| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Was ist das, h(tt)p://ui.skype.c.. unter Mozilla?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
24.02.2015, 02:52
| #1 |
| |  Was ist das, h(tt)p://ui.skype.c.. unter Mozilla? Hallo, ich habe ein Problem mit der Datei in CCleaner die sich nicht entfernen lassen will. Ja Task {7993CB2E-EAD0-4A59-8311-69D7B69128F6} Mozilla Corporation Benutzer "c:\program files\mozilla firefox\firefox.exe" h(tt)p://ui.skype.com/ui/0/6.2.0.106/de/abandoninstall?source=lightinstaller&page=tsMain Sie lässt sich weder Löschen noch Deaktivieren. Auch dann wenn ich Firefox deinstalliert habe bleibt diese Ziele stehen. Im Admin Bereich ist diese Zeile im CCL nicht zu finden, nur in meinem Arbeitskonto. Wie bekomme ich das weg und was für eine Bedeutung hat das? Selbst schon an Maßnahmen ergriffen habe ich. Virenscan mit AVAST 2015, die Datei suchen lassen mit Total Commander, gefundene Dateien in Mozilla „places.sqlite-shm“ „places.sqlite“ und „places.wal“ durchsucht und die Zeile entfernt. Probeweise mehrfach Firefox deinstalliert mit REVO Uninstaller Pro. Mit CCleaner die Datei immer wieder gefunden. Mit Regedit alles durchsucht und ergebnislos geblieben. FRST runtergeladen und nach eurer Anweisung gescannt. Dateien lege ich bei. FRST Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 23-02-2015 01
Ran by x (ATTENTION: The logged in user is not administrator) on ADMIN-PC on 24-02-2015 01:21:02
Running from D:\Prob
Loaded Profiles: x (Available profiles: Admin & x)
Platform: Microsoft Windows 7 Ultimate Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
Failed to access process -> smss.exe
Failed to access process -> csrss.exe
Failed to access process -> wininit.exe
Failed to access process -> services.exe
Failed to access process -> lsass.exe
Failed to access process -> lsm.exe
Failed to access process -> svchost.exe
Failed to access process -> nvvsvc.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> AvastSvc.exe
Failed to access process -> spoolsv.exe
Failed to access process -> svchost.exe
Failed to access process -> NetworkLicenseServer.exe
Failed to access process -> armsvc.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> WUDFHost.exe
Failed to access process -> SearchIndexer.exe
Failed to access process -> SearchProtocolHost.exe
Failed to access process -> WmiPrvSE.exe
Failed to access process -> wmpnetwk.exe
Failed to access process -> svchost.exe
Failed to access process -> OSPPSVC.EXE
Failed to access process -> svchost.exe
Failed to access process -> TrustedInstaller.exe
Failed to access process -> csrss.exe
Failed to access process -> winlogon.exe
Failed to access process -> nvxdsync.exe
Failed to access process -> nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
Failed to access process -> SearchFilterHost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-02-17] (AVAST Software)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\S-1-5-21-2179699683-2405127896-116133419-1006\...\MountPoints2: {6386c826-7848-11e2-8a4b-806e6f6e6963} - G:\Start.exe
HKU\S-1-5-21-2179699683-2405127896-116133419-1006\...\MountPoints2: {ecd0bc93-5a68-11e3-bcd5-404e57434401} - I:\Startme.exe
HKU\S-1-5-21-2179699683-2405127896-116133419-1006\...0c966feabec1\InprocServer32: [Default-shell32] ATTENTION! ====> ZeroAccess?
HKU\S-1-5-21-2179699683-2405127896-116133419-1006\...A8F59079A8D5}\localserver32: <==== ATTENTION!
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software)
BootExecute: autocheck autochk * sdnclean.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-2179699683-2405127896-116133419-1006\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/
HKU\S-1-5-21-2179699683-2405127896-116133419-1006\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
SearchScopes: HKLM -> DefaultScope {65EE7962-05F1-46B8-8FBE-34B9E02975B9} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKLM -> {65EE7962-05F1-46B8-8FBE-34B9E02975B9} URL = hxxp://www.sm.de/?q={searchTerms}
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\x\AppData\Roaming\Mozilla\Firefox\Profiles\5vhfi4z4.default
FF Homepage: https://www.google.de/?gws_rd=ssl
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.8 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\x\AppData\Roaming\Mozilla\Firefox\Profiles\5vhfi4z4.default\user.js
FF Extension: Wörterbuch Deutsch (de-DE), Hunspell-unterstützt - C:\Users\x\AppData\Roaming\Mozilla\Firefox\Profiles\5vhfi4z4.default\Extensions\de_DE@dicts.j3e.de [2015-02-24]
FF Extension: DownloadHelper - C:\Users\x\AppData\Roaming\Mozilla\Firefox\Profiles\5vhfi4z4.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2015-01-12]
FF Extension: Ghostery - C:\Users\x\AppData\Roaming\Mozilla\Firefox\Profiles\5vhfi4z4.default\Extensions\firefox@ghostery.com.xpi [2015-02-24]
FF Extension: Adblock Plus - C:\Users\x\AppData\Roaming\Mozilla\Firefox\Profiles\5vhfi4z4.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-02-24]
FF Extension: BetterPrivacy - C:\Users\x\AppData\Roaming\Mozilla\Firefox\Profiles\5vhfi4z4.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2015-02-24]
FF HKLM\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2014-10-15]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-02-17]
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-02-17]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 ABBYY.Licensing.FineReader.Professional.11.0; C:\Program Files\ABBYY FineReader 11\NetworkLicenseServer.exe [818952 2011-12-22] (ABBYY)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2015-02-17] (AVAST Software)
S3 BrYNSvc; C:\Program Files\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [File not signed]
R2 lmhosts; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 NlaSvc; C:\Windows\System32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [26080 2012-10-08] (Wondershare)
S3 ASPI; C:\Windows\System32\DRIVERS\ASPI32.sys [84832 2002-07-17] (Adaptec) [File not signed]
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2015-02-17] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [70384 2015-02-24] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81768 2015-02-17] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2015-02-17] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [787800 2015-02-17] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423784 2015-02-17] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [91496 2015-02-17] (AVAST Software)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [206248 2015-02-17] ()
R3 AVMCOWAN; C:\Windows\System32\DRIVERS\AVMCOWAN.sys [64000 2009-07-13] (AVM GmbH)
S3 CamDrL; C:\Windows\System32\DRIVERS\Camdrl.sys [1075360 2007-02-03] (Logitech Inc.)
