E46F2CAFE28D}) (Version: 12.0.00300 - Nero AG) Nero CoverDesigner (HKLM\...\{F1676432-361C-44EE-9596-24C1BB5608B8}) (Version: 12.0.00900 - Nero AG) Nero Prerequisite Installer 2.0 (HKLM\...\{F4C242B4-2973-43F3-93F2-ED1B47AE8848}) (Version: 12.0.02000 - Nero AG) Netzmanager (HKLM\...\Netzmanager) (Version: 1.081 - Deutsche Telekom AG) Netzmanager (Version: 1.081 - Deutsche Telekom AG, Marmiko IT-Solutions GmbH) Hidden Norton Internet Security (HKLM\...\NIS) (Version: 21.6.0.32 - Symantec Corporation) NVIDIA Grafiktreiber 307.68 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 307.68 - NVIDIA Corporation) NVIDIA Update 1.10.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.10.8 - NVIDIA Corporation) Picasa 3 (HKLM\...\Picasa 3) (Version: 3.9 - Google, Inc.) Pivot Pro Plugin (Version: 9.50.110 - Portrait Displays, Inc.) Hidden Prerequisite installer (Version: 12.0.0008 - Nero AG) Hidden Ravensburger tiptoi (HKLM\...\Ravensburger tiptoi) (Version: - ) RealDownloader (Version: 17.0.15.4 - RealNetworks, Inc.) Hidden RealDownloader (Version: 17.0.15.7 - RealNetworks) Hidden RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0 - RealNetworks, Inc) Hidden RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0 - RealNetworks, Inc) Hidden Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: - Realtek Semiconductor Corp.) RealUpgrade 1.1 (Version: 1.1.0 - RealNetworks, Inc.) Hidden RegHunter (HKLM\...\{A16BBEAB-AAEF-434A-BFDD-297708709FCC}) (Version: 1.3.3.1613 - Enigma Software Group USA, LLC) SDK (Version: 2.32.010 - Portrait Displays, Inc.) Hidden Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft) SpyHunter 4 (HKLM\...\SpyHunter) (Version: 4.18.9.4384 - Enigma Software Group, LLC) Studie zur Verbesserung von HP Officejet Pro 8610 (HKLM\...\{8E4E3EA0-9332-47B7-98D4-3DC850317C81}) (Version: 32.2.188.47710 - Hewlett-Packard Co.) tax 2015 (HKLM\...\{4CF96070-DEE5-43B5-B6A7-23AC07BC0C77}) (Version: 22.00.8811 - Buhl Data Service GmbH) TeamViewer 9 (HKLM\...\TeamViewer 9) (Version: 9.0.28223 - TeamViewer) Total Commander (Remove or Repair) (HKLM\...\Totalcmd) (Version: 8.01 - Ghisler Software GmbH) Turbo Lister 2 (HKLM\...\{8927E07C-97F7-4A54-88FB-D976F50DD46E}) (Version: 2.00.0000 - eBay Inc.) UpdateService (Version: 1.0.0 - RealNetworks, Inc.) Hidden UseNeXT by Tangysoft (HKLM\...\UseNeXT by Tangysoft_is1) (Version: - Tangysoft Ltd.) Video Downloader (Version: 1.0.0 - RealNetworks) Hidden VLC media player 2.0.5 (HKLM\...\VLC media player) (Version: 2.0.5 - VideoLAN) Winamp (HKLM\...\Winamp) (Version: 5.63 - Nullsoft, Inc) Winamp Erkennungs-Plug-in (HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc) Winamp Erkennungs-Plug-in (HKU\S-1-5-21-1030316957-1957585848-888588088-1004\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc) WinRAR 4.20 (32-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH) Zahlenzauber 1 (HKLM\...\Zahlenzauber 1_is1) (Version: - Oldenbourg Verlag) Zahlenzauber 2 (HKLM\...\Zahlenzauber 2_is1) (Version: - Oldenbourg Verlag) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) CustomCLSID: HKU\S-1-5-21-1030316957-1957585848-888588088-1001_Classes\CLSID\{268502F4-815D-4358-A8D6-B783FDB58EF0}\InprocServer32 -> C:\Users\Daniel\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.ContextMenuHandler.dll (Deutsche Telekom AG) CustomCLSID: HKU\S-1-5-21-1030316957-1957585848-888588088-1001_Classes\CLSID\{34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE}\InprocServer32 -> C:\Users\Daniel\AppData\Local\Microsoft\Internet Explorer\Downloaded Program Files\JordanApplet.dll (IPLabs GmbH) CustomCLSID: HKU\S-1-5-21-1030316957-1957585848-888588088-1001_Classes\CLSID\{3f04dadf-6ea4-44d1-a507-03cad176f443}\InprocServer32 -> C:\Users\Daniel\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.) CustomCLSID: HKU\S-1-5-21-1030316957-1957585848-888588088-1001_Classes\CLSID\{528EE335-5034-4EFC-834E-63E5F02D2BC2}\InprocServer32 -> C:\Users\Daniel\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG) CustomCLSID: HKU\S-1-5-21-1030316957-1957585848-888588088-1001_Classes\CLSID\{6066ADF0-9EB0-43E5-ADB6-990F5A3B979C}\InprocServer32 -> C:\Users\Daniel\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG) CustomCLSID: HKU\S-1-5-21-1030316957-1957585848-888588088-1001_Classes\CLSID\{77BC4082-DB5F-439A-8DC8-F9E24A63B0DE}\InprocServer32 -> C:\Users\Daniel\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG) ==================== Restore Points ========================= 25-01-2015 11:46:43 Windows Update 07-02-2015 17:42:33 Windows Update 10-02-2015 13:33:55 Installiert tax 2015 11-02-2015 13:46:30 Installed RegHunter ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2013-08-22 07:13 - 2013-08-22 07:13 - 00000824 ____N C:\WINDOWS\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {15B96CC9-1C62-4640-B718-AF0AE6D2AF60} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1030316957-1957585848-888588088-1001 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2014-10-30] (RealNetworks, Inc.) Task: {267EC242-A09F-4B76-8B2B-B2968BFEABD6} - System32\Tasks\RealDownloader Update Check => C:\Program Files\RealNetworks\RealDownloader\downloader2.exe [2014-10-29] () Task: {316304DE-C98B-4C2F-8168-42CCC03D6FA1} - System32\Tasks\HPCustParticipation HP Officejet Pro 8610 => C:\Program Files\HP\HP Officejet Pro 8610\Bin\HPCustPartic.exe [2014-03-06] (Hewlett-Packard Co.) Task: {382B533B-988A-4AAD-956E-E38B2E96AB21} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-12-19] (Google Inc.) Task: {400793B0-F552-4268-BA24-7F9FF4F7A390} - \Optimize Start Menu Cache Files-S-1-5-21-1030316957-1957585848-888588088-1001 No Task File <==== ATTENTION Task: {4028C731-8BCB-4341-A41A-42410F75C544} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-12-19] (Google Inc.) Task: {5F10BE7B-0050-4AC9-A10F-C75C6267DEB9} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {8C8B04A5-5EA5-4A0F-B744-BE05B340DFB1} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1030316957-1957585848-888588088-1001 => C:\Program Files\RealNetworks\RealDownloader\RealUpgrade.exe [2014-10-26] (RealNetworks, Inc.) Task: {94A68A17-B81E-4436-96FC-D5568DE86A64} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1030316957-1957585848-888588088-1001 => C:\Program Files\RealNetworks\RealDownloader\RealUpgrade.exe [2014-10-26] (RealNetworks, Inc.) Task: {9D4F4624-C31D-4A74-B30A-2AB5BD71C45C} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated) Task: {A09293A2-66BD-412C-95AB-C66AB0DDC1CC} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files\Norton Internet Security\Engine\21.6.0.32\SymErr.exe [2014-01-30] (Symantec Corporation) Task: {A42035CE-FB42-43C7-A841-5C1E5CB37AEC} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1030316957-1957585848-888588088-1001 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2014-10-30] (RealNetworks, Inc.) Task: {AE38AA98-0974-41EA-B869-B26E7A10DF77} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-1030316957-1957585848-888588088-1001 => C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe [2014-10-26] (RealNetworks, Inc.) Task: {AE664ED8-DD94-4D0E-BF2F-ADEC02A08D6D} - System32\Tasks\Norton WSC Integration => C:\Program Files\Norton Internet Security\Engine\21.6.0.32\WSCStub.exe [2014-09-21] (Symantec Corporation) Task: {B843DB97-0E46-46F6-902D-A4450A3822BE} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files\Norton Internet Security\Engine\21.6.0.32\SymErr.exe [2014-01-30] (Symantec Corporation) Task: {D5EF9AD8-9EC9-475D-AEEA-760F78D5F458} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-02-09] (Microsoft Corporation) Task: {F52E58CF-D27F-4D7C-9099-0ABEFA35BC21} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated) Task: {FF65185D-7111-4387-A339-7AE1FFF311B5} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============== 2014-01-20 13:17 - 2014-01-20 13:17 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll 2014-10-11 13:05 - 2014-10-11 13:05 - 01044776 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll 2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF 2012-12-29 10:46 - 2012-04-13 12:19 - 00244528 _____ () C:\Program Files\Common Files\Portrait Displays\Shared\dthook.dll 