R3 FPCIBASE; C:\Windows\System32\DRIVERS\fpcibase.sys [559104 2009-07-13] (AVM Berlin)
R3 L1E; C:\Windows\System32\DRIVERS\L1E62x86.sys [48640 2009-08-23] (Atheros Communications, Inc.)
R3 LEqdUsb; C:\Windows\System32\Drivers\LEqdUsb.Sys [42264 2014-03-19] (Logitech, Inc.)
R3 LHidEqd; C:\Windows\System32\Drivers\LHidEqd.Sys [10136 2014-03-19] (Logitech, Inc.)
S3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [28312 2013-05-23] (Logitech, Inc.)
R3 LVUSBSta; C:\Windows\System32\drivers\LVUSBSta.sys [41504 2007-02-03] (Logitech Inc.)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [13216 2009-07-16] ()
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-24 01:17 - 2015-02-24 01:21 - 00000000 ____D () C:\FRST
2015-02-24 00:38 - 2015-02-17 18:24 - 00291352 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2015-02-23 23:39 - 2015-02-23 23:39 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\ParetoLogic
2015-02-23 23:39 - 2015-02-23 23:39 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\DriverCure
2015-02-23 23:38 - 2015-02-23 23:44 - 00000000 ____D () C:\ProgramData\ParetoLogic
2015-02-23 23:38 - 2015-02-23 23:38 - 00000000 ____D () C:\Program Files\Common Files\ParetoLogic
2015-02-23 23:13 - 2015-02-24 00:34 - 00000000 ____D () C:\AdwCleaner
2015-02-17 20:49 - 2015-02-17 20:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2015-02-17 20:49 - 2015-02-17 20:49 - 00000000 ____D () C:\Program Files\7-Zip
2015-02-17 18:38 - 2015-02-17 18:38 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\AVAST Software
2015-02-17 18:35 - 2015-02-17 18:35 - 00000000 ____D () C:\Users\x\AppData\Roaming\AVAST Software
2015-02-17 18:25 - 2015-02-24 00:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-02-17 18:25 - 2015-02-17 18:25 - 00002077 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-02-17 18:24 - 2015-02-24 00:38 - 00070384 _____ (AVAST Software) C:\Windows\system32\Drivers\aswmonflt.sys
2015-02-17 18:24 - 2015-02-17 18:25 - 00787800 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2015-02-17 18:24 - 2015-02-17 18:24 - 00423784 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2015-02-17 18:24 - 2015-02-17 18:24 - 00206248 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-02-17 18:24 - 2015-02-17 18:24 - 00091496 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2015-02-17 18:24 - 2015-02-17 18:24 - 00081768 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2015-02-17 18:24 - 2015-02-17 18:24 - 00049944 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-02-17 18:24 - 2015-02-17 18:24 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2015-02-17 18:24 - 2015-02-17 18:24 - 00024184 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-02-17 18:23 - 2015-02-17 18:23 - 00000000 ____D () C:\Program Files\AVAST Software
2015-02-12 13:20 - 2015-01-23 04:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-02-12 13:20 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-11 14:54 - 2015-01-09 03:48 - 00635904 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2015-02-11 14:54 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2015-02-11 14:54 - 2015-01-09 03:48 - 00027136 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2015-02-11 13:42 - 2015-01-15 08:46 - 00136640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-11 13:42 - 2015-01-15 08:46 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-02-11 13:42 - 2015-01-15 08:43 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-02-11 13:42 - 2015-01-15 08:43 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-02-11 13:42 - 2015-01-15 08:42 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-11 13:42 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-02-11 13:42 - 2015-01-15 08:42 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-02-11 13:42 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-02-11 13:42 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-11 13:42 - 2015-01-15 05:21 - 00369968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-11 13:42 - 2015-01-09 02:45 - 02380288 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-11 13:41 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-11 13:41 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-02-11 13:41 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-02-11 13:41 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-11 13:41 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-11 13:41 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-11 13:41 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-11 13:41 - 2015-01-12 03:21 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-02-11 13:41 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-11 13:41 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-02-11 13:41 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-02-11 13:41 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-02-11 13:41 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-11 13:41 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-11 13:41 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-02-11 13:41 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-11 13:41 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-11 13:41 - 2015-01-12 02:55 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-02-11 13:41 - 2015-01-12 02:48 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-02-11 13:41 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-11 13:41 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-02-11 13:41 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-02-11 13:41 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-11 13:41 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-11 13:41 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-11 13:41 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-11 13:41 - 2015-01-12 02:23 - 00684544 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-11 13:41 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-02-11 13:41 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-11 13:41 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-11 13:41 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-11 13:41 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-11 13:41 - 2015-01-10 07:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-02-11 13:41 - 2015-01-10 07:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-02-11 13:41 - 2015-01-10 07:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-02-11 13:41 - 2015-01-10 07:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-02-11 13:41 - 2015-01-10 07:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-02-11 13:41 - 2015-01-10 07:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-02-11 13:41 - 2015-01-10 07:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-02-11 13:41 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-11 13:40 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-11 13:40 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-02-11 13:40 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-09 20:46 - 2015-02-24 00:34 - 00000000 ____D () C:\Users\x\AppData\Roaming\vlc
2015-02-09 20:46 - 2015-02-24 00:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2015-02-09 20:46 - 2015-02-09 20:46 - 00000984 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2015-02-08 14:43 - 2015-02-24 00:55 - 00000000 ____D () C:\x
2015-02-08 14:30 - 2015-02-08 14:34 - 00000999 _____ () C:\Users\x\Desktop\MediathekView - Verknüpfung.lnk
2015-02-05 23:01 - 2015-02-05 23:01 - 00001822 _____ () C:\Users\Public\Desktop\TV-Browser.lnk
2015-02-05 21:59 - 2015-02-05 21:59 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-05 20:32 - 2015-02-15 20:33 - 00000000 ____D () C:\Users\x\AppData\Roaming\TV-Browser
2015-02-05 20:30 - 2015-02-05 23:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TV-Browser
2015-02-05 20:30 - 2015-02-05 23:01 - 00000000 ____D () C:\Program Files\TV-Browser
2015-02-03 18:44 - 2015-02-03 18:44 - 00000000 ____D () C:\Users\x\AppData\Local\mquadr.at
2015-02-03 18:43 - 2015-02-05 22:38 - 00000000 ____D () C:\Users\x\AppData\Local\DTAG
2015-02-03 18:04 - 2015-02-08 14:34 - 00000000 ____D () C:\Program Files\MediathekView_8
2015-02-03 17:08 - 2015-02-03 17:08 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\WinRAR
2015-02-03 16:56 - 2015-02-03 16:56 - 00000000 ____D () C:\Users\x\AppData\Roaming\becker
2015-02-03 16:23 - 2015-02-03 16:23 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\ProductData
2015-02-03 16:21 - 2015-02-05 22:45 - 00000000 ____D () C:\Users\x\AppData\Roaming\ProductData
2015-02-03 16:20 - 2015-02-03 16:20 - 00000000 ____D () C:\Windows\Tasks\ImCleanDisabled
2015-02-03 16:20 - 2015-02-03 16:20 - 00000000 ____D () C:\Users\Default\AppData\Roaming\IObit
2015-02-03 16:20 - 2015-02-03 16:20 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\IObit
2015-02-03 16:20 - 2015-02-03 16:20 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Apple Computer
2015-02-03 16:20 - 2015-02-03 16:20 - 00000000 ____D () C:\ProgramData\{BAF091CA-86C4-4627-ADA1-897E2621C1B0}
2015-02-03 16:18 - 2015-02-03 16:47 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\IObit
2015-02-03 16:18 - 2015-02-03 16:47 - 00000000 ____D () C:\ProgramData\IObit
2015-02-03 16:18 - 2015-02-03 16:20 - 00000000 ____D () C:\Users\x\AppData\Roaming\IObit
2015-02-03 16:18 - 2015-02-03 16:20 - 00000000 ____D () C:\ProgramData\ProductData
2015-02-03 14:56 - 2015-02-03 14:56 - 00000000 ____D () C:\Program Files\Common Files\Java
2015-02-03 14:52 - 2015-02-03 14:57 - 00000000 ____D () C:\ProgramData\Oracle
2015-02-03 14:52 - 2015-02-03 14:56 - 00272296 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2015-02-03 14:52 - 2015-02-03 14:52 - 00000000 ____D () C:\ProgramData\Sun
2015-02-03 14:51 - 2015-02-05 22:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-02-03 14:51 - 2015-02-03 14:57 - 00000000 ____D () C:\Program Files\Java
2015-02-03 14:51 - 2015-02-03 14:56 - 00176552 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2015-02-03 14:51 - 2015-02-03 14:56 - 00176552 _____ (Oracle Corporation) C:\Windows\system32\java.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-24 01:18 - 2014-12-09 21:49 - 01754095 _____ () C:\Windows\WindowsUpdate.log
2015-02-24 01:17 - 2009-07-14 05:34 - 00020480 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-24 01:17 - 2009-07-14 05:34 - 00020480 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-24 01:11 - 2013-06-09 16:06 - 00001515 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-02-24 01:10 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-24 00:57 - 2015-01-18 14:30 - 00000000 ____D () C:\Download
2015-02-24 00:56 - 2014-03-24 15:08 - 00000000 ____D () C:\Temp
2015-02-24 00:56 - 2013-02-13 17:28 - 00000000 ____D () C:\Users\x\AppData\Local\GHISLER
2015-02-24 00:36 - 2013-02-13 15:37 - 00000000 ____D () C:\Users\x
2015-02-24 00:34 - 2015-01-12 05:59 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-02-24 00:34 - 2015-01-12 05:35 - 00000000 ____D () C:\Users\x\AppData\Roaming\Mozilla