2012-12-29 10:46 - 2012-04-13 11:56 - 00180224 _____ () C:\Program Files\Common Files\Portrait Displays\Shared\PresetsCOM.dll 2012-12-29 10:47 - 2012-04-13 12:18 - 00121648 _____ () C:\Program Files\Common Files\Portrait Displays\Plugins\CC\gui.dll 2013-05-22 19:50 - 2013-05-22 19:50 - 00400704 _____ () C:\Users\Daniel\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe 2012-12-29 10:47 - 2010-05-13 16:34 - 00674928 _____ () C:\Program Files\Portrait Displays\Pivot Pro Plugin\wpctrl.exe 2014-12-06 12:20 - 2014-11-19 01:55 - 06277952 _____ () C:\Users\Daniel\AppData\Local\Amazon Music\Amazon Music Helper.exe 2012-12-29 10:47 - 2010-05-13 16:34 - 00711792 _____ () C:\Program Files\Portrait Displays\Pivot Pro Plugin\floater.exe ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) AlternateDataStreams: C:\Users\Daniel\SkyDrive:ms-properties ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (whitelisted) =============== (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-1030316957-1957585848-888588088-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper HKU\S-1-5-21-1030316957-1957585848-888588088-1004\Control Panel\Desktop\\Wallpaper -> DNS Servers: 192.168.2.1 ==================== MSCONFIG/TASK MANAGER disabled items == (Currently there is no automatic fix for this section.) HKLM\...\StartupApproved\StartupFolder: => "PlexRadar.lnk" HKLM\...\StartupApproved\StartupFolder: => "t@x aktuell.lnk" HKLM\...\StartupApproved\Run: => "HP Software Update" HKLM\...\StartupApproved\Run: => "Adobe ARM" HKLM\...\StartupApproved\Run: => "TkBellExe" HKLM\...\StartupApproved\Run: => "iTunesHelper" HKLM\...\StartupApproved\Run: => "SunJavaUpdateSched" HKLM\...\StartupApproved\Run: => "Smart File Advisor" HKLM\...\StartupApproved\Run: => "BingDesktop" HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\StartupApproved\StartupFolder: => "PlexRadar.lnk" HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\StartupApproved\Run: => "Google Update" HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\StartupApproved\Run: => "SDP" HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\StartupApproved\Run: => "PC Suite Tray" ==================== Accounts: ============================= Administrator (S-1-5-21-1030316957-1957585848-888588088-500 - Administrator - Disabled) Daniel (S-1-5-21-1030316957-1957585848-888588088-1001 - Administrator - Enabled) => C:\Users\Daniel Gast (S-1-5-21-1030316957-1957585848-888588088-501 - Limited - Disabled) HomeGroupUser$ (S-1-5-21-1030316957-1957585848-888588088-1006 - Limited - Enabled) UpdatusUser (S-1-5-21-1030316957-1957585848-888588088-1004 - Limited - Enabled) => C:\Users\UpdatusUser ==================== Faulty Device Manager Devices ============= Name: Description: Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. ==================== Event log errors: ========================= Application errors: ================== Error: (02/16/2015 05:18:18 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1". Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error: (02/16/2015 05:18:13 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1". Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error: (02/16/2015 05:16:08 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1". Die abhängige Assemblierung "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". System errors: ============= Error: (02/16/2015 05:07:14 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: %%1069 Error: (02/16/2015 05:07:14 PM) (Source: Service Control Manager) (EventID: 7038) (User: ) Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%1326 Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC). Error: (02/16/2015 05:04:29 PM) (Source: Microsoft-Windows-Kernel-Processor-Power) (EventID: 6) (User: NT-AUTORITÄT) Description: Einige Features zur Energieverwaltung im Leistungsstatus wurden im Prozessor aufgrund eines bekannten Firmwareproblems deaktiviert. Wenden Sie sich an den Computerhersteller, um aktualisierte Firmware zu erhalten. Error: (02/11/2015 09:15:39 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: %%1069 Error: (02/11/2015 09:15:39 PM) (Source: Service Control Manager) (EventID: 7038) (User: ) Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%1326 Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC). Error: (02/11/2015 09:13:09 PM) (Source: Microsoft-Windows-Kernel-Processor-Power) (EventID: 6) (User: NT-AUTORITÄT) Description: Einige Features zur Energieverwaltung im Leistungsstatus wurden im Prozessor aufgrund eines bekannten Firmwareproblems deaktiviert. Wenden Sie sich an den Computerhersteller, um aktualisierte Firmware zu erhalten. Error: (02/11/2015 08:57:57 PM) (Source: DCOM) (EventID: 10010) (User: DANIEL) Description: {9E6E74C7-0E85-4D14-8851-7635E2C1C528} Error: (02/11/2015 08:57:26 PM) (Source: DCOM) (EventID: 10010) (User: DANIEL) Description: {9E6E74C7-0E85-4D14-8851-7635E2C1C528} Error: (02/11/2015 08:56:56 PM) (Source: DCOM) (EventID: 10010) (User: DANIEL) Description: {9E6E74C7-0E85-4D14-8851-7635E2C1C528} Error: (02/11/2015 08:56:26 PM) (Source: DCOM) (EventID: 10010) (User: DANIEL) Description: {9E6E74C7-0E85-4D14-8851-7635E2C1C528} Microsoft Office Sessions: ========================= Error: (02/16/2015 05:18:18 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\totalcmd\TCUNIN64.EXE Error: (02/16/2015 05:18:13 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"C:\Program Files\HP\HP Officejet Pro 8610\DriverStore\Yeti\V3\amd64\hpinkins7112.exe Error: (02/16/2015 05:16:08 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{6FCD4D5A-20B9-4D79-ABA5-4E7048944025}\recordingmanager.exe ==================== Memory info =========================== Processor: Pentium(R) Dual-Core CPU E5200 @ 2.50GHz Percentage of memory in use: 45% Total physical RAM: 3071.24 MB Available physical RAM: 1670.6 MB Total Pagefile: 3583.24 MB Available Pagefile: 1983.67 MB Total Virtual: 2047.88 MB Available Virtual: 1906.86 MB ==================== Drives ================================ Drive c: (Daniel) (Fixed) (Total:232.88 GB) (Free:120.49 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Drive d: (Volume) (Fixed) (Total:465.76 GB) (Free:43.38 GB) NTFS Drive j: (Musik) (Fixed) (Total:232.88 GB) (Free:52.5 GB) NTFS Drive k: (Daten) (Fixed) (Total:698.64 GB) (Free:34.46 GB) NTFS Drive m: () (Removable) (Total:29.8 GB) (Free:0.96 GB) FAT32 ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 232.9 GB) (Disk ID: F132F132) Partition 1: (Active) - (Size=232.9 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (MBR Code: Windows XP) (Size: 465.8 GB) (Disk ID: FEC30F37) Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS) ======================================================== Disk: 2 (Size: 232.9 GB) (Disk ID: 09E74DEE) Partition 1: (Not Active) - (Size=232.9 GB) - (Type=07 NTFS) ======================================================== Disk: 3 (Size: 698.6 GB) (Disk ID: 465232C5) Partition 1: (Not Active) - (Size=698.6 GB) - (Type=07 NTFS) ======================================================== Disk: 8 (Size: 29.8 GB) (Disk ID: 00000000) Partition: GPT Partition Type. ==================== End Of Log ============================ |
17.02.2015, 10:59 | #7 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Mal wieder "Positive Ads" Lade Dir bitte von hier Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
__________________ Logfiles bitte immer in CODE-Tags posten |
17.02.2015, 14:06 | #8 |
| Mal wieder "Positive Ads" Hallo, das habe ich jetzt gemacht. SpyHunter ist deinstalliert. Und wie löse ich nun das Problem mit den "Positive Finds Ads", die in Chrome aufpoppen und den Rechner ziemlich verlangsamen ? LG Daniel |
17.02.2015, 14:23 | #9 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Mal wieder "Positive Ads" Aktuelle Versionen von adwCleaner und JRT sollten diesen Dreck eigentlich erkennen...daher nochmal: Adware/Junkware/Toolbars entfernen Alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop! Virenscanner jetzt vor dem Einsatz dieser Tools bitte komplett deaktivieren! 1. Schritt: adwCleaner Downloade Dir bitte AdwCleaner auf deinen Desktop.