2015-02-24 00:34 - 2014-04-04 23:06 - 00000000 ____D () C:\Erika
2015-02-24 00:34 - 2013-12-15 14:09 - 00000000 ____D () C:\Program Files\VideoLAN
2015-02-24 00:34 - 2013-08-31 23:35 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\PacificPoker
2015-02-24 00:34 - 2013-05-11 22:13 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Wise Registry Cleaner
2015-02-24 00:34 - 2013-02-13 15:40 - 00000000 ____D () C:\Users\x\AppData\Roaming\GHISLER
2015-02-24 00:34 - 2013-02-12 13:32 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\GHISLER
2015-02-24 00:34 - 2013-02-12 11:57 - 00000000 ____D () C:\Users\Admin
2015-02-24 00:34 - 2009-07-14 03:37 - 00000000 ___RD () C:\Users\Public
2015-02-24 00:34 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\wfp
2015-02-24 00:34 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\registration
2015-02-24 00:34 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\AppCompat
2015-02-24 00:26 - 2013-03-11 22:52 - 00000000 ____D () C:\Users\x\AppData\Local\CrashDumps
2015-02-23 17:01 - 2013-11-24 01:29 - 00000000 ____D () C:\Users\x\dwhelper
2015-02-23 16:21 - 2014-12-10 16:27 - 00000000 ____D () C:\Bilder
2015-02-22 20:32 - 2015-01-14 17:07 - 00000000 ____D () C:\Users\x\.mediathek3
2015-02-20 22:40 - 2013-02-12 12:03 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-17 20:45 - 2014-12-04 20:56 - 00001082 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\WinRAR.lnk
2015-02-17 20:45 - 2013-11-03 17:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-02-17 20:45 - 2013-11-03 17:11 - 00000000 ____D () C:\Program Files\WinRAR
2015-02-17 18:23 - 2014-12-04 20:40 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-02-15 21:49 - 2015-01-14 17:11 - 00000000 ____D () C:\Users\x\MediathekView
2015-02-15 13:39 - 2013-02-12 16:32 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-02-15 13:39 - 2013-02-12 16:32 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-02-13 18:55 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\rescache
2015-02-13 14:07 - 2013-03-10 13:03 - 00000600 _____ () C:\Users\x\AppData\Local\PUTTY.RND
2015-02-12 16:17 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-02-11 15:06 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\tracing
2015-02-11 14:42 - 2014-05-15 17:38 - 00384608 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-11 14:39 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\de-DE
2015-02-11 14:39 - 2009-07-14 03:37 - 00000000 ____D () C:\Program Files\Internet Explorer - ST
2015-02-11 14:33 - 2013-07-13 09:53 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-11 14:29 - 2013-02-12 12:25 - 113756392 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-11 14:28 - 2013-02-12 17:05 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-08 14:55 - 2013-05-13 16:16 - 00013312 _____ () C:\Users\x\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-02-05 22:38 - 2013-12-04 00:38 - 00000000 ____D () C:\Users\x\AppData\Roaming\Nero
2015-02-05 22:22 - 2013-10-30 13:49 - 00000000 ____D () C:\Program Files\Common Files\MAGIX Services
2015-02-05 22:03 - 2013-10-30 13:50 - 00000000 ____D () C:\Users\x\AppData\Roaming\MAGIX
2015-02-05 21:59 - 2013-09-15 18:50 - 00000000 ____D () C:\Program Files\MSXML 4.0
2015-02-03 17:21 - 2015-01-14 18:32 - 00000000 ____D () C:\Users\Admin\.mediathek3
2015-02-03 14:56 - 2015-01-14 17:07 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2015-02-02 19:03 - 2013-02-13 15:37 - 00000000 ____D () C:\Users\x\AppData\Local\Nero
2015-02-02 19:03 - 2009-07-14 05:52 - 00000000 ____D () C:\Windows\twain_32
2015-02-02 19:03 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\NDF
2015-02-02 18:57 - 2009-07-14 05:52 - 00000000 ____D () C:\Windows\system32\FxsTmp
2015-01-26 17:13 - 2009-07-14 05:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-01-26 17:13 - 2009-07-14 05:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU(66).TXT
2015-01-26 17:13 - 2009-07-14 05:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU(31).TXT
==================== Files in the root of some directories =======
2013-05-13 16:16 - 2015-02-08 14:55 - 0013312 _____ () C:\Users\x\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-03-10 13:03 - 2015-02-13 14:07 - 0000600 _____ () C:\Users\x\AppData\Local\PUTTY.RND
2014-01-11 14:20 - 2014-01-11 14:20 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2013-03-12 18:02 - 2013-05-13 15:45 - 0001534 _____ () C:\ProgramData\ss.ini
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 23-02-2015 01
Ran by x at 2015-02-24 01:22:07
Running from D:\Prob
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (HKLM\...\7-Zip) (Version: - )
888poker (HKLM\...\888poker) (Version: - )
ABBYY FineReader 11 (HKLM\...\{F1100000-0011-0000-0001-074957833700}) (Version: 11.0.460 - ABBYY)
Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.239 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Any Video Converter 5.7.7 (HKLM\...\Any Video Converter_is1) (Version: - Any-Video-Converter.com)
Ashampoo Burning Studio 2015 v.1.15.0 (HKLM\...\{91B33C97-21E3-DF34-9630-2EE80DDE1648}_is1) (Version: 1.15.0 - Ashampoo GmbH & Co. KG)
Audacity 2.0.6 (HKLM\...\Audacity_is1) (Version: 2.0.6 - Audacity Team)
Avast Free Antivirus (HKLM\...\Avast) (Version: 10.0.2208 - AVAST Software)
Brother MFL-Pro Suite MFC-J410 (HKLM\...\{FB83EAC4-E3F6-4666-B45B-44522F2344B6}) (Version: 1.0.3.0 - Brother Industries, Ltd.)
Camtasia Studio 8 (HKLM\...\{8F6F7194-0734-4CDA-8C04-6B766F2241A6}) (Version: 8.0.4.1060 - TechSmith Corporation)
CCleaner (HKLM\...\CCleaner) (Version: 4.08 - Piriform)
Content Manager 2 (HKLM\...\Content Manager 2) (Version: 3.18.0.342250 - NNG Llc.)
eReg (Version: 1.20.138.34 - Logitech, Inc.) Hidden
FormatFactory 3.0.1 (HKLM\...\FormatFactory) (Version: 3.0.1 - Free Time)
Fotostory 3 für Windows (HKLM\...\{4F41AD68-89F2-4262-A32C-2F70B01FCE9E}) (Version: 3.0.1115.15 - Microsoft Corporation)
Java 8 Update 31 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
JPEG Lossless Rotator 9.0 (HKLM\...\JPEG Lossless Rotator_is1) (Version: - Anny)
LAME v3.99.3 (for Windows) (HKLM\...\LAME_is1) (Version: - )
Logitech SetPoint 6.65 (HKLM\...\sp6) (Version: 6.65.62 - Logitech)
Logitech Unifying-Software 2.50 (HKLM\...\Logitech Unifying) (Version: 2.50.25 - Logitech)
Microlife BPA 3.2 German (HKLM\...\InstallShield_{2F13B922-A593-4BFE-B863-D6F531D2B0FC}) (Version: 3.2.3 - Microlife)
Microlife BPA 3.2 German (Version: 3.2.3 - Microlife) Hidden
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 35.0.1 (x86 de) (HKLM\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Thunderbird 31.4.0 (x86 de) (HKLM\...\Mozilla Thunderbird 31.4.0 (x86 de)) (Version: 31.4.0 - Mozilla)
Mozilla Thunderbird 31.4.0 (x86 de) (HKU\S-1-5-21-2179699683-2405127896-116133419-1006\...\Mozilla Thunderbird 31.4.0 (x86 de)) (Version: 31.4.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Naviextras Toolbox Prerequesities (HKLM\...\{537575D6-3B96-474C-BD8F-DFF667363DBD}) (Version: 1.0.0 - NNG Llc.)
NVIDIA Grafiktreiber 335.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 335.23 - NVIDIA Corporation)
NVIDIA Update 10.4.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 10.4.0 - NVIDIA Corporation)
Revo Uninstaller Pro 3.0.7 (HKLM\...\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1) (Version: 3.0.7 - VS Revo Group, Ltd.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Total Commander (Remove or Repair) (HKLM\...\Totalcmd) (Version: 8.50 - Ghisler Software GmbH)
TV-Browser 3.4.1.0 (HKLM\...\tvbrowser) (Version: 3.4.1.0 - TV-Browser Team)
Ulead iPhoto Express 1.1 (HKLM\...\Ulead iPhoto Express 1.1) (Version: - )
VCRedistSetup (Version: 1.0.0 - Nero AG) Hidden
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Windows Tweaker (HKLM\...\{F6881752-3DD7-44C9-9AC6-D827A1E641CC}) (Version: 5.3 - Windows Tweaker)
WinRAR 5.01 (32-Bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
WinSCP 5.1.4 (HKLM\...\winscp3_is1) (Version: 5.1.4 - Martin Prikryl)
Wise Registry Cleaner 8.23 (HKLM\...\Wise Registry Cleaner_is1) (Version: 8.23 - WiseCleaner.com, Inc.)
Zoner Photo Studio 14 (HKLM\...\ZonerPhotoStudio14_DE_is1) (Version: 14.0.1.7 - ZONER software)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
ATTENTION: System Restore is disabled.