2. Schritt: JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
3. Schritt: Frisches Log mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ Logfiles bitte immer in CODE-Tags posten |
17.02.2015, 14:41 | #10 |
| Mal wieder "Positive Ads" Hi, das habe ich alles gemacht. Die Programme zeigen nichts an, was entfernt werden konnte. Mein Problem besteht aber weiterhin. Öffne ich in Chrome eine Internetseite, sieht die so aus: Hier die Log-Dateien: Adwcleaner Code:
ATTFilter # AdwCleaner v4.110 - Bericht erstellt 17/02/2015 um 14:18:02 # Aktualisiert 05/02/2015 von Xplode # Datenbank : 2015-02-14.2 [Server] # Betriebssystem : Windows 8.1 Pro (x86) # Benutzername : Daniel - DANIEL # Gestarted von : C:\Users\Daniel\Desktop\AdwCleaner_4.110.exe # Option : Löschen ***** [ Dienste ] ***** ***** [ Dateien / Ordner ] ***** ***** [ Geplante Tasks ] ***** ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** ***** [ Internetbrowser ] ***** -\\ Internet Explorer v11.0.9600.17416 -\\ Google Chrome v40.0.2214.111 ************************* AdwCleaner[R0].txt - [3316 Bytes] - [11/02/2015 14:09:45] AdwCleaner[R1].txt - [1433 Bytes] - [11/02/2015 14:25:56] AdwCleaner[R2].txt - [1003 Bytes] - [11/02/2015 14:44:49] AdwCleaner[R3].txt - [1608 Bytes] - [17/02/2015 14:08:47] AdwCleaner[R4].txt - [1179 Bytes] - [17/02/2015 14:15:38] AdwCleaner[S0].txt - [3249 Bytes] - [11/02/2015 14:12:57] AdwCleaner[S1].txt - [1222 Bytes] - [11/02/2015 14:40:54] AdwCleaner[S2].txt - [1669 Bytes] - [17/02/2015 14:11:30] AdwCleaner[S3].txt - [1102 Bytes] - [17/02/2015 14:18:02] ########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [1161 Bytes] ########## JRT Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.4.2 (02.02.2015:1) OS: Windows 8.1 Pro x86 Ran by Daniel on 17.02.2015 at 14:22:23,87 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys ~~~ Files Successfully deleted: [File] C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1030316957-1957585848-888588088-1001 ~~~ Folders ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 17.02.2015 at 14:25:34,43 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ FRST FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 15-02-2015 Ran by Daniel (administrator) on DANIEL on 17-02-2015 14:32:59 Running from C:\Users\Daniel\Desktop Loaded Profiles: Daniel (Available profiles: Daniel & UpdatusUser) Platform: Microsoft Windows 8.1 Pro (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: Opera) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (devolo AG) C:\Program Files\devolo\dlan\devolonetsvc.exe (Portrait Displays, Inc.) C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe (Deutsche Telekom AG) C:\Program Files\Telekom\Mediencenter\DTAG.Mediencenter.BackgroundService.exe (Deutsche Telekom AG) C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe (Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.6.0.32\nis.exe (Portrait Displays, Inc.) C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe (TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe (Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.6.0.32\nis.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Google Inc.) C:\Program Files\Google\Update\1.3.26.9\GoogleCrashHandler.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Portrait Displays, Inc) C:\Program Files\Acer Display\eDisplay Management\dthtml.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe () C:\Users\Daniel\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe (Portrait Displays Inc.) C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8610\Bin\ScanToPCActivationApp.exe () C:\Users\Daniel\AppData\Local\Amazon Music\Amazon Music Helper.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\AppleIEDAV.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\iCloudDrive.exe () C:\Program Files\Portrait Displays\Pivot Pro Plugin\wpCtrl.exe () C:\Program Files\Portrait Displays\Pivot Pro Plugin\Floater.exe (Nero AG) C:\Program Files\Nero\Update\NASvc.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8610\Bin\HPNetworkCommunicatorCom.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [6609440 2008-10-31] (Realtek Semiconductor) HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2008-10-31] (Realtek Semiconductor Corp.) HKLM\...\Run: [PivotSoftware] => C:\Program Files\Portrait Displays\Pivot Pro Plugin\Pivot_startup.exe [110192 2010-05-13] () HKLM\...\Run: [DT ACR] => C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe [121648 2012-04-13] (Portrait Displays, Inc.) HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.) HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.) HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard) HKLM\...\Run: [] => [X] HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Run: [AmazonMP3DownloaderHelper] => C:\Users\Daniel\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [400704 2013-05-22] () HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Run: [iCloudServices] => C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-10-17] (Apple Inc.) HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Run: [ApplePhotoStreams] => C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2014-11-21] (Apple Inc.) HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Run: [HP Officejet Pro 8610 (NET)] => C:\Program Files\HP\HP Officejet Pro 8610\Bin\ScanToPCActivationApp.exe [2427400 2014-03-06] (Hewlett-Packard Co.) HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Run: [Amazon Music] => C:\Users\Daniel\AppData\Local\Amazon Music\Amazon Music Helper.exe [6277952 2014-11-19] () HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Run: [AppleIEDAV] => C:\Program Files\Common Files\Apple\Internet Services\AppleIEDAV.exe [1080104 2014-08-04] (Apple Inc.) HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Run: [iCloudDrive] => C:\Program Files\Common Files\Apple\Internet Services\iCloudDrive.exe [43816 2014-10-20] (Apple Inc.) HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Policies\Explorer: [NoSaveSettings] 0 ShellIconOverlayIdentifiers: [01Mediencenter_InSync] -> {77BC4082-DB5F-439A-8DC8-F9E24A63B0DE} => C:\Users\Daniel\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG) ShellIconOverlayIdentifiers: [02Mediencenter_ToSync] -> {528EE335-5034-4EFC-834E-63E5F02D2BC2} => C:\Users\Daniel\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG) ShellIconOverlayIdentifiers: [03Mediencenter_Failed] -> {6066ADF0-9EB0-43E5-ADB6-990F5A3B979C} => C:\Users\Daniel\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG) BootExecute: autocheck autochk /m /P \Device\HarddiskVolume4autocheck autochk * ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-1030316957-1957585848-888588088-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/ SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader) BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files\Norton Internet Security\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation) BHO: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files\Norton Internet Security\Engine\21.6.0.32\IPS\IPSBHO.DLL (Symantec Corporation) BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation) Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1 FireFox: ======== FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF Plugin: @java.com/DTPlugin,version=10.17.2 -> C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.17.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin: @real.com/nppl3260;version=17.0.15.10 -> c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF Plugin: @real.com/nprndlhtml5videoshim;version=17.0.15 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.) FF Plugin: @real.com/nprpplugin;version=17.0.15.10 -> c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer Cloud) FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-1030316957-1957585848-888588088-1001: amazon.com/AmazonMP3DownloaderPlugin -> C:\Users\Daniel\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.) FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.0.2.1\coFFPlgn FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.0.2.1\coFFPlgn [2015-02-17] FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2014-11-16] FF HKLM\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.0.2.1\IPSFF FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.0.2.1\IPSFF [2013-10-09] FF HKLM\...\Firefox\Extensions: [{338950EA-82DB-44C1-930D-0C28E023C9F0}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext Chrome: ======= CHR HomePage: Default -> hxxp://www.google.de/ CHR StartupUrls: Default -> "hxxp://www.google.de/" CHR Profile: C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Docs) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-10-27] CHR Extension: (Google Drive) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2012-11-27] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-11] CHR Extension: (YouTube) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-11-27] CHR Extension: (Google-Suche) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-11-27] CHR Extension: (Norton Identity Safe) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdalibjnif [2014-09-11] CHR Extension: (Google Wallet) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-27] CHR Extension: (Google Mail) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-11-27] CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No Path CHR HKLM\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files\Norton Internet Security\Engine\21.6.0.32\Exts\Chrome.crx [2014-10-05] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 DevoloNetworkService; C:\Program Files\devolo\dlan\devolonetsvc.exe [3736520 2015-01-29] (devolo AG) R2 DTSRVC; C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe [138032 2012-04-13] (Portrait Displays, Inc.) R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) R2 MCSWASVR; C:\Program Files\Telekom\Mediencenter\DTAG.Mediencenter.BackgroundService.exe [12800 2012-08-13] (Deutsche Telekom AG) [File not signed] R2 NAUpdate; C:\Program Files\Nero\Update\NASvc.exe [786256 2014-07-15] (Nero AG) R2 Netzmanager Service; C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe [2635776 2012-07-20] (Deutsche Telekom AG) [File not signed] R2 NIS; C:\Program Files\Norton Internet Security\Engine\21.6.0.32\NIS.exe [276376 2014-09-21] (Symantec Corporation) R2 PdiService; C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe [113456 2012-04-13] (Portrait Displays, Inc.) S3 ScDeviceEnum; C:\WINDOWS\System32\ScDeviceEnum.dll [105472 2013-08-22] (Microsoft Corporation) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [288128 2014-09-22] (Microsoft Corporation) S3 WEPHOSTSVC; C:\WINDOWS\system32\wephostsvc.dll [20992 2013-08-22] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [22192 2014-09-22] (Microsoft Corporation) S3 workfolderssvc; C:\WINDOWS\system32\workfolderssvc.dll [1222144 2014-07-24] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R3 AnyDVD; C:\WINDOWS\System32\Drivers\AnyDVD.sys [124504 2013-03-18] (SlySoft, Inc.) R1 BasicRender; C:\WINDOWS\System32\drivers\BasicRender.sys [25600 2014-02-22] (Microsoft Corporation) R1 BHDrvx86; C:\Program Files\Norton Internet Security\NortonData\21.0.2.1\Definitions\BASHDefs\20150203.001\BHDrvx86.sys [1164504 2015-02-03] (Symantec Corporation) R1 ccSet_NIS; C:\WINDOWS\system32\drivers\NIS\1506000.020\ccSetx86.sys [127064 2013-09-26] (Symantec Corporation) R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [378672 2014-12-12] (Symantec Corporation) R1 ElbyCDIO; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [30616 2013-03-04] (Elaborate Bytes AG) R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [111408 2014-12-12] (Symantec Corporation) S3 GPIO; C:\WINDOWS\System32\drivers\iaiogpio.sys [22016 2013-07-23] (Intel Corporation) R1 IDSVix86; C:\Program Files\Norton Internet Security\NortonData\21.0.2.1\Definitions\IPSDefs\20150213.001\IDSvix86.sys [503512 2015-02-07] (Symantec Corporation) R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [23256 2014-11-21] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [114904 2015-02-17] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [51928 2014-11-21] (Malwarebytes Corporation) R3 NAVENG; C:\Program Files\Norton Internet Security\NortonData\21.0.2.1\Definitions\VirusDefs\20150216.003\NAVENG.SYS [95704 2015-01-24] (Symantec Corporation) R3 NAVEX15; C:\Program Files\Norton Internet Security\NortonData\21.0.2.1\Definitions\VirusDefs\20150216.003\NAVEX15.SYS [1636696 2015-01-24] (Symantec Corporation) R2 NPF_devolo; C:\WINDOWS\system32\drivers\npf_devolo.sys [35840 2015-01-29] (CACE Technologies) [File not signed] R3 PdiPorts; C:\WINDOWS\System32\Drivers\PdiPorts.sys [17328 2012-04-13] (Portrait Displays, Inc.) R3 SRTSP; C:\WINDOWS\System32\Drivers\NIS\1506000.020\SRTSP.SYS [664792 2014-08-26] (Symantec Corporation) R1 SRTSPX; C:\WINDOWS\system32\drivers\NIS\1506000.020\SRTSPX.SYS [32984 2014-08-26] (Symantec Corporation) R0 SymDS; C:\WINDOWS\System32\drivers\NIS\1506000.020\SYMDS.SYS [367704 2013-08-01] (Symantec Corporation) R0 SymEFA; C:\WINDOWS\System32\drivers\NIS\1506000.020\SYMEFA.SYS [936152 2014-03-04] (Symantec Corporation) S0 SymELAM; C:\WINDOWS\System32\drivers\NIS\1506000.020\SYMELAM.SYS [21520 2013-08-01] (Symantec Corporation) R3 SymEvent; C:\WINDOWS\system32\Drivers\SYMEVENT.SYS [142936 2013-09-24] (Symantec Corporation) R1 SymIRON; C:\WINDOWS\system32\drivers\NIS\1506000.020\Ironx86.SYS [209624 2014-08-06] (Symantec Corporation) R1 SymNetS; C:\WINDOWS\System32\Drivers\NIS\1506000.020\SYMNETS.SYS [447704 2014-02-18] (Symantec Corporation) S3 TelekomNM3; C:\Program Files\Netzmanager\NMInfraIS2\Driver\TelekomNM3.sys [35040 2010-09-16] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [84800 2014-09-22] (Microsoft Corporation) R0 Wof; C:\WINDOWS\system32\Drivers\Wof.sys [138584 2014-03-13] (Microsoft Corporation) R3 WUDFSensorLP; C:\WINDOWS\System32\drivers\WUDFRd.sys [188416 2014-05-31] (Microsoft Corporation) R3 WUDFWpdMtp; C:\WINDOWS\system32\DRIVERS\WUDFRd.sys [188416 2014-05-31] (Microsoft Corporation) S3 pccsmcfd; \SystemRoot\system32\DRIVERS\pccsmcfd.