Check "winmgmt" service or repair WMI.
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
==================== Loaded Modules (whitelisted) ==============
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2015-02-17 18:24 - 2015-02-17 18:24 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
HKU\S-1-5-21-2179699683-2405127896-116133419-1006\Software\Classes\.exe: => <===== ATTENTION!
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-2179699683-2405127896-116133419-1006\Control Panel\Desktop\\Wallpaper -> C:\Users\x\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== Accounts: =============================
Admin (S-1-5-21-2179699683-2405127896-116133419-1001 - Administrator - Enabled) => C:\Users\Admin
Administrator (S-1-5-21-2179699683-2405127896-116133419-500 - Administrator - Disabled)
x (S-1-5-21-2179699683-2405127896-116133419-1006 - Limited - Enabled) => C:\Users\x
Gast (S-1-5-21-2179699683-2405127896-116133419-501 - Limited - Enabled)
HomeGroupUser$ (S-1-5-21-2179699683-2405127896-116133419-1013 - Limited - Enabled)
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
System errors:
=============
Microsoft Office Sessions:
=========================
CodeIntegrity Errors:
===================================
Date: 2014-10-15 22:25:58.615
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\cryptsp.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-10-15 22:25:58.474
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\cryptsp.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-10-15 22:25:58.334
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\cryptsp.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-10-15 22:25:58.193
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\cryptsp.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-10-15 22:25:58.069
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\cryptsp.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-10-15 22:25:57.944
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\cryptsp.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-10-15 22:25:57.819
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\cryptsp.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-10-15 22:25:57.679
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\cryptsp.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-10-15 22:25:57.554
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\cryptsp.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-10-15 22:25:57.429
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\cryptsp.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 |
|
24.02.2015, 06:16
| #2 |
| /// the machine /// TB-Ausbilder    | Was ist das, h(tt)p://ui.skype.c.. unter Mozilla? Hi,
__________________unsere Tools brauchen immer Adminrechte! Scan mit Combofix
__________________ |
|
24.02.2015, 17:48
| #3 |
| | Was ist das, h(tt)p://ui.skype.c.. unter Mozilla? Hallo Schrauber,
__________________alles getan wie angesagt. (Zeile erscheint noch immer) Hier jetzt das Ergebniss. Code:
ATTFilter ComboFix 15-02-16.01 - Admin 24.02.2015 17:20:38.1.2 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.49.1031.18.2047.1194 [GMT 1:00]
ausgeführt von:: c:\download\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\sysdir
c:\windows\system32\sysdir\sycd7ul.dll
c:\windows\unin0407.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2015-01-24 bis 2015-02-24 ))))))))))))))))))))))))))))))
.
.
2015-02-24 16:28 . 2015-02-24 16:28 -------- d-----w- c:\users\Admin\AppData\Local\temp
2015-02-24 16:28 . 2015-02-24 16:28 -------- d-----w- c:\users\x\AppData\Local\temp
2015-02-24 16:28 . 2015-02-24 16:28 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-02-24 02:16 . 2015-02-24 02:16 -------- d-----w- c:\program files\Mozilla Maintenance Service
2015-02-24 01:15 . 2015-02-24 01:22 -------- d-----w- c:\users\x\AppData\Local\Mozilla
2015-02-24 01:01 . 2015-01-29 09:49 9041640 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{259613D4-7B03-4163-AE45-268009A7D88D}\mpengine.dll
2015-02-24 00:52 . 2015-02-17 17:24 291352 ----a-w- c:\windows\system32\aswBoot.exe
2015-02-24 00:17 . 2015-02-24 00:22 -------- d-----w- C:\FRST
2015-02-23 22:39 . 2015-02-23 22:39 -------- d-----w- c:\users\Admin\AppData\Roaming\ParetoLogic
2015-02-23 22:39 . 2015-02-23 22:39 -------- d-----w- c:\users\Admin\AppData\Roaming\DriverCure
2015-02-23 22:38 . 2015-02-23 22:38 -------- d-----w- c:\program files\Common Files\ParetoLogic
2015-02-23 22:38 . 2015-02-23 22:44 -------- d-----w- c:\programdata\ParetoLogic
2015-02-17 19:49 . 2015-02-17 19:49 -------- d-----w- c:\program files\7-Zip
2015-02-17 17:38 . 2015-02-17 17:38 -------- d-----w- c:\users\Admin\AppData\Roaming\AVAST Software
2015-02-17 17:35 . 2015-02-17 17:35 -------- d-----w- c:\users\x\AppData\Roaming\AVAST Software
2015-02-17 17:24 . 2015-02-17 17:24 91496 ----a-w- c:\windows\system32\drivers\aswStm.sys
2015-02-17 17:24 . 2015-02-17 17:24 423784 ----a-w- c:\windows\system32\drivers\aswsp.sys
2015-02-17 17:24 . 2015-02-17 17:24 206248 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2015-02-17 17:24 . 2015-02-17 17:24 49944 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2015-02-17 17:24 . 2015-02-24 00:52 70384 ----a-w- c:\windows\system32\drivers\aswmonflt.sys
2015-02-17 17:24 . 2015-02-17 17:24 24184 ----a-w- c:\windows\system32\drivers\aswHwid.sys
2015-02-17 17:24 . 2015-02-17 17:24 81768 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2015-02-17 17:24 . 2015-02-17 17:25 787800 ----a-w- c:\windows\system32\drivers\aswsnx.sys
2015-02-17 17:24 . 2015-02-17 17:24 43152 ----a-w- c:\windows\avastSS.scr
2015-02-17 17:23 . 2015-02-17 17:23 -------- d-----w- c:\program files\AVAST Software
2015-02-12 12:20 . 2015-01-23 03:43 620032 ----a-w- c:\windows\system32\jscript9diag.dll
2015-02-12 12:20 . 2015-01-23 03:17 4300800 ----a-w- c:\windows\system32\jscript9.dll
2015-02-11 13:54 . 2015-01-09 02:48 27136 ----a-w- c:\windows\system32\powertracker.dll
2015-02-11 13:54 . 2015-01-09 02:48 76800 ----a-w- c:\windows\system32\wdi.dll
2015-02-11 13:54 . 2015-01-09 02:48 635904 ----a-w- c:\windows\system32\perftrack.dll
2015-02-11 12:42 . 2015-01-09 01:45 2380288 ----a-w- c:\windows\system32\win32k.sys
2015-02-11 12:42 . 2015-01-15 07:46 67520 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2015-02-11 12:42 . 2015-01-15 07:46 136640 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2015-02-11 12:42 . 2015-01-15 07:43 15872 ----a-w- c:\windows\system32\sspisrv.dll
2015-02-11 12:42 . 2015-01-15 07:43 100352 ----a-w- c:\windows\system32\sspicli.dll
2015-02-11 12:42 . 2015-01-15 07:42 22016 ----a-w- c:\windows\system32\secur32.dll
2015-02-11 12:42 . 2015-01-15 07:42 1061376 ----a-w- c:\windows\system32\lsasrv.dll
2015-02-11 12:42 . 2015-01-15 07:42 22528 ----a-w- c:\windows\system32\lsass.exe
2015-02-11 12:42 . 2015-01-15 07:42 50176 ----a-w- c:\windows\system32\auditpol.exe
2015-02-11 12:42 . 2015-01-15 07:37 686080 ----a-w- c:\windows\system32\adtschema.dll
2015-02-11 12:42 . 2015-01-15 04:21 369968 ----a-w- c:\windows\system32\drivers\cng.sys
2015-02-11 12:40 . 2014-12-12 05:07 1174528 ----a-w- c:\windows\system32\crypt32.dll
2015-02-11 12:40 . 2015-01-13 02:49 1230336 ----a-w- c:\windows\system32\WindowsCodecs.dll
2015-02-11 12:40 . 2014-12-08 02:46 308224 ----a-w- c:\windows\system32\scesrv.dll
2015-02-09 19:46 . 2015-02-24 00:48 -------- d-----w- c:\users\x\AppData\Roaming\vlc
2015-02-08 13:43 . 2015-02-23 23:55 -------- d-----w- C:\x
2015-02-05 20:59 . 2015-02-05 20:59 -------- d-----w- c:\programdata\Package Cache
2015-02-05 19:32 . 2015-02-15 19:33 -------- d-----w- c:\users\x\AppData\Roaming\TV-Browser
2015-02-05 19:30 . 2015-02-05 22:01 -------- d-----w- c:\program files\TV-Browser
2015-02-03 17:44 . 2015-02-03 17:44 -------- d-----w- c:\users\x\AppData\Local\mquadr.at
2015-02-03 17:43 . 2015-02-05 21:38 -------- d-----w- c:\users\x\AppData\Local\DTAG
2015-02-03 17:04 . 2015-02-08 13:34 -------- d-----w- c:\program files\MediathekView_8
2015-02-03 15:56 . 2015-02-03 15:56 -------- d-----w- c:\users\x\AppData\Roaming\becker
2015-02-03 15:23 . 2015-02-03 15:23 -------- d-----w- c:\users\Admin\AppData\Roaming\ProductData
2015-02-03 15:21 . 2015-02-05 21:45 -------- d-----w- c:\users\x\AppData\Roaming\ProductData
2015-02-03 15:20 . 2015-02-03 15:20 -------- d-----w- c:\users\Default\AppData\Roaming\IObit
2015-02-03 15:20 . 2015-02-03 15:20 -------- d-----w- c:\programdata\{BAF091CA-86C4-4627-ADA1-897E2621C1B0}
2015-02-03 15:20 . 2015-02-03 15:20 -------- d-----w- c:\users\Admin\AppData\Roaming\Apple Computer
2015-02-03 15:18 . 2015-02-03 15:20 -------- d-----w- c:\users\x\AppData\Roaming\IObit
2015-02-03 15:18 . 2015-02-03 15:47 -------- d-----w- c:\programdata\IObit
2015-02-03 15:18 . 2015-02-03 15:20 -------- d-----w- c:\programdata\ProductData
2015-02-03 15:18 . 2015-02-03 15:47 -------- d-----w- c:\users\Admin\AppData\Roaming\IObit
2015-02-03 13:56 . 2015-02-03 13:56 -------- d-----w- c:\program files\Common Files\Java
2015-02-03 13:52 . 2015-02-03 13:57 -------- d-----w- c:\programdata\Oracle
2015-02-03 13:51 . 2015-02-03 13:57 -------- d-----w- c:\program files\Java
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-02-15 12:39 . 2013-02-12 15:32 71344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2015-02-15 12:39 . 2013-02-12 15:32 701616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2015-02-03 13:56 . 2015-01-14 16:07 96680 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2015-01-06 13:46 . 2013-09-15 12:54 87608 ----a-w- c:\users\Admin\AppData\Roaming\inst.exe
2015-01-06 13:46 . 2013-09-15 12:54 47360 ----a-w- c:\users\Admin\AppData\Roaming\pcouffin.sys
2014-12-22 23:50 . 2013-02-12 11:23 249488 ------w- c:\windows\system32\MpSigStub.exe
2014-12-19 02:43 . 2015-01-14 10:37 164864 ----a-w- c:\windows\system32\profsvc.dll
2014-12-19 01:34 . 2015-01-14 10:37 116224 ----a-w- c:\windows\system32\drivers\mrxdav.sys
2014-12-11 17:47 . 2015-01-14 10:37 74240 ----a-w- c:\windows\system32\TSWbPrxy.exe
2014-12-06 03:50 . 2015-01-14 10:37 242688 ----a-w- c:\windows\system32\nlasvc.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2015-02-17 17:24 723976 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2015-02-17 5227112]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"20150107"="c:\program files\AVAST Software\Avast\setup\emupdate\0befd563-4314-4589-ae50-dbec907023ae.exe" [2015-02-24 183232]
"*Restore"="c:\windows\System32\rstrui.exe" [2010-11-20 262656]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2014-03-24 22:50 64280 ----a-w- c:\program files\Common Files\logishrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0sdnclean.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"EvtMgr6"=c:\program files\Logitech\SetPointP\SetPoint.exe /launchGaming
.
R2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys [2015-02-17 91496]
R3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\DRIVERS\ASPI32.sys [2002-07-17 84832]
R3 BrYNSvc;BrYNSvc;c:\program files\Browny02\BrYNSvc.exe [2010-01-25 245760]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2015-01-12 102912]
R3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys [2013-09-15 47360]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 14848]
R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [2009-12-30 27192]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2013-10-02 49152]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2015-02-17 787800]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2015-02-17 423784]
S2 ABBYY.Licensing.FineReader.Professional.11.0;ABBYY FineReader 11 PE Licensing Service;c:\program files\ABBYY FineReader 11\NetworkLicenseServer.exe [2011-12-22 818952]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys [2015-02-17 24184]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2015-02-24 70384]
S3 Apowersoft_AudioDevice;Apowersoft_AudioDevice;c:\windows\system32\drivers\Apowersoft_AudioDevice.sys [2012-10-08 26080]
S3 AVMCOWAN;AVM ISDN CoNDIS WAN CAPI Driver;c:\windows\system32\DRIVERS\AVMCOWAN.sys [2009-07-13 64000]
S3 FPCIBASE;AVM FRITZ!Card PCI;c:\windows\system32\DRIVERS\fpcibase.sys [2009-07-13 559104]
S3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\Drivers\LEqdUsb.Sys [2014-03-19 42264]
S3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\Drivers\LHidEqd.Sys [2014-03-19 10136]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS fdrespub AppIDSvc QWAVE wcncsvc SensrSvc
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.startfenster.de
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9wecem9q.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.startfenster.de
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.alb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="FotoManagerDeluxe.10.alb"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eps\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="MAGIXviewer.eps"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="MAGIXviewer.gif"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="MAGIXviewer.iff"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="MAGIXviewer.pcd"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="MAGIXviewer.png"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tga\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="MAGIXviewer.tga"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="MAGIXviewer.tif"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="MAGIXviewer.tiff"
.
[HKEY_USERS\S-1-5-21-2179699683-2405127896-116133419-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*r¬/9]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-2179699683-2405127896-116133419-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*r¬/9\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_15_0_0_239_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_15_0_0_239_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2015-02-24 17:30:08
ComboFix-quarantined-files.txt 2015-02-24 16:30
.
Vor Suchlauf: 16 Verzeichnis(se), 20.351.369.216 Bytes frei
Nach Suchlauf: 22 Verzeichnis(se), 20.243.714.048 Bytes frei
.
- - End Of File - - B6A2322B35F629C99ADFA68012107022
A36C5E4F47E84449FF07ED3517B43A31
Hoffe das ich es richtig hochlade. in Code Tags. Vielen Dank auch dafür, das du dir hier die mühe machst um mir zu helfen. |
|
25.02.2015, 07:04
| #4 |
| /// the machine /// TB-Ausbilder | Was ist das, h(tt)p://ui.skype.c.. unter Mozilla? Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Was ist das, h(tt)p://ui.skype.c.. unter Mozilla? |
| .dll, administrator, adware, antivirus, avast, browser, converter, defender, desktop, entfernen, explorer, firefox, flash player, homepage, löschen, mozilla, problem, registry, revo uninstaller, scan, security, software, suche, system, total commander, windows, wmp |
WARNUNG an die MITLESER: 
Linear-Darstellung