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-17 14:25 - 2015-02-17 14:25 - 00000755 _____ () C:\Users\Daniel\Desktop\JRT.txt 2015-02-17 14:09 - 2015-02-17 14:09 - 01388274 _____ (Thisisu) C:\Users\Daniel\Desktop\JRT (1).exe 2015-02-17 14:08 - 2015-02-17 14:08 - 02112512 _____ () C:\Users\Daniel\Desktop\AdwCleaner_4.110.exe 2015-02-17 13:43 - 2015-02-17 13:43 - 00001276 _____ () C:\Users\Daniel\Desktop\Revo Uninstaller.lnk 2015-02-17 13:43 - 2015-02-17 13:43 - 00000000 ____D () C:\Program Files\VS Revo Group 2015-02-17 13:35 - 2015-01-29 14:24 - 00221184 _____ (CACE Technologies) C:\WINDOWS\system32\devolopcap.dll 2015-02-17 13:35 - 2015-01-29 14:24 - 00081920 _____ (CACE Technologies) C:\WINDOWS\system32\devolopacket.dll 2015-02-17 13:35 - 2015-01-29 14:24 - 00035840 _____ (CACE Technologies) C:\WINDOWS\system32\Drivers\npf_devolo.sys 2015-02-16 18:02 - 2015-02-16 18:02 - 00002114 _____ () C:\Users\Daniel\Desktop\JDownloader 2.lnk 2015-02-16 18:02 - 2015-02-16 18:02 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JDownloader 2015-02-16 18:01 - 2015-02-16 20:07 - 00000000 ____D () C:\Users\Daniel\AppData\Local\JDownloader 2.0 2015-02-16 17:51 - 2015-02-16 17:51 - 00027178 _____ () C:\Users\Daniel\Desktop\Addition.txt 2015-02-16 17:50 - 2015-02-17 14:33 - 00019703 _____ () C:\Users\Daniel\Desktop\FRST.txt 2015-02-16 17:42 - 2015-02-16 17:42 - 00027180 _____ () C:\Users\Daniel\Downloads\Addition.txt 2015-02-16 17:41 - 2015-02-16 17:42 - 00032241 _____ () C:\Users\Daniel\Downloads\FRST.txt 2015-02-16 17:39 - 2015-02-16 17:39 - 01125888 _____ (Farbar) C:\Users\Daniel\Desktop\FRST.exe 2015-02-11 17:50 - 2015-02-11 17:51 - 00021199 _____ () C:\Addition.txt 2015-02-11 17:48 - 2015-02-17 14:33 - 00000000 ____D () C:\FRST 2015-02-11 17:48 - 2015-02-11 17:51 - 00031649 _____ () C:\FRST.txt 2015-02-11 17:47 - 2015-02-11 17:47 - 01124864 _____ (Farbar) C:\FRST.exe 2015-02-11 17:39 - 2015-02-11 17:39 - 01124864 _____ (Farbar) C:\Users\Daniel\Downloads\FRST.exe 2015-02-11 17:24 - 2015-02-11 17:24 - 00002360 _____ () C:\Malware.txt 2015-02-11 16:47 - 2015-02-11 16:47 - 02347384 _____ (ESET) C:\Users\Daniel\Downloads\esetsmartinstaller_deu.exe 2015-02-11 14:09 - 2015-02-17 14:18 - 00000000 ____D () C:\AdwCleaner 2015-02-11 13:55 - 2015-02-11 14:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup_disabledByAcp 2015-02-11 13:47 - 2015-02-11 13:47 - 00001217 _____ () C:\Users\Public\Desktop\RegHunter.lnk 2015-02-11 13:47 - 2015-02-11 13:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RegHunter 2015-02-11 13:46 - 2015-02-11 13:46 - 00000000 ____D () C:\Program Files\Common Files\Wise Installation Wizard 2015-02-11 13:29 - 2015-02-11 13:29 - 00000000 __SHD () C:\Users\Daniel\AppData\Local\EmieBrowserModeList 2015-02-11 10:55 - 2015-02-11 10:55 - 01388274 _____ (Thisisu) C:\Users\Daniel\Downloads\JRT.exe 2015-02-11 10:50 - 2015-02-11 13:47 - 00000000 ____D () C:\Program Files\Enigma Software Group 2015-02-11 10:49 - 2015-02-11 10:49 - 03044736 _____ (Enigma Software Group USA, LLC.) C:\Users\Daniel\Downloads\SpyHunter-Installer.exe 2015-02-11 10:40 - 2015-02-17 14:26 - 00114904 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2015-02-11 10:40 - 2015-02-11 15:42 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2015-02-11 10:40 - 2015-02-11 10:40 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-02-11 10:40 - 2015-02-11 10:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-02-11 10:40 - 2015-02-11 10:40 - 00000000 ____D () C:\ProgramData\Malwarebytes 2015-02-11 10:40 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys 2015-02-11 10:40 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys 2015-02-11 10:40 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys 2015-02-11 10:38 - 2015-02-11 10:39 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Daniel\Downloads\mbam-setup-2.0.4.1028.exe 2015-02-10 13:38 - 2015-02-10 13:38 - 00002214 _____ () C:\Users\Public\Desktop\tax 2015.lnk 2015-02-10 13:38 - 2015-02-10 13:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\tax 2015 2015-01-18 10:07 - 2014-12-19 06:46 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys 2015-01-18 10:07 - 2014-12-12 02:34 - 00074240 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWbPrxy.exe 2015-01-18 10:07 - 2014-12-12 01:46 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys 2015-01-18 10:07 - 2014-12-09 04:42 - 00187904 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll 2015-01-18 10:07 - 2014-12-08 20:46 - 00485544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll 2015-01-18 10:07 - 2014-12-08 20:46 - 00108944 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll 2015-01-18 10:07 - 2014-12-08 20:42 - 00448792 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll 2015-01-18 10:07 - 2014-12-08 20:42 - 00372408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll 2015-01-18 10:07 - 2014-12-08 20:42 - 00033584 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe 2015-01-18 10:07 - 2014-12-06 03:36 - 00273408 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll 2015-01-18 10:07 - 2014-12-06 02:28 - 00314880 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll 2015-01-18 10:07 - 2014-12-06 02:23 - 00194048 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll 2015-01-18 10:07 - 2014-10-29 04:12 - 00413136 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe 2015-01-18 10:07 - 2014-10-29 04:12 - 00136296 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe 2015-01-18 10:07 - 2014-10-29 04:07 - 00424544 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll 2015-01-18 10:07 - 2014-10-29 04:07 - 00370424 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll 2015-01-18 10:07 - 2014-10-29 04:07 - 00344536 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll 2015-01-18 10:07 - 2014-10-29 04:07 - 00213336 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe 2015-01-18 10:07 - 2014-10-29 02:59 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll 2015-01-18 10:07 - 2014-10-29 02:01 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll 2015-01-18 10:07 - 2014-10-29 01:49 - 00694272 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-17 14:30 - 2012-11-27 14:38 - 00104960 ___SH () C:\Users\Daniel\Desktop\Thumbs.db 2015-02-17 14:21 - 2015-01-09 21:24 - 00000000 ___RD () C:\Users\Daniel\iCloudDrive 2015-02-17 14:21 - 2013-10-21 19:29 - 00000000 ___DO () C:\Users\Daniel\SkyDrive 2015-02-17 14:21 - 2012-12-19 13:55 - 00001116 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job 2015-02-17 14:19 - 2013-08-22 08:23 - 00393743 _____ () C:\WINDOWS\setupact.log 2015-02-17 14:19 - 2013-08-22 08:23 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT 2015-02-17 14:19 - 2012-12-19 13:55 - 00001120 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job 2015-02-17 14:18 - 2012-12-11 15:46 - 00000000 ____D () C:\Users\Daniel\AppData\Local\CrashDumps 2015-02-17 14:13 - 2013-09-29 19:54 - 00055782 _____ () C:\WINDOWS\PFRO.log 2015-02-17 14:12 - 2013-08-22 07:13 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI 2015-02-17 14:02 - 2013-08-22 09:17 - 00000000 ____D () C:\WINDOWS\system32\sru 2015-02-17 13:49 - 2013-10-21 18:43 - 01984752 _____ () C:\WINDOWS\WindowsUpdate.log 2015-02-17 13:39 - 2013-08-22 09:17 - 00000000 ____D () C:\WINDOWS\AppReadiness 2015-02-17 13:37 - 2014-05-13 16:35 - 00000000 ____D () C:\Program Files\devolo 2015-02-16 23:58 - 2012-11-27 16:47 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\vlc 2015-02-16 23:14 - 2013-02-03 19:31 - 00000724 _____ () C:\WINDOWS\wiso.ini 2015-02-16 18:30 - 2013-06-29 21:04 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\UseNeXT 2015-02-16 18:29 - 2013-06-29 21:04 - 00000000 ____D () C:\Users\Daniel\Documents\UseNeXT 2015-02-16 18:20 - 2015-01-09 21:26 - 00000000 ____D () C:\Users\Daniel\AppData\Local\2EF11234-024A-4F20-928E-971B64C955C4.aplzod 2015-02-16 17:39 - 2013-09-30 05:08 - 01785518 _____ () C:\WINDOWS\system32\PerfStringBackup.INI 2015-02-16 17:17 - 2013-08-22 09:17 - 00000000 ____D () C:\WINDOWS\Microsoft.NET 2015-02-16 17:05 - 2013-08-22 07:13 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM 2015-02-11 14:44 - 2012-12-31 09:34 - 00000125 ___SH () C:\ProgramData\.zreglib 2015-02-11 11:10 - 2013-08-22 09:17 - 00000000 ____D () C:\WINDOWS\Vss 2015-02-11 10:52 - 2013-10-21 18:24 - 00000000 ____D () C:\Users\Daniel 2015-02-10 13:44 - 2013-02-03 19:38 - 00000000 ____D () C:\Users\Daniel\Documents\tax 2015-02-10 13:38 - 2013-02-03 19:31 - 00000000 ____D () C:\Users\Daniel\AppData\Local\Buhl 2015-02-10 13:34 - 2013-02-03 17:22 - 00000000 ____D () C:\Program Files\Buhl finance 2015-02-10 13:34 - 2012-12-26 10:38 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information 2015-02-09 10:18 - 2013-09-05 06:35 - 00000000 ____D () C:\WINDOWS\system32\MRT 2015-02-09 10:03 - 2012-12-14 21:17 - 110348472 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2015-02-07 18:33 - 2013-10-27 09:16 - 00002179 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2015-02-07 18:09 - 2012-07-26 07:43 - 00000000 ____D () C:\WINDOWS\CbsTemp 2015-02-03 20:31 - 2014-08-16 20:49 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe 2015-02-03 20:31 - 2014-08-16 20:49 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl 2015-01-25 13:58 - 2014-12-06 09:38 - 00000000 ____D () C:\ProgramData\Netzmanager 2015-01-24 21:53 - 2013-07-01 21:18 - 01010176 ___SH () C:\Users\Daniel\Documents\Thumbs.db ==================== Files in the root of some directories ======= 2012-12-07 20:16 - 2014-12-21 20:16 - 0078336 _____ () C:\Users\Daniel\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2013-01-22 09:14 - 2013-04-28 19:03 - 0000021 _____ () C:\Users\Daniel\AppData\Local\mc.pixel.data 2012-12-31 09:34 - 2015-02-11 14:44 - 0000125 ___SH () C:\ProgramData\.zreglib 2012-11-27 20:15 - 2012-11-27 20:15 - 0000057 _____ () C:\ProgramData\Ament.ini Files to move or delete: ==================== C:\Users\Daniel\CDmage.exe Some content of TEMP: ==================== C:\Users\Daniel\AppData\Local\Temp\amazonicon_v10.exe C:\Users\Daniel\AppData\Local\Temp\amazoninstallernircmdc.exe C:\Users\Daniel\AppData\Local\Temp\DseShExt-x86.dll C:\Users\Daniel\AppData\Local\Temp\isotousb_setup.exe C:\Users\Daniel\AppData\Local\Temp\Mediencenter_3.9.1055.64.exe C:\Users\Daniel\AppData\Local\Temp\proxy_vole791488949136643241.dll C:\Users\Daniel\AppData\Local\Temp\Quarantine.exe C:\Users\Daniel\AppData\Local\Temp\RHSetup.exe C:\Users\Daniel\AppData\Local\Temp\sdan.exe C:\Users\Daniel\AppData\Local\Temp\sdapk.exe C:\Users\Daniel\AppData\Local\Temp\sdaspwn.exe C:\Users\Daniel\AppData\Local\Temp\SDShelEx-win32.dll C:\Users\Daniel\AppData\Local\Temp\sqlite3.dll C:\Users\Daniel\AppData\Local\Temp\stubhelper.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\WINDOWS\explorer.exe => File is digitally signed C:\WINDOWS\system32\winlogon.exe => File is digitally signed C:\WINDOWS\system32\wininit.exe => File is digitally signed C:\WINDOWS\system32\svchost.exe => File is digitally signed C:\WINDOWS\system32\services.exe => File is digitally signed C:\WINDOWS\system32\User32.dll => File is digitally signed C:\WINDOWS\system32\userinit.exe => File is digitally signed C:\WINDOWS\system32\rpcss.dll => File is digitally signed C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-02-16 17:15 ==================== End Of Log ============================ Addition Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 15-02-2015 Ran by Daniel at 2015-02-17 14:33:50 Running from C:\Users\Daniel\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AV: Norton Internet Security (Disabled - Up to date) {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB} AS: Norton Internet Security (Enabled - Up to date) {631E4324-D31C-783F-EC5C-35AD42B18466} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FW: Norton Internet Security (Enabled) {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Acer eDisplay Management (HKLM\...\{A586DC50-B18D-48FB-B7CC-A598200457C2}) (Version: 1.37.007 - Portrait Displays, Inc.) Adobe AIR (HKLM\...\Adobe AIR) (Version: 3.9.0.1030 - Adobe Systems Incorporated) Adobe Reader XI (11.0.10) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated) Amazon MP3-Downloader 1.0.18 (HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Amazon MP3-Downloader) (Version: 1.0.18 - Amazon Services LLC) Amazon Music (HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Amazon Amazon Music) (Version: 3.7.0.693 - Amazon Services LLC) Amazon Music Importer (HKLM\...\com.amazon.music.uploader) (Version: 2.1.0 - Amazon Services LLC) Amazon Music Importer (Version: 2.1.0 - Amazon Services LLC) Hidden Any Video Converter 5.7.7 (HKLM\...\Any Video Converter_is1) (Version: - Any-Video-Converter.com) AnyDVD (HKLM\...\AnyDVD) (Version: 7.1.7.0 - SlySoft) Apple Application Support (HKLM\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{235EBB33-3DA1-46DF-AADE-9955123409CB}) (Version: 8.0.5.6 - Apple Inc.) Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) AusweisApp (HKLM\...\{6E2E92F9-A81B-426F-8F35-4F3718A7D0AF}) (Version: 1.11.0 - OpenLimit SignCubes AG) Avidemux 2.6 (32-bit) (HKLM\...\Avidemux 2.6) (Version: 2.6.6.8941 - ) Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.) CDex - Open Source Digital Audio CD Extractor (HKLM\...\CDex) (Version: 1.76.0.2015 - Georgy Berdyshev) devolo Cockpit (HKLM\...\dlancockpit) (Version: 4.3.0.0 - devolo AG) DHTML Editing Component (HKLM\...\{2EA870FA-585F-4187-903D-CB9FFD21E2E0}) (Version: 6.02.0001 - Microsoft Corporation) DVD Flick 1.3.0.7 (HKLM\...\DVD Flick_is1) (Version: 1.3.0.7 - Dennis Meuwissen) DVD Shrink 3.2 (Version: - DVD Shrink) Hidden Google Chrome (HKLM\...\Google Chrome) (Version: 40.0.2214.111 - Google Inc.) Google Earth Plug-in (HKLM\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google) Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden Google+ Auto Backup (HKLM\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google) HP Officejet Pro 8610 - Grundlegende Software für das Gerät (HKLM\...\{4A990817-F950-4770-AC83-7CC57EA18F65}) (Version: 32.2.188.47710 - Hewlett-Packard Co.) HP Officejet Pro 8610 Hilfe (HKLM\...\{2466D8D5-4856-4492-BDEF-48A640F58866}) (Version: 32.0.0 - Hewlett Packard) HP Update (HKLM\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard) HPDiagnosticAlert (Version: 1.00.0000 - Microsoft) Hidden I.R.I.S. OCR (HKLM\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP) iCloud (HKLM\...\{760BB327-3973-4608-85C8-88162E2FF3B6}) (Version: 4.0.6.28 - Apple Inc.) iTunes (HKLM\...\{5D928931-D1D2-4A93-A82D-BF60D0E7CFA5}) (Version: 12.0.1.26 - Apple Inc.) Java 7 Update 17 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217017FF}) (Version: 7.0.170 - Oracle) JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH) Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation) Mediencenter 3.9.1055.64 (HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Mediencenter) (Version: 3.9.1055.64 - Deutsche Telekom AG) Mediencenter Assistent (HKLM\...\Mediencenter Software) (Version: 2.7.0.1451 - Telekom) Medieval CUE Splitter (HKLM\...\{B96D2269-568B-4CBF-9332-12FAE8B158F7}) (Version: 1.2.0 - Medieval Software) Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation) Microsoft WSE 3.0 Runtime (HKLM\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.) MP3-Tag-Editor 3.14.0 (HKLM\...\{DB363BBA-6375-4306-85F9-528CD666FC30}) (Version: 3.14.0 - Gisbert Müller) MSVC80_x86_v2 (Version: 1.0.3.0 - Nokia) Hidden MSVC90_x86 (Version: 1.0.1.2 - Nokia) Hidden Music Wizard Professional 8.0.9 (HKLM\...\MUSICWIZARD_is1) (Version: - Stefan Hollesch) Nero BurningROM 12 (HKLM\...\{3D9167B2-87EB-4713-90B4-E46F2CAFE28D}) (Version: 12.0.00300 - Nero AG) Nero CoverDesigner (HKLM\...\{F1676432-361C-44EE-9596-24C1BB5608B8}) (Version: 12.0.00900 - Nero AG) Nero Prerequisite Installer 2.0 (HKLM\...\{F4C242B4-2973-43F3-93F2-ED1B47AE8848}) (Version: 12.0.02000 - Nero AG) Netzmanager (HKLM\...\Netzmanager) (Version: 1.081 - Deutsche Telekom AG) Netzmanager (Version: 1.081 - Deutsche Telekom AG, Marmiko IT-Solutions GmbH) Hidden Norton Internet Security (HKLM\...\NIS) (Version: 21.6.0.32 - Symantec Corporation) NVIDIA Grafiktreiber 307.68 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 307.68 - NVIDIA Corporation) NVIDIA Update 1.10.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.10.8 - NVIDIA Corporation) Picasa 3 (HKLM\...\Picasa 3) (Version: 3.9 - Google, Inc.) Pivot Pro Plugin (Version: 9.50.110 - Portrait Displays, Inc.) Hidden Prerequisite installer (Version: 12.0.0008 - Nero AG) Hidden Ravensburger tiptoi (HKLM\...\Ravensburger tiptoi) (Version: - ) RealDownloader (Version: 17.0.15.4 - RealNetworks, Inc.) Hidden RealDownloader (Version: 17.0.15.7 - RealNetworks) Hidden RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0 - RealNetworks, Inc) Hidden RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0 - RealNetworks, Inc) Hidden Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: - Realtek Semiconductor Corp.) RealUpgrade 1.1 (Version: 1.1.0 - RealNetworks, Inc.) Hidden RegHunter (HKLM\...\{A16BBEAB-AAEF-434A-BFDD-297708709FCC}) (Version: 1.3.3.1613 - Enigma Software Group USA, LLC) Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group) SDK (Version: 2.32.010 - Portrait Displays, Inc.) Hidden Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft) Studie zur Verbesserung von HP Officejet Pro 8610 (HKLM\...\{8E4E3EA0-9332-47B7-98D4-3DC850317C81}) (Version: 32.2.188.47710 - Hewlett-Packard Co.) tax 2015 (HKLM\...\{4CF96070-DEE5-43B5-B6A7-23AC07BC0C77}) (Version: 22.00.8811 - Buhl Data Service GmbH) TeamViewer 9 (HKLM\...\TeamViewer 9) (Version: 9.0.28223 - TeamViewer) Total Commander (Remove or Repair) (HKLM\...\Totalcmd) (Version: 8.01 - Ghisler Software GmbH) Turbo Lister 2 (HKLM\...\{8927E07C-97F7-4A54-88FB-D976F50DD46E}) (Version: 2.00.0000 - eBay Inc.) UpdateService (Version: 1.0.0 - RealNetworks, Inc.) Hidden UseNeXT by Tangysoft (HKLM\...\UseNeXT by Tangysoft_is1) (Version: - Tangysoft Ltd.) Video Downloader (Version: 1.0.0 - RealNetworks) Hidden VLC media player 2.0.5 (HKLM\...\VLC media player) (Version: 2.0.5 - VideoLAN) Winamp (HKLM\...\Winamp) (Version: 5.63 - Nullsoft, Inc) Winamp Erkennungs-Plug-in (HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc) WinRAR 4.20 (32-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH) Zahlenzauber 1 (HKLM\...\Zahlenzauber 1_is1) (Version: - Oldenbourg Verlag) Zahlenzauber 2 (HKLM\...\Zahlenzauber 2_is1) (Version: - Oldenbourg Verlag) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) CustomCLSID: HKU\S-1-5-21-1030316957-1957585848-888588088-1001_Classes\CLSID\{268502F4-815D-4358-A8D6-B783FDB58EF0}\InprocServer32 -> C:\Users\Daniel\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.ContextMenuHandler.dll (Deutsche Telekom AG) CustomCLSID: HKU\S-1-5-21-1030316957-1957585848-888588088-1001_Classes\CLSID\{34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE}\InprocServer32 -> C:\Users\Daniel\AppData\Local\Microsoft\Internet Explorer\Downloaded Program Files\JordanApplet.dll (IPLabs GmbH) CustomCLSID: HKU\S-1-5-21-1030316957-1957585848-888588088-1001_Classes\CLSID\{3f04dadf-6ea4-44d1-a507-03cad176f443}\InprocServer32 -> C:\Users\Daniel\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.) CustomCLSID: HKU\S-1-5-21-1030316957-1957585848-888588088-1001_Classes\CLSID\{528EE335-5034-4EFC-834E-63E5F02D2BC2}\InprocServer32 -> C:\Users\Daniel\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG) CustomCLSID: HKU\S-1-5-21-1030316957-1957585848-888588088-1001_Classes\CLSID\{6066ADF0-9EB0-43E5-ADB6-990F5A3B979C}\InprocServer32 -> C:\Users\Daniel\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG) CustomCLSID: HKU\S-1-5-21-1030316957-1957585848-888588088-1001_Classes\CLSID\{77BC4082-DB5F-439A-8DC8-F9E24A63B0DE}\InprocServer32 -> C:\Users\Daniel\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG) ==================== Restore Points ========================= 25-01-2015 11:46:43 Windows Update 07-02-2015 17:42:33 Windows Update 10-02-2015 13:33:55 Installiert tax 2015 11-02-2015 13:46:30 Installed RegHunter 17-02-2015 13:45:53 Revo Uninstaller's restore point - SpyHunter 4 ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2013-08-22 07:13 - 2013-08-22 07:13 - 00000824 ____N C:\WINDOWS\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {15B96CC9-1C62-4640-B718-AF0AE6D2AF60} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1030316957-1957585848-888588088-1001 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2014-10-30] (RealNetworks, Inc.) Task: {267EC242-A09F-4B76-8B2B-B2968BFEABD6} - System32\Tasks\RealDownloader Update Check => C:\Program Files\RealNetworks\RealDownloader\downloader2.exe [2014-10-29] () Task: {316304DE-C98B-4C2F-8168-42CCC03D6FA1} - System32\Tasks\HPCustParticipation HP Officejet Pro 8610 => C:\Program Files\HP\HP Officejet Pro 8610\Bin\HPCustPartic.exe [2014-03-06] (Hewlett-Packard Co.) Task: {382B533B-988A-4AAD-956E-E38B2E96AB21} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-12-19] (Google Inc.) Task: {4028C731-8BCB-4341-A41A-42410F75C544} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-12-19] (Google Inc.) Task: {5F10BE7B-0050-4AC9-A10F-C75C6267DEB9} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {8C8B04A5-5EA5-4A0F-B744-BE05B340DFB1} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1030316957-1957585848-888588088-1001 => C:\Program Files\RealNetworks\RealDownloader\RealUpgrade.exe [2014-10-26] (RealNetworks, Inc.) Task: {94A68A17-B81E-4436-96FC-D5568DE86A64} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1030316957-1957585848-888588088-1001 => C:\Program Files\RealNetworks\RealDownloader\RealUpgrade.exe [2014-10-26] (RealNetworks, Inc.) Task: {9D4F4624-C31D-4A74-B30A-2AB5BD71C45C} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated) Task: {A09293A2-66BD-412C-95AB-C66AB0DDC1CC} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files\Norton Internet Security\Engine\21.6.0.32\SymErr.exe [2014-01-30] (Symantec Corporation) Task: {A42035CE-FB42-43C7-A841-5C1E5CB37AEC} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1030316957-1957585848-888588088-1001 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2014-10-30] (RealNetworks, Inc.) Task: {AE38AA98-0974-41EA-B869-B26E7A10DF77} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-1030316957-1957585848-888588088-1001 => C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe [2014-10-26] (RealNetworks, Inc.) Task: {AE664ED8-DD94-4D0E-BF2F-ADEC02A08D6D} - System32\Tasks\Norton WSC Integration => C:\Program Files\Norton Internet Security\Engine\21.6.0.32\WSCStub.exe [2014-09-21] (Symantec Corporation) Task: {B843DB97-0E46-46F6-902D-A4450A3822BE} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files\Norton Internet Security\Engine\21.6.0.32\SymErr.exe [2014-01-30] (Symantec Corporation) Task: {C3A04C3B-EF09-42F7-8485-D715B08B1E4D} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-02-09] (Microsoft Corporation) Task: {F52E58CF-D27F-4D7C-9099-0ABEFA35BC21} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated) Task: {FF65185D-7111-4387-A339-7AE1FFF311B5} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============== 2014-01-20 13:17 - 2014-01-20 13:17 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll 2014-10-11 13:05 - 2014-10-11 13:05 - 01044776 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll 2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF 2012-12-29 10:46 - 2012-04-13 11:56 - 00180224 _____ () C:\Program Files\Common Files\Portrait Displays\Shared\PresetsCOM.dll 2012-12-29 10:47 - 2012-04-13 12:18 - 00121648 _____ () C:\Program Files\Common Files\Portrait Displays\Plugins\CC\gui.dll 2013-05-22 19:50 - 2013-05-22 19:50 - 00400704 _____ () C:\Users\Daniel\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe 2012-12-29 10:46 - 2012-04-13 12:19 - 00244528 _____ () C:\Program Files\Common Files\Portrait Displays\Shared\dthook.dll 2014-12-06 12:20 - 2014-11-19 01:55 - 06277952 _____ () C:\Users\Daniel\AppData\Local\Amazon Music\Amazon Music Helper.exe 2012-12-29 10:47 - 2010-05-13 16:34 - 00674928 _____ () C:\Program Files\Portrait Displays\Pivot Pro Plugin\wpctrl.exe 2012-12-29 10:47 - 2010-05-13 16:34 - 00711792 _____ () C:\Program Files\Portrait Displays\Pivot Pro Plugin\floater.exe ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) AlternateDataStreams: C:\Users\Daniel\SkyDrive:ms-properties ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (whitelisted) =============== (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-1030316957-1957585848-888588088-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper DNS Servers: 192.168.2.1 ==================== MSCONFIG/TASK MANAGER disabled items == (Currently there is no automatic fix for this section.) HKLM\...\StartupApproved\StartupFolder: => "PlexRadar.lnk" HKLM\...\StartupApproved\StartupFolder: => "t@x aktuell.lnk" HKLM\...\StartupApproved\Run: => "HP Software Update" HKLM\...\StartupApproved\Run: => "Adobe ARM" HKLM\...\StartupApproved\Run: => "TkBellExe" HKLM\...\StartupApproved\Run: => "iTunesHelper" HKLM\...\StartupApproved\Run: => "SunJavaUpdateSched" HKLM\...\StartupApproved\Run: => "Smart File Advisor" HKLM\...\StartupApproved\Run: => "BingDesktop" HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\StartupApproved\StartupFolder: => "PlexRadar.lnk" HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\StartupApproved\Run: => "Google Update" HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\StartupApproved\Run: => "SDP" HKU\S-1-5-21-1030316957-1957585848-888588088-1001\...\StartupApproved\Run: => "PC Suite Tray" ==================== Accounts: ============================= Administrator (S-1-5-21-1030316957-1957585848-888588088-500 - Administrator - Disabled) Daniel (S-1-5-21-1030316957-1957585848-888588088-1001 - Administrator - Enabled) => C:\Users\Daniel Gast (S-1-5-21-1030316957-1957585848-888588088-501 - Limited - Disabled) HomeGroupUser$ (S-1-5-21-1030316957-1957585848-888588088-1006 - Limited - Enabled) UpdatusUser (S-1-5-21-1030316957-1957585848-888588088-1004 - Limited - Enabled) => C:\Users\UpdatusUser ==================== Faulty Device Manager Devices ============= Name: Description: Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. ==================== Event log errors: ========================= Application errors: ================== System errors: ============= Microsoft Office Sessions: ========================= ==================== Memory info =========================== Processor: Pentium(R) Dual-Core CPU E5200 @ 2.50GHz Percentage of memory in use: 42% Total physical RAM: 3071.24 MB Available physical RAM: 1769.36 MB Total Pagefile: 3583.24 MB Available Pagefile: 2086.18 MB Total Virtual: 2047.88 MB Available Virtual: 1907.42 MB ==================== Drives ================================ Drive c: (Daniel) (Fixed) (Total:232.88 GB) (Free:119.93 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Drive d: (Volume) (Fixed) (Total:465.76 GB) (Free:36.56 GB) NTFS Drive j: (Musik) (Fixed) (Total:232.88 GB) (Free:52.5 GB) NTFS Drive k: (Daten) (Fixed) (Total:698.64 GB) (Free:34.46 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 232.9 GB) (Disk ID: 09E74DEE) Partition 1: (Not Active) - (Size=232.9 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (Size: 232.9 GB) (Disk ID: F132F132) Partition 1: (Active) - (Size=232.9 GB) - (Type=07 NTFS) ======================================================== Disk: 2 (MBR Code: Windows XP) (Size: 465.8 GB) (Disk ID: FEC30F37) Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS) ======================================================== Disk: 3 (Size: 698.6 GB) (Disk ID: 465232C5) Partition 1: (Not Active) - (Size=698.6 GB) - (Type=07 NTFS) ==================== End Of Log ============================ |
17.02.2015, 14:49 | #11 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Mal wieder "Positive Ads" FRST-Fix Virenscanner jetzt bitte komplett deaktivieren, damit sichergestellt ist, dass der Fix sauber durchläuft! Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Users\Daniel\CDmage.exe HKLM\...\Run: [] => [X] SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No Path EmptyTemp: Hosts: Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ Logfiles bitte immer in CODE-Tags posten |
17.02.2015, 15:05 | #12 |
| Mal wieder "Positive Ads" Hallo, hier die Datei: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 15-02-2015 Ran by Daniel at 2015-02-17 14:59:26 Run:1 Running from C:\Users\Daniel\Desktop Loaded Profiles: Daniel (Available profiles: Daniel & UpdatusUser) Boot Mode: Normal ============================================== Content of fixlist: ***************** C:\Users\Daniel\CDmage.exe HKLM\...\Run: [] => [X] SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No Path EmptyTemp: Hosts: ***************** C:\Users\Daniel\CDmage.exe => Moved successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully. HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully. HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully. HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully. "HKLM\SOFTWARE\Google\Chrome\Extensions\iikflkcanblccfahdhdonehdalibjnif" => Key deleted successfully. C:\Windows\System32\Drivers\etc\hosts => Moved successfully. Hosts was reset successfully. EmptyTemp: => Removed 800.3 MB temporary data. The system needed a reboot. ==== End of Fixlog 15:00:35 ==== |
17.02.2015, 15:22 | #13 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Mal wieder "Positive Ads" Okay, dann Kontrollscans mit MBAM und ESET bitte: Downloade Dir bitte Malwarebytes Anti-Malware
ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten |