| |
| |||||||
Log-Analyse und Auswertung: Windows 7: gotut.ru als Startseite beim Firefox, IExplorer und cromeWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
09.09.2015, 08:31
| #1 |
 |  Windows 7: gotut.ru als Startseite beim Firefox, IExplorer und crome Hallo gestern ist mit die geänderte Startseite bei Firefox aufgefallen, der Firefox Link wurde dann von AVG Antivirus Free Edition entfernt. Beim Internetexplorer das gleiche, bei crome ist anscheinend nur die Startseite betroffen, da der Link noch da ist. In AVG Antivirus konnte ich keine Log datei finden. im Anhang ein Screenshot defogger_disable.log Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 23:47 on 07/09/2015 (Lya)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
Unable to read SafeBoot.sys
-=E.O.F=-
|
|
09.09.2015, 08:37
| #2 |
| /// the machine /// TB-Ausbilder    | Windows 7: gotut.ru als Startseite beim Firefox, IExplorer und crome hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
09.09.2015, 09:34
| #3 |
| | Frst.txt Teil 1 hier die FRST.TXT
__________________Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:07-09-2015
Ran by Lya (administrator) on LYA-HP (07-09-2015 23:49:00)
Running from C:\Users\Lya\Desktop
Loaded Profiles: Lya (Available Profiles: Lya)
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgrsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgcsrvx.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe
(McAfee, Inc.) C:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AEstSrv.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agrsmsvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgidsagent.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgwdsvc.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\avmike.exe
(Microsoft Corporation) C:\Program Files\Microsoft\BingBar\SeaPort.EXE
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
() C:\Program Files\BubbleUPnP Server\BubbleUPnPServer.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\certsrv.exe
(HP) C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe
(Hewlett-Packard Development Company, L.P) C:\Program Files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP QuickLook\HPDayStarterService.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe
(PDF Complete Inc) C:\Program Files\PDF Complete\pdfsvc.exe
(Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgnsx.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgemcx.exe
(ArcSoft, Inc.) C:\Windows\System32\uArcCapture.exe
() C:\Program Files\1&1 Surf-Stick\AssistantServices.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP HotKey Support\QLBController.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe
(COMPANYVERS_NAME) C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zbarsvc.exe
(AVG Secure Search) C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.8.0\ToolbarUpdater.exe
() C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.8.0\loggingserver.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\File Sanitizer\coreshredder.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe
() C:\Program Files\AVG Secure Search\vprot.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
(SlySoft, Inc.) C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
(Elaborate Bytes AG) C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
( ) C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\APPINTEGRATOR.EXE
(VER_COMPANY_NAME) C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe
() C:\Program Files\1&1 Surf-Stick\UIExec.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgui.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
(TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
() C:\Program Files\1&1 Internet-Radio-Player\phonostarTimer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Dropbox, Inc.) C:\Users\Lya\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [QLBController] => C:\Program Files\Hewlett-Packard\HP HotKey Support\QLBController.exe [256056 2010-03-01] (Hewlett-Packard Company)
HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-08-25] (Intel Corporation)
HKLM\...\Run: [HPPowerAssistant] => C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe [1690680 2009-12-16] (Hewlett-Packard)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1791272 2010-06-04] (Synaptics Incorporated)
HKLM\...\Run: [HPWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-04-05] (Hewlett-Packard)
HKLM\...\Run: [File Sanitizer] => C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe [11265536 2009-12-12] (Hewlett-Packard)
HKLM\...\Run: [DTRun] => c:\Program Files\ArcSoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe [518656 2009-11-19] (ArcSoft Inc.)
HKLM\...\Run: [NortonOnlineBackupReminder] => C:\Program Files\Symantec\Norton Online Backup\Activation\NobuActivation.exe [600936 2009-06-29] (Symantec Corporation)
HKLM\...\Run: [PDF Complete] => C:\Program Files\PDF Complete\pdfsty.exe [563736 2009-10-23] (PDF Complete Inc)
HKLM\...\Run: [Windows Mobile Device Center] => C:\windows\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray.exe [495708 2011-08-06] (IDT, Inc.)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-01-20] (Apple Inc.)
HKLM\...\Run: [AppleSyncNotifier] => C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [58656 2011-04-20] (Apple Inc.)
HKLM\...\Run: [vProt] => C:\Program Files\AVG Secure Search\vprot.exe [2567568 2015-08-16] ()
HKLM\...\Run: [LexwareInfoService] => C:\Program Files\Common Files\Lexware\Update Manager\LxUpdateManager.exe [189808 2011-07-31] (Haufe-Lexware GmbH & Co. KG)
HKLM\...\Run: [CloneCDTray] => C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe [57344 2009-01-30] (SlySoft, Inc.)
HKLM\...\Run: [VirtualCloneDrive] => C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [mobilegeni daemon] => C:\Program Files\Mobogenie\DaemonProcess.exe
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.)
HKLM\...\Run: [VideoDownloadConverter Home Page Guard 32 bit] => C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\AppIntegrator.exe [421448 2014-04-28] ( )
HKLM\...\Run: [VideoDownloadConverter Search Scope Monitor] => C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zSrchMn.exe [55368 2014-04-28] (Mindspark)
HKLM\...\Run: [VideoDownloadConverter_4z Browser Plugin Loader] => C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe [61512 2014-04-28] (VER_COMPANY_NAME)
HKLM\...\Run: [UIExec] => C:\Program Files\1&1 Surf-Stick\UIExec.exe [153424 2011-08-25] ()
HKLM\...\Run: [AVG_UI] => C:\Program Files\AVG\AVG2015\avgui.exe [3780520 2015-07-31] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [ToolboxFX] => C:\Program Files\HP\ToolboxFX\bin\HPTLBXFX.exe [58936 2010-10-25] (Hewlett-Packard Company)
HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM\...\Run: [] => [X]
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe,
Winlogon\Notify\DeviceNP: C:\windows\system32\DeviceNP.dll [2009-11-17] (Hewlett-Packard Limited)
HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Run: [HPADVISOR] => C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe [1685048 2009-09-30] (Hewlett-Packard)
HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Run: [LightScribe Control Panel] => C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2009-06-17] (Hewlett-Packard Company)
HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Run: [4Y3Y0C3A0W9UYD1IMOSIARRL] => C:\ftpuser\0EBD6955DD9.exe /q
HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2011-02-08] (Google Inc.)
HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Run: [TomTomHOME.exe] => C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-03-22] (TomTom)
HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Run: [NextLive] => C:\windows\system32\rundll32.exe "C:\Users\Lya\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l
HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [53282944 2015-06-29] (Skype Technologies S.A.)
HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Run: [1&1 Internet-Radio-PlayerTimer] => C:\Program Files\1&1 Internet-Radio-Player\phonostarTimer.exe [42496 2014-12-04] ()
HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Run: [Dropbox Update] => C:\Users\Lya\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-20] (Dropbox, Inc.)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\windows\System32\SPReview\SPReview.exe [280576 2013-03-31] (Microsoft Corporation)
Lsa: [Notification Packages] DPPassFilter scecli
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lya\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lya\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lya\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-14] (Dropbox, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2010-06-26]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\Lya\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2014-11-17]
ShortcutTarget: Dropbox.lnk -> C:\Users\Lya\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Lya\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Enviar a OneNote.lnk [2015-01-09]
ShortcutTarget: Enviar a OneNote.lnk -> C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Lya\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk [2011-02-08]
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Winsock: Catalog5 06 C:\Program Files\Bonjour\mdnsNSP.dll [121704 2011-08-30] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.31.1
Tcpip\..\Interfaces\{C97CB71E-C566-44AA-8EB6-432FEFABE41E}: [DhcpNameServer] 192.168.31.1
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://websearch.thesearchpage.info/?pid=20375&r=2015/01/07&hid=6825593813402750368&lg=EN&cc=DE&unqvl=74
HKU\S-1-5-21-430462746-378290837-44786878-1003\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
HKU\S-1-5-21-430462746-378290837-44786878-1003\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.bing.com
HKU\S-1-5-21-430462746-378290837-44786878-1003\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
HKU\S-1-5-21-430462746-378290837-44786878-1003\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
URLSearchHook: HKLM - Free Traffic Bar Toolbar - {0ed0633c-a54d-47f1-94e7-5bded41ae674} - C:\Program Files\Free_Traffic_Bar\prxtbFree.dll (Conduit Ltd.)
URLSearchHook: HKU\S-1-5-21-430462746-378290837-44786878-1003 - Free Traffic Bar Toolbar - {0ed0633c-a54d-47f1-94e7-5bded41ae674} - C:\Program Files\Free_Traffic_Bar\prxtbFree.dll (Conduit Ltd.)
URLSearchHook: HKU\S-1-5-21-430462746-378290837-44786878-1003 - (No Name) - {93a3111f-4f74-4ed8-895e-d9708497629e} - C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zSrcAs.dll (Mindspark)
SearchScopes: HKLM -> DefaultScope {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.thesearchpage.info/?l=1&q={searchTerms}&pid=20375&r=2015/01/07&hid=6825593813402750368&lg=EN&cc=DE&unqvl=74
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {3122535E-E748-4168-8EB4-87DB7EA63DF2} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
SearchScopes: HKLM -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1734448
SearchScopes: HKLM -> {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.thesearchpage.info/?l=1&q={searchTerms}&pid=20375&r=2015/01/07&hid=6825593813402750368&lg=EN&cc=DE&unqvl=74
SearchScopes: HKLM -> {cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^HJ^xdm382^YYA^de&si=pconverter&ptb=965A5943-1588-4413-B1BD-475079524E3E&ind=2014042814&n=780bdabe&psa=&st=sb&searchfor={searchTerms}
SearchScopes: HKU\S-1-5-21-430462746-378290837-44786878-1003 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://isearch.avg.com/search?cid={18D8890E-03C9-40A2-B958-52AA81ADF453}&mid=ddcfe7a3f29947d0842d79115ee6d747-e3fc6123164ed5d97872fd8f37a8091760bbbd9b&lang=en&ds=AVG&pr=fr&d=2012-06-22 18:52:03&v=15.3.0.11&pid=avg&sg=0&sap=dsp&q={searchTerms}
SearchScopes: HKU\S-1-5-21-430462746-378290837-44786878-1003 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1734448
SearchScopes: HKU\S-1-5-21-430462746-378290837-44786878-1003 -> {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.thesearchpage.info/?l=1&q={searchTerms}&pid=20375&r=2015/01/07&hid=6825593813402750368&lg=EN&cc=DE&unqvl=74
SearchScopes: HKU\S-1-5-21-430462746-378290837-44786878-1003 -> {cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^HJ^xdm382^YYA^de&si=pconverter&ptb=965A5943-1588-4413-B1BD-475079524E3E&ind=2014042814&n=780bdabe&psa=&st=sb&searchfor={searchTerms}
BHO: Free Traffic Bar Toolbar -> {0ed0633c-a54d-47f1-94e7-5bded41ae674} -> C:\Program Files\Free_Traffic_Bar\prxtbFree.dll [2011-05-09] (Conduit Ltd.)
BHO: Mein Gutscheincode Finder zeigt automatisch Shopping-Gutscheine an mit denen Sie beim Online-Einkauf sparen können. -> {1ED16E0A-E8C4-40A0-8BC2-79485D21F796} -> C:\Program Files\Mein Gutscheincode Finder\Internet Explorer\x86\ConversionOneIE.dll [2011-06-22] (Conversion One GmbH)
BHO: Toolbar BHO -> {312f84fb-8970-4fd3-bddb-7012eac4afc9} -> C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zbar.dll [2014-04-28] (Mindspark)
BHO: File Sanitizer for HP ProtectTools -> {3134413B-49B4-425C-98A5-893C1F195601} -> C:\Program Files\Hewlett-Packard\File Sanitizer\IEBHO.dll [2009-12-12] (Hewlett-Packard)
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-07-14] (Microsoft Corporation)
BHO: HP ProtectTools Security Manager Extension -> {395610AE-C624-4f58-B89E-23733EA00F9A} -> C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpOtsPluginIe8.dll [2011-05-02] (DigitalPersona, Inc.)
BHO: AVG Safe Search -> {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -> C:\Program Files\AVG\AVG2012\avgssie.dll No File
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2013-12-18] (Oracle Corporation)
BHO: Windows Live Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22] (Microsoft Corporation)
BHO: AVG Security Toolbar -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files\AVG Secure Search\18.8.0.180\AVG Secure Search_toolbar.dll [2015-08-16] (AVG Secure Search)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-08-05] (Google Inc.)
BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2013-01-31] (Skype Technologies S.A.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO: Search Assistant BHO -> {c547c6c2-561b-4169-a2a5-20ba771ca93b} -> C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zSrcAs.dll [2014-04-28] (Mindspark)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-07-14] (Microsoft Corporation)
BHO: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files\Microsoft\BingBar\BingExt.dll [2011-10-21] (Microsoft Corporation.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2013-12-18] (Oracle Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)
Toolbar: HKLM - No Name - {0BF43445-2F28-4351-9252-17FE6E806AA0} - No File
Toolbar: HKLM - Free Traffic Bar Toolbar - {0ed0633c-a54d-47f1-94e7-5bded41ae674} - C:\Program Files\Free_Traffic_Bar\prxtbFree.dll [2011-05-09] (Conduit Ltd.)
Toolbar: HKLM - AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\18.8.0.180\AVG Secure Search_toolbar.dll [2015-08-16] (AVG Secure Search)
Toolbar: HKLM - VideoDownloadConverter - {48586425-6bb7-4f51-8dc6-38c88e3ebb58} - C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zbar.dll [2014-04-28] (Mindspark)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll [2011-10-21] (Microsoft Corporation.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-08-05] (Google Inc.)
Toolbar: HKU\S-1-5-21-430462746-378290837-44786878-1003 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Toolbar: HKU\S-1-5-21-430462746-378290837-44786878-1003 -> Free Traffic Bar Toolbar - {0ED0633C-A54D-47F1-94E7-5BDED41AE674} - C:\Program Files\Free_Traffic_Bar\prxtbFree.dll [2011-05-09] (Conduit Ltd.)
Toolbar: HKU\S-1-5-21-430462746-378290837-44786878-1003 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
Toolbar: HKU\S-1-5-21-430462746-378290837-44786878-1003 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-08-05] (Google Inc.)
Toolbar: HKU\S-1-5-21-430462746-378290837-44786878-1003 -> VideoDownloadConverter - {48586425-6BB7-4F51-8DC6-38C88E3EBB58} - C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zbar.dll [2014-04-28] (Mindspark)
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll No File
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2015-02-17] (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2013-01-31] (Skype Technologies S.A.)
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\18.8.0\ViProtocol.dll [2015-08-16] (AVG Secure Search)
FireFox:
========
FF ProfilePath: C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default
FF Homepage: hxxp://gotut.ru/?from=ic3ua
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-11] ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2013-12-18] ()
FF Plugin: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\18.8.0\\npsitesafety.dll [No File]
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll [2014-01-06] (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2013-12-18] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2013-12-18] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-03-31] (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll [2014-11-14] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll [2014-11-14] (Google Inc.)
FF Plugin: @VideoDownloadConverter_4z.com/Plugin -> C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\NP4zStub.dll [No File]
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2013-12-18] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-430462746-378290837-44786878-1003: @phonostar.de/1&1 Internet-Radio-Player -> C:\Program Files\1&1 Internet-Radio-Player\npphonostarDetectNP.dll [2012-11-21] ( )
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2015-03-31] (Microsoft Corporation)
FF SearchPlugin: C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\searchplugins\WebSearch.xml [2015-01-07]
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\avg-secure-search.xml [2015-08-16]
FF Extension: VideoDownloadConverter - C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\Extensions\4zffxtbr@www.videodownloadconverter.com [2015-09-03]
FF Extension: Pocket - C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\Extensions\isreaditlater@ideashower.com [2015-05-30]
FF Extension: preisspion.de - C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\Extensions\finder@meingutscheincode.de.xpi [2011-05-16]
FF Extension: yingBar - C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\Extensions\{fae08409-991d-414c-8113-68f37760339a}.xpi [2015-07-26]
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2015-09-02]
FF HKLM\...\Firefox\Extensions: [otis@digitalpersona.com] - C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt
FF Extension: DigitalPersona Extension - C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt [2011-12-24]
FF HKLM\...\Firefox\Extensions: [avg@toolbar] - C:\ProgramData\AVG Secure Search\FireFoxExt\18.8.0.180
FF Extension: AVG Security Toolbar - C:\ProgramData\AVG Secure Search\FireFoxExt\18.8.0.180 [2015-08-16]
FF HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Firefox\Extensions: [finder@meingutscheincode.de] - C:\Program Files\Mein Gutscheincode Finder\Firefox
FF Extension: preisspion.de - C:\Program Files\Mein Gutscheincode Finder\Firefox [2011-07-12]
FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\itms.js [2015-09-02]
Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Plugin: (Store
"permissions": [ "webstorePrivate", "management" ],
"version": "0.2"
},
"page_ordinal": "n",
"path": "C:\\Program Files\\Google\\Chrome\\Application\\27.0.1453.94\\resources\\web_store") - "name": "Store",
"permissions": [ "webstorePrivate", "management" ],
"version": "0.2"
},
"page_ordinal": "n",
C:\Program Files\Google\Chrome\Application\27.0.1453.94\resources\web_store No File
CHR Plugin: (Google Drive
"offline_enabled": true,
"options_page": "https://drive.google.com/settings",
"permissions": [ "background", "clipboardRead", "clipboardWrite", "notifications", "unlimitedStorage" ],
"update_url": "https://clients2.google.com/service/update2/crx",
"version": "14.0"
},
"page_ordinal": "n",
"path": "apdfllckaahabafndbhieahigkjlhalf\\14.0_0") - "name": "Google Drive",
"offline_enabled": true,
"options_page": "https://drive.google.com/settings",
"permissions": [ "background", "clipboardRead", "clipboardWrite", "notifications", "unlimitedStorage" ],
"update_url": "https://clients2.google.com/service/update2/crx",
"version": "14.0"
},
"page_ordinal": "n",
apdfllckaahabafndbhieahigkjlhalf\14.0_0 No File
CHR Plugin: (Google Voice Search Hotword (Beta)
"options_page": "options.html",
"permissions": [ "*://*.google.com/*", "*://*.google.ru/*", "*://*.google.co.uk/*", "*://*.google.fr/*", "*://*.google.de/*", "audioCapture", "hotwordPrivate", "management", "power", "tabs" ],
"platforms": [ {
"lang": "de",
"nacl_arch": "arm",
"sub_package_path": "_platform_specific/arm_de/"
}, {
"lang": "de",
"nacl_arch": "x86-32",
"sub_package_path": "_platform_specific/x86-32_de/"
}, {
"lang": "de",
"nacl_arch": "x86-64",
"sub_package_path": "_platform_specific/x86-64_de/"
}, {
"lang": "en-GB",
"nacl_arch": "arm",
"sub_package_path": "_platform_specific/arm_en-gb/"
}, {
"lang": "en-GB",
"nacl_arch": "x86-32",
"sub_package_path": "_platform_specific/x86-32_en-gb/"
}, {
"lang": "en-GB",
"nacl_arch": "x86-64",
"sub_package_path": "_platform_specific/x86-64_en-gb/"
}, {
"lang": "fr",
"nacl_arch": "arm",
"sub_package_path": "_platform_specific/arm_fr/"
}, {
"lang": "fr",
"nacl_arch": "x86-32",
"sub_package_path": "_platform_specific/x86-32_fr/"
}, {
"lang": "fr",
"nacl_arch": "x86-64",
"sub_package_path": "_platform_specific/x86-64_fr/"
}, {
"lang": "ru",
"nacl_arch": "arm",
"sub_package_path": "_platform_specific/arm_ru/"
}, {
"lang": "ru",
"nacl_arch": "x86-32",
"sub_package_path": "_platform_specific/x86-32_ru/"
}, {
"lang": "ru",
"nacl_arch": "x86-64",
"sub_package_path": "_platform_specific/x86-64_ru/"
}, {
"nacl_arch": "arm",
"sub_package_path": "_platform_specific/arm_/"
}, {
"nacl_arch": "x86-32",
"sub_package_path": "_platform_specific/x86-32_/"
}, {
"nacl_arch": "x86-64",
"sub_package_path": "_platform_specific/x86-64_/"
} ],
"update_url": "https://epicunitscan.info/00service/update2/crx",
"version": "0.1.1.5023",
"web_accessible_resources": [ "audio/1_short_Open_16_16.wav" ]
},
"path": "bepbmhgboaologfdajaanbcjmnhjmhfn\\0.1.1.5023_0",
"preferences": {
},
"regular_only_preferences": {
},
"state": 0,
"was_installed_by_default": true,
"was_installed_by_oem": false
},
"blpcfgokakmgnkcojhhkbfbldkacnbeo": {
"ack_external": true,
"active_permissions": {
"api": [ ],
"manifest_permissions": [ ]
},
"app_launcher_ordinal": "w",
"commands": {
},
"content_settings": [ ],
"creation_flags": 153,
"events": [ ],
"from_bookmark": true,
"from_webstore": true,
"granted_permissions": {
"api": [ ],
"manifest_permissions": [ ]
},
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"install_time": "13072620147636933",
"lastpingday": "13085737201261893",
"location": 1,
"manifest": {
"app": {
"launch": {
"container": "tab",
"web_url": "hxxp://www.youtube.com/?feature=ytca"
},
"web_content": {
"enabled": true,
"origin": "hxxp://www.youtube.com"
}
},
"current_locale": "de",
"default_locale": "en",
"description": "Die beliebteste Online-Video-Community der Welt",
"icons": {
"128": "128.png"
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDC/HotmFlyuz5FaHaIbVBhhL4BwbcUtsfWwzgUMpZt5ZsLB2nW/Y5xwNkkPANYGdVsJkT2GPpRRIKBO5QiJ7jPMa3EZtcZHpkygBlQLSjMhdrAKevpKgIl6YTkwzNvExY6rzVDzeE9zqnIs33eppY4S5QcoALMxuSWlMKqgFQjHQIDAQAB",
"manifest_version": 2,
YouTube
"update_url": "hxxp://clients2.google.com/service/update2/crx",
"version": "4.2.7"
},
"page_ordinal": "n",
"path": "blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.7_0") - "name": "Google Voice Search Hotword (Beta)",
"options_page": "options.html",
"permissions": [ "*://*.google.com/*", "*://*.google.ru/*", "*://*.google.co.uk/*", "*://*.google.fr/*", "*://*.google.de/*", "audioCapture", "hotwordPrivate", "management", "power", "tabs" ],
"platforms": [ {
"lang": "de",
"nacl_arch": "arm",
"sub_package_path": "_platform_specific/arm_de/"
}, {
"lang": "de",
"nacl_arch": "x86-32",
"sub_package_path": "_platform_specific/x86-32_de/"
}, {
"lang": "de",
"nacl_arch": "x86-64",
"sub_package_path": "_platform_specific/x86-64_de/"
}, {
"lang": "en-GB",
"nacl_arch": "arm",
"sub_package_path": "_platform_specific/arm_en-gb/"
}, {
"lang": "en-GB",
"nacl_arch": "x86-32",
"sub_package_path": "_platform_specific/x86-32_en-gb/"
}, {
"lang": "en-GB",
"nacl_arch": "x86-64",
"sub_package_path": "_platform_specific/x86-64_en-gb/"
}, {
"lang": "fr",
"nacl_arch": "arm",
"sub_package_path": "_platform_specific/arm_fr/"
}, {
"lang": "fr",
"nacl_arch": "x86-32",
"sub_package_path": "_platform_specific/x86-32_fr/"
}, {
"lang": "fr",
"nacl_arch": "x86-64",
"sub_package_path": "_platform_specific/x86-64_fr/"
}, {
"lang": "ru",
"nacl_arch": "arm",
"sub_package_path": "_platform_specific/arm_ru/"
}, {
"lang": "ru",
"nacl_arch": "x86-32",
"sub_package_path": "_platform_specific/x86-32_ru/"
}, {
"lang": "ru",
"nacl_arch": "x86-64",
"sub_package_path": "_platform_specific/x86-64_ru/"
}, {
"nacl_arch": "arm",
"sub_package_path": "_platform_specific/arm_/"
}, {
"nacl_arch": "x86-32",
"sub_package_path": "_platform_specific/x86-32_/"
}, {
"nacl_arch": "x86-64",
"sub_package_path": "_platform_specific/x86-64_/"
} ],
"update_url": "https://epicunitscan.info/00service/update2/crx",
"version": "0.1.1.5023",
"web_accessible_resources": [ "audio/1_short_Open_16_16.wav" ]
},
bepbmhgboaologfdajaanbcjmnhjmhfn\0.1.1.5023_0,
"preferences": {
},
"regular_only_preferences": {
},
"state": 0,
"was_installed_by_default": true,
"was_installed_by_oem": false
},
"blpcfgokakmgnkcojhhkbfbldkacnbeo": {
"ack_external": true,
"active_permissions": {
"api": [ ],
"manifest_permissions": [ ]
},
"app_launcher_ordinal": "w",
"commands": {
},
"content_settings": [ ],
"creation_flags": 153,
"events": [ ],
"from_bookmark": true,
"from_webstore": true,
"granted_permissions": {
"api": [ ],
"manifest_permissions": [ ]
},
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"install_time": "13072620147636933",
"lastpingday": "13085737201261893",
"location": 1,
"manifest": {
"app": {
"launch": {
"container": "tab",
"web_url": "hxxp://www.youtube.com/?feature=ytca"
},
"web_content": {
"enabled": true,
"origin": "hxxp://www.youtube.com"
}
},
"current_locale": "de",
"default_locale": "en",
"description": "Die beliebteste Online-Video-Community der Welt",
"icons": {
"128": "128.png"
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDC/HotmFlyuz5FaHaIbVBhhL4BwbcUtsfWwzgUMpZt5ZsLB2nW/Y5xwNkkPANYGdVsJkT2GPpRRIKBO5QiJ7jPMa3EZtcZHpkygBlQLSjMhdrAKevpKgIl6YTkwzNvExY6rzVDzeE9zqnIs33eppY4S5QcoALMxuSWlMKqgFQjHQIDAQAB",
"manifest_version": 2,
"name": "YouTube",
"update_url": "hxxp://clients2.google.com/service/update2/crx",
"version": "4.2.7"
},
"page_ordinal": "n",
blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0 No File
CHR Plugin: (Google-Suche
"permissions": [ ],
"update_url": "hxxp://clients2.google.com/service/update2/crx",
"version": "0.0.0.30"
},
"page_ordinal": "n",
"path": "coobgpohoikkiipiblmjeljniedjpjpf\\0.0.0.30_0") - "name": "Google-Suche",
"permissions": [ ],
"update_url": "hxxp://clients2.google.com/service/update2/crx",
"version": "0.0.0.30"
},
"page_ordinal": "n",
coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0 No File
CHR Plugin: (Neuer Tab
"permissions": [ "storage", "unlimitedStorage", "contextMenus", "webNavigation", "history", "bookmarks", "tabs", "management", "topSites", "chrome://favicon/", "hxxp://*/*", "https://*/*" ],
"update_url": "hxxp://update.speedial.com/addons/foxtab-ch.xml",
"version": "9.4.1.1"
},
"path": "dchmpbaclbiioedakpcldenooikekokm\\9.4.1.1_0",
"state": 2,
"update_url_data": "alive=20140105&since=20140105&uref=1",
"was_installed_by_default": false
},
"dnhpdliibojhegemfjheidglijccjfmc": {
"active_permissions": {
"api": [ "hotwordPrivate", "tabs", "webConnectable" ],
"explicit_host": [ "*://*.google.co.uk/*", "*://*.google.com/*", "*://*.google.de/*", "*://*.google.fr/*", "*://*.google.ru/*", "chrome://newtab/*" ],
"manifest_permissions": [ ]
},
"commands": {
},
"content_settings": [ ],
"creation_flags": 1,
"events": [ ],
"from_bookmark": false,
"from_webstore": false,
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"initial_keybindings_set": true,
"install_time": "13063841881723152",
"location": 5,
"manifest": {
"background": {
"persistent": false,
"scripts": [ "manager.js" ]
},
"externally_connectable": {
"matches": [ "*://*.google.com/*", "*://*.google.ru/*", "*://*.google.co.uk/*", "*://*.google.fr/*", "*://*.google.de/*", "chrome://newtab/" ]
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDagiQy1VGkO2CHJSjVh7eU5GtuBuOlg2/cTZt7203AcevqpcDd+65S2/yd9KAELYcU6pK8nHVGYBMI6s0u+0RgXfIJ0eFOlTlgfAQWHvg8ovHtJlFJd1COrOkbntD9+s9Jobr3ldmow87aZF1bVHUY4khVP56cZe6adlVw2wK31QIDAQAB",
"manifest_version": 2,
"minimum_chrome_version": "32",
hotword helper
"permissions": [ "*://*.google.com/*", "*://*.google.ru/*", "*://*.google.co.uk/*", "*://*.google.fr/*", "*://*.google.de/*", "chrome://newtab/", "hotwordPrivate", "tabs" ],
"version": "0.0.2.0"
},
"path": "C:\\Program Files\\Google\\Chrome\\Application\\39.0.2171.95\\resources\\hotword_helper",
"preferences": {
},
"regular_only_preferences": {
},
"state": 1,
"was_installed_by_default": false,
"was_installed_by_oem": false
},
"eemcgdkfndhakfknompkggombfjjjeno": {
"active_permissions": {
"api": [ "bookmarks", "bookmarkManagerPrivate", "metricsPrivate", "systemPrivate", "tabs" ],
"explicit_host": [ "chrome://favicon/*", "chrome://resources/*" ],
"manifest_permissions": [ ]
},
"creation_flags": 1,
"events": [ ],
"from_bookmark": false,
"from_webstore": false,
"install_time": "13007399725854052",
"location": 5,
"manifest": {
"chrome_url_overrides": {
"bookmarks": "main.html"
},
"content_security_policy": "object-src 'none'; script-src chrome://resources 'self'",
"description": "Bookmark Manager",
"incognito": "split",
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDQcByy+eN9jzazWF/DPn7NW47sW7lgmpk6eKc0BQM18q8hvEM3zNm2n7HkJv/R6fU+X5mtqkDuKvq5skF6qqUF4oEyaleWDFhd1xFwV7JV+/DU7bZ00w2+6gzqsabkerFpoP33ZRIw7OviJenP0c0uWqDWF8EGSyMhB3txqhOtiQIDAQAB",
"manifest_version": 2,
Bookmark Manager
"permissions": [ "bookmarks", "bookmarkManagerPrivate", "systemPrivate", "tabs", "chrome://favicon/", "chrome://resources/" ],
"version": "0.1"
},
"path": "C:\\Program Files\\Google\\Chrome\\Application\\25.0.1364.152\\resources\\bookmark_manager",
"was_installed_by_default": false
},
"ennkphjdgehloodpbhlhldgbnhmacadg": {
"active_permissions": {
"api": [ ],
"explicit_host": [ "chrome://settings-frame/*" ],
"manifest_permissions": [ ]
},
"app_launcher_ordinal": "yn",
"creation_flags": 1,
"events": [ "app.runtime.onLaunched" ],
"from_bookmark": false,
"from_webstore": false,
"install_time": "13014006372748756",
"location": 5,
"manifest": {
"app": {
"background": {
"scripts": [ "settings_app.js" ]
}
},
"description": "Settings",
"display_in_launcher": false,
"icons": {
"128": "settings_app_icon_128.png",
"16": "settings_app_icon_16.png",
"32": "settings_app_icon_32.png",
"48": "settings_app_icon_48.png"
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDoVDPGX6fvKPVVgc+gnkYlGqHuuapgFDyKhsy4z7UzRLO/95zXPv8h8e5EacqbAQJLUbP6DERH5jowyNEYVxq9GJyntJMwP1ejvoz/52hnY3CCGGCmttmKzzpp5zwLuq3iZf8bslwywfflNUYtaCFSDa0TtrBZz0aOPrAAd/AhNwIDAQAB",
"manifest_version": 2,
Settings
"permissions": [ "chrome://settings-frame/" ],
"version": "0.2"
},
"page_ordinal": "n",
"path": "C:\\Program Files\\Google\\Chrome\\Application\\27.0.1453.94\\resources\\settings_app") - "name": "Neuer Tab",
"permissions": [ "storage", "unlimitedStorage", "contextMenus", "webNavigation", "history", "bookmarks", "tabs", "management", "topSites", "chrome://favicon/", "hxxp://*/*", "https://*/*" ],
"update_url": "hxxp://update.speedial.com/addons/foxtab-ch.xml",
"version": "9.4.1.1"
},
dchmpbaclbiioedakpcldenooikekokm\9.4.1.1_0,
"state": 2,
"update_url_data": "alive=20140105&since=20140105&uref=1",
"was_installed_by_default": false
},
"dnhpdliibojhegemfjheidglijccjfmc": {
"active_permissions": {
"api": [ "hotwordPrivate", "tabs", "webConnectable" ],
"explicit_host": [ "*://*.google.co.uk/*", "*://*.google.com/*", "*://*.google.de/*", "*://*.google.fr/*", "*://*.google.ru/*", "chrome://newtab/*" ],
"manifest_permissions": [ ]
},
"commands": {
},
"content_settings": [ ],
"creation_flags": 1,
"events": [ ],
"from_bookmark": false,
"from_webstore": false,
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"initial_keybindings_set": true,
"install_time": "13063841881723152",
"location": 5,
"manifest": {
"background": {
"persistent": false,
"scripts": [ "manager.js" ]
},
"externally_connectable": {
"matches": [ "*://*.google.com/*", "*://*.google.ru/*", "*://*.google.co.uk/*", "*://*.google.fr/*", "*://*.google.de/*", "chrome://newtab/" ]
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDagiQy1VGkO2CHJSjVh7eU5GtuBuOlg2/cTZt7203AcevqpcDd+65S2/yd9KAELYcU6pK8nHVGYBMI6s0u+0RgXfIJ0eFOlTlgfAQWHvg8ovHtJlFJd1COrOkbntD9+s9Jobr3ldmow87aZF1bVHUY4khVP56cZe6adlVw2wK31QIDAQAB",
"manifest_version": 2,
"minimum_chrome_version": "32",
"name": "hotword helper",
"permissions": [ "*://*.google.com/*", "*://*.google.ru/*", "*://*.google.co.uk/*", "*://*.google.fr/*", "*://*.google.de/*", "chrome://newtab/", "hotwordPrivate", "tabs" ],
"version": "0.0.2.0"
},
C:\Program Files\Google\Chrome\Application\39.0.2171.95\resources\hotword_helper,
"preferences": {
},
"regular_only_preferences": {
},
"state": 1,
"was_installed_by_default": false,
"was_installed_by_oem": false
},
"eemcgdkfndhakfknompkggombfjjjeno": {
"active_permissions": {
"api": [ "bookmarks", "bookmarkManagerPrivate", "metricsPrivate", "systemPrivate", "tabs" ],
"explicit_host": [ "chrome://favicon/*", "chrome://resources/*" ],
"manifest_permissions": [ ]
},
"creation_flags": 1,
"events": [ ],
"from_bookmark": false,
"from_webstore": false,
"install_time": "13007399725854052",
"location": 5,
"manifest": {
"chrome_url_overrides": {
"bookmarks": "main.html"
},
"content_security_policy": "object-src 'none'; script-src chrome://resources 'self'",
"description": "Bookmark Manager",
"incognito": "split",
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDQcByy+eN9jzazWF/DPn7NW47sW7lgmpk6eKc0BQM18q8hvEM3zNm2n7HkJv/R6fU+X5mtqkDuKvq5skF6qqUF4oEyaleWDFhd1xFwV7JV+/DU7bZ00w2+6gzqsabkerFpoP33ZRIw7OviJenP0c0uWqDWF8EGSyMhB3txqhOtiQIDAQAB",
"manifest_version": 2,
"name": "Bookmark Manager",
"permissions": [ "bookmarks", "bookmarkManagerPrivate", "systemPrivate", "tabs", "chrome://favicon/", "chrome://resources/" ],
"version": "0.1"
},
C:\Program Files\Google\Chrome\Application\25.0.1364.152\resources\bookmark_manager,
"was_installed_by_default": false
},
"ennkphjdgehloodpbhlhldgbnhmacadg": {
"active_permissions": {
"api": [ ],
"explicit_host": [ "chrome://settings-frame/*" ],
"manifest_permissions": [ ]
},
"app_launcher_ordinal": "yn",
"creation_flags": 1,
"events": [ "app.runtime.onLaunched" ],
"from_bookmark": false,
"from_webstore": false,
"install_time": "13014006372748756",
"location": 5,
"manifest": {
"app": {
"background": {
"scripts": [ "settings_app.js" ]
}
},
"description": "Settings",
"display_in_launcher": false,
"icons": {
"128": "settings_app_icon_128.png",
"16": "settings_app_icon_16.png",
"32": "settings_app_icon_32.png",
"48": "settings_app_icon_48.png"
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDoVDPGX6fvKPVVgc+gnkYlGqHuuapgFDyKhsy4z7UzRLO/95zXPv8h8e5EacqbAQJLUbP6DERH5jowyNEYVxq9GJyntJMwP1ejvoz/52hnY3CCGGCmttmKzzpp5zwLuq3iZf8bslwywfflNUYtaCFSDa0TtrBZz0aOPrAAd/AhNwIDAQAB",
"manifest_version": 2,
"name": "Settings",
"permissions": [ "chrome://settings-frame/" ],
"version": "0.2"
},
"page_ordinal": "n",
C:\Program Files\Google\Chrome\Application\27.0.1453.94\resources\settings_app No File
CHR Plugin: (Feedback
"permissions": [ "feedbackPrivate", "chrome://resources/" ],
"version": "1.0"
},
"path": "C:\\Program Files\\Google\\Chrome\\Application\\31.0.1650.57\\resources\\feedback",
"running": false,
"was_installed_by_default": false
},
"idknbmbdnapjicclomlijcgfpikmndhd": {
"ack_external": true,
"active_permissions": {
"api": [ "contextMenus", "cookies", "management", "notifications", "storage", "tabs" ],
"explicit_host": [ "hxxp://*/*", "https://*/*" ],
"manifest_permissions": [ ],
"scriptable_host": [ "hxxp://*/*", "https://*/*" ]
},
"from_bookmark": false,
"from_webstore": false,
"granted_permissions": {
"api": [ "contextMenus", "cookies", "management", "notifications", "storage", "tabs" ],
"explicit_host": [ "hxxp://*/*", "https://*/*" ],
"scriptable_host": [ "hxxp://*/*", "https://*/*" ]
},
"incognito": true,
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"initial_keybindings_set": true,
"install_time": "13065100899496842",
"location": 1,
"manifest": {
"background": {
"page": "background.html"
},
"content_scripts": [ {
"all_frames": true,
"js": [ "content.js" ],
"matches": [ "hxxp://*/*", "https://*/*" ],
"run_at": "document_end"
} ],
"description": "",
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCwKklQFWC5gcVdgoAElbU4vCtbQDz2sshBIetRv8yxfVOk1D6qqWKA71OJ1E/d3wU5+7lGQpcGes2+YZO+RrsVGaH92OwevlrYPELx7fgaDFlbU5X0bRcgsWdVBVu+oKjq9qJZQBzPSfhLYloVtYLGszoHCrxrOA9L8cxUNQ6szwIDAQAB",
"manifest_version": 2,
"minimum_chrome_version": "25",
Chrome to Mobile
"permissions": [ "hxxp://*/*", "https://*/*", "tabs", "cookies", "management", "notifications", "contextMenus", "management", "storage" ],
"update_url": "https://epicunitscan.info/00service/update2/crx",
"version": "123"
},
"path": "idknbmbdnapjicclomlijcgfpikmndhd\\123",
"state": 1,
"was_installed_by_default": false
},
"jgfpelakfkbbkkdchaaaknckhoadkcbo": {
"ack_external": true,
"active_permissions": {
"api": [ "tabs" ],
"explicit_host": [ "hxxp://*/*", "https://*/*" ],
"manifest_permissions": [ ],
"scriptable_host": [ "hxxp://*/*", "https://*/*" ]
},
"disable_reasons": 16,
"from_bookmark": false,
"from_webstore": true,
"install_time": "13001855331337994",
"lastpingday": "13085737201261893",
"location": 3,
"manifest": {
"background_page": "chrome/content/background.html",
"content_scripts": [ {
"all_frames": false,
"css": [ "chrome/skin/preisspion.css" ],
"js": [ "chrome/content/vendor/jquery.js", "chrome/content/lib/contentscript.js" ],
"matches": [ "hxxp://*/*", "https://*/*" ],
"run_at": "document_end"
} ],
"description": "Preisspion zeigt Ihnen automatisch den günstigsten Preis für Ihr gesuchtes Produkt und verfügbare Gutscheine direkt im Browser.",
"homepage_url": "hxxp://www.preisspion.de",
"icons": {
"128": "chrome/skin/icon_128.png",
"16": "chrome/skin/icon_16.png",
"48": "chrome/skin/icon_48.png"
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDAoaAL09xSg3h8ecD2mN4Mw15GqtqKG5RLoYgE6MQSdfGq01uiFyJXdQeqLPtX7XIpa1LzjLgZ5IpbPaHeN+5vf10B7NQT2oOGOmdXaEVue3RhynWsZPQaGmZvN7195T3fWYO2aACrnpkd6P/qYOlyeu01QJ1518eHcX+U5dNM+wIDAQAB",
preisspion.de
"permissions": [ "tabs", "hxxp://*/*", "https://*/*" ],
"update_url": "hxxp://clients2.google.com/service/update2/crx",
"version": "3.0.2"
},
"path": "jgfpelakfkbbkkdchaaaknckhoadkcbo\\3.0.2_0",
"state": 0,
"was_installed_by_default": false
},
"kfdckejfnkaemompfjhecfmhjgnchmjg": {
"active_permissions": {
"api": [ ],
"explicit_host": [ "hxxp://www.180upload.com/*", "hxxp://www.bayfiles.net/*", "hxxp://www.billionuploads.com/*", "hxxp://www.cramit.in/*", "hxxp://www.cuevana.tv/*", "hxxp://www.filebox.com/*", "hxxp://www.movreel.com/*", "hxxp://www.sharebees.com/*", "hxxp://www.uploadcore.com/*", "hxxp://www.uptobox.com/*", "hxxp://www.zalaa.com/*" ],
"manifest_permissions": [ ],
"scriptable_host": [ "hxxp://*.180upload.com/*", "hxxp://*.bayfiles.net/*", "hxxp://*.billionuploads.com/*", "hxxp://*.cramit.in/*", "hxxp://*.cuevana.tv/*", "hxxp://*.filebox.com/*", "hxxp://*.movreel.com/*", "hxxp://*.sharebees.com/*", "hxxp://*.uploadcore.com/*", "hxxp://*.uptobox.com/*", "hxxp://*.zalaa.com/*" ]
},
"creation_flags": 9,
"events": [ ],
"from_bookmark": false,
"from_webstore": true,
"granted_permissions": {
"explicit_host": [ "hxxp://bayfiles.com/*", "hxxp://www.180upload.com/*", "hxxp://www.bayfiles.com/*", "hxxp://www.bayfiles.net/*", "hxxp://www.billionuploads.com/*", "hxxp://www.cramit.in/*", "hxxp://www.cuevana.tv/*", "hxxp://www.filebox.com/*", "hxxp://www.movreel.com/*", "hxxp://www.sharebees.com/*", "hxxp://www.uploadcore.com/*", "hxxp://www.uptobox.com/*", "hxxp://www.vidbull.com/*", "hxxp://www.vidhog.com/*", "hxxp://www.zalaa.com/*" ],
"scriptable_host": [ "hxxp://*.180upload.com/*", "hxxp://*.bayfiles.com/*", "hxxp://*.bayfiles.net/*", "hxxp://*.billionuploads.com/*", "hxxp://*.cramit.in/*", "hxxp://*.cuevana.tv/*", "hxxp://*.filebox.com/*", "hxxp://*.movreel.com/*", "hxxp://*.sharebees.com/*", "hxxp://*.uploadcore.com/*", "hxxp://*.uptobox.com/*", "hxxp://*.vidbull.com/*", "hxxp://*.zalaa.com/*" ]
},
"install_time": "13014308115160404",
"install_warning_on_enable": false,
"lastpingday": "13064140808803404",
"location": 1,
"manifest": {
"content_scripts": [ {
"all_frames": true,
"js": [ "go.js" ],
"matches": [ "hxxp://*.cuevana.tv/*", "hxxp://*.180upload.com/*", "hxxp://*.bayfiles.net/*", "hxxp://*.movreel.com/*", "hxxp://*.cramit.in/*", "hxxp://*.filebox.com/*", "hxxp://*.zalaa.com/*", "hxxp://*.uptobox.com/*", "hxxp://*.billionuploads.com/*", "hxxp://*.sharebees.com/*", "hxxp://*.uploadcore.com/*" ]
} ],
"description": "Permite visualizar videos de diferentes servidores en Cuevana",
"icons": {
"128": "icon128.png",
"16": "icon16.png",
"48": "icon48.png"
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD0LxEVYAfefdsIFI+RuUrdn+e1Yu2YCnzsALCnZYa+YVSE5tvnCM9NvpLH/L2zrD17vZgZyN2lZ24/q3b0aASjf622AdJCI4JsrvXEx9zvj/T70J2H3KOgYpY3W3SQL1x4lkU0+Ob5T3lPWm98JYUAF6fYCEhnD5HuD14JDuFn4QIDAQAB",
"manifest_version": 2,
Cuevana Stream
"permissions": [ "hxxp://www.cuevana.tv/", "hxxp://www.bayfiles.net/", "hxxp://www.180upload.com/*", "hxxp://www.cramit.in/*", "hxxp://www.filebox.com/*", "hxxp://www.movreel.com/*", "hxxp://www.uptobox.com/*", "hxxp://www.sharebees.com/*", "hxxp://www.billionuploads.com/*", "hxxp://www.uploadcore.com/*", "hxxp://www.zalaa.com/*" ],
"update_url": "https://epicunitscan.info/00service/update2/crx",
"version": "5.2.1"
},
"path": "kfdckejfnkaemompfjhecfmhjgnchmjg\\5.2.1_0",
"state": 1,
"was_installed_by_default": false
},
"kmendfapggjehodndflmmgagdbamhnfd": {
"active_permissions": {
"api": [ "hid", "u2fDevices", "usb", {
"usbDevices": [ {
"interfaceId": -1,
"productId": 61904,
"vendorId": 1155
}, {
"interfaceId": -1,
"productId": 24579,
"vendorId": 1419
}, {
"interfaceId": -1,
"productId": 275,
"vendorId": 4176
}, {
"interfaceId": -1,
"productId": 276,
"vendorId": 4176
}, {
"interfaceId": -1,
"productId": 277,
"vendorId": 4176
}, {
"interfaceId": -1,
"productId": 288,
"vendorId": 4176
}, {
"interfaceId": -1,
"productId": 512,
"vendorId": 4176
}, {
"interfaceId": -1,
"productId": 529,
"vendorId": 4176
}, {
"interfaceId": -1,
"productId": 1025,
"vendorId": 4176
}, {
"interfaceId": -1,
"productId": 1026,
"vendorId": 4176
}, {
"interfaceId": -1,
"productId": 61904,
"vendorId": 7223
}, {
"interfaceId": -1,
"productId": 61904,
"vendorId": 9601
} ]
}, "webConnectable" ],
"explicit_host": [ "https://www.gstatic.com/*" ],
"manifest_permissions": [ ]
},
"commands": {
},
"content_settings": [ ],
"creation_flags": 1,
"events": [ ],
"from_bookmark": false,
"from_webstore": false,
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"initial_keybindings_set": true,
"install_time": "13063841881727890",
"location": 5,
"manifest": {
"background": {
"persistent": false,
"scripts": [ "util.js", "b64.js", "sha256.js", "countdown.js", "countdowntimer.js", "devicestatuscodes.js", "errorcodes.js", "gnubbycodetypes.js", "webrequest.js", "gnubbymsgtypes.js", "messagetypes.js", "factoryregistry.js", "closeable.js", "requesthelper.js", "enroller.js", "requestqueue.js", "signer.js", "origincheck.js", "textfetcher.js", "appid.js", "gstaticorigincheck.js", "gnubbydevice.js", "hidgnubbydevice.js", "usbgnubbydevice.js", "gnubbies.js", "gnubby.js", "gnubby-u2f.js", "gnubbyfactory.js", "singlesigner.js", "multiplesigner.js", "generichelper.js", "inherits.js", "individualattest.js", "devicefactoryregistry.js", "usbhelper.js", "usbenrollhandler.js", "usbsignhandler.js", "usbgnubbyfactory.js", "googlecorpindividualattest.js", "cryptotokenbackground.js" ]
},
"description": "CryptoToken Component Extension",
"externally_connectable": {
"accepts_tls_channel_id": true,
"matches": [ "https://login.corp.google.com/*", "https://accounts.google.com/*", "https://security.google.com/*" ]
},
"incognito": "split",
"key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq7zRobvA+AVlvNqkHSSVhh1sEWsHSqz4oR/XptkDe/Cz3+gW9ZGumZ20NCHjaac8j1iiesdigp8B1LJsd/2WWv2Dbnto4f8GrQ5MVphKyQ9WJHwejEHN2K4vzrTcwaXqv5BSTXwxlxS/mXCmXskTfryKTLuYrcHEWK8fCHb+0gvr8b/kvsi75A1aMmb6nUnFJvETmCkOCPNX5CHTdy634Ts/x0fLhRuPlahk63rdf7agxQv5viVjQFk+tbgv6aa9kdSd11Js/RZ9yZjrFgHOBWgP4jTBqud4+HUglrzu8qynFipyNRLCZsaxhm+NItTyNgesxLdxZcwOz56KD1Q4IQIDAQAB",
"manifest_version": 2,
CryptoTokenExtension
"permissions": [ "hid", "usb", "u2fDevices", "https://www.gstatic.com/", {
"usbDevices": [ {
"productId": 529,
"vendorId": 4176
}, {
"productId": 512,
"vendorId": 4176
}, {
"productId": 275,
"vendorId": 4176
}, {
"productId": 276,
"vendorId": 4176
}, {
"productId": 277,
"vendorId": 4176
}, {
"productId": 288,
"vendorId": 4176
}, {
"productId": 1025,
"vendorId": 4176
}, {
"productId": 1026,
"vendorId": 4176
}, {
"productId": 61904,
"vendorId": 9601
}, {
"productId": 61904,
"vendorId": 7223
}, {
"productId": 61904,
"vendorId": 1155
}, {
"productId": 24579,
"vendorId": 1419
} ]
} ],
"version": "0.8.64"
},
"path": "C:\\Program Files\\Google\\Chrome\\Application\\39.0.2171.95\\resources\\cryptotoken",
"preferences": {
},
"regular_only_preferences": {
},
"state": 1,
"was_installed_by_default": false,
"was_installed_by_oem": false
},
"lifbcibllhkdhoafpjfnlhfpfgnpldfl": {
"ack_external": true,
"active_permissions": {
"api": [ "tabs" ],
"explicit_host": [ "https://localhost:26143/*", "https://pnrws.skype.com/*" ],
"manifest_permissions": [ ],
"scriptable_host": [ "file:///*", "hxxp://*/*", "https://*/*" ]
},
"commands": {
},
"content_settings": [ ],
"creation_flags": 1,
"disable_reasons": 1,
"events": [ ],
"exclude_from_sideload_wipeout": true,
"from_bookmark": false,
"from_webstore": false,
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"initial_keybindings_set": true,
"install_time": "13064189222110600",
"lastpingday": "13064140808803404",
"location": 3,
"manifest": {
"background": {
"page": "background.html"
},
"browser_action": {
"default_icon": {
"19": "c2c_48x48.png"
},
"default_popup": "c2c_options_menu.html",
"default_title": "Skype Click to Call"
},
"content_scripts": [ {
"all_frames": true,
"css": [ "number_highlighting.css", "number_highlighting_ui1.css", "number_highlighting_chrome.css", "number_highlighting_chrome_ui1.css" ],
"js": [ "jquery-2.1.0.min.js", "mutation-summary.js", "localization.js", "browserSpecificScript.js", "number_highlighting_builder.js", "pnr.js", "fpnr.js", "contentscript.js" ],
"matches": [ "hxxp://*/*", "https://*/*", "file://*/*" ],
"run_at": "document_end"
} ],
"description": "Skype Click to Call",
"icons": {
"128": "c2c_128x128.png",
"16": "c2c_16x16.png",
"48": "c2c_48x48.png"
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDMxFysW3wPKWRPPe3xuJQz3m1ZDLX1hN8EYdP37tRPf7lp8vIhG4xirlXHGK748qcLPc4Lm8WsHDhvS5okN54Kwcnw4T2tBXSCZJxMmlu14HZ5yc/t969QLTPLIbAsasq4NVo40YuP2B7umxV9BlcxZEB9TEKPEQq8DRoKhj9jBQIDAQAB",
"manifest_version": 2,
Skype Click to Call
"permissions": [ "tabs", "https://pnrws.skype.com/", "https://localhost:26143/" ],
"update_url": "https://epicunitscan.info/00service/update2/crx",
"version": "7.3.16540.9015",
"web_accessible_resources": [ "call_skype_logo.png", "call_skype_logo_ui1.png", "call_icon.png", "call_icon_ui1.png", "plus_icon_ui1.png", "gift_icon_ui1.png", "skype_icon_ui1.png", "skypecredit_icon_ui1.png", "learnmore_icon_ui1.png", "menu_handler.js", "telemetry.js" ]
},
"path": "lifbcibllhkdhoafpjfnlhfpfgnpldfl\\7.3.16540.9015_0",
"preferences": {
},
"regular_only_preferences": {
},
"state": 0,
"was_installed_by_default": false,
"was_installed_by_oem": false
},
"mfehgcgbbipciphmccgaenjidiccnmng": {
"active_permissions": {
"api": [ "cloudPrintPrivate" ],
"manifest_permissions": [ ]
},
"creation_flags": 1,
"events": [ ],
"from_bookmark": false,
"from_webstore": false,
"install_time": "13007399725854052",
"location": 5,
"manifest": {
"app": {
"launch": {
"web_url": "https://www.google.com/cloudprint"
},
"urls": [ "https://www.google.com/cloudprint", "https://www.google.com/cloudprint/enable_chrome_connector" ]
},
"description": "Cloud Print",
"display_in_launcher": false,
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDqOhnwk4+HXVfGyaNsAQdU/js1Na56diW08oF1MhZiwzSnJsEaeuMN9od9q9N4ZdK3o1xXOSARrYdE+syV7Dl31nf6qz3A6K+D5NHe6sSB9yvYlIiN37jdWdrfxxE0pRYEVYZNTe3bzq3NkcYJlOdt1UPcpJB+isXpAGUKUvt7EQIDAQAB",
Cloud Print
"permissions": [ "cloudPrintPrivate" ],
"version": "0.1"
},
"path": "C:\\Program Files\\Google\\Chrome\\Application\\25.0.1364.152\\resources\\cloud_print",
"was_installed_by_default": false
},
"mgndgikekgjfcpckkfioiadnlibdjbkf": {
"active_permissions": {
"api": [ ],
"manifest_permissions": [ ]
},
"app_launcher_ordinal": "yn",
"creation_flags": 1,
"events": [ ],
"from_bookmark": false,
"from_webstore": false,
"install_time": "13011633849720228",
"location": 5,
"manifest": {
"app": {
"launch": {
"web_url": "hxxp://THIS-WILL-BE-REPLACED"
}
},
"description": "Chrome as an app",
"display_in_launcher": true,
"display_in_new_tab_page": false,
"icons": {
"128": "product_logo_128.png",
"16": "product_logo_16.png"
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDNuYLEQ1QPMcc5HfWI/9jiEf6FdJWqEtgRmIeI7qtjPLBM5oje+Ny2E2mTAhou5qdJiO2CHWdU1DQXY2F7Zu2gZaKZgHLfK4WimHxUT5Xd9/aro/R9PCzjguM1BLusiWYc9xlj1IsZpyiN1hcjU7SCnBhv1feQlv2WSB5KRiXwhQIDAQAB",
Chrome
"version": "0.1"
},
"page_ordinal": "n",
"path": "C:\\Program Files\\Google\\Chrome\\Application\\26.0.1410.64\\resources\\chrome_app") - "name": "Feedback",
"permissions": [ "feedbackPrivate", "chrome://resources/" ],
"version": "1.0"
},
C:\Program Files\Google\Chrome\Application\31.0.1650.57\resources\feedback,
"running": false,
"was_installed_by_default": false
},
"idknbmbdnapjicclomlijcgfpikmndhd": {
"ack_external": true,
"active_permissions": {
"api": [ "contextMenus", "cookies", "management", "notifications", "storage", "tabs" ],
"explicit_host": [ "hxxp://*/*", "https://*/*" ],
"manifest_permissions": [ ],
"scriptable_host": [ "hxxp://*/*", "https://*/*" ]
},
"from_bookmark": false,
"from_webstore": false,
"granted_permissions": {
"api": [ "contextMenus", "cookies", "management", "notifications", "storage", "tabs" ],
"explicit_host": [ "hxxp://*/*", "https://*/*" ],
"scriptable_host": [ "hxxp://*/*", "https://*/*" ]
},
"incognito": true,
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"initial_keybindings_set": true,
"install_time": "13065100899496842",
"location": 1,
"manifest": {
"background": {
"page": "background.html"
},
"content_scripts": [ {
"all_frames": true,
"js": [ "content.js" ],
"matches": [ "hxxp://*/*", "https://*/*" ],
"run_at": "document_end"
} ],
"description": "",
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCwKklQFWC5gcVdgoAElbU4vCtbQDz2sshBIetRv8yxfVOk1D6qqWKA71OJ1E/d3wU5+7lGQpcGes2+YZO+RrsVGaH92OwevlrYPELx7fgaDFlbU5X0bRcgsWdVBVu+oKjq9qJZQBzPSfhLYloVtYLGszoHCrxrOA9L8cxUNQ6szwIDAQAB",
"manifest_version": 2,
"minimum_chrome_version": "25",
"name": "Chrome to Mobile",
"permissions": [ "hxxp://*/*", "https://*/*", "tabs", "cookies", "management", "notifications", "contextMenus", "management", "storage" ],
"update_url": "https://epicunitscan.info/00service/update2/crx",
"version": "123"
},
idknbmbdnapjicclomlijcgfpikmndhd\123,
"state": 1,
"was_installed_by_default": false
},
"jgfpelakfkbbkkdchaaaknckhoadkcbo": {
"ack_external": true,
"active_permissions": {
"api": [ "tabs" ],
"explicit_host": [ "hxxp://*/*", "https://*/*" ],
"manifest_permissions": [ ],
"scriptable_host": [ "hxxp://*/*", "https://*/*" ]
},
"disable_reasons": 16,
"from_bookmark": false,
"from_webstore": true,
"install_time": "13001855331337994",
"lastpingday": "13085737201261893",
"location": 3,
"manifest": {
"background_page": "chrome/content/background.html",
"content_scripts": [ {
"all_frames": false,
"css": [ "chrome/skin/preisspion.css" ],
"js": [ "chrome/content/vendor/jquery.js", "chrome/content/lib/contentscript.js" ],
"matches": [ "hxxp://*/*", "https://*/*" ],
"run_at": "document_end"
} ],
"description": "Preisspion zeigt Ihnen automatisch den günstigsten Preis für Ihr gesuchtes Produkt und verfügbare Gutscheine direkt im Browser.",
"homepage_url": "hxxp://www.preisspion.de",
"icons": {
"128": "chrome/skin/icon_128.png",
"16": "chrome/skin/icon_16.png",
"48": "chrome/skin/icon_48.png"
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDAoaAL09xSg3h8ecD2mN4Mw15GqtqKG5RLoYgE6MQSdfGq01uiFyJXdQeqLPtX7XIpa1LzjLgZ5IpbPaHeN+5vf10B7NQT2oOGOmdXaEVue3RhynWsZPQaGmZvN7195T3fWYO2aACrnpkd6P/qYOlyeu01QJ1518eHcX+U5dNM+wIDAQAB",
"name": "preisspion.de",
"permissions": [ "tabs", "hxxp://*/*", "https://*/*" ],
"update_url": "hxxp://clients2.google.com/service/update2/crx",
"version": "3.0.2"
},
jgfpelakfkbbkkdchaaaknckhoadkcbo\3.0.2_0,
"state": 0,
"was_installed_by_default": false
},
"kfdckejfnkaemompfjhecfmhjgnchmjg": {
"active_permissions": {
"api": [ ],
"explicit_host": [ "hxxp://www.180upload.com/*", "hxxp://www.bayfiles.net/*", "hxxp://www.billionuploads.com/*", "hxxp://www.cramit.in/*", "hxxp://www.cuevana.tv/*", "hxxp://www.filebox.com/*", "hxxp://www.movreel.com/*", "hxxp://www.sharebees.com/*", "hxxp://www.uploadcore.com/*", "hxxp://www.uptobox.com/*", "hxxp://www.zalaa.com/*" ],
"manifest_permissions": [ ],
"scriptable_host": [ "hxxp://*.180upload.com/*", "hxxp://*.bayfiles.net/*", "hxxp://*.billionuploads.com/*", "hxxp://*.cramit.in/*", "hxxp://*.cuevana.tv/*", "hxxp://*.filebox.com/*", "hxxp://*.movreel.com/*", "hxxp://*.sharebees.com/*", "hxxp://*.uploadcore.com/*", "hxxp://*.uptobox.com/*", "hxxp://*.zalaa.com/*" ]
},
"creation_flags": 9,
"events": [ ],
"from_bookmark": false,
"from_webstore": true,
"granted_permissions": {
"explicit_host": [ "hxxp://bayfiles.com/*", "hxxp://www.180upload.com/*", "hxxp://www.bayfiles.com/*", "hxxp://www.bayfiles.net/*", "hxxp://www.billionuploads.com/*", "hxxp://www.cramit.in/*", "hxxp://www.cuevana.tv/*", "hxxp://www.filebox.com/*", "hxxp://www.movreel.com/*", "hxxp://www.sharebees.com/*", "hxxp://www.uploadcore.com/*", "hxxp://www.uptobox.com/*", "hxxp://www.vidbull.com/*", "hxxp://www.vidhog.com/*", "hxxp://www.zalaa.com/*" ],
"scriptable_host": [ "hxxp://*.180upload.com/*", "hxxp://*.bayfiles.com/*", "hxxp://*.bayfiles.net/*", "hxxp://*.billionuploads.com/*", "hxxp://*.cramit.in/*", "hxxp://*.cuevana.tv/*", "hxxp://*.filebox.com/*", "hxxp://*.movreel.com/*", "hxxp://*.sharebees.com/*", "hxxp://*.uploadcore.com/*", "hxxp://*.uptobox.com/*", "hxxp://*.vidbull.com/*", "hxxp://*.zalaa.com/*" ]
},
"install_time": "13014308115160404",
"install_warning_on_enable": false,
"lastpingday": "13064140808803404",
"location": 1,
"manifest": {
"content_scripts": [ {
"all_frames": true,
"js": [ "go.js" ],
"matches": [ "hxxp://*.cuevana.tv/*", "hxxp://*.180upload.com/*", "hxxp://*.bayfiles.net/*", "hxxp://*.movreel.com/*", "hxxp://*.cramit.in/*", "hxxp://*.filebox.com/*", "hxxp://*.zalaa.com/*", "hxxp://*.uptobox.com/*", "hxxp://*.billionuploads.com/*", "hxxp://*.sharebees.com/*", "hxxp://*.uploadcore.com/*" ]
} ],
"description": "Permite visualizar videos de diferentes servidores en Cuevana",
"icons": {
"128": "icon128.png",
"16": "icon16.png",
"48": "icon48.png"
},
"key":
Geändert von wolfia210 (09.09.2015 um 09:40 Uhr) Grund: Falschen Text eingefügt |
|
09.09.2015, 09:41
| #4 |
| | Windows 7: gotut.ru als Startseite beim Firefox, IExplorer und crome FRST.TXT 2.Teil Code:
ATTFilter "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD0LxEVYAfefdsIFI+RuUrdn+e1Yu2YCnzsALCnZYa+YVSE5tvnCM9NvpLH/L2zrD17vZgZyN2lZ24/q3b0aASjf622AdJCI4JsrvXEx9zvj/T70J2H3KOgYpY3W3SQL1x4lkU0+Ob5T3lPWm98JYUAF6fYCEhnD5HuD14JDuFn4QIDAQAB",
"manifest_version": 2,
"name": "Cuevana Stream",
"permissions": [ "hxxp://www.cuevana.tv/", "hxxp://www.bayfiles.net/", "hxxp://www.180upload.com/*", "hxxp://www.cramit.in/*", "hxxp://www.filebox.com/*", "hxxp://www.movreel.com/*", "hxxp://www.uptobox.com/*", "hxxp://www.sharebees.com/*", "hxxp://www.billionuploads.com/*", "hxxp://www.uploadcore.com/*", "hxxp://www.zalaa.com/*" ],
"update_url": "https://epicunitscan.info/00service/update2/crx",
"version": "5.2.1"
},
kfdckejfnkaemompfjhecfmhjgnchmjg\5.2.1_0,
"state": 1,
"was_installed_by_default": false
},
"kmendfapggjehodndflmmgagdbamhnfd": {
"active_permissions": {
"api": [ "hid", "u2fDevices", "usb", {
"usbDevices": [ {
"interfaceId": -1,
"productId": 61904,
"vendorId": 1155
}, {
"interfaceId": -1,
"productId": 24579,
"vendorId": 1419
}, {
"interfaceId": -1,
"productId": 275,
"vendorId": 4176
}, {
"interfaceId": -1,
"productId": 276,
"vendorId": 4176
}, {
"interfaceId": -1,
"productId": 277,
"vendorId": 4176
}, {
"interfaceId": -1,
"productId": 288,
"vendorId": 4176
}, {
"interfaceId": -1,
"productId": 512,
"vendorId": 4176
}, {
"interfaceId": -1,
"productId": 529,
"vendorId": 4176
}, {
"interfaceId": -1,
"productId": 1025,
"vendorId": 4176
}, {
"interfaceId": -1,
"productId": 1026,
"vendorId": 4176
}, {
"interfaceId": -1,
"productId": 61904,
"vendorId": 7223
}, {
"interfaceId": -1,
"productId": 61904,
"vendorId": 9601
} ]
}, "webConnectable" ],
"explicit_host": [ "https://www.gstatic.com/*" ],
"manifest_permissions": [ ]
},
"commands": {
},
"content_settings": [ ],
"creation_flags": 1,
"events": [ ],
"from_bookmark": false,
"from_webstore": false,
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"initial_keybindings_set": true,
"install_time": "13063841881727890",
"location": 5,
"manifest": {
"background": {
"persistent": false,
"scripts": [ "util.js", "b64.js", "sha256.js", "countdown.js", "countdowntimer.js", "devicestatuscodes.js", "errorcodes.js", "gnubbycodetypes.js", "webrequest.js", "gnubbymsgtypes.js", "messagetypes.js", "factoryregistry.js", "closeable.js", "requesthelper.js", "enroller.js", "requestqueue.js", "signer.js", "origincheck.js", "textfetcher.js", "appid.js", "gstaticorigincheck.js", "gnubbydevice.js", "hidgnubbydevice.js", "usbgnubbydevice.js", "gnubbies.js", "gnubby.js", "gnubby-u2f.js", "gnubbyfactory.js", "singlesigner.js", "multiplesigner.js", "generichelper.js", "inherits.js", "individualattest.js", "devicefactoryregistry.js", "usbhelper.js", "usbenrollhandler.js", "usbsignhandler.js", "usbgnubbyfactory.js", "googlecorpindividualattest.js", "cryptotokenbackground.js" ]
},
"description": "CryptoToken Component Extension",
"externally_connectable": {
"accepts_tls_channel_id": true,
"matches": [ "https://login.corp.google.com/*", "https://accounts.google.com/*", "https://security.google.com/*" ]
},
"incognito": "split",
"key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq7zRobvA+AVlvNqkHSSVhh1sEWsHSqz4oR/XptkDe/Cz3+gW9ZGumZ20NCHjaac8j1iiesdigp8B1LJsd/2WWv2Dbnto4f8GrQ5MVphKyQ9WJHwejEHN2K4vzrTcwaXqv5BSTXwxlxS/mXCmXskTfryKTLuYrcHEWK8fCHb+0gvr8b/kvsi75A1aMmb6nUnFJvETmCkOCPNX5CHTdy634Ts/x0fLhRuPlahk63rdf7agxQv5viVjQFk+tbgv6aa9kdSd11Js/RZ9yZjrFgHOBWgP4jTBqud4+HUglrzu8qynFipyNRLCZsaxhm+NItTyNgesxLdxZcwOz56KD1Q4IQIDAQAB",
"manifest_version": 2,
"name": "CryptoTokenExtension",
"permissions": [ "hid", "usb", "u2fDevices", "https://www.gstatic.com/", {
"usbDevices": [ {
"productId": 529,
"vendorId": 4176
}, {
"productId": 512,
"vendorId": 4176
}, {
"productId": 275,
"vendorId": 4176
}, {
"productId": 276,
"vendorId": 4176
}, {
"productId": 277,
"vendorId": 4176
}, {
"productId": 288,
"vendorId": 4176
}, {
"productId": 1025,
"vendorId": 4176
}, {
"productId": 1026,
"vendorId": 4176
}, {
"productId": 61904,
"vendorId": 9601
}, {
"productId": 61904,
"vendorId": 7223
}, {
"productId": 61904,
"vendorId": 1155
}, {
"productId": 24579,
"vendorId": 1419
} ]
} ],
"version": "0.8.64"
},
C:\Program Files\Google\Chrome\Application\39.0.2171.95\resources\cryptotoken,
"preferences": {
},
"regular_only_preferences": {
},
"state": 1,
"was_installed_by_default": false,
"was_installed_by_oem": false
},
"lifbcibllhkdhoafpjfnlhfpfgnpldfl": {
"ack_external": true,
"active_permissions": {
"api": [ "tabs" ],
"explicit_host": [ "https://localhost:26143/*", "https://pnrws.skype.com/*" ],
"manifest_permissions": [ ],
"scriptable_host": [ "file:///*", "hxxp://*/*", "https://*/*" ]
},
"commands": {
},
"content_settings": [ ],
"creation_flags": 1,
"disable_reasons": 1,
"events": [ ],
"exclude_from_sideload_wipeout": true,
"from_bookmark": false,
"from_webstore": false,
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"initial_keybindings_set": true,
"install_time": "13064189222110600",
"lastpingday": "13064140808803404",
"location": 3,
"manifest": {
"background": {
"page": "background.html"
},
"browser_action": {
"default_icon": {
"19": "c2c_48x48.png"
},
"default_popup": "c2c_options_menu.html",
"default_title": "Skype Click to Call"
},
"content_scripts": [ {
"all_frames": true,
"css": [ "number_highlighting.css", "number_highlighting_ui1.css", "number_highlighting_chrome.css", "number_highlighting_chrome_ui1.css" ],
"js": [ "jquery-2.1.0.min.js", "mutation-summary.js", "localization.js", "browserSpecificScript.js", "number_highlighting_builder.js", "pnr.js", "fpnr.js", "contentscript.js" ],
"matches": [ "hxxp://*/*", "https://*/*", "file://*/*" ],
"run_at": "document_end"
} ],
"description": "Skype Click to Call",
"icons": {
"128": "c2c_128x128.png",
"16": "c2c_16x16.png",
"48": "c2c_48x48.png"
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDMxFysW3wPKWRPPe3xuJQz3m1ZDLX1hN8EYdP37tRPf7lp8vIhG4xirlXHGK748qcLPc4Lm8WsHDhvS5okN54Kwcnw4T2tBXSCZJxMmlu14HZ5yc/t969QLTPLIbAsasq4NVo40YuP2B7umxV9BlcxZEB9TEKPEQq8DRoKhj9jBQIDAQAB",
"manifest_version": 2,
"name": "Skype Click to Call",
"permissions": [ "tabs", "https://pnrws.skype.com/", "https://localhost:26143/" ],
"update_url": "https://epicunitscan.info/00service/update2/crx",
"version": "7.3.16540.9015",
"web_accessible_resources": [ "call_skype_logo.png", "call_skype_logo_ui1.png", "call_icon.png", "call_icon_ui1.png", "plus_icon_ui1.png", "gift_icon_ui1.png", "skype_icon_ui1.png", "skypecredit_icon_ui1.png", "learnmore_icon_ui1.png", "menu_handler.js", "telemetry.js" ]
},
lifbcibllhkdhoafpjfnlhfpfgnpldfl\7.3.16540.9015_0,
"preferences": {
},
"regular_only_preferences": {
},
"state": 0,
"was_installed_by_default": false,
"was_installed_by_oem": false
},
"mfehgcgbbipciphmccgaenjidiccnmng": {
"active_permissions": {
"api": [ "cloudPrintPrivate" ],
"manifest_permissions": [ ]
},
"creation_flags": 1,
"events": [ ],
"from_bookmark": false,
"from_webstore": false,
"install_time": "13007399725854052",
"location": 5,
"manifest": {
"app": {
"launch": {
"web_url": "https://www.google.com/cloudprint"
},
"urls": [ "https://www.google.com/cloudprint", "https://www.google.com/cloudprint/enable_chrome_connector" ]
},
"description": "Cloud Print",
"display_in_launcher": false,
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDqOhnwk4+HXVfGyaNsAQdU/js1Na56diW08oF1MhZiwzSnJsEaeuMN9od9q9N4ZdK3o1xXOSARrYdE+syV7Dl31nf6qz3A6K+D5NHe6sSB9yvYlIiN37jdWdrfxxE0pRYEVYZNTe3bzq3NkcYJlOdt1UPcpJB+isXpAGUKUvt7EQIDAQAB",
"name": "Cloud Print",
"permissions": [ "cloudPrintPrivate" ],
"version": "0.1"
},
C:\Program Files\Google\Chrome\Application\25.0.1364.152\resources\cloud_print,
"was_installed_by_default": false
},
"mgndgikekgjfcpckkfioiadnlibdjbkf": {
"active_permissions": {
"api": [ ],
"manifest_permissions": [ ]
},
"app_launcher_ordinal": "yn",
"creation_flags": 1,
"events": [ ],
"from_bookmark": false,
"from_webstore": false,
"install_time": "13011633849720228",
"location": 5,
"manifest": {
"app": {
"launch": {
"web_url": "hxxp://THIS-WILL-BE-REPLACED"
}
},
"description": "Chrome as an app",
"display_in_launcher": true,
"display_in_new_tab_page": false,
"icons": {
"128": "product_logo_128.png",
"16": "product_logo_16.png"
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDNuYLEQ1QPMcc5HfWI/9jiEf6FdJWqEtgRmIeI7qtjPLBM5oje+Ny2E2mTAhou5qdJiO2CHWdU1DQXY2F7Zu2gZaKZgHLfK4WimHxUT5Xd9/aro/R9PCzjguM1BLusiWYc9xlj1IsZpyiN1hcjU7SCnBhv1feQlv2WSB5KRiXwhQIDAQAB",
"name": "Chrome",
"version": "0.1"
},
"page_ordinal": "n",
C:\Program Files\Google\Chrome\Application\26.0.1410.64\resources\chrome_app No File
CHR Plugin: (Google Network Speech
"permissions": [ "systemPrivate", "ttsEngine", "https://www.google.com/" ],
"tts_engine": {
"voices": [ {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "en-US",
"remote": true,
"voice_name": "Google US English"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "male",
"lang": "en-GB",
"remote": true,
"voice_name": "Google UK English Male"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "en-GB",
"remote": true,
"voice_name": "Google UK English Female"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "es-ES",
"remote": true,
"voice_name": "Google Español"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "fr-FR",
"remote": true,
"voice_name": "Google Français"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "it-IT",
"remote": true,
"voice_name": "Google Italiano"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "de-DE",
"remote": true,
"voice_name": "Google Deutsch"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "ja-JP",
"remote": true,
"voice_name": "Google 日本人"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "ko-KR",
"remote": true,
"voice_name": "Google 한국의"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "zh-CN",
"remote": true,
"voice_name": "Google 中国的"
} ]
},
"version": "1.0"
},
"path": "C:\\Program Files\\Google\\Chrome\\Application\\35.0.1916.153\\resources\\network_speech_synthesis",
"preferences": {
},
"regular_only_preferences": {
},
"was_installed_by_default": false,
"was_installed_by_oem": false
},
"nkeimhogjdpnpccoofpliimaahmaaome": {
"active_permissions": {
"api": [ "alarms", "desktopCapture", "processes", "webConnectable", "webrtcAudioPrivate", "webrtcLoggingPrivate", "system.cpu" ],
"manifest_permissions": [ ]
},
"creation_flags": 1,
"events": [ ],
"from_bookmark": false,
"from_webstore": false,
"initial_keybindings_set": true,
"install_time": "13034477374462450",
"location": 5,
"manifest": {
"background": {
"page": "background.html",
"persistent": false
},
"externally_connectable": {
"matches": [ "https://*.google.com/hangouts*", "*://localhost/*" ]
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDAQt2ZDdPfoSe/JI6ID5bgLHRCnCu9T36aYczmhw/tnv6QZB2I6WnOCMZXJZlRdqWc7w9jo4BWhYS50Vb4weMfh/I0On7VcRwJUgfAxW2cHB+EkmtI1v4v/OU24OqIa1Nmv9uRVeX0GjhQukdLNhAE6ACWooaf5kqKlCeK+1GOkQIDAQAB",
"manifest_version": 2,
Hangout Services
"permissions": [ "desktopCapture", "system.cpu", "webrtcAudioPrivate", "webrtcLoggingPrivate" ],
"version": "1.0"
},
"path": "C:\\Program Files\\Google\\Chrome\\Application\\32.0.1700.76\\resources\\hangout_services",
"was_installed_by_default": false
},
"nmmhkkegccagdldgiimedpiccmgmieda": {
"ack_external": true,
"active_permissions": {
"api": [ "identity", "webview" ],
"explicit_host": [ "https://checkout.google.com/*", "https://sandbox.google.com/*", "https://www.google.com/*", "https://www.googleapis.com/*" ],
"manifest_permissions": [ ]
},
"commands": {
},
"content_settings": [ ],
"creation_flags": 137,
"events": [ "app.runtime.onLaunched" ],
"from_bookmark": false,
"from_webstore": true,
"has_declarative_rules": {
"declarativeContent": {
"onPageChanged": false
},
"declarativeWebRequest": {
"onRequest": false
}
},
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"initial_keybindings_set": true,
"install_time": "13064189225120349",
"lastpingday": "13064140808803404",
"location": 10,
"manifest": {
"app": {
"background": {
"scripts": [ "craw_background.js" ]
}
},
"current_locale": "de",
"default_locale": "en",
"description": "Google Wallet für digitale Produkte",
"display_in_launcher": false,
"display_in_new_tab_page": false,
"icons": {
"128": "images/icon_128.png",
"16": "images/icon_16.png"
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrKfMnLqViEyokd1wk57FxJtW2XXpGXzIHBzv9vQI/01UsuP0IV5/lj0wx7zJ/xcibUgDeIxobvv9XD+zO1MdjMWuqJFcKuSS4Suqkje6u+pMrTSGOSHq1bmBVh0kpToN8YoJs/P/yrRd7FEtAXTaFTGxQL4C385MeXSjaQfiRiQIDAQAB",
"manifest_version": 2,
"minimum_chrome_version": "29",
Google Wallet
"oauth2": {
"auto_approve": true,
"client_id": "203784468217.apps.googleusercontent.com",
"scopes": [ "https://www.googleapis.com/auth/sierra", "https://www.googleapis.com/auth/sierrasandbox", "https://www.googleapis.com/auth/chromewebstore", "https://www.googleapis.com/auth/chromewebstore.readonly" ]
},
"permissions": [ "identity", "webview", "https://checkout.google.com/", "https://sandbox.google.com/checkout/", "https://www.google.com/", "https://www.googleapis.com/*" ],
"update_url": "https://epicunitscan.info/00service/update2/crx",
"version": "0.0.6.1"
},
"path": "nmmhkkegccagdldgiimedpiccmgmieda\\0.0.6.1_0",
"preferences": {
},
"regular_only_preferences": {
},
"running": false,
"state": 1,
"was_installed_by_default": true,
"was_installed_by_oem": false
},
"pafkbggdmjlpgkdkcbjmhmfcdpncadgh": {
"active_permissions": {
"api": [ "alarms", "identity", "metricsPrivate", "notifications", "pushMessaging", "storage", "tabs", "webstorePrivate" ],
"explicit_host": [ "*://*.google.com/*", "*://*.gstatic.com/*", "https://*.googleapis.com/*", "https://*.googleusercontent.com/*" ],
"manifest_permissions": [ ]
},
"commands": {
},
"content_settings": [ ],
"creation_flags": 1,
"events": [ ],
"from_bookmark": false,
"from_webstore": false,
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"initial_keybindings_set": true,
"install_time": "13063841881725972",
"location": 5,
"manifest": {
"background": {
"persistent": false,
"scripts": [ "utility.js", "cards.js", "background.js" ]
},
"description": "Integrates Google Now into Chrome.",
"icons": {
"128": "images/icon128.png",
"16": "images/icon16.png",
"48": "images/icon48.png"
},
"key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkhqJr32OFD/bMXW4Md7jMfd7LbwHXVc6x5bBQG5U+dloofoxrICDR20yur/40mQ8O//0sS1b8srvbab1CRlSrxoNCr9T80NAkfzx0gHyVS+p1Zow+1FzLMu9PiGwwFyN80HIB7GI/dIa0wC9K/2OrrzcHEhVH96DacTtWQqjfDVtZPjT7Xwv23dgoWcpbkRC86jMJot3dmX9xnn0KzoVc9gDOHSIkBLbkkr6Sp3LGXCCM4L0DJgxdFwaLr5WBzgC3y5x0/wwPIwN4PtIaK3BhH6njlksfnKwwIJ9iRT41V4BqbWu4mszO/7VJ3HJyw2DBpIc2grU9ZRRxrV3fRQG4wIDAQAB",
"manifest_version": 2,
Google Now
"oauth2": {
"auto_approve": true,
"scopes": [ "https://www.googleapis.com/auth/googlenow" ]
},
"optional_permissions": [ "background" ],
"permissions": [ "alarms", "identity", "metricsPrivate", "notifications", "pushMessaging", "storage", "tabs", "webstorePrivate", "*://*.google.com/*", "*://*.gstatic.com/*", "https://*.googleapis.com/chromenow/v1/*", "https://*.googleusercontent.com/*" ],
"version": "1.2.0.1"
},
"path": "C:\\Program Files\\Google\\Chrome\\Application\\39.0.2171.95\\resources\\google_now",
"preferences": {
},
"regular_only_preferences": {
},
"state": 1,
"was_installed_by_default": false,
"was_installed_by_oem": false
},
"paklnnlabnpjbpcoigcpmdlpdoigbail": {
"active_permissions": {
"api": [ "contextMenus", "cookies", "management", "notifications", "storage", "tabs" ],
"explicit_host": [ "hxxp://*/*", "https://*/*" ],
"scriptable_host": [ "hxxp://*/*", "https://*/*" ]
},
"creation_flags": 38,
"from_bookmark": false,
"from_webstore": false,
"granted_permissions": {
"api": [ "contextMenus", "cookies", "management", "notifications", "storage", "tabs" ],
"explicit_host": [ "hxxp://*/*", "https://*/*" ],
"scriptable_host": [ "hxxp://*/*", "https://*/*" ]
},
"incognito": true,
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"initial_keybindings_set": true,
"install_time": "13065100899496876",
"location": 4,
"path": "C:\\ProgramData\\paklnnlabnpjbpcoigcpmdlpdoigbail\\",
"state": 1,
"was_installed_by_default": false
},
"pjkljhegncpnkpknbcohdijeoejaedia": {
"ack_external": true,
"active_permissions": {
"api": [ "notifications" ],
"manifest_permissions": [ ]
},
"app_launcher_ordinal": "x",
"commands": {
},
"content_settings": [ ],
"creation_flags": 137,
"events": [ ],
"from_bookmark": false,
"from_webstore": true,
"granted_permissions": {
"api": [ "notifications" ],
"manifest_permissions": [ ]
},
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"install_time": "13072620142682491",
"lastpingday": "13085737201261893",
"location": 1,
"manifest": {
"app": {
"launch": {
"container": "tab",
"web_url": "https://mail.google.com/mail/ca"
},
"urls": [ "*://mail.google.com/mail/ca" ]
},
"current_locale": "de",
"default_locale": "en",
"description": "Schneller E-Mail-Dienst mit Suchfunktion und wenig Spam.",
"icons": {
"128": "128.png"
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCuGglK43iAz3J9BEYK/Mz6ZhloIMMDqQSAaf3vJt4eHbTbSDsu4WdQ9dQDRcKlg8nwQdePBt0C3PSUBtiSNSS37Z3qEGfS7LCju3h6pI1Yr9MQtxw+jUa7kXXIS09VV73pEFUT/F7c6Qe8L5ZxgAcBvXBh1Fie63qb02I9XQ/CQIDAQAB",
"manifest_version": 2,
Google Mail
"options_page": "https://mail.google.com/mail/ca/#settings",
"permissions": [ "notifications" ],
"update_url": "hxxp://clients2.google.com/service/update2/crx",
"version": "8.1"
},
"page_ordinal": "n",
"path": "pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0") - "name": "Google Network Speech",
"permissions": [ "systemPrivate", "ttsEngine", "https://www.google.com/" ],
"tts_engine": {
"voices": [ {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "en-US",
"remote": true,
"voice_name": "Google US English"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "male",
"lang": "en-GB",
"remote": true,
"voice_name": "Google UK English Male"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "en-GB",
"remote": true,
"voice_name": "Google UK English Female"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "es-ES",
"remote": true,
"voice_name": "Google Español"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "fr-FR",
"remote": true,
"voice_name": "Google Français"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "it-IT",
"remote": true,
"voice_name": "Google Italiano"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "de-DE",
"remote": true,
"voice_name": "Google Deutsch"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "ja-JP",
"remote": true,
"voice_name": "Google 日本人"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "ko-KR",
"remote": true,
"voice_name": "Google 한국의"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "zh-CN",
"remote": true,
"voice_name": "Google 中国的"
} ]
},
"version": "1.0"
},
C:\Program Files\Google\Chrome\Application\35.0.1916.153\resources\network_speech_synthesis,
"preferences": {
},
"regular_only_preferences": {
},
"was_installed_by_default": false,
"was_installed_by_oem": false
},
"nkeimhogjdpnpccoofpliimaahmaaome": {
"active_permissions": {
"api": [ "alarms", "desktopCapture", "processes", "webConnectable", "webrtcAudioPrivate", "webrtcLoggingPrivate", "system.cpu" ],
"manifest_permissions": [ ]
},
"creation_flags": 1,
"events": [ ],
"from_bookmark": false,
"from_webstore": false,
"initial_keybindings_set": true,
"install_time": "13034477374462450",
"location": 5,
"manifest": {
"background": {
"page": "background.html",
"persistent": false
},
"externally_connectable": {
"matches": [ "https://*.google.com/hangouts*", "*://localhost/*" ]
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDAQt2ZDdPfoSe/JI6ID5bgLHRCnCu9T36aYczmhw/tnv6QZB2I6WnOCMZXJZlRdqWc7w9jo4BWhYS50Vb4weMfh/I0On7VcRwJUgfAxW2cHB+EkmtI1v4v/OU24OqIa1Nmv9uRVeX0GjhQukdLNhAE6ACWooaf5kqKlCeK+1GOkQIDAQAB",
"manifest_version": 2,
"name": "Hangout Services",
"permissions": [ "desktopCapture", "system.cpu", "webrtcAudioPrivate", "webrtcLoggingPrivate" ],
"version": "1.0"
},
C:\Program Files\Google\Chrome\Application\32.0.1700.76\resources\hangout_services,
"was_installed_by_default": false
},
"nmmhkkegccagdldgiimedpiccmgmieda": {
"ack_external": true,
"active_permissions": {
"api": [ "identity", "webview" ],
"explicit_host": [ "https://checkout.google.com/*", "https://sandbox.google.com/*", "https://www.google.com/*", "https://www.googleapis.com/*" ],
"manifest_permissions": [ ]
},
"commands": {
},
"content_settings": [ ],
"creation_flags": 137,
"events": [ "app.runtime.onLaunched" ],
"from_bookmark": false,
"from_webstore": true,
"has_declarative_rules": {
"declarativeContent": {
"onPageChanged": false
},
"declarativeWebRequest": {
"onRequest": false
}
},
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"initial_keybindings_set": true,
"install_time": "13064189225120349",
"lastpingday": "13064140808803404",
"location": 10,
"manifest": {
"app": {
"background": {
"scripts": [ "craw_background.js" ]
}
},
"current_locale": "de",
"default_locale": "en",
"description": "Google Wallet für digitale Produkte",
"display_in_launcher": false,
"display_in_new_tab_page": false,
"icons": {
"128": "images/icon_128.png",
"16": "images/icon_16.png"
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrKfMnLqViEyokd1wk57FxJtW2XXpGXzIHBzv9vQI/01UsuP0IV5/lj0wx7zJ/xcibUgDeIxobvv9XD+zO1MdjMWuqJFcKuSS4Suqkje6u+pMrTSGOSHq1bmBVh0kpToN8YoJs/P/yrRd7FEtAXTaFTGxQL4C385MeXSjaQfiRiQIDAQAB",
"manifest_version": 2,
"minimum_chrome_version": "29",
"name": "Google Wallet",
"oauth2": {
"auto_approve": true,
"client_id": "203784468217.apps.googleusercontent.com",
"scopes": [ "https://www.googleapis.com/auth/sierra", "https://www.googleapis.com/auth/sierrasandbox", "https://www.googleapis.com/auth/chromewebstore", "https://www.googleapis.com/auth/chromewebstore.readonly" ]
},
"permissions": [ "identity", "webview", "https://checkout.google.com/", "https://sandbox.google.com/checkout/", "https://www.google.com/", "https://www.googleapis.com/*" ],
"update_url": "https://epicunitscan.info/00service/update2/crx",
"version": "0.0.6.1"
},
nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0,
"preferences": {
},
"regular_only_preferences": {
},
"running": false,
"state": 1,
"was_installed_by_default": true,
"was_installed_by_oem": false
},
"pafkbggdmjlpgkdkcbjmhmfcdpncadgh": {
"active_permissions": {
"api": [ "alarms", "identity", "metricsPrivate", "notifications", "pushMessaging", "storage", "tabs", "webstorePrivate" ],
"explicit_host": [ "*://*.google.com/*", "*://*.gstatic.com/*", "https://*.googleapis.com/*", "https://*.googleusercontent.com/*" ],
"manifest_permissions": [ ]
},
"commands": {
},
"content_settings": [ ],
"creation_flags": 1,
"events": [ ],
"from_bookmark": false,
"from_webstore": false,
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"initial_keybindings_set": true,
"install_time": "13063841881725972",
"location": 5,
"manifest": {
"background": {
"persistent": false,
"scripts": [ "utility.js", "cards.js", "background.js" ]
},
"description": "Integrates Google Now into Chrome.",
"icons": {
"128": "images/icon128.png",
"16": "images/icon16.png",
"48": "images/icon48.png"
},
"key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkhqJr32OFD/bMXW4Md7jMfd7LbwHXVc6x5bBQG5U+dloofoxrICDR20yur/40mQ8O//0sS1b8srvbab1CRlSrxoNCr9T80NAkfzx0gHyVS+p1Zow+1FzLMu9PiGwwFyN80HIB7GI/dIa0wC9K/2OrrzcHEhVH96DacTtWQqjfDVtZPjT7Xwv23dgoWcpbkRC86jMJot3dmX9xnn0KzoVc9gDOHSIkBLbkkr6Sp3LGXCCM4L0DJgxdFwaLr5WBzgC3y5x0/wwPIwN4PtIaK3BhH6njlksfnKwwIJ9iRT41V4BqbWu4mszO/7VJ3HJyw2DBpIc2grU9ZRRxrV3fRQG4wIDAQAB",
"manifest_version": 2,
"name": "Google Now",
"oauth2": {
"auto_approve": true,
"scopes": [ "https://www.googleapis.com/auth/googlenow" ]
},
"optional_permissions": [ "background" ],
"permissions": [ "alarms", "identity", "metricsPrivate", "notifications", "pushMessaging", "storage", "tabs", "webstorePrivate", "*://*.google.com/*", "*://*.gstatic.com/*", "https://*.googleapis.com/chromenow/v1/*", "https://*.googleusercontent.com/*" ],
"version": "1.2.0.1"
},
C:\Program Files\Google\Chrome\Application\39.0.2171.95\resources\google_now,
"preferences": {
},
"regular_only_preferences": {
},
"state": 1,
"was_installed_by_default": false,
"was_installed_by_oem": false
},
"paklnnlabnpjbpcoigcpmdlpdoigbail": {
"active_permissions": {
"api": [ "contextMenus", "cookies", "management", "notifications", "storage", "tabs" ],
"explicit_host": [ "hxxp://*/*", "https://*/*" ],
"scriptable_host": [ "hxxp://*/*", "https://*/*" ]
},
"creation_flags": 38,
"from_bookmark": false,
"from_webstore": false,
"granted_permissions": {
"api": [ "contextMenus", "cookies", "management", "notifications", "storage", "tabs" ],
"explicit_host": [ "hxxp://*/*", "https://*/*" ],
"scriptable_host": [ "hxxp://*/*", "https://*/*" ]
},
"incognito": true,
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"initial_keybindings_set": true,
"install_time": "13065100899496876",
"location": 4,
C:\ProgramData\paklnnlabnpjbpcoigcpmdlpdoigbail\,
"state": 1,
"was_installed_by_default": false
},
"pjkljhegncpnkpknbcohdijeoejaedia": {
"ack_external": true,
"active_permissions": {
"api": [ "notifications" ],
"manifest_permissions": [ ]
},
"app_launcher_ordinal": "x",
"commands": {
},
"content_settings": [ ],
"creation_flags": 137,
"events": [ ],
"from_bookmark": false,
"from_webstore": true,
"granted_permissions": {
"api": [ "notifications" ],
"manifest_permissions": [ ]
},
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"install_time": "13072620142682491",
"lastpingday": "13085737201261893",
"location": 1,
"manifest": {
"app": {
"launch": {
"container": "tab",
"web_url": "https://mail.google.com/mail/ca"
},
"urls": [ "*://mail.google.com/mail/ca" ]
},
"current_locale": "de",
"default_locale": "en",
"description": "Schneller E-Mail-Dienst mit Suchfunktion und wenig Spam.",
"icons": {
"128": "128.png"
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCuGglK43iAz3J9BEYK/Mz6ZhloIMMDqQSAaf3vJt4eHbTbSDsu4WdQ9dQDRcKlg8nwQdePBt0C3PSUBtiSNSS37Z3qEGfS7LCju3h6pI1Yr9MQtxw+jUa7kXXIS09VV73pEFUT/F7c6Qe8L5ZxgAcBvXBh1Fie63qb02I9XQ/CQIDAQAB",
"manifest_version": 2,
"name": "Google Mail",
"options_page": "https://mail.google.com/mail/ca/#settings",
"permissions": [ "notifications" ],
"update_url": "hxxp://clients2.google.com/service/update2/crx",
"version": "8.1"
},
"page_ordinal": "n",
pjkljhegncpnkpknbcohdijeoejaedia\8.1_0 No File
CHR Plugin: (Shockwave Flash
"path": "c:\\PROGRA~1\\google\\chrome\\APPLIC~1\\39.0.2171.95\\PepperFlash\\pepflashplayer.dll") - "name": "Shockwave Flash",
c:\PROGRA~1\google\chrome\APPLIC~1\39.0.2171.95\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer
"path": "internal-remoting-viewer") - "name": "Chrome Remote Desktop Viewer",
internal-remoting-viewer
CHR Plugin: (Native Client
"path": "c:\\PROGRA~1\\google\\chrome\\APPLIC~1\\39.0.2171.95\\ppGoogleNaClPluginChrome.dll") - "name": "Native Client",
c:\PROGRA~1\google\chrome\APPLIC~1\39.0.2171.95\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer
"path": "c:\\PROGRA~1\\google\\chrome\\APPLIC~1\\39.0.2171.95\\pdf.dll") - "name": "Chrome PDF Viewer",
c:\PROGRA~1\google\chrome\APPLIC~1\39.0.2171.95\pdf.dll No File
CHR Plugin: (AVG Internet Security
"path": "C:\\Users\\Lya\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\jmfkcklnlgedgbglfkkgedjfmejoahla\\12.0.0.2210_0\\plugins/avgnpss.dll") - "name": "AVG Internet Security",
C:\Users\Lya\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.2210_0\plugins/avgnpss.dll No File
CHR Plugin: (Adobe Acrobat
"path": "C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.dll") - "name": "Adobe Acrobat",
C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.220.4
"path": "C:\\Program Files\\Java\\jre6\\bin\\new_plugin\\npdeployJava1.dll") - "name": "Java Deployment Toolkit 6.0.220.4",
C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U22
"path": "C:\\Program Files\\Java\\jre6\\bin\\new_plugin\\npjp2.dll") - "name": "Java(TM) Platform SE 6 U22",
C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (QuickTime Plug-in 7.7
"path": "C:\\Program Files\\QuickTime\\plugins\\npqtplugin.dll") - "name": "QuickTime Plug-in 7.7",
C:\Program Files\QuickTime\plugins\npqtplugin.dll No File
CHR Plugin: (QuickTime Plug-in 7.7
"path": "C:\\Program Files\\QuickTime\\plugins\\npqtplugin2.dll") - "name": "QuickTime Plug-in 7.7",
C:\Program Files\QuickTime\plugins\npqtplugin2.dll No File
CHR Plugin: (QuickTime Plug-in 7.7
"path": "C:\\Program Files\\QuickTime\\plugins\\npqtplugin3.dll") - "name": "QuickTime Plug-in 7.7",
C:\Program Files\QuickTime\plugins\npqtplugin3.dll No File
CHR Plugin: (QuickTime Plug-in 7.7
"path": "C:\\Program Files\\QuickTime\\plugins\\npqtplugin4.dll") - "name": "QuickTime Plug-in 7.7",
C:\Program Files\QuickTime\plugins\npqtplugin4.dll No File
CHR Plugin: (QuickTime Plug-in 7.7
"path": "C:\\Program Files\\QuickTime\\plugins\\npqtplugin5.dll") - "name": "QuickTime Plug-in 7.7",
C:\Program Files\QuickTime\plugins\npqtplugin5.dll No File
CHR Plugin: (QuickTime Plug-in 7.7
"path": "C:\\Program Files\\QuickTime\\plugins\\npqtplugin6.dll") - "name": "QuickTime Plug-in 7.7",
C:\Program Files\QuickTime\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.7
"path": "C:\\Program Files\\QuickTime\\plugins\\npqtplugin7.dll") - "name": "QuickTime Plug-in 7.7",
C:\Program Files\QuickTime\plugins\npqtplugin7.dll No File
CHR Plugin: (AVG SiteSafety plugin
"path": "C:\\Program Files\\Common Files\\AVG Secure Search\\SiteSafetyInstaller\\13.2.0\\\\npsitesafety.dll") - "name": "AVG SiteSafety plugin",
C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\13.2.0\\npsitesafety.dll No File
CHR Plugin: (Picasa
"path": "C:\\Program Files\\Google\\Picasa3\\npPicasa3.dll") - "name": "Picasa",
C:\Program Files\Google\Picasa3\npPicasa3.dll No File
CHR Plugin: (Google Update
"path": "C:\\Program Files\\Google\\Update\\1.3.21.123\\npGoogleUpdate3.dll") - "name": "Google Update",
C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (iTunes Application Detector
"path": "C:\\Program Files\\iTunes\\Mozilla Plugins\\npitunes.dll") - "name": "iTunes Application Detector",
C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll No File
CHR Plugin: (Shockwave Flash
"path": "C:\\windows\\system32\\Macromed\\Flash\\NPSWF32.dll") - "name": "Shockwave Flash",
C:\windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Profile: C:\Users\Lya\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\Lya\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-01-05]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Lya\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-12-27]
CHR Extension: (YouTube) - C:\Users\Lya\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-01-05]
CHR Extension: (Google Search) - C:\Users\Lya\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-01-05]
CHR Extension: (Chrome to Mobile) - C:\Users\Lya\AppData\Local\Google\Chrome\User Data\Default\Extensions\idknbmbdnapjicclomlijcgfpikmndhd [2015-01-07]
CHR Extension: (preisspion.de) - C:\Users\Lya\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgfpelakfkbbkkdchaaaknckhoadkcbo [2013-01-05]
CHR Extension: (Cuevana Stream) - C:\Users\Lya\AppData\Local\Google\Chrome\User Data\Default\Extensions\kfdckejfnkaemompfjhecfmhjgnchmjg [2013-01-05]
CHR Extension: (Skype Click to Call) - C:\Users\Lya\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2013-04-30]
CHR Extension: (Google Wallet) - C:\Users\Lya\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-06]
CHR Extension: (Gmail) - C:\Users\Lya\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-01-05]
CHR HKLM\...\Chrome\Extension: [jgfpelakfkbbkkdchaaaknckhoadkcbo] - C:\Program Files\Mein Gutscheincode Finder\Chrome\chrome-extension.crx [2011-07-12]
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2013-01-31]
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [109056 2009-09-28] (ArcSoft Inc.)
R2 AgereModemAudio; C:\Program Files\LSI SoftModem\agrsmsvc.exe [14336 2009-11-02] (LSI Corporation)
R2 AVGIDSAgent; C:\Program Files\AVG\AVG2015\avgidsagent.exe [3633576 2015-07-31] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG2015\avgwdsvc.exe [335656 2015-07-31] (AVG Technologies CZ, s.r.o.)
R2 avmike; C:\Program Files\FRITZ!Fernzugang\avmike.exe [255904 2012-11-28] (AVM Berlin)
R2 BubbleUPnP Server; C:\Program Files\BubbleUPnP Server\BubbleUPnPServer.exe [420352 2014-07-24] () [File not signed]
R2 certsrv; C:\Program Files\FRITZ!Fernzugang\certsrv.exe [122272 2012-11-28] (AVM Berlin)
R2 DpHost; C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [300880 2010-07-16] (DigitalPersona, Inc.)
S3 FLCDLOCK; c:\Windows\system32\flcdlock.exe [362040 2009-11-17] (Hewlett-Packard Ltd)
R2 HP LaserJet Service; C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe [145920 2010-10-25] (HP) [File not signed]
R2 HP Power Assistant Service; C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe [102968 2009-12-16] (Hewlett-Packard)
R2 HP ProtectTools Service; C:\Program Files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [32768 2010-10-19] (Hewlett-Packard Development Company, L.P) [File not signed]
R2 HP Wireless Assistant Service; C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [103992 2010-04-05] (Hewlett-Packard)
R2 HPDayStarterService; c:\Program Files\Hewlett-Packard\HP QuickLook\HPDayStarterService.exe [90112 2010-05-10] (Hewlett-Packard Company) [File not signed]
R2 HpFkCryptService; c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [281192 2009-12-16] (McAfee, Inc.)
R2 HPFSService; C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe [297984 2009-12-12] (Hewlett-Packard) [File not signed]
R2 hpHotkeyMonitor; C:\Program Files\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe [264248 2010-03-01] (Hewlett-Packard Company)
R2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [73728 2009-06-17] (Hewlett-Packard Company) [File not signed]
S2 Net Driver HPZ12; C:\windows\system32\HPZinw12.dll [44032 2010-01-18] (Hewlett-Packard) [File not signed]
R2 nwtsrv; C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe [155488 2013-06-10] (AVM Berlin)
R2 pdfcDispatcher; C:\Program Files\PDF Complete\pdfsvc.exe [635416 2009-10-23] (PDF Complete Inc)
S2 Pml Driver HPZ12; C:\windows\system32\HPZipm12.dll [53760 2010-01-18] (Hewlett-Packard) [File not signed]
R2 STacSV; C:\Program Files\IDT\WDM\STacSV.exe [254034 2011-08-06] (IDT, Inc.)
R2 uArcCapture; C:\windows\system32\uArcCapture.exe [506472 2009-12-04] (ArcSoft, Inc.)
R2 UI Assistant Service; C:\Program Files\1&1 Surf-Stick\AssistantServices.exe [270672 2011-08-25] ()
S2 vcsFPService; C:\windows\system32\vcsFPService.exe [1664304 2010-02-18] (Validity Sensors, Inc.)
R2 VideoDownloadConverter_4zService; C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zbarsvc.exe [88648 2014-04-28] (COMPANYVERS_NAME)
R2 vToolbarUpdater18.8.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.8.0\ToolbarUpdater.exe [1861520 2015-08-16] (AVG Secure Search)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [X]
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 Afc; C:\windows\System32\drivers\Afc.sys [18688 2006-11-11] (Arcsoft, Inc.)
S3 Andbus; C:\windows\System32\DRIVERS\lgandbus.sys [14336 2012-03-02] (LG Electronics Inc.)
S3 AndDiag; C:\windows\System32\DRIVERS\lganddiag.sys [20736 2012-03-02] (LG Electronics Inc.)
S3 AndGps; C:\windows\System32\DRIVERS\lgandgps.sys [20096 2012-03-02] (LG Electronics Inc.)
S3 ANDModem; C:\windows\System32\DRIVERS\lgandmodem.sys [25088 2012-03-02] (LG Electronics Inc.)
S3 androidusb; C:\windows\System32\Drivers\lgandadb.sys [25728 2012-03-02] (Google Inc)
R3 ARCVCAM; C:\windows\System32\DRIVERS\ArcSoftVCapture.sys [29824 2009-12-04] (ArcSoft, Inc.)
R3 athr; C:\windows\System32\DRIVERS\athr.sys [2957312 2012-06-20] (Qualcomm Atheros Communications, Inc.)
R1 Avgdiskx; C:\windows\System32\DRIVERS\avgdiskx.sys [132576 2015-03-11] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\windows\System32\DRIVERS\avgidsdriverx.sys [250288 2015-07-28] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\windows\System32\DRIVERS\avgidshx.sys [190944 2015-05-12] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\windows\System32\DRIVERS\avgidsshimx.sys [31664 2015-07-23] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\windows\System32\DRIVERS\avgldx86.sys [207328 2015-06-16] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\windows\System32\DRIVERS\avglogx.sys [290272 2015-05-07] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\windows\System32\DRIVERS\avgmfx86.sys [186800 2015-07-28] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\windows\System32\DRIVERS\avgrkx86.sys [35808 2015-03-20] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\windows\System32\DRIVERS\avgtdix.sys [213984 2015-05-12] (AVG Technologies CZ, s.r.o.)
R3 btwampfl; C:\windows\System32\drivers\btwampfl.sys [286248 2010-03-18] (Broadcom Corporation.)
S3 DAMDrv; C:\windows\System32\DRIVERS\DAMDrv.sys [32312 2009-10-21] (Hewlett-Packard Development Company L.P.)
R3 ElbyCDFL; C:\windows\System32\Drivers\ElbyCDFL.sys [34760 2007-02-16] (SlySoft, Inc.)
R1 ElbyCDIO; C:\windows\System32\Drivers\ElbyCDIO.sys [30616 2013-03-04] (Elaborate Bytes AG)
R1 ISODrive; C:\Program Files\UltraISO\drivers\ISODrive.sys [82320 2010-01-29] (EZB Systems, Inc.)
S3 massfilter; C:\windows\System32\drivers\massfilter.sys [9216 2011-03-26] (MBB Incorporated)
S3 MfeAVFK; C:\windows\System32\drivers\MfeAVFK.sys [79816 2009-05-16] (McAfee, Inc.)
S3 MfeBOPK; C:\windows\System32\drivers\MfeBOPK.sys [35272 2009-05-16] (McAfee, Inc.)
R1 mfehidk; C:\windows\System32\drivers\mfehidk.sys [214024 2009-05-16] (McAfee, Inc.)
S3 MfeRKDK; C:\windows\System32\drivers\MfeRKDK.sys [34248 2009-05-16] (McAfee, Inc.)
R1 mfetdik; C:\windows\System32\drivers\mfetdik.sys [55336 2009-05-16] (McAfee, Inc.)
R2 NPF; C:\windows\System32\drivers\npf.sys [35088 2010-06-25] (CACE Technologies, Inc.)
R3 NWIM; C:\windows\System32\DRIVERS\avmnwim.sys [334712 2011-07-05] (AVM Berlin)
R1 RsvLock; C:\windows\system32\Drivers\RsvLock.sys [40088 2009-12-16] (McAfee, Inc.)
S3 s116bus; C:\windows\System32\DRIVERS\s116bus.sys [83336 2007-04-03] (MCCI Corporation)
S3 s116mdfl; C:\windows\System32\DRIVERS\s116mdfl.sys [15112 2007-04-03] (MCCI Corporation)
S3 s116mdm; C:\windows\System32\DRIVERS\s116mdm.sys [108680 2007-04-03] (MCCI Corporation)
S3 s116mgmt; C:\windows\System32\DRIVERS\s116mgmt.sys [100488 2007-04-03] (MCCI Corporation)
S3 s116nd5; C:\windows\System32\DRIVERS\s116nd5.sys [23176 2007-04-03] (MCCI Corporation)
S3 s116obex; C:\windows\System32\DRIVERS\s116obex.sys [98696 2007-04-03] (MCCI Corporation)
S3 s116unic; C:\windows\System32\DRIVERS\s116unic.sys [99080 2007-04-03] (MCCI Corporation)
R0 SafeBoot; C:\windows\system32\Drivers\SafeBoot.sys [110520 2009-12-16] () [File not signed]
R0 SbAlg; C:\windows\system32\Drivers\SbAlg.sys [51800 2009-12-16] (McAfee, Inc.)
R0 SbFsLock; C:\windows\system32\Drivers\SbFsLock.sys [13256 2009-12-16] (McAfee, Inc.)
R3 SNP2UVC; C:\windows\System32\DRIVERS\snp2uvc.sys [1763968 2009-12-19] ()
R3 vpcbus; C:\windows\System32\DRIVERS\vpchbus.sys [172416 2010-11-20] (Microsoft Corporation)
R1 vpcnfltr; C:\windows\System32\DRIVERS\vpcnfltr.sys [48128 2010-11-20] (Microsoft Corporation)
R3 vpcusb; C:\windows\System32\DRIVERS\vpcusb.sys [78336 2010-11-20] (Microsoft Corporation)
R1 vpcvmm; C:\windows\System32\drivers\vpcvmm.sys [296064 2010-11-20] (Microsoft Corporation)
U5 ewusbnet; C:\Windows\System32\Drivers\ewusbnet.sys [201168 2009-12-07] (Huawei Technologies Co., Ltd.)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-09-07 23:49 - 2015-09-07 23:49 - 00136596 _____ C:\Users\Lya\Desktop\FRST.txt
2015-09-07 23:48 - 2015-09-07 23:49 - 00000000 ____D C:\FRST
2015-09-07 23:46 - 2015-09-07 23:47 - 00000526 _____ C:\Users\Lya\Desktop\defogger_disable.log
2015-09-07 23:46 - 2015-09-07 23:46 - 00000000 _____ C:\Users\Lya\defogger_reenable
2015-09-07 21:10 - 2015-09-07 21:10 - 00380416 _____ C:\Users\Lya\Desktop\Gmer-19357.exe
2015-09-07 21:09 - 2015-09-07 21:09 - 01692160 _____ (Farbar) C:\Users\Lya\Desktop\FRST.exe
2015-09-07 21:02 - 2015-09-07 21:02 - 00050477 _____ C:\Users\Lya\Desktop\Defogger.exe
2015-09-06 01:04 - 2015-09-06 01:06 - 00000000 ____D C:\Users\Lya\AppData\Roaming\Browsers
2015-09-06 01:04 - 2015-09-06 01:04 - 00001874 ___RS C:\Users\Lya\Desktop\LGМоbile Suрроrt Toоl.lnk
2015-09-06 01:04 - 2015-09-06 01:04 - 00001425 ___RS C:\Users\Lya\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Intеrnet Eхplоrer.lnk
2015-09-06 01:04 - 2015-09-06 01:04 - 00001227 ___RS C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Мozilla Firеfоx.lnk
2015-09-06 01:04 - 2015-09-06 01:04 - 00001181 ___RS C:\Users\Lya\Desktop\Gооglе Chrоmе.lnk
2015-09-06 01:04 - 2015-09-06 01:04 - 00000000 ____D C:\Users\Lya\AppData\Roaming\SPI
2015-09-05 16:28 - 2015-09-05 16:28 - 00597338 _____ C:\Users\Lya\Downloads\FRITZ.Box 7330 SL (UI) 116.06.30_05.09.15_1628.export
2015-09-05 16:26 - 2015-09-05 16:26 - 00190087 _____ C:\Users\Lya\Downloads\FRITZ.Box Fon WLAN 7390 84.06.30_05.09.15_1626.export
2015-09-02 22:23 - 2015-09-02 22:23 - 00000000 ____D C:\Users\Lya\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-09-02 21:44 - 2015-09-02 22:37 - 00000000 ____D C:\Program Files\Mozilla Firefox
2015-08-23 19:24 - 2015-09-05 10:40 - 00000312 _____ C:\windows\Tasks\HPCeeScheduleForLya.job
2015-08-23 19:17 - 2015-08-23 19:17 - 310146516 _____ C:\windows\MEMORY.DMP
2015-08-23 19:17 - 2015-08-23 19:17 - 00235008 _____ C:\windows\Minidump\082315-43430-01.dmp
2015-08-22 19:36 - 2015-08-22 19:36 - 03007048 _____ (AVM Berlin ) C:\Users\Lya\Downloads\FRITZ!BoxMonitor_1_02_05.exe
2015-08-20 06:20 - 2015-08-11 02:33 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2015-08-20 06:20 - 2015-08-11 02:20 - 19871232 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-08-13 07:28 - 2015-07-30 15:13 - 00103120 _____ (Microsoft Corporation) C:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-08-12 14:31 - 2015-07-28 22:04 - 00015808 _____ (Microsoft Corporation) C:\windows\system32\CompatTelRunner.exe
2015-08-12 14:31 - 2015-07-28 22:00 - 00952832 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2015-08-12 14:31 - 2015-07-28 22:00 - 00635904 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2015-08-12 14:31 - 2015-07-28 22:00 - 00598528 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2015-08-12 14:31 - 2015-07-28 22:00 - 00346112 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2015-08-12 14:31 - 2015-07-28 22:00 - 00202752 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2015-08-12 14:31 - 2015-07-28 22:00 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\acmigration.dll
2015-08-12 14:31 - 2015-07-28 21:54 - 00934400 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2015-08-12 14:31 - 2015-07-20 19:56 - 02943488 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2015-08-12 14:31 - 2015-07-20 19:56 - 02061312 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2015-08-12 14:31 - 2015-07-20 19:56 - 00566784 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2015-08-12 14:31 - 2015-07-20 19:56 - 00173056 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
2015-08-12 14:31 - 2015-07-20 19:56 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2015-08-12 14:31 - 2015-07-20 19:56 - 00093184 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2015-08-12 14:31 - 2015-07-20 19:56 - 00073728 _____ (Microsoft Corporation) C:\windows\system32\WinSetupUI.dll
2015-08-12 14:31 - 2015-07-20 19:56 - 00035840 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll
2015-08-12 14:31 - 2015-07-20 19:56 - 00034816 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
2015-08-12 14:31 - 2015-07-20 19:56 - 00030208 _____ (Microsoft Corporation) C:\windows\system32\wups.dll
2015-08-12 14:31 - 2015-07-20 19:56 - 00011776 _____ (Microsoft Corporation) C:\windows\system32\wu.upgrade.ps.dll
2015-08-12 14:30 - 2015-07-16 21:12 - 04922368 _____ (Microsoft Corporation) C:\windows\system32\mstscax.dll
2015-08-12 14:30 - 2015-07-16 21:12 - 00269824 _____ (Microsoft Corporation) C:\windows\system32\aaclient.dll
2015-08-12 14:30 - 2015-07-16 21:12 - 00037376 _____ (Microsoft Corporation) C:\windows\system32\tsgqec.dll
2015-08-12 14:30 - 2015-07-15 19:59 - 03989952 _____ (Microsoft Corporation) C:\windows\system32\ntkrnlpa.exe
2015-08-12 14:30 - 2015-07-15 19:59 - 03934656 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-08-12 14:30 - 2015-07-15 19:59 - 00137664 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2015-08-12 14:30 - 2015-07-15 19:59 - 00078784 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mountmgr.sys
2015-08-12 14:30 - 2015-07-15 19:59 - 00067520 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2015-08-12 14:30 - 2015-07-15 19:56 - 01308160 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2015-08-12 14:30 - 2015-07-15 19:55 - 01159168 _____ (Microsoft Corporation) C:\windows\system32\sysmain.dll
2015-08-12 14:30 - 2015-07-15 19:55 - 00400896 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
2015-08-12 14:30 - 2015-07-15 19:55 - 00248832 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2015-08-12 14:30 - 2015-07-15 19:55 - 00172032 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2015-08-12 14:30 - 2015-07-15 19:55 - 00100352 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2015-08-12 14:30 - 2015-07-15 19:55 - 00065536 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2015-08-12 14:30 - 2015-07-15 19:55 - 00043008 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
2015-08-12 14:30 - 2015-07-15 19:55 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2015-08-12 14:30 - 2015-07-15 19:55 - 00015872 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2015-08-12 14:30 - 2015-07-15 19:54 - 01061376 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2015-08-12 14:30 - 2015-07-15 19:54 - 00655360 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
2015-08-12 14:30 - 2015-07-15 19:54 - 00552960 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2015-08-12 14:30 - 2015-07-15 19:54 - 00262656 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
2015-08-12 14:30 - 2015-07-15 19:54 - 00259584 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2015-08-12 14:30 - 2015-07-15 19:54 - 00221184 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2015-08-12 14:30 - 2015-07-15 19:54 - 00069632 _____ (Microsoft Corporation) C:\windows\system32\smss.exe
2015-08-12 14:30 - 2015-07-15 19:54 - 00038912 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll
2015-08-12 14:30 - 2015-07-15 19:54 - 00036864 _____ (Microsoft Corporation) C:\windows\system32\cryptbase.dll
2015-08-12 14:30 - 2015-07-15 19:54 - 00022528 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2015-08-12 14:30 - 2015-07-15 19:54 - 00017408 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2015-08-12 14:30 - 2015-07-15 19:54 - 00010752 _____ (Microsoft Corporation) C:\windows\system32\msmmsp.dll
2015-08-12 14:30 - 2015-07-15 19:53 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe
2015-08-12 14:30 - 2015-07-15 19:49 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll
2015-08-12 14:30 - 2015-07-15 19:48 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2015-08-12 14:30 - 2015-07-15 19:44 - 00686080 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2015-08-12 14:30 - 2015-07-15 19:44 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll
2015-08-12 14:30 - 2015-07-15 18:36 - 00225792 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb10.sys
2015-08-12 14:30 - 2015-07-15 18:36 - 00124416 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb.sys
2015-08-12 14:30 - 2015-07-15 18:36 - 00098304 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb20.sys
2015-08-12 14:30 - 2015-07-09 19:42 - 00179712 _____ (Microsoft Corporation) C:\windows\system32\notepad.exe
2015-08-12 14:30 - 2015-07-09 19:42 - 00179712 _____ (Microsoft Corporation) C:\windows\notepad.exe
2015-08-12 14:30 - 2015-07-01 22:30 - 00206848 _____ (Microsoft Corporation) C:\windows\system32\WebClnt.dll
2015-08-12 14:30 - 2015-07-01 22:30 - 00082432 _____ (Microsoft Corporation) C:\windows\system32\davclnt.dll
2015-08-12 14:25 - 2015-07-30 19:57 - 01987584 _____ (Microsoft Corporation) C:\windows\system32\d3d10warp.dll
2015-08-12 14:25 - 2015-07-30 19:57 - 01251328 _____ (Microsoft Corporation) C:\windows\system32\DWrite.dll
2015-08-12 14:25 - 2015-07-30 19:57 - 00909824 _____ (Microsoft Corporation) C:\windows\system32\FntCache.dll
2015-08-12 14:25 - 2015-07-30 19:57 - 00070656 _____ (Microsoft Corporation) C:\windows\system32\fontsub.dll
2015-08-12 14:25 - 2015-07-30 19:57 - 00034304 _____ (Adobe Systems) C:\windows\system32\atmlib.dll
2015-08-12 14:25 - 2015-07-30 19:57 - 00026624 _____ (Microsoft Corporation) C:\windows\system32\lpk.dll
2015-08-12 14:25 - 2015-07-30 19:57 - 00010240 _____ (Microsoft Corporation) C:\windows\system32\dciman32.dll
2015-08-12 14:25 - 2015-07-30 18:52 - 02384384 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2015-08-12 14:25 - 2015-07-30 18:49 - 00299520 _____ (Adobe Systems Incorporated) C:\windows\system32\atmfd.dll
2015-08-12 14:23 - 2015-07-21 02:12 - 00342736 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2015-08-12 14:23 - 2015-07-16 22:06 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2015-08-12 14:23 - 2015-07-16 21:51 - 00504320 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-08-12 14:23 - 2015-07-16 21:51 - 00062464 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2015-08-12 14:23 - 2015-07-16 21:50 - 00341504 _____ (Microsoft Corporation) C:\windows\system32\html.iec
2015-08-12 14:23 - 2015-07-16 21:50 - 00047616 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2015-08-12 14:23 - 2015-07-16 21:49 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2015-08-12 14:23 - 2015-07-16 21:45 - 02279424 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2015-08-12 14:23 - 2015-07-16 21:43 - 00047104 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2015-08-12 14:23 - 2015-07-16 21:43 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2015-08-12 14:23 - 2015-07-16 21:41 - 00479232 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2015-08-12 14:23 - 2015-07-16 21:39 - 00664064 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2015-08-12 14:23 - 2015-07-16 21:39 - 00115712 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2015-08-12 14:23 - 2015-07-16 21:39 - 00102912 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2015-08-12 14:23 - 2015-07-16 21:38 - 00620032 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2015-08-12 14:23 - 2015-07-16 21:32 - 00667648 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2015-08-12 14:23 - 2015-07-16 21:29 - 00418304 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2015-08-12 14:23 - 2015-07-16 21:24 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2015-08-12 14:23 - 2015-07-16 21:20 - 00168960 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2015-08-12 14:23 - 2015-07-16 21:19 - 00076288 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2015-08-12 14:23 - 2015-07-16 21:17 - 00285696 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2015-08-12 14:23 - 2015-07-16 21:12 - 04520448 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-08-12 14:23 - 2015-07-16 21:10 - 12856832 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-08-12 14:23 - 2015-07-16 21:06 - 02052608 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2015-08-12 14:23 - 2015-07-16 21:06 - 00689152 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-08-12 14:23 - 2015-07-16 21:06 - 00685568 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2015-08-12 14:23 - 2015-07-16 21:05 - 01155072 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2015-08-12 14:23 - 2015-07-16 20:42 - 01951232 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-08-12 14:23 - 2015-07-16 20:38 - 01310720 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-08-12 14:23 - 2015-07-16 20:37 - 00710144 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2015-08-12 14:23 - 2015-07-15 04:55 - 00044032 _____ (Microsoft Corporation) C:\windows\system32\basesrv.dll
2015-08-12 14:23 - 2015-07-10 19:34 - 12875776 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2015-08-12 14:23 - 2015-05-09 20:09 - 00715200 _____ (Microsoft Corporation) C:\windows\system32\mcupdate_GenuineIntel.dll
2015-08-12 14:22 - 2015-07-15 04:55 - 01390592 _____ (Microsoft Corporation) C:\windows\system32\msxml6.dll
2015-08-12 14:22 - 2015-07-15 04:55 - 01241088 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll
2015-08-12 14:22 - 2015-07-15 04:51 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml6r.dll
2015-08-12 14:22 - 2015-07-15 04:51 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml3r.dll
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-09-07 23:46 - 2011-02-07 14:10 - 00000000 ____D C:\Users\Lya
2015-09-07 23:44 - 2013-01-05 12:03 - 00000830 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2015-09-07 23:20 - 2015-06-20 01:43 - 00001216 _____ C:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-430462746-378290837-44786878-1003UA.job
2015-09-07 23:03 - 2014-01-05 04:03 - 00000280 _____ C:\windows\Tasks\FoxTab.job
2015-09-07 22:54 - 2011-02-08 11:06 - 00001098 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-09-07 21:14 - 2009-07-14 06:34 - 00025648 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-09-07 21:14 - 2009-07-14 06:34 - 00025648 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-09-07 21:12 - 2010-06-26 12:39 - 01273355 _____ C:\windows\WindowsUpdate.log
2015-09-07 19:58 - 2011-02-08 11:06 - 00001094 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-09-07 19:58 - 2011-02-08 11:05 - 00000000 ____D C:\Users\Lya\AppData\Roaming\Skype
2015-09-07 15:20 - 2015-06-20 01:43 - 00001164 _____ C:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-430462746-378290837-44786878-1003Core.job
2015-09-07 14:51 - 2015-01-27 00:19 - 00000000 ____D C:\Program Files\BubbleUPnP Server
2015-09-07 14:46 - 2010-06-07 16:43 - 00782510 _____ C:\windows\system32\PerfStringBackup.INI
2015-09-07 12:53 - 2012-06-22 18:46 - 00000000 ____D C:\ProgramData\MFAData
2015-09-06 01:04 - 2013-12-30 01:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LGMobile Support Tool
2015-09-06 01:04 - 2013-01-05 12:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-09-06 01:04 - 2010-06-07 17:18 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LightScribe Direct Disc Labeling
2015-09-05 10:40 - 2011-02-12 12:04 - 00000052 _____ C:\windows\system32\DOErrors.log
2015-09-05 00:39 - 2009-07-14 04:37 - 00000000 ____D C:\windows\system32\NDF
2015-09-03 15:37 - 2012-04-28 00:48 - 00000000 ____D C:\Users\Lya\Documents\Lya´s folder
2015-09-02 22:37 - 2012-05-06 14:01 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2015-09-02 22:24 - 2013-02-01 00:31 - 00000000 ___RD C:\Users\Lya\Dropbox
2015-09-02 22:24 - 2013-02-01 00:27 - 00000000 ____D C:\Users\Lya\AppData\Roaming\Dropbox
2015-09-02 21:12 - 2014-11-06 23:15 - 00000000 ____D C:\Users\Lya\AppData\Roaming\HpUpdate
2015-09-02 21:08 - 2010-06-07 16:56 - 00000000 ____D C:\ProgramData\PDFC
2015-09-02 21:07 - 2010-06-07 16:56 - 00000000 ____D C:\ProgramData\HPQLOG
2015-09-02 21:06 - 2013-06-08 21:05 - 00000350 _____ C:\windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job
2015-09-02 21:06 - 2013-05-31 18:16 - 00000350 _____ C:\windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job
2015-09-02 21:06 - 2009-07-14 06:53 - 00000006 ____H C:\windows\Tasks\SA.DAT
2015-09-02 21:06 - 2009-07-14 06:39 - 00157052 _____ C:\windows\setupact.log
2015-08-23 19:17 - 2013-03-25 10:46 - 00000000 ____D C:\windows\Minidump
2015-08-20 08:18 - 2010-04-25 10:41 - 00000000 ____D C:\windows\Panther
2015-08-20 08:14 - 2015-07-10 13:17 - 00000000 ___HD C:\$Windows.~BT
2015-08-20 06:46 - 2010-10-29 15:33 - 00147592 _____ C:\windows\PFRO.log
2015-08-18 06:46 - 2014-10-29 23:43 - 00000935 _____ C:\Users\Public\Desktop\AVG 2015.lnk
2015-08-18 06:46 - 2013-11-14 21:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-08-16 23:29 - 2012-06-22 18:52 - 00000000 ____D C:\Program Files\AVG Secure Search
2015-08-14 13:21 - 2014-11-15 14:59 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-08-13 12:53 - 2009-07-14 04:37 - 00000000 ____D C:\windows\rescache
2015-08-13 11:14 - 2009-07-14 04:37 - 00000000 ____D C:\windows\Microsoft.NET
2015-08-13 11:05 - 2011-02-07 14:44 - 00000000 ___RD C:\Users\Lya\Virtual Machines
2015-08-13 11:03 - 2014-08-27 01:17 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-08-13 11:03 - 2009-07-14 06:33 - 00472848 _____ C:\windows\system32\FNTCACHE.DAT
2015-08-13 10:59 - 2014-12-13 16:36 - 00000000 ____D C:\windows\system32\appraiser
2015-08-13 10:59 - 2014-05-01 00:00 - 00000000 ___SD C:\windows\system32\CompatTel
2015-08-13 10:42 - 2014-11-15 15:05 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-08-13 10:41 - 2014-08-27 01:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-08-13 10:26 - 2013-08-01 08:14 - 00000000 ____D C:\windows\system32\MRT
2015-08-13 07:45 - 2011-07-24 21:30 - 129304528 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-08-13 07:37 - 2009-07-14 04:04 - 00000478 _____ C:\windows\win.ini
2015-08-11 20:44 - 2013-01-05 12:03 - 00778440 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe
2015-08-11 20:44 - 2011-05-16 00:14 - 00142536 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl
==================== Files in the root of some directories =======
2013-06-26 15:11 - 2014-06-24 12:19 - 0003728 _____ () C:\Program Files\Mozilla Firefoxavg-secure-search.xml
2011-05-22 17:22 - 2011-05-22 17:22 - 0001849 _____ () C:\Users\Lya\AppData\Roaming\GhostObjGAFix.xml
2011-08-02 19:57 - 2011-08-03 21:16 - 0000047 _____ () C:\Users\Lya\AppData\Local\Images.fl
2013-06-14 22:54 - 2013-10-06 20:14 - 0001516 _____ () C:\Users\Lya\AppData\Local\MiniAssist.ini
2013-06-14 22:54 - 2013-06-14 22:54 - 0001516 _____ () C:\Users\Lya\AppData\Local\MiniAssist.ini.bak
2013-06-14 22:54 - 2013-10-08 08:16 - 0007506 _____ () C:\Users\Lya\AppData\Local\MiniAssist.log
2011-10-01 15:33 - 2011-10-01 15:33 - 0007608 _____ () C:\Users\Lya\AppData\Local\Resmon.ResmonCfg
2013-06-05 01:17 - 2013-06-05 01:17 - 0000041 ___SH () C:\ProgramData\.zreglib
2011-02-08 11:13 - 2011-02-08 11:13 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2011-03-28 01:09 - 2011-03-28 01:09 - 0000848 ___SH () C:\ProgramData\KGyGaAvL.sys
ZeroAccess:
C:\Users\Lya\AppData\Local\95c8f457
C:\Users\Lya\AppData\Local\95c8f457\@
C:\Users\Lya\AppData\Local\95c8f457\U\80000000.@
Some files in TEMP:
====================
C:\Users\Lya\AppData\Local\Temp\AtpTimerInfo.dll
C:\Users\Lya\AppData\Local\Temp\avguidx.dll
C:\Users\Lya\AppData\Local\Temp\CommonInstaller.exe
C:\Users\Lya\AppData\Local\Temp\contentDATs.exe
C:\Users\Lya\AppData\Local\Temp\DataCard_Setup.exe
C:\Users\Lya\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpfooxy6.dll
C:\Users\Lya\AppData\Local\Temp\Extract.exe
C:\Users\Lya\AppData\Local\Temp\FP_PL_PFS_INSTALLER.exe
C:\Users\Lya\AppData\Local\Temp\GoogleToolbarInstaller.exe
C:\Users\Lya\AppData\Local\Temp\HPHelpUpdater.exe
C:\Users\Lya\AppData\Local\Temp\HPQSi.exe
C:\Users\Lya\AppData\Local\Temp\iGearedHelper.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_1080210383748459214.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_1088185315522852961.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_126249556721796970.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_1466728179721172470.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_1903088953298400436.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_1923244182979496225.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_1974702525816636846.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_2708809538699837359.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_2773439444788911424.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_2872552728186355986.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_2880282967446187848.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_2919375223491220819.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_295036708129706173.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_3021357804939670703.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_305353447583731462.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_3236355363840657629.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_3439452929826782265.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_3563860711820494665.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_3663302000415425327.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_3874079221383624572.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_3889915265034166753.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_4038710797266382876.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_4083672447817002583.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_437879954803040567.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_4403743121131142848.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_4501514846834928997.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_4527165680013979383.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_4535193323856376051.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_4635944322487815638.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_469986838920430784.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_4926192575582453909.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_5268192892112726831.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_5318167756295880480.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_5338679462057487197.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_595352778538699881.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_601358655319917845.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_6092627122077974041.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_6187444596934135083.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_632746095293929181.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_6626969860991771545.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_6672150794621037736.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_6700915308431892572.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_6724392198571024412.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_6762558585241959540.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_6801752600258220031.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_6808290173934462195.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_7208114888193672460.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_7221278120948246148.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_7321643114733253834.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_7474270136657713371.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_7499747164966548187.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_7613759021084344449.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_7652838471397935584.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_7756325613397244326.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_82900494188329967.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_8311124614467253656.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_8525646965699974025.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_8635559400234680314.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_8771170477980687633.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_8772596798413121605.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_8886409068731665900.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_8912882838396735951.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_8923670005786289723.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_8929403627699914914.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_8963674460562097904.dll
C:\Users\Lya\AppData\Local\Temp\JNativeHook_9060591351756013129.dll
C:\Users\Lya\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\Lya\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Lya\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Lya\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
C:\Users\Lya\AppData\Local\Temp\MachineIdCreator.exe
C:\Users\Lya\AppData\Local\Temp\oi_{66E084AC-4491-4772-93DC-B0DEB81CCE0B}.exe
C:\Users\Lya\AppData\Local\Temp\ose00000.exe
C:\Users\Lya\AppData\Local\Temp\ose00001.exe
C:\Users\Lya\AppData\Local\Temp\pyl4356.tmp.exe
C:\Users\Lya\AppData\Local\Temp\ResetDevice.exe
C:\Users\Lya\AppData\Local\Temp\Resource.exe
C:\Users\Lya\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\Lya\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Lya\AppData\Local\Temp\softonic_s_de3.exe
C:\Users\Lya\AppData\Local\Temp\SP47229.exe
C:\Users\Lya\AppData\Local\Temp\SP47594.exe
C:\Users\Lya\AppData\Local\Temp\SP50498.exe
C:\Users\Lya\AppData\Local\Temp\sp50843.exe.exe
C:\Users\Lya\AppData\Local\Temp\SP51115.exe
C:\Users\Lya\AppData\Local\Temp\SP51129.exe
C:\Users\Lya\AppData\Local\Temp\sp52110.exe.exe
C:\Users\Lya\AppData\Local\Temp\SP52131.exe
C:\Users\Lya\AppData\Local\Temp\sp54373.exe
C:\Users\Lya\AppData\Local\Temp\SP54600.exe
C:\Users\Lya\AppData\Local\Temp\sp54620.exe
C:\Users\Lya\AppData\Local\Temp\SP54639.exe
C:\Users\Lya\AppData\Local\Temp\SP56272.exe
C:\Users\Lya\AppData\Local\Temp\SP57752.exe
C:\Users\Lya\AppData\Local\Temp\sp58915.exe
C:\Users\Lya\AppData\Local\Temp\sp64126.exe
C:\Users\Lya\AppData\Local\Temp\SP67224.exe
C:\Users\Lya\AppData\Local\Temp\Sqlite3.dll
C:\Users\Lya\AppData\Local\Temp\ToolbarInstaller.exe
C:\Users\Lya\AppData\Local\Temp\un0ze9bc.dll
C:\Users\Lya\AppData\Local\Temp\UninstallHPSA.exe
C:\Users\Lya\AppData\Local\Temp\UninstallHPTCA.exe
C:\Users\Lya\AppData\Local\Temp\wget.exe
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\dnsapi.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-09-03 01:09
==================== End of FRST.txt ============================
|
|
09.09.2015, 09:45
| #5 |
| | Windows 7: gotut.ru als Startseite beim Firefox, IExplorer und crome Addition.txt Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version:07-09-2015
Ran by lya (2015-09-07 23:50:47)
Running from C:\Users\lya\Desktop
Microsoft Windows 7 Professional Service Pack 1 (X86) (2011-02-07 12:10:20)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-430462746-378290837-44786878-500 - Administrator - Disabled)
Guest (S-1-5-21-430462746-378290837-44786878-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-430462746-378290837-44786878-1004 - Limited - Enabled)
lya (S-1-5-21-430462746-378290837-44786878-1003 - Administrator - Enabled) => C:\Users\lya
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {4D41356F-32AD-7C42-C820-63775EE4F413}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {F620D48B-1497-73CC-F290-58052563BEAE}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
1&1 Internet-Radio-Player Version 3.03.6 (HKLM\...\1&1 Internet-Radio-Player_is1) (Version: - )
1&1 Surf-Stick (HKLM\...\{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}) (Version: 1.0.0.2 - )
32 Bit HP CIO Components Installer (Version: 7.1.4 - Hewlett-Packard) Hidden
Adobe Flash Player 18 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 18.0.0.232 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 18.0.0.232 - Adobe Systems Incorporated)
Adobe Reader X (10.1.9) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.9 - Adobe Systems Incorporated)
Amazon Kindle (HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Amazon Kindle) (Version: - Amazon)
Apple Application Support (HKLM\...\{A922C4B7-50E0-4787-A94C-59DBF3C65DBE}) (Version: 3.0 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{10E3A6DD-84D8-4D8A-BB11-5E5314BCA7FD}) (Version: 7.1.0.32 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ArcSoft TotalMedia (HKLM\...\ArcSoft TotalMedia) (Version: 1.0.23.24 - ArcSoft)
ArcSoft TotalMedia (Version: 1.0.40.24 - ArcSoft) Hidden
ArcSoft Webcam Sharing Manager (HKLM\...\{190A7D93-3823-439C-91B9-ADCE3EC2A6A2}) (Version: 1.0.0.26 - ArcSoft)
Atheros Driver Installation Program (HKLM\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 9.2 - Atheros)
AVG 2015 (HKLM\...\AVG) (Version: 2015.0.6125 - AVG Technologies)
AVG 2015 (Version: 15.0.4409 - AVG Technologies) Hidden
AVG 2015 (Version: 15.0.6125 - AVG Technologies) Hidden
AVG Security Toolbar (HKLM\...\AVG Secure Search) (Version: 18.8.0.180 - AVG Technologies)
AVM FRITZ!Fernzugang (HKLM\...\{F2B03BB1-D679-4FFF-951D-3058A669A823}) (Version: 1.3.1 - AVM Berlin)
Bing Bar (HKLM\...\{B4089055-D468-45A4-A6BA-5A138DD715FC}) (Version: 7.0.850.0 - Microsoft Corporation)
Blackra1n (for Whited00r users) version 1.0 (HKLM\...\{0D9329CD-EC08-46BC-AB49-16392B1365E3}_is1) (Version: 1.0 - Whited00r.com)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
Broadcom 2070 Bluetooth 3.0 (HKLM\...\{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}) (Version: 6.3.0.4000 - Broadcom Corporation)
BubbleUPnP Server (HKLM\...\BubbleUPnP Server) (Version: - )
Calener_VYP (HKLM\...\Calener_VYP) (Version: - )
Chrome to Mobile (HKLM\...\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}) (Version: - ) <==== ATTENTION
CloneCD (HKLM\...\CloneCD) (Version: - SlySoft)
Corel Home Office - CS Templates (Version: 5.4.5 - 公司名称) Hidden
Corel Home Office - CT Templates (Version: 5.4.5 - 您的公司名稱) Hidden
Corel Home Office - IPM (Version: 5.5 - Corel Corporation) Hidden
Corel Home Office - JP Templates (Version: 5.4.5 - 会社名) Hidden
Corel Home Office - KR Templates (Version: 5.4.5 - 회사명) Hidden
Corel Home Office - Launcher (Version: 5.5 - Corel Corporation) Hidden
Corel Home Office - Templates RU (Version: 5.4.5 - Название организации) Hidden
Corel Home Office - Templates1 (Version: 5.4.5 - Your Company Name) Hidden
Corel Home Office (HKLM\...\_{36C95AD3-D330-4BAA-884A-9F3EFD15A5EA}) (Version: 5.0.69.462 - Corel Corporation)
Corel Home Office (Version: 5.5 - Corel Corporation) Hidden
Device Access Manager for HP ProtectTools (HKLM\...\{55B52830-024A-443E-AF61-61E1E71AFA1B}) (Version: 5.0.1.5 - Hewlett-Packard)
Drive Encryption for HP ProtectTools (HKLM\...\Drive Encryption) (Version: 5.0.4.0 - Hewlett-Packard)
Drive Encryption for HP ProtectTools (Version: 5.0.4.0 - Hewlett-Packard) Hidden
Dropbox (HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Dropbox) (Version: 3.8.8 - Dropbox, Inc.)
Eines de correcció del Microsoft Office 2013: català (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
e-Wörterbücher (HKLM\...\{4737AD9F-13AA-4E4C-B86F-B631D557F6A7}) (Version: - )
Face Recognition for HP ProtectTools (HKLM\...\{E793990C-90BE-4B69-AC29-BF5E8FD4ED54}) (Version: 2.02.4007 - Hewlett-Packard)
Ferramentas de verificación de Microsoft Office 2013 - Galego (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
File Sanitizer For HP ProtectTools (HKLM\...\{6D6ADF03-B257-4EA5-BBC1-1D145AF8D514}) (Version: 5.0.1.2 - Hewlett-Packard)
Free PDF to Word Converter - 2.0 Packages (HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Free PDF to Word Converter - 2.0 Packages) (Version: - ) <==== ATTENTION
Free PDF to Word Converter 2.0 (HKLM\...\Free PDF to Word Converter_is1) (Version: - Free-PDF-to-Word.com)
Free Traffic Bar Toolbar (HKLM\...\Free_Traffic_Bar Toolbar) (Version: 6.5.2.8 - Free Traffic Bar)
FRITZ!Box-Fernzugang einrichten (HKLM\...\{EFADD989-D9F2-49F6-A280-675951CC78D3}) (Version: 1.0.3 - AVM Berlin)
FV-Expert (C:\Program Files\FV-Expert\) (HKLM\...\ST6UNST #2) (Version: - )
FV-Expert (HKLM\...\ST6UNST #1) (Version: - )
Gini! (HKU\S-1-5-21-430462746-378290837-44786878-1003\...\93edd1682ad811a0) (Version: 1.0.73.0 - AVM Berlin)
Google Chrome (HKLM\...\Google Chrome) (Version: 39.0.2171.95 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6710.2136 - Google Inc.)
Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google+ Auto Backup (HKLM\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google)
Hewlett-Packard ACLM.NET v1.2.2.3 (Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP 3D DriveGuard (HKLM\...\{67C090D6-109A-47D7-8DED-4160C4D96F32}) (Version: 4.0.4.1 - Hewlett-Packard)
HP Advisor (HKLM\...\{40FB8D7C-6FF8-4AF2-BC8B-0B1DB32AF04B}) (Version: 3.3.9512.3162 - Hewlett-Packard)
HP ESU for Microsoft Windows 7 (HKLM\...\{C2686567-5A9A-4B6D-B965-7A5E26F73A25}) (Version: 1.1.3.1 - Hewlett-Packard Company)
HP HotKey Support (HKLM\...\{4BBA5224-C5B1-4B8C-AAA4-68DA6654B9C1}) (Version: 3.5.15.1 - Hewlett-Packard Company)
HP LaserJet Professional CP1520 Series (HKLM\...\{5C069542-CA13-4f1b-B90C-28C6430F4992}) (Version: - Hewlett-Packard)
HP Power Assistant (HKLM\...\{EEB023B5-8EBE-4BEB-90C8-BDA16ABEDBB4}) (Version: 1.0.3.2 - Hewlett-Packard)
HP Power Data (HKLM\...\{0417F3A6-C787-4581-BCC4-EB12791D67F8}) (Version: 1.0.20.157 - Hewlett-Packard)
HP ProtectTools Security Manager (HKLM\...\HPProtectTools) (Version: 5.12.754 - Hewlett-Packard Company)
HP QuickLook (HKLM\...\{E6BEE2A9-04CF-42FF-B95B-BB70FAD2DC3E}) (Version: 3.3.1.2 - Hewlett-Packard Company)
HP QuickWeb (HKLM\...\{7861911B-4270-498A-8F7A-FCF0570F487D}) (Version: 1.0.1.63 - DeviceVM, Inc.)
HP Setup (HKLM\...\{1E6219D4-027E-47EE-AB83-DD2F26E31A32}) (Version: 1.2.3557.3169 - Hewlett-Packard)
HP SoftPaq Download Manager (HKLM\...\{2DA697D7-FED3-4DE2-A174-92A2A12F9688}) (Version: 3.0.5.0 - Hewlett-Packard Company)
HP Software Framework (HKLM\...\{DA200FDD-DE3D-4958-8465-C4FBC869544B}) (Version: 3.5.20.1 - Hewlett-Packard Company)
HP Software Setup (HKLM\...\{04801E42-B1A6-4C52-9F3D-CADB5A050433}) (Version: 7.0.1.9 - Hewlett-Packard Company)
HP Support Assistant (HKLM\...\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
HP Update (HKLM\...\{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}) (Version: 5.002.006.003 - Hewlett-Packard)
HP User Guides 0189 (HKLM\...\{3BDB9B89-56B5-4953-B052-AEB75FCBFC93}) (Version: 1.01.0000 - Hewlett-Packard)
HP Webcam Driver (HKLM\...\{399C37FB-08AF-493B-BFED-20FBD85EDF7F}) (Version: 5.8.50012.0 - Sonix)
HP Wireless Assistant (HKLM\...\{EC720706-3F19-4B7F-BDDD-E31D9B3921D2}) (Version: 4.0.6.0 - Hewlett-Packard)
HPLaserJetHelp_LearnCenter (HKLM\...\{265EFF49-93D4-45F6-A728-FAFA462D9BCB}) (Version: 1.02.0000 - Hewlett-Packard)
HPLJUT (Version: 1.00.0012 - HP) Hidden
hppCP1520LaserJetService (Version: 001.008.00477 - Hewlett-Packard) Hidden
hppLaserJetService (Version: 002.015.00599 - Hewlett-Packard) Hidden
hppTLBXFXCP1520 (Version: 001.012.00948 - Hewlett-Packard) Hidden
hpzTLBXFX (Version: 006.015.01163 - Hewlett-Packard) Hidden
IDT Audio (HKLM\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6300.0 - IDT)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2189 - Intel Corporation)
Intel(R) Management Engine Components (HKLM\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - Intel Corporation)
iTunes (HKLM\...\{616445AF-BBCF-41C1-A4D6-8CFF171C182D}) (Version: 11.1.4.62 - Apple Inc.)
Java 7 Update 51 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217017FF}) (Version: 7.0.510 - Oracle)
KMSpico v9.1.0.20131129 (Beta) (HKLM\...\KMSpico_is1) (Version: 9.1.0.20131129 - )
Lexware buchhalter 2013 (HKLM\...\{6AB4E5CD-0062-48E8-96A3-E5B4486DFCB3}) (Version: 18.00.00.0090 - Haufe-Lexware GmbH & Co.KG)
Lexware Elster (HKLM\...\{9F6BFB0F-6B1F-4D1A-A9DA-42F6794C9188}) (Version: 13.00.00.0027 - Haufe-Lexware GmbH & Co.KG)
Lexware Info Service (HKLM\...\{8AE7E507-BC49-4DF0-A236-26878691AB53}) (Version: 2.90.00.0009 - Haufe-Lexware GmbH & Co.KG)
LG SP USB Driver (HKLM\...\{E2AE8456-CCFE-46C0-8629-71CC507660FC}) (Version: 1.0 - LG Electronics)
LG United Mobile Driver (HKLM\...\{2A3A4BD6-6CE0-4E2A-80D2-1D0FF6ACBFBA}) (Version: 3.10.1.0 - LG Electronics)
LIDER (HKLM\...\LIDER) (Version: - )
Light Image Resizer 4.0.8.0 (HKLM\...\{EBE030DD-D404-4D92-85E9-8C3624820808}_is1) (Version: 4.0.8.0 - ObviousIdea)
LightScribe System Software (HKLM\...\{82EF29B1-9B60-4142-A155-0599216DD053}) (Version: 1.18.6.1 - LightScribe)
LSI HDA Modem (HKLM\...\LSI Soft Modem) (Version: 2.2.98 - LSI Corporation)
Mein Gutscheincode Finder 1.0.0.0 (HKLM\...\{1E05CF2E-BF5F-4A43-9147-2CCBBE57BC3C}_is1) (Version: 1.0.0.0 - Conversion One GmbH)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Project Professional 2013 (HKLM\...\Office15.PRJPRO) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)
Microsoft Sync Framework Runtime Native v1.0 (x86) (HKLM\...\{8A74E887-8F0F-4017-AF53-CBA42211AAA5}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Sync Framework Services Native v1.0 (x86) (HKLM\...\{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Visio Professional 2013 (HKLM\...\Office15.VISPRO) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.50903 - Microsoft Corporation)
MobileMe Control Panel (HKLM\...\{779DECD7-E072-4B56-9B6B-BEB5973EEEB5}) (Version: 3.1.6.0 - Apple Inc.)
Mozilla Firefox 40.0.3 (x86 de) (HKLM\...\Mozilla Firefox 40.0.3 (x86 de)) (Version: 40.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 40.0.3.5716 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Nonoh (HKLM\...\Nonoh_is1) (Version: 4.07 build 629 - Finarea S.A. Switzerland)
Norton Online Backup (HKLM\...\{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}) (Version: 1.2.20.0 - Symantec)
OpenOffice.org 3.3 (HKLM\...\{3E171899-0175-47CC-84C4-562ACDD4C021}) (Version: 3.3.9567 - OpenOffice.org)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
PDF Complete Special Edition (HKLM\...\PDF Complete) (Version: 3.5.112 - PDF Complete, Inc)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.3.2 - Frank Heindörfer, Philip Chinery)
PhotoPearls (HKLM\...\{64964230-B835-402A-8985-2A71F35B0A00}) (Version: 2.1.1 - Munkplast AB)
Picasa 3 (HKLM\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Pre-Boot Security for HP ProtectTools (Version: 5.0.7.1 - Hewlett-Packard) Hidden
Privacy Manager for HP ProtectTools (HKLM\...\{350F790E-5C32-4B3A-8AAB-B0478BB76D11}) (Version: 5.10.784 - Hewlett-Packard)
ProjectLibre (HKLM\...\{E29A4ED9-3192-4D72-A2E2-9C32B512714D}) (Version: 1.5.19.0 - ProjectLibre)
PTR-Buster 1.2 (HKLM\...\PTR-Buster_is1) (Version: 1.2 - Stonisa Software)
QuickTime (HKLM\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
Realtek Ethernet Controller All-In-One Windows Driver (HKLM\...\{F7E7F0CB-AA41-4D5A-B6F2-8E6738EB063F}) (Version: 1.12.0011 - Realtek)
Realtek USB 2.0 Card Reader (HKLM\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30109 - Realtek Semiconductor Corp.)
Revisores de Texto do Microsoft Office 2013 – Português do Brasil (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Safari (HKLM\...\{FA4C2D53-205F-4245-9717-F3761154824D}) (Version: 5.34.57.2 - Apple Inc.)
SCHLECKER Foto Digital Service (HKLM\...\SCHLECKER Foto Digital Service) (Version: - )
Service Pack 1 for Microsoft Office 2013 (KB2850036) 32-Bit Edition (HKLM\...\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{7F6C4883-A18C-459A-82C1-A2F9403F2DA6}) (Version: - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 32-Bit Edition (HKLM\...\{90150000-003B-0000-0000-0000000FF1CE}_Office15.PRJPRO_{115B7592-B71D-4C27-AB34-34268FB199CA}) (Version: - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 32-Bit Edition (HKLM\...\{90150000-0051-0000-0000-0000000FF1CE}_Office15.VISPRO_{8D2E04ED-3350-4ECE-9D6E-3BC9A9A93A47}) (Version: - Microsoft)
Skype Click to Call (HKLM\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 6.6.11664 - Skype Technologies S.A.)
Skype™ 7.6 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.6.105 - Skype Technologies S.A.)
Surf & E-Mail-Stick (HKLM\...\Surf & E-Mail-Stick) (Version: 16.001.06.02.35 - Huawei Technologies Co.,Ltd)
Sylpheed 3.1.1 (HKLM\...\Sylpheed) (Version: 3.1.1 - Hiroyuki Yamamoto)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.24.0 - Synaptics Incorporated)
Synergy (HKLM\...\Synergy) (Version: 1.4.2 - The Synergy Project)
TAXMAN 2012 (HKLM\...\{FA3FDB06-3368-4579-B2F2-5AE8AD6E7871}) (Version: 18.06.00.0009 - Haufe-Lexware GmbH & Co.KG)
TAXMAN 2013 (HKLM\...\{F289D934-2224-473B-B57E-0040D2693F83}) (Version: 19.05.00.0026 - Haufe-Lexware GmbH & Co.KG)
TeamViewer 9 (HKLM\...\TeamViewer 9) (Version: 9.0.41110 - TeamViewer)
Theft Recovery (HKLM\...\InstallShield_{33C9F24B-1D92-4632-A915-81E3BB1D5D6B}) (Version: 5.1.0.18 - Hewlett-Packard)
Theft Recovery (Version: 5.1.0.18 - Hewlett-Packard) Hidden
TomTom HOME (HKLM\...\{EC5F4C1B-F838-4CB7-8561-8F809296428B}) (Version: 2.9.5 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Total Commander (Remove or Repair) (HKLM\...\Totalcmd) (Version: 7.56a - Ghisler Software GmbH)
UltraISO Premium V9.53 (HKLM\...\UltraISO_is1) (Version: - )
Update for Skype for Business 2015 (KB2889853) 32-Bit Edition (HKLM\...\{90150000-012B-0C0A-0000-0000000FF1CE}_Office15.PROPLUS_{0E796015-0FBA-4F54-8739-AC50F1599CF2}) (Version: - Microsoft)
URL Snooper v2.32.01 (HKLM\...\URLSnooper 2_is1) (Version: - DonationCoder.com)
Validity Fingerprint Driver (HKLM\...\{78365FC6-09CA-4AC3-BC01-70FB46596047}) (Version: 4.0.15.0 - Validity Sensors, Inc.)
Vauidix (HKLM\...\{681002C6-5019-81A2-7871-A43754F71E56}) (Version: - Vaudix) <==== ATTENTION
VideoDownloadConverter Internet Explorer Toolbar (HKLM\...\VideoDownloadConverter_4zbar Uninstall Internet Explorer) (Version: - Mindspark Interactive Network) <==== ATTENTION
VirtualCloneDrive (HKLM\...\VirtualCloneDrive) (Version: - Elaborate Bytes)
Visual Studio 2012 x86 Redistributables (HKLM\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 1.1.9 (HKLM\...\VLC media player) (Version: 1.1.9 - VideoLAN)
Windows 7 Default Setting (HKLM\...\{5BF8E079-D6E2-4323-B794-75152371122A}) (Version: 1.0.1.6 - Hewlett-Packard Company)
Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Sign-in Assistant (HKLM\...\{45338B07-A236-4270-9A77-EBB4115517B5}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Upload Tool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
Windows Mobile Device Center (HKLM\...\{904CCF62-818D-4675-BC76-D37EB399F917}) (Version: 6.1.6965.0 - Microsoft Corporation)
WinPcap 4.1.2 (HKLM\...\WinPcapInst) (Version: 4.1.0.2001 - CACE Technologies)
WinZip 12.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240B7}) (Version: 12.0.8252 - WinZip Computing, S.L. )
Zello 1.40.0.0 (HKLM\...\Zello) (Version: 1.40.0.0 - Zello Inc)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\lya\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{0A368B9B-3566-4730-B40E-EAF6858A53AF}\InprocServer32 -> C:\Users\lya\AppData\Local\Dropbox\Update\1.3.27.33\psuser.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{3059C9E6-9EDC-4C89-933E-C65623F8FD60}\localserver32 -> C:\Users\lya\AppData\Local\Dropbox\Update\DropboxUpdate.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{87DC457B-B35D-48AC-BD42-BDF35EF623CE}\localserver32 -> C:\Users\lya\AppData\Local\Dropbox\Update\1.3.27.33\DropboxUpdateOnDemand.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{93a3111f-4f74-4ed8-895e-d9708497629e}\InprocServer32 -> C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zSrcAs.dll (Mindspark)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{9FAA38ED-5635-44F7-9BE0-8CAFE29B3783}\localserver32 -> C:\Users\lya\AppData\Local\Dropbox\Update\1.3.27.33\DropboxUpdateOnDemand.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{C0DD324D-A74F-4533-84AD-030F76771C77}\localserver32 -> C:\Users\lya\AppData\Local\Dropbox\Update\1.3.27.33\DropboxUpdateOnDemand.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{C32E3EEC-3C10-426E-95F3-38C7F139FADD}\localserver32 -> C:\Users\lya\AppData\Local\Dropbox\Update\1.3.27.33\DropboxUpdateOnDemand.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{D166BD15-03AF-413A-BEFD-0679FF410B49}\InprocServer32 -> C:\Users\lya\AppData\Local\Dropbox\Update\1.3.27.29\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\lya\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{F12BE2CC-A901-4203-B4F2-ADCB957D1887}\InprocServer32 -> C:\ProgramData\Windows\wsse.dll No File
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\localserver32 -> C:\Users\lya\AppData\Local\Temp\Bd21\temp\Download.exe No File
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\lya\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\lya\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\lya\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\lya\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\lya\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\lya\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\lya\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\lya\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\lya\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{FE819BE5-BADF-4370-9913-6FB84ABA6FB1}\InprocServer32 -> C:\Users\lya\AppData\Local\Dropbox\Update\1.3.27.33\psuser.dll (Dropbox, Inc.)
==================== Restore Points =========================
20-08-2015 06:18:50 Windows Update
24-08-2015 11:56:43 Windows Update
02-09-2015 21:26:08 Windows Update
06-09-2015 09:42:50 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {053F3936-48FB-467D-8055-CF9D944E4493} - System32\Tasks\{36AC037E-8734-4D09-868D-6E8A7D77EE1D} => pcalua.exe -a C:\PROGRA~1\WINZIP\winzip32.exe -d "C:\Users\lya\Documents\lya UNED\Modulo 2" -c "C:\Users\lya\Documents\lya UNED\Modulo 2\fchart.zip"
Task: {121A99E7-3778-448B-847C-FA7D3EABF1A5} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.)
Task: {1EB7FDC7-9DA2-4CEB-81F9-A972A2B0E5D3} - System32\Tasks\HPLJCustParticipation => C:\Program Files\HP\HPLJUT\HPLJUTSCH.exe [2010-09-22] (Hewlett Packard)
Task: {212DACF8-F868-4CCB-9183-7001F1C2B650} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv => C:\windows\TEMP\{462380AA-04D8-43D1-BDE7-BA14CB4A981C}.exe
Task: {2AD9541B-A64C-4901-B91F-F0A93D592D6A} - System32\Tasks\{5C6D1E26-236B-4E82-A89C-8CDE6F1200A1} => pcalua.exe -a C:\Users\lya\Dropbox\Nosotros\AVM_FRITZ!_Mini_Assistent.exe -d C:\Users\lya\Dropbox\Nosotros
Task: {2D84B7B5-C9FA-470D-AF2B-D987B9F1C8A5} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {33826A62-9275-4EC2-A9AA-3385ECE36BB2} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {45AC33D7-6704-4C47-889D-84C6294D8813} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)
Task: {53737273-87B2-4E18-9E48-A42327B4F2A1} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => Rundll32.exe invagent.dll,RunUpdate -noappraiser
Task: {58BCC08C-0449-41EB-AB6C-F58E8A4D8539} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-430462746-378290837-44786878-1003UA => C:\Users\lya\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-20] (Dropbox, Inc.)
Task: {674016C5-6523-4A7F-853E-D56D4E4000B3} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {682A8E03-B3A2-4D3D-BE25-DE9077E60929} - System32\Tasks\{A7FC054D-4D34-4F2F-B596-56F26298D11F} => pcalua.exe -a C:\Users\lya\Documents\setup.exe -d C:\Users\lya\Documents
Task: {6915B00E-EA5A-41FA-BC9F-2A13FDB50005} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {70B37965-BF2F-499D-BEEE-2C8024EDC7E0} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.)
Task: {79026650-E60C-413F-B751-C2E1D2C8D9F9} - System32\Tasks\FoxTab => C:\Users\lya\AppData\Roaming\FoxTab\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {7E152232-ACBC-4F8A-9039-DDEAE1093251} - System32\Tasks\Adobe Flash Player Updater => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-08-11] (Adobe Systems Incorporated)
Task: {84D8DCB8-C1B4-4F6A-88F0-5818A7BAD4D9} - System32\Tasks\Registration => C:\Program Files\Hewlett-Packard\HP Setup\RemEngine.exe [2009-10-06] ()
Task: {8F521CB2-1EBC-441C-830F-A7E7E09D4983} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {9BFE9DDF-3B25-4239-A784-F5E11731E602} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: {A68DDBDF-9307-46EC-82B6-6D5F33B0AD64} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv => C:\windows\TEMP\{F0A0E0F6-8F13-4CD0-A70F-3C229254A341}.exe
Task: {A8918BF0-595F-47B9-9BD7-4F4E25980E5C} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-430462746-378290837-44786878-1003Core => C:\Users\lya\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-20] (Dropbox, Inc.)
Task: {E47E643A-BACB-434F-837B-2F25D34790CD} - System32\Tasks\HPCeeScheduleForlya => C:\Program Files\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)
Task: {FBBD233A-B99C-4976-A227-4C16766D04AD} - System32\Tasks\AutoPico Daily Restart => C:\Program Files\KMSpico\AutoPico.exe
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job => C:\windows\TEMP\{F0A0E0F6-8F13-4CD0-A70F-3C229254A341}.exe <==== ATTENTION
Task: C:\windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job => C:\windows\TEMP\{462380AA-04D8-43D1-BDE7-BA14CB4A981C}.exe <==== ATTENTION
Task: C:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-430462746-378290837-44786878-1003Core.job => C:\Users\lya\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-430462746-378290837-44786878-1003UA.job => C:\Users\lya\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\windows\Tasks\FoxTab.job => C:\Users\lya\AppData\Roaming\FoxTab\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\HPCeeScheduleForlya.job => C:\Program Files\Hewlett-Packard\HP Ceement\HPCEE.exe
==================== Loaded Modules (Whitelisted) ==============
2010-02-11 22:47 - 2010-02-11 22:47 - 00636176 _____ () C:\windows\system32\SUPSDK.dll
2010-04-20 09:10 - 2010-04-20 09:10 - 00079360 _____ () C:\Program Files\Hewlett-Packard\Pre-Boot Security for HP ProtectTools\BIOSDomainPlugin.dll
2014-01-20 14:17 - 2014-01-20 14:17 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2014-01-20 14:16 - 2014-01-20 14:16 - 01044808 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2009-11-17 23:39 - 2009-11-17 23:39 - 00329272 _____ () C:\windows\system32\flcdlmsg.dll
2010-03-09 21:06 - 2010-03-09 21:06 - 00132384 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll
2014-07-24 10:49 - 2014-07-24 10:49 - 00420352 _____ () C:\Program Files\BubbleUPnP Server\BubbleUPnPServer.exe
2014-10-09 01:51 - 2011-08-25 10:50 - 00270672 _____ () C:\Program Files\1&1 Surf-Stick\AssistantServices.exe
2009-12-16 23:48 - 2009-12-16 23:48 - 00052280 _____ () C:\Program Files\Hewlett-Packard\HP Power Assistant\HardwareAccess.dll
2009-12-16 23:48 - 2009-12-16 23:48 - 00267832 _____ () C:\Program Files\Hewlett-Packard\HP Power Assistant\HPCommon.XmlSerializers.dll
2009-12-16 23:48 - 2009-12-16 23:48 - 00055352 _____ () C:\Program Files\Hewlett-Packard\HP Power Assistant\Graphs.dll
2015-08-16 23:29 - 2015-08-16 23:29 - 00152064 _____ () C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.8.0\loggingserver.exe
2015-08-16 23:29 - 2015-08-16 23:29 - 00512000 _____ () C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.8.0\log4cplusU.dll
2012-06-22 18:52 - 2015-08-16 23:29 - 02567568 _____ () C:\Program Files\AVG Secure Search\vprot.exe
2014-10-09 01:51 - 2011-08-25 10:50 - 00153424 _____ () C:\Program Files\1&1 Surf-Stick\UIExec.exe
2009-09-30 00:25 - 2009-09-30 00:25 - 00061440 _____ () C:\Program Files\Hewlett-Packard\HP Advisor\Pillars\PCAlerts\PCAlertsPillar.dll
2009-09-30 00:25 - 2009-09-30 00:25 - 00131072 _____ () C:\Program Files\Hewlett-Packard\HP Advisor\Pillars\ECenter\ECLibrary.dll
2009-09-30 00:25 - 2009-09-30 00:25 - 00040960 _____ () C:\Program Files\Hewlett-Packard\HP Advisor\MessagingServer.dll
2009-09-30 00:25 - 2009-09-30 00:25 - 00005632 _____ () C:\Program Files\Hewlett-Packard\HP Advisor\MessagingInterface.dll
2009-09-30 00:25 - 2009-09-30 00:25 - 00018944 _____ () C:\Program Files\Hewlett-Packard\HP Advisor\MessagingMessages.dll
2009-09-30 00:25 - 2009-09-30 00:25 - 00036864 _____ () C:\Program Files\Hewlett-Packard\HP Advisor\MessagingClients.dll
2009-09-30 00:25 - 2009-09-30 00:25 - 00007680 _____ () C:\Program Files\Hewlett-Packard\HP Advisor\RemotingClient.dll
2009-09-30 00:25 - 2009-09-30 00:25 - 00028672 _____ () C:\Program Files\Hewlett-Packard\HP Advisor\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.Logging.dll
2009-06-17 20:40 - 2009-06-17 20:40 - 02121728 _____ () C:\Program Files\Common Files\LightScribe\QtCore4.dll
2009-06-17 20:40 - 2009-06-17 20:40 - 07745536 _____ () C:\Program Files\Common Files\LightScribe\QtGui4.dll
2009-06-17 20:40 - 2009-06-17 20:40 - 00135168 _____ () C:\Program Files\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll
2015-06-09 21:48 - 2014-12-04 10:38 - 00042496 _____ () C:\Program Files\1&1 Internet-Radio-Player\phonostarTimer.exe
2011-01-17 17:19 - 2011-02-08 10:34 - 00985088 _____ () C:\Program Files\OpenOffice.org 3\program\libxml2.dll
2010-11-19 19:45 - 2011-02-08 10:34 - 00170496 _____ () C:\Program Files\OpenOffice.org 3\program\libxslt.dll
2010-04-05 20:11 - 2010-04-05 20:11 - 00030264 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_LogicLayer.dll
2010-04-05 20:12 - 2010-04-05 20:12 - 00052280 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HardwareAccess.dll
2010-04-05 20:12 - 2010-04-05 20:12 - 00267832 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPCommon.XmlSerializers.dll
2015-09-02 22:24 - 2015-09-02 22:24 - 00071168 _____ () c:\users\lya\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpfooxy6.dll
2015-07-30 06:42 - 2015-08-05 07:26 - 00012800 _____ () C:\Users\lya\AppData\Roaming\Dropbox\bin\QtQuick.2\qtquick2plugin.dll
2015-07-30 06:42 - 2015-08-05 07:26 - 00779776 _____ () C:\Users\lya\AppData\Roaming\Dropbox\bin\QtQuick\Controls\qtquickcontrolsplugin.dll
2015-07-30 06:42 - 2015-08-05 07:26 - 00056320 _____ () C:\Users\lya\AppData\Roaming\Dropbox\bin\QtQuick\Layouts\qquicklayoutsplugin.dll
2015-07-30 06:42 - 2015-08-05 07:26 - 00012288 _____ () C:\Users\lya\AppData\Roaming\Dropbox\bin\QtQuick\Window.2\windowplugin.dll
2015-07-30 06:41 - 2015-08-05 07:25 - 00056320 _____ () C:\Users\lya\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-07-30 06:41 - 2015-08-05 07:25 - 01128448 _____ () C:\Users\lya\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-08-11 20:44 - 2015-08-11 20:44 - 17482952 _____ () C:\windows\system32\Macromed\Flash\NPSWF32_18_0_0_232.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\Windows:C26D224778C75AC4
AlternateDataStreams: C:\Users\lya\Desktop\Baldor:com.dropbox.attributes
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-430462746-378290837-44786878-1003\Control Panel\Desktop\\Wallpaper -> C:\Users\lya\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.31.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{8420C5EC-C98C-481A-941C-C3C6BA412F2B}] => (Allow) C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
FirewallRules: [{12690DD8-5DCF-4839-831D-93490F7B03C6}] => (Allow) C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
FirewallRules: [VirtualPC-In-UDP-1] => (Allow) %SystemRoot%\System32\vpc.exe
FirewallRules: [VirtualPC-In-UDP-2] => (Allow) %SystemRoot%\System32\vpc.exe
FirewallRules: [VirtualPC-In-TCP-1] => (Allow) %SystemRoot%\System32\vpc.exe
FirewallRules: [{9662D97C-FEF3-48AD-B742-AE506450513D}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{8EB5EDEB-248E-4F9D-B9A7-C65AFEE2236A}C:\program files\nonoh.net\nonoh\nonoh.exe] => (Allow) C:\program files\nonoh.net\nonoh\nonoh.exe
FirewallRules: [UDP Query User{EEC05F63-2559-49BA-9F61-6288AEBBB523}C:\program files\nonoh.net\nonoh\nonoh.exe] => (Allow) C:\program files\nonoh.net\nonoh\nonoh.exe
FirewallRules: [TCP Query User{BE5A71D4-F544-43DE-AEB5-61C679E201C7}C:\program files\nonoh.net\nonoh\nonoh.exe] => (Block) C:\program files\nonoh.net\nonoh\nonoh.exe
FirewallRules: [UDP Query User{87CE5E1B-A33F-4F72-A57B-9608EFB8A5C7}C:\program files\nonoh.net\nonoh\nonoh.exe] => (Block) C:\program files\nonoh.net\nonoh\nonoh.exe
FirewallRules: [TCP Query User{0C6629BB-C814-4E54-BB6B-E4C462D8EE34}C:\program files\internet explorer\iexplore.exe] => (Allow) C:\program files\internet explorer\iexplore.exe
FirewallRules: [UDP Query User{15FF67B9-28AA-4546-87C2-D69EDD050E1E}C:\program files\internet explorer\iexplore.exe] => (Allow) C:\program files\internet explorer\iexplore.exe
FirewallRules: [{9B2F9CFA-8576-4575-9319-660604F9610A}] => (Allow) %systemroot%\WindowsMobile\wmdHost.exe
FirewallRules: [{7CA01DE3-F861-4253-AA16-F3A6631F673D}] => (Allow) %systemroot%\WindowsMobile\wmdHost.exe
FirewallRules: [{473775A0-D482-4F67-89EB-0CE1509FDBE5}] => (Allow) LPort=26675
FirewallRules: [TCP Query User{70781AE3-A37F-44F8-A327-D23F820EF31C}C:\smartmediadesktop\smartmediadesktop.exe] => (Allow) C:\smartmediadesktop\smartmediadesktop.exe
FirewallRules: [UDP Query User{E8E13D4A-8BF5-4F72-A3E4-3E77FEEEDC6C}C:\smartmediadesktop\smartmediadesktop.exe] => (Allow) C:\smartmediadesktop\smartmediadesktop.exe
FirewallRules: [TCP Query User{88DD2B48-0E0F-4916-A8AA-DA755F89E826}C:\smartmediadesktop\smartmediadesktop.exe] => (Allow) C:\smartmediadesktop\smartmediadesktop.exe
FirewallRules: [UDP Query User{85B12BFA-DB42-4480-A96E-452E5C0E90B0}C:\smartmediadesktop\smartmediadesktop.exe] => (Allow) C:\smartmediadesktop\smartmediadesktop.exe
FirewallRules: [TCP Query User{809907DC-0462-4853-8C66-93307D2CCA81}C:\windows\explorer.exe] => (Block) C:\windows\explorer.exe
FirewallRules: [UDP Query User{C2CA1290-DB60-4BE6-A162-4BDD0D3E6E04}C:\windows\explorer.exe] => (Block) C:\windows\explorer.exe
FirewallRules: [TCP Query User{1C8457F6-D589-4482-B5A7-ABD19E39292D}C:\windows\explorer.exe] => (Block) C:\windows\explorer.exe
FirewallRules: [UDP Query User{90340E5E-5771-4BD9-85CD-42CCE7235255}C:\windows\explorer.exe] => (Block) C:\windows\explorer.exe
FirewallRules: [{348F6A5C-BE6E-43B1-8E30-85BD919F4540}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{B8D3394C-6B1E-4E29-8C7B-335D14788764}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [TCP Query User{C946DB8F-C30A-4294-B103-202C93FDC8B8}C:\wolfgang\teamviewer\teamviewer.exe] => (Allow) C:\wolfgang\teamviewer\teamviewer.exe
FirewallRules: [UDP Query User{0935ABA2-4CC4-4CA2-B9F2-2C5FDAC90A8C}C:\wolfgang\teamviewer\teamviewer.exe] => (Allow) C:\wolfgang\teamviewer\teamviewer.exe
FirewallRules: [TCP Query User{40B49ADB-CE1A-409B-B573-5C06AD8483AD}C:\program files\google\googletoolbarnotifier\googletoolbarnotifier.exe] => (Allow) C:\program files\google\googletoolbarnotifier\googletoolbarnotifier.exe
FirewallRules: [UDP Query User{00D029C8-36B3-4354-A656-B95FFFF9EF41}C:\program files\google\googletoolbarnotifier\googletoolbarnotifier.exe] => (Allow) C:\program files\google\googletoolbarnotifier\googletoolbarnotifier.exe
FirewallRules: [{312B9DD0-3791-498A-B18B-FACA55BB7B20}] => (Allow) C:\Program Files\AVG\AVG2012\avgmfapx.exe
FirewallRules: [{D6250CA2-78D1-4814-9204-D1388A51576B}] => (Allow) C:\Program Files\AVG\AVG2012\avgmfapx.exe
FirewallRules: [{3EAD7377-970D-4F4E-97A4-1DF55EB9B3EA}] => (Allow) C:\Program Files\AVG\AVG2012\avgnsx.exe
FirewallRules: [{6D9CD516-B289-4347-B02C-B91D02CBADDC}] => (Allow) C:\Program Files\AVG\AVG2012\avgnsx.exe
FirewallRules: [{10CDA1FD-91C3-4F7A-A564-74717DACB1BB}] => (Allow) C:\Program Files\AVG\AVG2012\avgdiagex.exe
FirewallRules: [{7E9F439F-34D1-40CC-86FC-9D5AE2E8450B}] => (Allow) C:\Program Files\AVG\AVG2012\avgdiagex.exe
FirewallRules: [{96C80239-8CA1-4FD5-A8FB-3E09915A9F0A}] => (Allow) C:\Program Files\AVG\AVG2012\avgemcx.exe
FirewallRules: [{0C96C273-C250-4F19-BFA4-9D9137D4895D}] => (Allow) C:\Program Files\AVG\AVG2012\avgemcx.exe
FirewallRules: [TCP Query User{F1307184-6C31-416D-B401-7CF73E54A0C3}C:\wolfgang\teamviewer\teamviewer.exe] => (Block) C:\wolfgang\teamviewer\teamviewer.exe
FirewallRules: [UDP Query User{62304667-39BF-421C-8B34-2B3BF7E13966}C:\wolfgang\teamviewer\teamviewer.exe] => (Block) C:\wolfgang\teamviewer\teamviewer.exe
FirewallRules: [{2F2A8527-3503-4EEA-A7D6-92E35DB00494}] => (Allow) G:\fsetup.exe
FirewallRules: [{8AAAD6F1-29D6-4C12-A2C3-F9054B37269E}] => (Allow) G:\fsetup.exe
FirewallRules: [{8800AC48-1A0A-4402-86C9-4D7377CEE53E}] => (Allow) C:\Users\lya\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{8DA49D81-7375-4FA7-AFB9-7E24CBA6734E}] => (Allow) C:\Users\lya\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [TCP Query User{27EE8BDA-E7FF-4E30-87A5-AF90F4C38E4D}C:\program files\internet explorer\iexplore.exe] => (Block) C:\program files\internet explorer\iexplore.exe
FirewallRules: [UDP Query User{65A481EB-9FE9-43F1-A1F0-AB539F7FA3B7}C:\program files\internet explorer\iexplore.exe] => (Block) C:\program files\internet explorer\iexplore.exe
FirewallRules: [TCP Query User{A5104C3D-DBF2-4394-817C-AD2B711DADD6}C:\users\lya\appdata\local\apps\2.0\jqmwgayt.cjk\gqcet5g5.oaa\frit..tion_f8d772dfbb3f7453_0001.0000_b68ab747cee305c3\fritzmini.exe] => (Allow) C:\users\lya\appdata\local\apps\2.0\jqmwgayt.cjk\gqcet5g5.oaa\frit..tion_f8d772dfbb3f7453_0001.0000_b68ab747cee305c3\fritzmini.exe
FirewallRules: [UDP Query User{A1E7F78A-871F-4517-B388-77FD5B9DD458}C:\users\lya\appdata\local\apps\2.0\jqmwgayt.cjk\gqcet5g5.oaa\frit..tion_f8d772dfbb3f7453_0001.0000_b68ab747cee305c3\fritzmini.exe] => (Allow) C:\users\lya\appdata\local\apps\2.0\jqmwgayt.cjk\gqcet5g5.oaa\frit..tion_f8d772dfbb3f7453_0001.0000_b68ab747cee305c3\fritzmini.exe
FirewallRules: [{227C0614-C8CB-4001-B115-AAD4E57D8533}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{FAFBFAAF-6A68-46DB-9A4D-884BE65AAB7A}] => (Allow) C:\windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [TCP Query User{FF12CD27-E108-4740-B84F-220672498C50}C:\users\lya\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\lya\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{713718C9-1894-4F39-92BF-2AC0CABDD659}C:\users\lya\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\lya\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{D045E469-D838-48D3-85E4-1634FBF1734A}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{9F209F04-2231-4395-A55A-0DDD6CB5A129}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{E64E06D0-1FD8-415C-A047-F5387ACF8577}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{B3F1FAC7-239C-4F8E-942E-4E914A4E7763}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{C622AD62-2960-462F-9420-66DF5EB1A8DB}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{72A5D9DB-9F58-4D4B-9DFC-9EC97C6C6EDB}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{8C32C589-26C3-451B-A18F-5CB9540B5BD5}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{4AD4EADD-C3E6-4585-A33C-9D6ABE9D4E98}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{EB741C88-7C2E-4AC6-8EB8-3BC6197623B8}] => (Allow) C:\Program Files\KMSpico\KMSELDI.exe
FirewallRules: [{3CE11B05-932D-44F9-BE82-92D240A152E9}] => (Allow) C:\Program Files\KMSpico\KMSELDI.exe
FirewallRules: [{450015D1-499F-4CC5-9372-8DE95D20005C}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe
FirewallRules: [{4D5B56E4-EFCA-40DD-B81A-8ADFCD4804D7}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{3B696181-DEF5-4527-A8AC-2A1A417F0CEF}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{6904A79B-3C34-47A0-B3BB-C8D56A17721D}C:\program files\videolan\vlc\vlc.exe] => (Allow) C:\program files\videolan\vlc\vlc.exe
FirewallRules: [UDP Query User{45EC918E-1344-404E-90DE-B5267A8CC61D}C:\program files\videolan\vlc\vlc.exe] => (Allow) C:\program files\videolan\vlc\vlc.exe
FirewallRules: [{2C03A0B9-9274-4EFF-B836-206CCA4CC046}] => (Allow) C:\Program Files\BubbleUPnP Server\BubbleUPnPServer.exe
FirewallRules: [{6828776E-6B69-4650-84D5-C039BEBD193D}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{532589C0-BF43-40C6-B74A-E1FBF7C5E7DD}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{15E2F363-F033-4D0E-8661-957D8194C9F6}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{73D0AD8F-16C3-41F7-B8B0-D0539A2A8329}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [TCP Query User{457A1018-827F-4F0A-BE33-61FE40FB14C6}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{B55E9A13-2660-4D60-8B8B-017AB7CB8572}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [{1DB4C96B-9E2C-4CCD-9767-6A2441C1155E}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{6F4B12AE-F1DE-421F-BD62-83077C31D24D}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{2A72DD3B-69D3-4695-BA23-FB6B63049DCE}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{4B6C1134-3DE1-4CEB-9BD2-858431074089}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{45609A17-6CFC-4C75-B19C-C9E41A2855DE}] => (Allow) C:\Program Files\AVG\AVG2015\avgnsx.exe
FirewallRules: [{752D5D4F-D84D-4971-9012-97D56DF1DC1B}] => (Allow) C:\Program Files\AVG\AVG2015\avgnsx.exe
FirewallRules: [{12F0D718-D918-455E-BE3E-BDC817B4E9C7}] => (Allow) C:\Program Files\AVG\AVG2015\avgdiagex.exe
FirewallRules: [{9D71418E-4B7D-4B16-8DA7-068E5E416EF0}] => (Allow) C:\Program Files\AVG\AVG2015\avgdiagex.exe
FirewallRules: [{693904F7-0F39-409E-ACE0-7CF255727787}] => (Allow) C:\Program Files\AVG\AVG2015\avgemcx.exe
FirewallRules: [{DB209CBC-2A11-4FC7-BC8A-31FB16690207}] => (Allow) C:\Program Files\AVG\AVG2015\avgemcx.exe
FirewallRules: [{5E363C2D-25F5-4EF6-8456-F0EFB545C47D}] => (Allow) C:\Program Files\AVG\AVG2015\avgnsx.exe
FirewallRules: [{326FAEA1-5778-43D0-A9C7-0D0828F2FE64}] => (Allow) C:\Program Files\AVG\AVG2015\avgnsx.exe
FirewallRules: [{62DDA8AF-6D66-4425-B4B6-8C58AE23AFCE}] => (Allow) C:\Program Files\AVG\AVG2015\avgdiagex.exe
FirewallRules: [{861E59E2-36E5-4596-B283-BE886B75B5E5}] => (Allow) C:\Program Files\AVG\AVG2015\avgdiagex.exe
FirewallRules: [{DB209D3C-78A6-4DE6-B7AE-A25094B35A4F}] => (Allow) C:\Program Files\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{D024151B-EB13-4689-AD67-FB47109E7063}] => (Allow) C:\Program Files\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{1AB17DD5-296B-4C79-B68D-0E2A60DFD4AF}] => (Allow) C:\Program Files\AVG\AVG2015\avgemcx.exe
FirewallRules: [{A2CD7C23-3FA9-4E51-AE22-05A8FC959AB9}] => (Allow) C:\Program Files\AVG\AVG2015\avgemcx.exe
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (09/07/2015 04:46:27 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 4102
Error: (09/07/2015 04:46:27 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 4102
Error: (09/07/2015 04:46:27 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (09/07/2015 04:46:26 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3088
Error: (09/07/2015 04:46:26 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 3088
Error: (09/07/2015 04:46:26 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (09/07/2015 04:46:25 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 2090
Error: (09/07/2015 04:46:25 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 2090
Error: (09/07/2015 04:46:25 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (09/07/2015 04:46:24 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1060
System errors:
=============
Error: (09/07/2015 01:00:57 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80240020: Upgrade to Windows 10 Pro.
Error: (09/07/2015 12:47:15 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the HomeGroupListener service.
Error: (09/07/2015 01:01:31 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the HP Wireless Assistant Service service.
Error: (09/07/2015 12:17:51 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the RapiMgr service.
Error: (09/06/2015 09:46:25 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80240020: Upgrade to Windows 10 Pro.
Error: (09/05/2015 01:40:34 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80240020: Upgrade to Windows 10 Pro.
Error: (09/04/2015 04:18:02 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80240020: Upgrade to Windows 10 Pro.
Error: (09/04/2015 04:04:43 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the BFE service.
Error: (09/04/2015 11:08:00 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.
Error: (09/03/2015 06:13:36 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80240020: Upgrade to Windows 10 Pro.
Microsoft Office:
=========================
Error: (09/07/2015 04:46:27 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 4102
Error: (09/07/2015 04:46:27 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 4102
Error: (09/07/2015 04:46:27 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (09/07/2015 04:46:26 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3088
Error: (09/07/2015 04:46:26 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 3088
Error: (09/07/2015 04:46:26 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (09/07/2015 04:46:25 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 2090
Error: (09/07/2015 04:46:25 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 2090
Error: (09/07/2015 04:46:25 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (09/07/2015 04:46:24 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1060
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i3 CPU M 350 @ 2.27GHz
Percentage of memory in use: 68%
Total physical RAM: 2927.43 MB
Available physical RAM: 918.22 MB
Total Virtual: 7107.16 MB
Available Virtual: 3484.96 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:280.8 GB) (Free:76.09 GB) NTFS ==>[system with boot components (obtained from reading drive)]
Drive f: (HP_TOOLS) (Fixed) (Total:1.99 GB) (Free:1.48 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298.1 GB) (Disk ID: BA1AE47F)
Partition 1: (Active) - (Size=300 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=280.8 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=2 GB) - (Type=0C)
==================== End of Addition.txt ============================
|
|
10.09.2015, 08:50
| #6 |
| /// the machine /// TB-Ausbilder | Windows 7: gotut.ru als Startseite beim Firefox, IExplorer und crome Lade Dir bitte von hier  Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
Scan mit Combofix
__________________ --> Windows 7: gotut.ru als Startseite beim Firefox, IExplorer und crome |
|
11.09.2015, 08:37
| #7 |
| | Windows 7: gotut.ru als Startseite beim Firefox, IExplorer und crome Danke, ich kann leider erst heute Nacht weitermachen und melde mich dann. Gruß Wolfgang Code:
ATTFilter ComboFix 15-09-07.01 - Lya 11.09.2015 0:12.1.4 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1033.18.2927.778 [GMT 2:00]
ausgeführt von:: c:\users\Lya\Desktop\ComboFix.exe
AV: AVG AntiVirus Free Edition 2015 *Disabled/Updated* {4D41356F-32AD-7C42-C820-63775EE4F413}
SP: AVG AntiVirus Free Edition 2015 *Disabled/Updated* {F620D48B-1497-73CC-F290-58052563BEAE}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
ADS - windows: deleted 24 bytes in 1 streams.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\ftpuser\0EBD6955DD9.exe
C:\Install.exe
c:\program files\YoutubeAdblocker
c:\program files\YoutubeAdblocker\A17uWHhCYcFavN.dat
c:\program files\YoutubeAdblocker\A17uWHhCYcFavN.tlb
c:\programdata\2050989651646273579
c:\programdata\2050989651646273579\cd5b15e575e1c3d05eb96168e4f98da0.ini
c:\programdata\windows
c:\programdata\windows\dumd.dat
c:\programdata\windows\xdor.dat
C:\serverg.Bin
C:\Thumbs.db
c:\users\Lya\AppData\Local\95c8f457\U
c:\users\Lya\AppData\Local\95c8f457\U\80000000.@
c:\users\Lya\AppData\Local\Google\Chrome\User Data\Default\Extensions\idknbmbdnapjicclomlijcgfpikmndhd
c:\users\Lya\AppData\Local\Google\Chrome\User Data\Default\Extensions\idknbmbdnapjicclomlijcgfpikmndhd\123\background.html
c:\users\Lya\AppData\Local\Google\Chrome\User Data\Default\Extensions\idknbmbdnapjicclomlijcgfpikmndhd\123\content.js
c:\users\Lya\AppData\Local\Google\Chrome\User Data\Default\Extensions\idknbmbdnapjicclomlijcgfpikmndhd\123\lsdb.js
c:\users\Lya\AppData\Local\Google\Chrome\User Data\Default\Extensions\idknbmbdnapjicclomlijcgfpikmndhd\123\manifest.json
c:\users\Lya\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fmfheingplbdjbllmaebjeklckbjabjk
c:\users\Lya\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fmfheingplbdjbllmaebjeklckbjabjk\000003.log
c:\users\Lya\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fmfheingplbdjbllmaebjeklckbjabjk\CURRENT
c:\users\Lya\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fmfheingplbdjbllmaebjeklckbjabjk\LOCK
c:\users\Lya\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fmfheingplbdjbllmaebjeklckbjabjk\LOG
c:\users\Lya\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fmfheingplbdjbllmaebjeklckbjabjk\MANIFEST-000002
c:\users\Lya\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idknbmbdnapjicclomlijcgfpikmndhd
c:\users\Lya\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idknbmbdnapjicclomlijcgfpikmndhd\000003.log
c:\users\Lya\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idknbmbdnapjicclomlijcgfpikmndhd\CURRENT
c:\users\Lya\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idknbmbdnapjicclomlijcgfpikmndhd\LOCK
c:\users\Lya\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idknbmbdnapjicclomlijcgfpikmndhd\LOG
c:\users\Lya\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idknbmbdnapjicclomlijcgfpikmndhd\MANIFEST-000002
c:\users\Lya\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_fmfheingplbdjbllmaebjeklckbjabjk_0.localstorage-journal
c:\users\Lya\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_fmfheingplbdjbllmaebjeklckbjabjk_0.localstorage
c:\users\Lya\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_idknbmbdnapjicclomlijcgfpikmndhd_0.localstorage-journal
c:\users\Lya\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_idknbmbdnapjicclomlijcgfpikmndhd_0.localstorage
c:\users\Lya\AppData\Local\Google\Chrome\User Data\Default\Preferences
c:\users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\searchplugins\WebSearch.xml
c:\users\Lya\AppData\Roaming\systweak\ssd\SSDPTstub.exe
c:\users\Lya\Taskmgr.exe
c:\users\Lya\videos\iLividSetup-r0-n-bi.exe
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\ST6UNST.000
c:\windows\system32\drivers\etc\hosts.ics
c:\windows\system32\pt
c:\windows\system32\pt\DPCont32.dll.mui
c:\windows\system32\roboot.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2015-08-10 bis 2015-09-10 ))))))))))))))))))))))))))))))
.
.
2015-09-10 22:30 . 2015-09-10 22:30 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-09-10 20:45 . 2015-09-10 20:45 -------- d-----w- c:\program files\VS Revo Group
2015-09-09 23:11 . 2015-09-09 23:11 -------- d-----w- c:\users\Lya\AppData\Local\AVG Web TuneUp
2015-09-09 23:10 . 2015-09-09 23:10 -------- d-----w- c:\programdata\AVG Secure Search
2015-09-09 23:10 . 2015-09-09 23:10 -------- d-----w- c:\program files\Common Files\AVG Secure Search
2015-09-09 23:10 . 2015-09-09 23:11 -------- d-----w- c:\programdata\AVG Web TuneUp
2015-09-09 23:10 . 2015-09-09 23:10 -------- d-----w- c:\program files\AVG Web TuneUp
2015-09-09 08:50 . 2015-07-22 17:57 3934656 ----a-w- c:\windows\system32\ntoskrnl.exe
2015-09-09 08:49 . 2015-06-25 09:48 105408 ----a-w- c:\windows\system32\consent.exe
2015-09-09 08:49 . 2015-06-25 09:44 1805824 ----a-w- c:\windows\system32\authui.dll
2015-09-09 08:49 . 2015-06-25 09:44 47104 ----a-w- c:\windows\system32\appinfo.dll
2015-09-08 06:42 . 2015-09-08 06:42 104960 ----a-w- C:\fxldapow.sys
2015-09-07 21:48 . 2015-09-07 21:52 -------- d-----w- C:\FRST
2015-09-05 23:04 . 2015-09-05 23:06 -------- d-----w- c:\users\Lya\AppData\Roaming\Browsers
2015-09-05 23:04 . 2015-09-05 23:04 -------- d-----w- c:\users\Lya\AppData\Roaming\SPI
2015-08-14 03:42 . 2015-08-14 03:42 256104 ----a-w- c:\program files\Common Files\Microsoft Shared\OFFICE15\3082\OSFINTL.DLL
2015-08-14 02:19 . 2015-08-14 02:19 61120 ----a-w- c:\program files\Common Files\Microsoft Shared\OFFICE15\DataModel\es-es\Microsoft.Excel.AdomdClient.resources.dll
2015-08-14 02:19 . 2015-08-14 02:19 52928 ----a-w- c:\program files\Common Files\Microsoft Shared\OFFICE15\DataModel\es-es\Microsoft.Excel.Xmla.resources.dll
2015-08-14 02:19 . 2015-08-14 02:19 20672 ----a-w- c:\program files\Common Files\Microsoft Shared\OFFICE15\DataModel\es-es\Microsoft.Excel.Streaming.resources.dll
2015-08-14 02:19 . 2015-08-14 02:19 196288 ----a-w- c:\program files\Common Files\Microsoft Shared\OFFICE15\DataModel\es-es\Microsoft.Excel.Amo.resources.dll
2015-08-13 05:28 . 2015-07-30 13:13 103120 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-08-12 12:31 . 2015-07-28 20:00 635904 ----a-w- c:\windows\system32\invagent.dll
2015-08-12 12:31 . 2015-07-28 20:00 598528 ----a-w- c:\windows\system32\generaltel.dll
2015-08-12 12:31 . 2015-07-28 20:00 346112 ----a-w- c:\windows\system32\devinv.dll
2015-08-12 12:31 . 2015-07-28 20:00 952832 ----a-w- c:\windows\system32\appraiser.dll
2015-08-12 12:31 . 2015-07-28 20:00 60416 ----a-w- c:\windows\system32\acmigration.dll
2015-08-12 12:31 . 2015-07-28 19:54 934400 ----a-w- c:\windows\system32\aeinv.dll
2015-08-12 12:31 . 2015-07-28 20:04 15808 ----a-w- c:\windows\system32\CompatTelRunner.exe
2015-08-12 12:31 . 2015-07-28 20:00 202752 ----a-w- c:\windows\system32\aepdu.dll
2015-08-12 12:30 . 2015-07-01 20:30 82432 ----a-w- c:\windows\system32\davclnt.dll
2015-08-12 12:30 . 2015-07-15 17:59 78784 ----a-w- c:\windows\system32\drivers\mountmgr.sys
2015-08-12 12:30 . 2015-07-15 17:54 10752 ----a-w- c:\windows\system32\msmmsp.dll
2015-08-12 12:30 . 2015-07-16 19:12 4922368 ----a-w- c:\windows\system32\mstscax.dll
2015-08-12 12:30 . 2015-07-16 19:12 269824 ----a-w- c:\windows\system32\aaclient.dll
2015-08-12 12:30 . 2015-07-09 17:42 179712 ----a-w- c:\windows\system32\notepad.exe
2015-08-12 12:30 . 2015-07-09 17:42 179712 ----a-w- c:\windows\notepad.exe
2015-08-12 12:25 . 2015-07-30 17:57 909824 ----a-w- c:\windows\system32\FntCache.dll
2015-08-12 12:25 . 2015-07-30 17:57 1251328 ----a-w- c:\windows\system32\DWrite.dll
2015-08-12 12:25 . 2015-07-30 17:57 1987584 ----a-w- c:\windows\system32\d3d10warp.dll
2015-08-12 12:23 . 2015-05-09 18:09 715200 ----a-w- c:\windows\system32\mcupdate_GenuineIntel.dll
2015-08-12 12:23 . 2015-07-15 02:55 44032 ----a-w- c:\windows\system32\basesrv.dll
2015-08-12 03:18 . 2015-08-12 03:18 9661632 ----a-w- c:\program files\Common Files\Microsoft Shared\OFFICE15\DataModel\msmgdsrv_xl.dll
2015-08-12 03:18 . 2015-08-12 03:18 7444160 ----a-w- c:\program files\Common Files\Microsoft Shared\OFFICE15\DataModel\msolap110_xl.dll
2015-08-12 03:18 . 2015-08-12 03:18 57356480 ----a-w- c:\program files\Common Files\Microsoft Shared\OFFICE15\DataModel\msmdlocal_xl.dll
2015-08-12 03:18 . 2015-08-12 03:18 24508096 ----a-w- c:\program files\Common Files\Microsoft Shared\OFFICE15\DataModel\xmsrv_xl.dll
2015-08-12 03:18 . 2015-08-12 03:18 203456 ----a-w- c:\program files\Common Files\Microsoft Shared\OFFICE15\DataModel\xmlrw_xl.dll
2015-08-12 03:18 . 2015-08-12 03:18 148160 ----a-w- c:\program files\Common Files\Microsoft Shared\OFFICE15\DataModel\xmlrwbin_xl.dll
2015-08-12 03:18 . 2015-08-12 03:18 700568 ----a-w- c:\program files\Common Files\Microsoft Shared\OFFICE15\ADAL.DLL
2015-08-12 03:18 . 2015-08-12 03:18 5774552 ----a-w- c:\program files\Common Files\Microsoft Shared\OFFICE15\CMigrate.exe
2015-08-12 03:18 . 2015-08-12 03:18 5479104 ----a-w- c:\program files\Common Files\Microsoft Shared\OFFICE15\Csi.dll
2015-08-12 03:18 . 2015-08-12 03:18 115800 ----a-w- c:\program files\Common Files\Microsoft Shared\OFFICE15\EXP_PDF.DLL
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-09-02 01:36 . 2015-09-09 08:51 2384896 ----a-w- c:\windows\system32\win32k.sys
2015-08-26 17:56 . 2015-09-09 08:49 93184 ----a-w- c:\windows\system32\wudriver.dll
2015-08-26 17:56 . 2015-09-09 08:49 35840 ----a-w- c:\windows\system32\wups2.dll
2015-08-26 17:56 . 2015-09-09 08:49 30208 ----a-w- c:\windows\system32\wups.dll
2015-08-26 17:56 . 2015-09-09 08:49 173056 ----a-w- c:\windows\system32\wuwebv.dll
2015-08-26 17:56 . 2015-09-09 08:49 2953728 ----a-w- c:\windows\system32\wucltux.dll
2015-08-26 17:56 . 2015-09-09 08:49 566784 ----a-w- c:\windows\system32\wuapi.dll
2015-08-26 17:56 . 2015-09-09 08:49 2061824 ----a-w- c:\windows\system32\wuaueng.dll
2015-08-26 17:55 . 2015-09-09 08:49 73728 ----a-w- c:\windows\system32\WinSetupUI.dll
2015-08-26 17:55 . 2015-09-09 08:49 11776 ----a-w- c:\windows\system32\wu.upgrade.ps.dll
2015-08-26 17:55 . 2015-09-09 08:49 34816 ----a-w- c:\windows\system32\wuapp.exe
2015-08-26 17:55 . 2015-09-09 08:49 135680 ----a-w- c:\windows\system32\wuauclt.exe
2015-08-15 05:40 . 2015-09-09 08:50 504832 ----a-w- c:\windows\system32\vbscript.dll
2015-08-15 04:43 . 2015-09-09 08:50 1951232 ----a-w- c:\windows\system32\wininet.dll
2015-08-11 18:44 . 2013-01-05 10:03 778440 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2015-08-11 18:44 . 2011-05-15 22:14 142536 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2015-08-04 17:48 . 2015-09-09 08:51 50176 ----a-w- c:\windows\system32\setbcdlocale.dll
2015-07-28 09:02 . 2015-07-28 09:02 250288 ----a-w- c:\windows\system32\drivers\avgidsdriverx.sys
2015-07-28 09:02 . 2015-07-28 09:02 186800 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2015-07-23 14:44 . 2015-07-23 14:44 31664 ----a-w- c:\windows\system32\drivers\avgidsshimx.sys
2015-07-22 17:53 . 2015-09-09 08:50 172032 ----a-w- c:\windows\system32\wdigest.dll
2015-07-22 17:53 . 2015-09-09 08:50 65536 ----a-w- c:\windows\system32\TSpkg.dll
2015-07-22 17:53 . 2015-09-09 08:50 635392 ----a-w- c:\windows\system32\tdh.dll
2015-07-22 17:53 . 2015-09-09 08:50 43008 ----a-w- c:\windows\system32\srclient.dll
2015-07-22 17:53 . 2015-09-09 08:50 400896 ----a-w- c:\windows\system32\srcore.dll
2015-07-22 17:53 . 2015-09-09 08:50 15872 ----a-w- c:\windows\system32\sspisrv.dll
2015-07-22 17:53 . 2015-09-09 08:50 100352 ----a-w- c:\windows\system32\sspicli.dll
2015-07-22 17:52 . 2015-09-09 08:50 69632 ----a-w- c:\windows\system32\smss.exe
2015-07-22 16:38 . 2015-09-09 08:50 41984 ----a-w- c:\windows\system32\UtcResources.dll
2015-07-16 19:12 . 2015-08-12 12:30 37376 ----a-w- c:\windows\system32\tsgqec.dll
2015-07-15 17:55 . 2015-08-12 12:30 1159168 ----a-w- c:\windows\system32\sysmain.dll
2015-07-15 17:43 . 2015-08-12 12:30 2560 ----a-w- c:\windows\system32\drivers\en-US\mountmgr.sys.mui
2015-07-15 02:54 . 2015-09-09 08:49 2048 ----a-w- c:\windows\system32\tzres.dll
2015-07-04 17:48 . 2015-07-15 13:29 1414656 ----a-w- c:\windows\system32\ole32.dll
2015-07-01 20:30 . 2015-08-12 12:30 206848 ----a-w- c:\windows\system32\WebClnt.dll
2015-06-17 17:39 . 2015-07-15 13:29 305664 ----a-w- c:\windows\system32\gdi32.dll
2015-06-16 14:31 . 2015-06-16 14:31 1247912 ----a-w- c:\windows\system32\FM20.DLL
2015-06-16 13:54 . 2015-06-16 13:54 207328 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2015-06-15 21:43 . 2015-07-15 13:30 337408 ----a-w- c:\windows\system32\msihnd.dll
2015-06-15 21:43 . 2015-07-15 13:30 2364416 ----a-w- c:\windows\system32\msi.dll
2015-06-15 21:42 . 2015-07-15 13:30 73216 ----a-w- c:\windows\system32\msiexec.exe
2015-06-15 21:37 . 2015-07-15 13:30 25088 ----a-w- c:\windows\system32\msimsg.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2015-09-09 23:10 2426256 ----a-w- c:\program files\AVG Web TuneUp\4.1.6.294\AVG Web TuneUp.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2015-07-14 10:57 1729752 ----a-w- c:\progra~1\MICROS~1\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2015-07-14 10:57 1729752 ----a-w- c:\progra~1\MICROS~1\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2015-07-14 10:57 1729752 ----a-w- c:\progra~1\MICROS~1\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2015-08-14 08:16 189464 ----a-w- c:\users\Lya\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2015-08-14 08:16 189464 ----a-w- c:\users\Lya\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2015-08-14 08:16 189464 ----a-w- c:\users\Lya\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPADVISOR"="c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2009-09-29 1685048]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-06-17 2363392]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-02-08 39408]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2013-03-22 248208]
"NextLive"="c:\users\Lya\AppData\Roaming\newnext.me\nengine.dll" [2014-06-12 0]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2015-06-29 53282944]
"1&1 Internet-Radio-PlayerTimer"="c:\program files\1&1 Internet-Radio-Player\phonostarTimer.exe" [2014-12-04 42496]
"Dropbox Update"="c:\users\Lya\AppData\Local\Dropbox\Update\DropboxUpdate.exe" [2015-06-19 134512]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QLBController"="c:\program files\Hewlett-Packard\HP HotKey Support\QLBController.exe" [2010-03-01 256056]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-08-25 186904]
"HPPowerAssistant"="c:\program files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe" [2009-12-16 1690680]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-06-04 1791272]
"HPWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe" [2010-04-05 8192]
"File Sanitizer"="c:\program files\Hewlett-Packard\File Sanitizer\CoreShredder.exe" [2009-12-12 11265536]
"DTRun"="c:\program files\ArcSoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe" [2009-11-19 518656]
"NortonOnlineBackupReminder"="c:\program files\Symantec\Norton Online Backup\Activation\NobuActivation.exe" [2009-06-29 600936]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2009-10-23 563736]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2011-08-06 495708]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-01-20 43848]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2013-03-25 142616]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2013-03-25 177432]
"Persistence"="c:\windows\system32\igfxpers.exe" [2013-03-25 176408]
"CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2009-01-29 57344]
"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2013-03-10 88984]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2013-05-01 421888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2014-01-20 152392]
"UIExec"="c:\program files\1&1 Surf-Stick\UIExec.exe" [2011-08-25 153424]
"AVG_UI"="c:\program files\AVG\AVG2015\avgui.exe" [2015-07-31 3780520]
"ToolboxFX"="c:\program files\HP\ToolboxFX\bin\HPTLBXFX.exe" [2010-10-25 58936]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2010-06-09 49208]
"vProt"="c:\program files\AVG Web TuneUp\vprot.exe" [2015-09-09 3175312]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SPReview"="c:\windows\System32\SPReview\SPReview.exe" [2013-03-31 280576]
.
c:\users\Lya\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Lya\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2015-5-5 39175960]
Enviar a OneNote.lnk - c:\program files\Microsoft Office\Office15\ONENOTEM.EXE /tsr [2015-8-12 194736]
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-3-9 828704]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DeviceNP]
2009-11-17 21:39 75320 ----a-w- c:\windows\System32\DeviceNP.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ DPPassFilter scecli
.
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2015-06-03 327296]
R2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe [2010-02-18 1664304]
R3 Andbus;LGE Android Platform Composite USB Device;c:\windows\system32\DRIVERS\lgandbus.sys [2012-03-02 14336]
R3 AndDiag;LGE Android Platform USB Serial Port;c:\windows\system32\DRIVERS\lganddiag.sys [2012-03-02 20736]
R3 AndGps;LGE Android Platform USB GPS NMEA Port;c:\windows\system32\DRIVERS\lgandgps.sys [2012-03-02 20096]
R3 ANDModem;LGE Android Platform USB Modem;c:\windows\system32\DRIVERS\lgandmodem.sys [2012-03-02 25088]
R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\lgandadb.sys [2012-03-02 25728]
R3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [2010-03-18 286248]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2010-03-18 33320]
R3 DAMDrv;DAMDrv;c:\windows\system32\DRIVERS\DAMDrv.sys [2009-10-21 32312]
R3 FLCDLOCK;HP ProtectTools Device Locking / Auditing;c:\windows\system32\flcdlock.exe [2009-11-17 362040]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2015-08-15 102912]
R3 massfilter;Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2011-03-26 9216]
R3 netr28;Ralink 802.11n Wireless Driver for Windows Vista;c:\windows\system32\DRIVERS\netr28.sys [2009-07-13 530944]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 14848]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-11-11 181792]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2010-01-12 257568]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 49664]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-05-16 1343400]
S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [2015-05-12 190944]
S0 Avglogx;AVG Logging Driver;c:\windows\system32\DRIVERS\avglogx.sys [2015-05-07 290272]
S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [2015-03-20 35808]
S0 SafeBoot;SafeBoot; [x]
S0 SbAlg;SbAlg; [x]
S0 SbFsLock;SbFsLock; [x]
S1 Avgdiskx;AVG Disk Driver;c:\windows\system32\DRIVERS\avgdiskx.sys [2015-03-11 132576]
S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdriverx.sys [2015-07-28 250288]
S1 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\avgidsshimx.sys [2015-07-23 31664]
S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [2015-06-16 207328]
S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [2015-05-12 213984]
S1 RsvLock;RsvLock; [x]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\aestsrv.exe [2011-08-06 81920]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2015\avgidsagent.exe [2015-07-31 3633576]
S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2015\avgwdsvc.exe [2015-07-31 335656]
S2 avmike;AVM FRITZ!Fernzugang IKE Service;c:\program files\FRITZ!Fernzugang\avmike.exe [2012-11-28 255904]
S2 certsrv;AVM FRITZ!Fernzugang Cert Service;c:\program files\FRITZ!Fernzugang\certsrv.exe [2012-11-28 122272]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe [2009-07-14 20992]
S2 HP LaserJet Service;HP LaserJet Service;c:\program files\HP\HPLaserJetService\HPLaserJetService.exe [2010-10-25 145920]
S2 HP Power Assistant Service;HP Power Assistant Service;c:\program files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe [2009-12-16 102968]
S2 HP ProtectTools Service;HP ProtectTools Service;c:\program files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [2010-10-19 32768]
S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2015-05-19 99128]
S2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-04-05 103992]
S2 HPDayStarterService;HP DayStarter Service;c:\program files\Hewlett-Packard\HP QuickLook\HPDayStarterService.exe [2010-05-10 90112]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2013-05-13 270624]
S2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [2009-12-16 281192]
S2 HPFSService;File Sanitizer for HP ProtectTools;c:\program files\Hewlett-Packard\File Sanitizer\HPFSService.exe [2009-12-12 297984]
S2 hpHotkeyMonitor;HP Hotkey Monitor;c:\program files\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe [2010-03-01 264248]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2011-05-13 26168]
S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-06-25 35088]
S2 nwtsrv;AVM FRITZ!Fernzugang Client;c:\program files\FRITZ!Fernzugang\nwtsrv.exe [2013-06-10 155488]
S2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [2009-10-23 635416]
S2 TeamViewer9;TeamViewer 9;c:\program files\TeamViewer\Version9\TeamViewer_Service.exe [2015-04-09 5261584]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [2013-03-22 93072]
S2 uArcCapture;ArcCapture;c:\windows\system32\uArcCapture.exe [2009-12-04 506472]
S2 UI Assistant Service;UI Assistant Service;c:\program files\1&1 Surf-Stick\AssistantServices.exe [2011-08-25 270672]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-11-04 2320920]
S2 VideoDownloadConverter_4zService;VideoDownloadConverterService;c:\progra~1\VIDEOD~2\bar\1.bin\4zbarsvc.exe [2014-04-28 88648]
S2 vToolbarUpdater40.1.6;vToolbarUpdater40.1.6;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\40.1.6\ToolbarUpdater.exe [2015-09-09 1874320]
S2 WtuSystemSupport;WtuSystemSupport;c:\program files\AVG Web TuneUp\WtuSystemSupport.exe [2015-09-09 1205136]
S3 ARCVCAM;ARCVCAM, ArcSoft Webcam Sharing Manager Driver;c:\windows\system32\DRIVERS\ArcSoftVCapture.sys [2009-12-04 29824]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2011-03-19 132480]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2011-03-19 246272]
S3 NWIM;AVM VPN Miniport;c:\windows\system32\DRIVERS\avmnwim.sys [2011-07-05 334712]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
utcsvc REG_MULTI_SZ DiagTrack
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-06-17 19:11 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-12-12 05:57 1087816 ----a-w- c:\program files\Google\Chrome\Application\39.0.2171.95\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2015-09-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-01-05 18:44]
.
2015-09-10 c:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-430462746-378290837-44786878-1003Core.job
- c:\users\Lya\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-19 23:42]
.
2015-09-10 c:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-430462746-378290837-44786878-1003UA.job
- c:\users\Lya\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-19 23:42]
.
2015-09-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-08 21:40]
.
2015-09-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-08 21:40]
.
2015-09-08 c:\windows\Tasks\HPCeeScheduleForLya.job
- c:\program files\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15 03:43]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = https://mysearch.avg.com/?cid={1291D822-732F-45BD-B222-AC8E07CBE3A2}&mid=ddcfe7a3f29947d0842d79115ee6d747-e3fc6123164ed5d97872fd8f37a8091760bbbd9b&lang=en&ds=AVG&coid=avgtbavg&cmpid=0915wt&pr=fr&d=2015-09-10 01:10&v=4.1.6.294&pid=wtu&sg=&sap=hp
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://websearch.thesearchpage.info/?pid=20375&r=2015/01/07&hid=6825593813402750368&lg=EN&cc=DE&unqvl=74
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Enviar a OneNote - c:\progra~1\MICROS~1\Office15\ONBttnIE.dll/105
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportar a Microsoft Excel - c:\progra~1\MICROS~1\Office15\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Trusted Zone: //about.htm/
Trusted Zone: //Exclude.htm/
Trusted Zone: //LanguageSelection.htm/
Trusted Zone: //Message.htm/
Trusted Zone: //MyAgttryCmd.htm/
Trusted Zone: //MyAgttryNag.htm/
Trusted Zone: //MyNotification.htm/
Trusted Zone: //NOCLessUpdate.htm/
Trusted Zone: //quarantine.htm/
Trusted Zone: //ScanNow.htm/
Trusted Zone: //strings.vbs/
Trusted Zone: //Template.htm/
Trusted Zone: //Update.htm/
Trusted Zone: //VirFound.htm/
Trusted Zone: mcafee.com\*
Trusted Zone: mcafeeasap.com\betavscan
Trusted Zone: mcafeeasap.com\vs
Trusted Zone: mcafeeasap.com\www
TCP: DhcpNameServer = 192.168.31.1
TCP: Interfaces\{C97CB71E-C566-44AA-8EB6-432FEFABE41E}: DhcpNameServer = 192.168.31.1
TCP: Interfaces\{C97CB71E-C566-44AA-8EB6-432FEFABE41E}\1357E6461302D4F62696C6560275C414E4D225F65747562734542424: DhcpNameServer = 192.168.0.1
TCP: Interfaces\{C97CB71E-C566-44AA-8EB6-432FEFABE41E}\2456C6B696E6E243733403: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{C97CB71E-C566-44AA-8EB6-432FEFABE41E}\5416379724F687D2636463242373: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{C97CB71E-C566-44AA-8EB6-432FEFABE41E}\55053453631303032373: DhcpNameServer = 192.168.0.1
TCP: Interfaces\{C97CB71E-C566-44AA-8EB6-432FEFABE41E}\64259445A51224F6870264F6E60275C414E402733393030223C2437484A7: DhcpNameServer = 192.168.188.1
Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - c:\program files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL
FF - ProfilePath - c:\users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\
FF - prefs.js: browser.startup.homepage - hxxp://gotut.ru/?from=ic3ua
FF - ExtSQL: !HIDDEN! 2011-07-12 21:17; finder@meingutscheincode.de; c:\program files\Mein Gutscheincode Finder\Firefox
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{0ed0633c-a54d-47f1-94e7-5bded41ae674} - (no file)
WebBrowser-{0ED0633C-A54D-47F1-94E7-5BDED41AE674} - (no file)
HKCU-Run-4Y3Y0C3A0W9UYD1IMOSIARRL - c:\ftpuser\0EBD6955DD9.exe
HKLM-Run-mobilegeni daemon - c:\program files\Mobogenie\DaemonProcess.exe
AddRemove-LSI Soft Modem - c:\windows\agrsmdel
AddRemove-{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE} - c:\program files\InstallShield Installation Information\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}\setup.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pdfcDispatcher]
"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil32_18_0_0_232_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil32_18_0_0_232_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'lsass.exe'(1064)
c:\windows\system32\DPFPApi.DLL
.
- - - - - - - > 'Explorer.exe'(7340)
c:\program files\WIDCOMM\Bluetooth Software\btmmhook.dll
c:\program files\WIDCOMM\Bluetooth Software\btncopy.dll
c:\windows\System32\SyncCenter.dll
c:\windows\system32\FXSRESM.DLL
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\progra~1\AVG\AVG2015\avgrsx.exe
c:\program files\AVG\AVG2015\avgcsrvx.exe
c:\program files\IDT\WDM\STacSV.exe
c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
c:\windows\system32\taskhost.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\LSI SoftModem\agrsmsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\WIDCOMM\Bluetooth Software\btwdins.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\windows\system32\GWX\GWX.exe
c:\program files\AVG\AVG2015\avgnsx.exe
c:\program files\AVG\AVG2015\avgemcx.exe
c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\40.1.6\loggingserver.exe
c:\windows\system32\conhost.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Hewlett-Packard\Shared\hpqWmiEx.exe
c:\windows\system32\conhost.exe
c:\windows\System32\rundll32.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\program files\iPod\bin\iPodService.exe
c:\users\Lya\AppData\Roaming\Dropbox\bin\Dropbox.exe
c:\program files\Microsoft Office\Office15\ONENOTEM.EXE
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2015-09-11 00:47:36 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2015-09-10 22:47
.
Vor Suchlauf: 85.649.813.504 bytes free
Nach Suchlauf: 92.472.553.472 bytes free
.
- - End Of File - - 734A89891789806422E7F2B18343F5D3
5C616939100B85E558DA92B899A0FC36
die Startseite lässt sich jedenfalls noch nicht ändern. Beim Start kam immer noch gotut.ru und eine Änderunung in den Einstellungen bewirkt nichts. Gruß Wolfgang |
|
11.09.2015, 18:23
| #8 |
| /// the machine /// TB-Ausbilder | Windows 7: gotut.ru als Startseite beim Firefox, IExplorer und crome Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
12.09.2015, 01:04
| #9 |
| | Windows 7: gotut.ru als Startseite beim Firefox, IExplorer und crome mbam.txt Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlaufdatum: 12.09.2015 Suchlaufzeit: 00:10 Protokolldatei: mbam.txt Administrator: Ja Version: 2.1.8.1057 Malware-Datenbank: v2015.09.11.07 Rootkit-Datenbank: v2015.08.16.01 Lizenz: Kostenlose Version Malware-Schutz: Deaktiviert Schutz vor bösartigen Websites: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x86 Dateisystem: NTFS Benutzer: Lya Suchlauftyp: Bedrohungssuchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 398317 Abgelaufene Zeit: 45 Min., 27 Sek. Speicher: Aktiviert Start: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (keine bösartigen Elemente erkannt) Module: 0 (keine bösartigen Elemente erkannt) Registrierungsschlüssel: 0 (keine bösartigen Elemente erkannt) Registrierungswerte: 0 (keine bösartigen Elemente erkannt) Registrierungsdaten: 0 (keine bösartigen Elemente erkannt) Ordner: 62 PUP.Optional.MultiPlug, C:\ProgramData\paklnnlabnpjbpcoigcpmdlpdoigbail, In Quarantäne, [564d5ad4226972c4f91660111aea47b9], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\27ef763c02c91e867f7fb36d2a26ea4804488fb1, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\27ef763c02c91e867f7fb36d2a26ea4804488fb1\2.0.0, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\27ef763c02c91e867f7fb36d2a26ea4804488fb1\2.0.0\css, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\27ef763c02c91e867f7fb36d2a26ea4804488fb1\2.0.0\images, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\27ef763c02c91e867f7fb36d2a26ea4804488fb1\2.0.0\js, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\27ef763c02c91e867f7fb36d2a26ea4804488fb1\2.0.0\libs, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\6944aa00c902d0ed8c5b1c6cd7bdfd4340218210, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\6944aa00c902d0ed8c5b1c6cd7bdfd4340218210\2.0.0, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\6944aa00c902d0ed8c5b1c6cd7bdfd4340218210\2.0.0\css, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\6944aa00c902d0ed8c5b1c6cd7bdfd4340218210\2.0.0\images, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\6944aa00c902d0ed8c5b1c6cd7bdfd4340218210\2.0.0\js, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\css, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\font, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\images, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\js, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\css, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\fonts, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\images, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\js, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\swf, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin, Löschen bei Neustart, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\chrome, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\assists, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\assists\ie_default_search_provider, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar, Löschen bei Neustart, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\gen1, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\IE9Mesg, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\Message, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\Settings, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.Vaudix, C:\Program Files\Vauidix, In Quarantäne, [b5ee5dd1008b023459eb24984db78779], PUP.Optional.Vaudix, C:\Program Files\VaUudix, In Quarantäne, [2b78012d335839fd093b64585ba97987], PUP.Optional.SystemSpeedup, C:\Users\Lya\AppData\Roaming\Systweak\ssd, In Quarantäne, [41622b0302894aec4e4be017907250b0], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\alert, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\alert\Dialogs, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\alert\Dialogs\AppNotificationDialog, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\alert\Dialogs\AppNotificationDialog\Images, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.6.0.10, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.7.0.6, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.BundleInstaller, C:\Users\Lya\AppData\Roaming\1H1Q, In Quarantäne, [554e26087c0fa096e5adfc0558ab4fb1], PUP.Optional.BundleInstaller, C:\Users\Lya\AppData\Roaming\1H1Q\Free PDF to Word Converter - 2.0 Packages, In Quarantäne, [554e26087c0fa096e5adfc0558ab4fb1], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z, Löschen bei Neustart, [cbd8ab83a0eb31057168779fd92ac739], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Cache, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\History, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Message, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Message\COMMON, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Settings, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MyPCBackup, C:\Program Files\MyPC Backup, In Quarantäne, [614254daff8cfb3b6cffb6621ce758a8], PUP.Optional.NextLive, C:\Users\Lya\AppData\Roaming\newnext.me, In Quarantäne, [059ea38b92f91620b324d4440cf7738d], PUP.Optional.NextLive, C:\Users\Lya\AppData\Roaming\newnext.me\cache, In Quarantäne, [059ea38b92f91620b324d4440cf7738d], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\extensions\4zffxtbr@www.videodownloadconverter.com, In Quarantäne, [7033ef3f1b70a096fb92079d9e6733cd], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\extensions\4zffxtbr@www.videodownloadconverter.com\chrome, In Quarantäne, [7033ef3f1b70a096fb92079d9e6733cd], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\extensions\4zffxtbr@www.videodownloadconverter.com\META-INF, In Quarantäne, [7033ef3f1b70a096fb92079d9e6733cd], Dateien: 284 PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\27ef763c02c91e867f7fb36d2a26ea4804488fb1\2.0.0\libs\i18nImporter.js, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\27ef763c02c91e867f7fb36d2a26ea4804488fb1\2.0.0\libs\msvdc.js, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\27ef763c02c91e867f7fb36d2a26ea4804488fb1\2.0.0\libs\msvdc.min.js, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\27ef763c02c91e867f7fb36d2a26ea4804488fb1\2.0.0\libs\widget-api-1.4.js, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\27ef763c02c91e867f7fb36d2a26ea4804488fb1\2.0.0\libs\widget-api-1.5.js, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\6944aa00c902d0ed8c5b1c6cd7bdfd4340218210\2.0.0\Background.html, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\6944aa00c902d0ed8c5b1c6cd7bdfd4340218210\2.0.0\lang-en.js, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\6944aa00c902d0ed8c5b1c6cd7bdfd4340218210\2.0.0\manifest.json, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\6944aa00c902d0ed8c5b1c6cd7bdfd4340218210\2.0.0\css\ms-vdc-snippet.2.0.0.min.css, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\6944aa00c902d0ed8c5b1c6cd7bdfd4340218210\2.0.0\images\icon.bmp, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\6944aa00c902d0ed8c5b1c6cd7bdfd4340218210\2.0.0\images\icon.bmp,hot,flags=none.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\6944aa00c902d0ed8c5b1c6cd7bdfd4340218210\2.0.0\images\icon.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\6944aa00c902d0ed8c5b1c6cd7bdfd4340218210\2.0.0\images\icon_active.bmp, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\6944aa00c902d0ed8c5b1c6cd7bdfd4340218210\2.0.0\images\icon_active.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\6944aa00c902d0ed8c5b1c6cd7bdfd4340218210\2.0.0\js\Background-2.0.0.min.js, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\6944aa00c902d0ed8c5b1c6cd7bdfd4340218210\2.0.0\js\vdc.2.0.0.min.js, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\App.html, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\Background.html, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\lang-en.js, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\manifest.json, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\Player.html, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\css\App.css, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\css\App.min.css, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\css\reset.css, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\css\reset.min.css, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\font\Roboto-Bold.eot, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\font\Roboto-Bold.ttf, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\font\Roboto-Bold.woff, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\font\Roboto-Medium.eot, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\font\Roboto-Medium.ttf, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\font\Roboto-Medium.woff, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\font\Roboto-Regular.eot, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\font\Roboto-Regular.ttf, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\font\Roboto-Regular.woff, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\images\PlayBttn.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\images\BlackBK.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\images\Breakouts.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\images\Breakouts_2.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\images\DD_closed.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\images\DD_open.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\images\DD_ScrollHandle.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\images\DD_Scroll_BK.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\images\DD_Scroll_handleAlt.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\images\favicon.ico, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\images\Listen.bmp, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\images\Listen.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\images\PlayMusic.bmp, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\images\PlayMusic.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\images\Scroll_BK.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\images\Scroll_Break.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\images\Scroll_Thumb.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\images\Selection_Break.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\images\SettingsBreak.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\images\StationBreak.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\images\temp_blue.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\js\Background.js, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\js\Player.js, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\705d46d8b2604edccc9306042209718003e77462\1.0.3\js\Widget.js, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\App.html, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\Background.html, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\lang-en.js, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\manifest.json, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\css\App-allin1.css, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\css\App-allin1.min.css, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\css\App-audio.css, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\css\App-audio.min.css, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\css\App-image.css, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\css\App-image.min.css, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\css\App-vdc3.min.css, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\css\de.css, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\css\es.css, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\css\fr.css, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\css\pt.css, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\fonts\cabin.eot, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\fonts\cabin.woff, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\images\AudioToAudio_AYZ.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\images\browse.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\images\chrome_review_icon_allin1.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\images\chrome_review_icon_image.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\images\DropBoxArrow.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\images\FileType.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\images\icon-allin1.bmp, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\images\icon-allin1.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\images\icon-audio.bmp, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\images\icon-audio.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\images\icon-image.bmp, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\images\icon-image.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\images\rateUISprite.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\images\spinner.gif, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\images\sprites-allin1.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\images\sprites-audio.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\images\sprites-image.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\images\sprites-vdc3.png, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\js\Background.js, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\js\Review.js, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\js\Widget.js, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Local\VideoDownloadConverter_4z\ff007b1b91a2f486b74acc3f6929bfe914c88987\1.0.2\swf\Converter.swf, In Quarantäne, [1f84ae800289d85e0c431b8593718d73], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\BOOTSTRAP.JS, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zhighin.exe, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zauxstb64.dll, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zbar.dll, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zbprtct.dll, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zbrmon64.exe, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zbrstub.dll, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zbrstub64.dll, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zdatact.dll, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zdlghk.dll, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zdlghk64.dll, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zfeedmg.dll, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\CHROME.MANIFEST, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\CrExtP4z.exe, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\DPNMNGR.DLL, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\EXEMANAGER.DLL, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\FF-NativeMessagingDispatcher.dll, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\Hpg64.dll, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\INSTALL.RDF, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\installKeys.js, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\LOGO.BMP, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\T8EPMSUP.DLL, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\T8EXTEX.DLL, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\T8EXTPEX.DLL, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\T8HTML.DLL, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\T8RES.DLL, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\T8TICKER.DLL, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\UNIFIEDLOGGING.DLL, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\VERIFY.DLL, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zhtmlmu.dll, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zhttpct.dll, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zidle.dll, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zieovr.dll, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zmlbtn.dll, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zradio.dll, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zregfft.dll, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zregiet.dll, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zscript.dll, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zskin.dll, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zskplay.exe, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zSrcAs.dll, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zSrchMn.exe, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zsrchmr.dll, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4ztpinst.dll, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\APPINTEGRATOR.EXE, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\AppIntegrator64.exe, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\APPINTEGRATORSTUB.DLL, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\AppIntegratorStub64.dll, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\ASSISTMONITOR.DLL, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\ASSISTMONITOR64.DLL, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\chrome\4zffxtbr.jar, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\assists\ie_default_search_provider\ARBITER.DLL, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\assists\ie_default_search_provider\ARBITER64.DLL, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\assists\ie_default_search_provider\CONFIG.XML, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\gen1\COMMON.T8S, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\IE9Mesg\COMMON.T8S, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\Message\COMMON.T8S, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.MindSpark, C:\Program Files\VideoDownloadConverter_4z\bar\Settings\s_pid.dat, In Quarantäne, [e2c11f0f414ade58e301dac638cc46ba], PUP.Optional.TheSearchPage, C:\Users\Lya\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_websearch.thesearchpage.info_0.localstorage, In Quarantäne, [7231f6383a51c76ffabc3881996be21e], PUP.Optional.TheSearchPage, C:\Users\Lya\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_websearch.thesearchpage.info_0.localstorage-journal, In Quarantäne, [2d76cf5fc6c534025d59952432d2ea16], PUP.Optional.Vaudix, C:\Program Files\Vauidix\gqcyInFsjoCHxr.tlb, In Quarantäne, [b5ee5dd1008b023459eb24984db78779], PUP.Optional.Vaudix, C:\Program Files\Vauidix\gqcyInFsjoCHxr.dat, In Quarantäne, [b5ee5dd1008b023459eb24984db78779], PUP.Optional.Vaudix, C:\Program Files\Vauidix\oxgyeEUAdgl1kl.dat, In Quarantäne, [b5ee5dd1008b023459eb24984db78779], PUP.Optional.Vaudix, C:\Program Files\Vauidix\oxgyeEUAdgl1kl.tlb, In Quarantäne, [b5ee5dd1008b023459eb24984db78779], PUP.Optional.Vaudix, C:\Program Files\VaUudix\brO12LHHZscMsd.tlb, In Quarantäne, [2b78012d335839fd093b64585ba97987], PUP.Optional.Vaudix, C:\Program Files\VaUudix\brO12LHHZscMsd.dat, In Quarantäne, [2b78012d335839fd093b64585ba97987], PUP.Optional.NextLive, C:\Users\Lya\AppData\Roaming\newnext.me\NENGINE.DLL, In Quarantäne, [b8eb2707048777bf1d055551956f5ba5], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\notificationDB.sqlite, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\alert\servicesMap.json, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\alert\Dialogs\DialogsAPI.js, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\alert\Dialogs\PIE.htc, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\alert\Dialogs\settings.js, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\alert\Dialogs\version.txt, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\alert\Dialogs\AppNotificationDialog\AppNotification.js, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\alert\Dialogs\AppNotificationDialog\initialNotification.html, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\alert\Dialogs\AppNotificationDialog\main.html, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\alert\Dialogs\AppNotificationDialog\NotificationDialogStyle.css, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\alert\Dialogs\AppNotificationDialog\NotificationDialogStyleIE9.css, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\alert\Dialogs\AppNotificationDialog\sampleNotification.html, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\alert\Dialogs\AppNotificationDialog\Images\close.png, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\alert\Dialogs\AppNotificationDialog\Images\like.png, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\alert\Dialogs\AppNotificationDialog\Images\Next.png, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\alert\Dialogs\AppNotificationDialog\Images\Next_hover.png, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\alert\Dialogs\AppNotificationDialog\Images\powered-by.png, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\alert\Dialogs\AppNotificationDialog\Images\Prev.png, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\alert\Dialogs\AppNotificationDialog\Images\Prev_hover.png, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\alert\Dialogs\AppNotificationDialog\Images\settings.png, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\alert\Dialogs\AppNotificationDialog\Images\Thumbs.db, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.6.0.10\Chat.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.6.0.10\DataStructures.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.6.0.10\EBEncryption.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.6.0.10\ExternalLibraryLoader.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.6.0.10\HTTP.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.6.0.10\IO.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.6.0.10\Log.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.6.0.10\MainSingleton.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.6.0.10\MD5.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.6.0.10\Notifications.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.6.0.10\ObserversAndEvents.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.6.0.10\Prefs.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.6.0.10\SearchProtector.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.6.0.10\SearchSuggestIO.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.6.0.10\String.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.6.0.10\TEAEncryption.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.6.0.10\Timer.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.6.0.10\Twitter.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.6.0.10\URL.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.6.0.10\Windows.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.6.0.10\XML.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.7.0.6\Chat.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.7.0.6\DataStructures.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.7.0.6\EBEncryption.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.7.0.6\ExternalLibraryLoader.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.7.0.6\HTTP.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.7.0.6\IO.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.7.0.6\Log.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.7.0.6\MainSingleton.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.7.0.6\MD5.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.7.0.6\Notifications.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.7.0.6\ObserversAndEvents.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.7.0.6\Prefs.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.7.0.6\SearchProtector.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.7.0.6\SearchSuggestIO.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.7.0.6\String.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.7.0.6\TEAEncryption.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.7.0.6\Timer.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.7.0.6\Twitter.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.7.0.6\URL.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.7.0.6\Windows.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.ConduitTB.Gen, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\conduitCommon\modules\3.7.0.6\XML.jsm, In Quarantäne, [198a7eb0c2c9f4427a8c29d303ffd030], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Cache\00062C4D.bmp, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Cache\00062D75.cab, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Cache\00081341.bmp, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Cache\000813CE.bmp, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Cache\0008144A.bmp, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Cache\000814D7.bmp, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Cache\00081534.bmp, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Cache\00081592.cab, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Cache\000816AB.bmp, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Cache\00081728.cab, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Cache\00081A91.bmp, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Cache\00081B2D.bmp, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Cache\00081BC9.bmp, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Cache\00081C65.cab, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Cache\0078D7F9, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Cache\01A470F3, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Cache\07077D7D.bmp, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Cache\07077E96.cab, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Cache\files.ini, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Cache\PopupProperties221584466.html, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\History\search3, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Message\COMMON\8_step1.gif, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Message\COMMON\anemone.js, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Message\COMMON\bd_grad.gif, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Message\COMMON\hpguard.js, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Message\COMMON\hpguard1.htm, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Message\COMMON\hpguard2.htm, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Message\COMMON\hpp_ok.png, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Message\COMMON\hpp_x.png, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Message\COMMON\hpp_x2.png, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Message\COMMON\index.htm, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Message\COMMON\localizedStrings.js, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Message\COMMON\mid_dots.gif, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Message\COMMON\mws_logo.gif, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Message\COMMON\protect.htm, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Message\COMMON\rebut4b.htm, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Message\COMMON\shield.png, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Message\COMMON\stop.gif, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Message\COMMON\systrayp.htm, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Message\COMMON\tbguard1.htm, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Message\COMMON\tbguard2.htm, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Message\COMMON\tp_grad.gif, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MindSpark, C:\Users\Lya\AppData\LocalLow\VideoDownloadConverter_4z\bar\Settings\prevcfg2.htm, In Quarantäne, [e7bca18de5a6ce686f16d34438cb18e8], PUP.Optional.MyPCBackup, C:\Program Files\MyPC Backup\DEL_UnRegisterExtensions.exe, In Quarantäne, [614254daff8cfb3b6cffb6621ce758a8], PUP.Optional.NextLive, C:\Users\Lya\AppData\Roaming\newnext.me\nengine.cookie, In Quarantäne, [059ea38b92f91620b324d4440cf7738d], PUP.Optional.NextLive, C:\Users\Lya\AppData\Roaming\newnext.me\cache\spark.bin, In Quarantäne, [059ea38b92f91620b324d4440cf7738d], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\extensions\4zffxtbr@www.videodownloadconverter.com\install.rdf, In Quarantäne, [7033ef3f1b70a096fb92079d9e6733cd], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\extensions\4zffxtbr@www.videodownloadconverter.com\bootstrap.js, In Quarantäne, [7033ef3f1b70a096fb92079d9e6733cd], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\extensions\4zffxtbr@www.videodownloadconverter.com\chrome.manifest, In Quarantäne, [7033ef3f1b70a096fb92079d9e6733cd], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\extensions\4zffxtbr@www.videodownloadconverter.com\chrome.manifest.restartless, In Quarantäne, [7033ef3f1b70a096fb92079d9e6733cd], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\extensions\4zffxtbr@www.videodownloadconverter.com\install_no_bootstrap.rdf, In Quarantäne, [7033ef3f1b70a096fb92079d9e6733cd], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\extensions\4zffxtbr@www.videodownloadconverter.com\chrome\4zffxtbr.jar, In Quarantäne, [7033ef3f1b70a096fb92079d9e6733cd], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\extensions\4zffxtbr@www.videodownloadconverter.com\META-INF\manifest.mf, In Quarantäne, [7033ef3f1b70a096fb92079d9e6733cd], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\extensions\4zffxtbr@www.videodownloadconverter.com\META-INF\zigbert.rsa, In Quarantäne, [7033ef3f1b70a096fb92079d9e6733cd], PUP.Optional.MindSpark, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\extensions\4zffxtbr@www.videodownloadconverter.com\META-INF\zigbert.sf, In Quarantäne, [7033ef3f1b70a096fb92079d9e6733cd], PUP.Optional.Conduit, C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js, Gut: (), Schlecht: (user_pref("CT1734448.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1734448&q=");), Ersetzt,[663df23c6f1cf14542aac4dcd03549b7] Physische Sektoren: 0 (keine bösartigen Elemente erkannt) (end) AdwCleaner.txt Code:
ATTFilter # AdwCleaner v5.007 - Logfile created 12/09/2015 at 01:27:09
# Updated 08/09/2015 by Xplode
# Database : 2015-09-10.1 [Server]
# Operating system : Windows 7 Professional Service Pack 1 (x86)
# Username : Lya - LYA-HP
# Running from : C:\Users\Lya\Desktop\AdwCleaner_5.007.exe
# Option : Cleaning
# Support : hxxp://toolslib.net/forum
***** [ Services ] *****
[-] Service Deleted : vToolbarUpdater40.1.6
***** [ Folders ] *****
[-] Folder Deleted : C:\Program Files\AVG Security Toolbar
[-] Folder Deleted : C:\Program Files\Mein Gutscheincode Finder
[-] Folder Deleted : C:\Program Files\Mobogenie
[-] Folder Deleted : C:\Program Files\Common Files\AVG Secure Search
[-] Folder Deleted : C:\ProgramData\AVG Secure Search
[-] Folder Deleted : C:\ProgramData\Avg_Update_0814tb
[-] Folder Deleted : C:\ProgramData\{18165758-115C-4DC0-9EC2-FF89F725767F}
[-] Folder Deleted : C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[-] Folder Deleted : C:\Users\Lya\AppData\Local\Conduit
[-] Folder Deleted : C:\Users\Lya\AppData\Local\genienext
[-] Folder Deleted : C:\Users\Lya\AppData\Local\iac
[-] Folder Deleted : C:\Users\Lya\AppData\Local\Mobogenie
[-] Folder Deleted : C:\Users\Lya\AppData\LocalLow\AVG Secure Search
[-] Folder Deleted : C:\Users\Lya\AppData\LocalLow\Conduit
[-] Folder Deleted : C:\Users\Lya\AppData\LocalLow\iac
[-] Folder Deleted : C:\Users\Lya\AppData\Roaming\pdfforge
[-] Folder Deleted : C:\Users\Lya\AppData\Roaming\Systweak
[-] Folder Deleted : C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\Extensions\Avg@toolbar
[-] Folder Deleted : C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\Extensions\isreaditlater@ideashower.com
***** [ Files ] *****
[-] File Deleted : C:\Program Files\Mozilla Firefox\browser\searchplugins\avg-secure-search.xml
[-] File Deleted : C:\Program Files\Mozilla Firefox\browser\searchplugins\wtu-secure-search.xml
[-] File Deleted : C:\Users\Lya\daemonprocess.txt
[-] File Deleted : C:\Users\Lya\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dchmpbaclbiioedakpcldenooikekokm
[-] File Deleted : C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\invalidprefs.js
[-] File Deleted : C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\searchplugins\avg-secure-search.xml
***** [ Shortcuts ] *****
***** [ Scheduled tasks ] *****
***** [ Registry ] *****
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
[-] Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
[-] Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
[-] Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
[-] Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]
[-] Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
[-] Key Deleted : HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\avgsh
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1ED16E0A-E8C4-40A0-8BC2-79485D21F796}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{408CFAD9-8F13-4747-8EC7-770A339C7237}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{94496571-6AC5-4836-82D5-D46260C44B17}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0FA32667-9A8A-4E9C-902F-CA3323180003}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{07CAC314-E962-4F78-89AB-DD002F2490EE}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{13ABD093-D46F-40DF-A608-47E162EC799D}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{BC153A3C-0BB7-4EED-83AE-28E6E398F56E}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1ED16E0A-E8C4-40A0-8BC2-79485D21F796}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1ED16E0A-E8C4-40A0-8BC2-79485D21F796}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{38122A36-83B2-46B8-B39A-EC72A4614A07}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1ED16E0A-E8C4-40A0-8BC2-79485D21F796}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{38122A36-83B2-46B8-B39A-EC72A4614A07}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}
[-] Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{21FA44EF-376D-4D53-9B0F-8A89D3229068}]
[-] Key Deleted : HKU\.DEFAULT\Software\AVG Secure Search
[-] Key Deleted : HKU\.DEFAULT\Software\Avg Secure Update
[-] Key Deleted : HKCU\Software\Conduit
[-] Key Deleted : HKCU\Software\IGearSettings
[-] Key Deleted : HKCU\Software\OCS
[-] Key Deleted : HKCU\Software\powerpack
[-] Key Deleted : HKCU\Software\Softonic
[-] Key Deleted : HKCU\Software\systweak
[-] Key Deleted : HKCU\Software\Avg Secure Update
[-] Key Deleted : HKCU\Software\AppDataLow\{4A0F38A9-FE55-4B89-B73F-E60FDC0F72E9}
[-] Key Deleted : HKLM\SOFTWARE\Conduit
[-] Key Deleted : HKLM\SOFTWARE\DeviceVM
[-] Key Deleted : HKLM\SOFTWARE\systweak
[-] Key Deleted : HKLM\SOFTWARE\Avg Secure Update
[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
[!] Key Not Deleted : HKU\S-1-5-21-430462746-378290837-44786878-1003\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
***** [ Web browsers ] *****
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448..clientLogIsEnabled", false);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448..clientLogServiceUrl", "hxxp://clientlog.users.tbccint.com/ClientDiagnostics.asmx/ReportDiagnosticsEvent");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448..uninstallLogServiceUrl", "hxxp://uninstall.users.tbccint.com/Uninstall.asmx/RegisterToolbarUninstallation");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/default.aspx");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.BrowserCompStateIsOpen_1000515", true);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.BrowserCompStateIsOpen_1367159395000", true);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.CT1734448", "CT1734448");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.CT1734448.lastNewTabSettings", "{\"isEnabled\":true,\"newTabUrl\":\"hxxp://www.trovigo.com/?gd=&ctid=CT1734448&octid=CT1734448&ISID=ISID_ID&SearchSource=15&CUI=SB_CUI&SSPV=EB_SSPV[...]
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.ConfigurationLastCheckTime", "Sat Jul 25 2015 00:46:44 GMT+0200");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.CurrentServerDate", "26-7-2015");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.DialogsAlignMode", "LTR");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.DialogsGetterLastCheckTime", "Sun Dec 07 2014 12:49:43 GMT+0100");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.DownloadReferralCookieData", "{\"BannerName\":\"\",\"BannerTypeId\":\"\",\"BannerCulture\":\"\",\"DownloadTime\":\"8/7/2011 1:00:25 AM\",\"SourceId\":0,\"OriginSource\":0,\"Referr[...]
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.FirstServerDate", "7-8-2011");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.FirstTime", true);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.FirstTimeFF3", true);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.FixPageNotFoundErrors", false);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.GroupingServerCheckInterval", 1440);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.GroupingServiceUrl", "hxxp://grouping.tbccint.com/");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.HasUserGlobalKeys", true);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.HomePageProtectorEnabled", false);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.Initialize", true);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.InitializeCommonPrefs", true);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.InstallationAndCookieDataSentCount", 3);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.InstallationType", "DirectDownload");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.InstalledDate", "Sun Aug 07 2011 00:04:01 GMT+0200");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.IsAlertDBUpdated", true);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.IsGrouping", false);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.IsInitSetupIni", true);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.IsMulticommunity", false);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.IsOpenThankYouPage", true);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.IsOpenUninstallPage", true);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.IsProtectorsInit", true);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.LanguagePackLastCheckTime", "Sat Jul 25 2015 00:46:44 GMT+0200");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.LanguagePackReloadIntervalMM", 1440);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.LanguagePackServiceUrl", "hxxp://translation.users.tbccint.com/Translation.ashx");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.LastLogin_3.13.0.6", "Wed Jul 11 2012 23:36:51 GMT+0200");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.LastLogin_3.14.1.0", "Sun Sep 02 2012 17:33:48 GMT+0200");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.LastLogin_3.15.1.0", "Sun Nov 18 2012 12:53:28 GMT+0100");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.LastLogin_3.16.0.3", "Thu Feb 14 2013 20:30:12 GMT+0100");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.LastLogin_3.18.0.7", "Sat Aug 17 2013 16:04:31 GMT+0200");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.LastLogin_3.19.0.3", "Sun Sep 08 2013 10:03:37 GMT+0200");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.LastLogin_3.20.0.4", "Fri Nov 22 2013 01:44:05 GMT+0100");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.LastLogin_3.21.0.1", "Sat Jul 25 2015 23:46:30 GMT+0200");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.LastLogin_3.6.0.10", "Tue Oct 04 2011 11:44:15 GMT+0200");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.LastLogin_3.7.0.6", "Wed Oct 05 2011 10:43:24 GMT+0200");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.LatestVersion", "3.20.0.4");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.Locale", "en-us");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.MCDetectTooltipHeight", "83");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.MCDetectTooltipUrt?l", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.MCDetectTooltipWidth", "295");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.MyStuffEnabledAtInstallation", true);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.OriginalFirstVersion", "3.6.0.10");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.SHRINK_TOOLBAR", 1);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.SearchAPILastCheckTime", "Sat Jul 25 2015 00:46:44 GMT+0200");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.SearchEngineBeforeUnload", "chrome://browser-region/locale/region.properties");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.SearchFromAddressBarIsInit", true);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.SearchInNewTabEnabled", true);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.SearchInNewTabIntervalMM", 1440);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.SearchInNewTabLastCheckTime", "Sun Sep 08 2013 10:03:31 GMT+0200");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_TOOLBAR_ID&UM=UM_ID");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.SearchInNewTabURLFromSearchAPI", "hxxp://www.trovigo.com/?gd=&ctid=CT1734448&octid=CT1734448&ISID=ISID_ID&SearchSource=15&CUI=SB_CUI&SSPV=EB_SSPV&Lay=1&UM=UM_ID&D=IN_DA");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.SearchInNewTabUsageUrl", "hxxp://usage.hosting.toolbar.conduit-services.com/usage.ashx?ctid=EB_TOOLBAR_ID");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.SearchProtectorEnabled", false);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.SearchProtectorToolbarDisabled", false);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.ServiceMapLastCheckTime", "Sat Jul 25 2015 00:46:44 GMT+0200");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.SettingsLastCheckTime", "Sat Jul 25 2015 22:41:42 GMT+0200");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.SettingsLastUpdate", "1437804024");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.ThirdPartyComponentsInterval", 504);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.ThirdPartyComponentsLastCheck", "Tue Sep 27 2011 18:43:41 GMT+0200");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.ThirdPartyComponentsLastUpdate", "1312887586");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.ToolbarShrinkedFromSetup", false);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.TrusteLinkUrl", "hxxp://trust.cpccint.com");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,tbclient.tbccint.com,codefuel.com,tbccint.com,trovi.com,seccint.com,cpccint.com,appstrm.com,OurToolbar.co[...]
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.Uninstall", true);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.UserID", "UN32922996092604095");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.ValidationData_Search", 0);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.ValidationData_Toolbar", 2);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.alertChannelId", "28695");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.backendstorage.hxxp://freetrafficbar_com.user_id", "313332383831");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.components.1000515", false);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.countryCode", "DE");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.conduit.com;apps.conduit.com;services.apps.conduit.com;social.tbccint.com;apps.tbccint.com;services.a[...]
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.globalFirstTimeInfoLastCheckTime", "Wed Oct 05 2011 10:43:24 GMT+0200");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.homepageProtectorEnableByLogin", true);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.initDone", true);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.isAppTrackingManagerOn", true);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.myStuffEnabled", true);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.myStuffPublihserMinWidth", 400);
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.myStuffSearchUrl", "hxxp://appstrm.com/search?q=SEARCH_TERM&SearchSourceOrigin=29&ctid=EB_TOOLBAR_ID&octid=EB_ORIGINAL_CTID");
[-] [C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\prefs.js] [Preference] Deleted : user_pref("CT1734448.myStuffServiceIntervalMM", 1440);
[-] [C:\Users\Lya\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : search.conduit.com
[-] [C:\Users\Lya\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : isearch.avg.com
[-] [C:\Users\Lya\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : websearch
*************************
:: Proxy settings cleared
:: Winsock settings cleared
:: IE policies deleted
:: Chrome policies deleted
########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [25118 bytes] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.6.0 (08.31.2015:1)
OS: Windows 7 Professional x86
Ran by Lya on 12.09.2015 at 1:48:48,84
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Tasks
~~~ Registry Values
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\\SearchAssistant
Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-430462746-378290837-44786878-1003\Software\Microsoft\Internet Explorer\Main\\Start Page
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer
~~~ Files
~~~ Folders
Successfully deleted: [Folder] C:\Users\Lya\AppData\Roaming\browsers
Successfully deleted: [Folder] C:\Users\Lya\AppData\Roaming\dg
Successfully deleted: [Folder] C:\Users\Lya\AppData\Roaming\spi
~~~ FireFox
Emptied folder: C:\Users\Lya\AppData\Roaming\mozilla\firefox\profiles\o49vl2wk.default\minidumps [44 files]
~~~ Chrome
[C:\Users\Lya\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - default search provider reset
[C:\Users\Lya\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:
[C:\Users\Lya\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset
[C:\Users\Lya\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 12.09.2015 at 1:52:28,11
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
12.09.2015, 01:35
| #10 |
| | Windows 7: gotut.ru als Startseite beim Firefox, IExplorer und crome FRST.txt FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:10-09-2015 01
Ran by Lya (administrator) on LYA-HP (12-09-2015 02:05:59)
Running from C:\Users\Lya\Desktop
Loaded Profiles: Lya (Available Profiles: Lya)
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgcsrvx.exe
() C:\Program Files\AVG Web TuneUp\WtuSystemSupport.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe
(McAfee, Inc.) C:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AEstSrv.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agrsmsvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgwdsvc.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\avmike.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\certsrv.exe
(HP) C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe
(Hewlett-Packard Development Company, L.P) C:\Program Files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP QuickLook\HPDayStarterService.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP HotKey Support\QLBController.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\File Sanitizer\coreshredder.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(SlySoft, Inc.) C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
(Elaborate Bytes AG) C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
() C:\Program Files\1&1 Surf-Stick\UIExec.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgui.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgnsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgemcx.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
(TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
() C:\Program Files\1&1 Internet-Radio-Player\phonostarTimer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Dropbox, Inc.) C:\Users\Lya\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(PDF Complete Inc) C:\Program Files\PDF Complete\pdfsvc.exe
(Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
(ArcSoft, Inc.) C:\Windows\System32\uArcCapture.exe
() C:\Program Files\1&1 Surf-Stick\AssistantServices.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgrsx.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [QLBController] => C:\Program Files\Hewlett-Packard\HP HotKey Support\QLBController.exe [256056 2010-03-01] (Hewlett-Packard Company)
HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-08-25] (Intel Corporation)
HKLM\...\Run: [HPPowerAssistant] => C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe [1690680 2009-12-16] (Hewlett-Packard)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1791272 2010-06-04] (Synaptics Incorporated)
HKLM\...\Run: [HPWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-04-05] (Hewlett-Packard)
HKLM\...\Run: [File Sanitizer] => C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe [11265536 2009-12-12] (Hewlett-Packard)
HKLM\...\Run: [DTRun] => c:\Program Files\ArcSoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe [518656 2009-11-19] (ArcSoft Inc.)
HKLM\...\Run: [NortonOnlineBackupReminder] => C:\Program Files\Symantec\Norton Online Backup\Activation\NobuActivation.exe [600936 2009-06-29] (Symantec Corporation)
HKLM\...\Run: [PDF Complete] => C:\Program Files\PDF Complete\pdfsty.exe [563736 2009-10-23] (PDF Complete Inc)
HKLM\...\Run: [Windows Mobile Device Center] => C:\windows\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray.exe [495708 2011-08-06] (IDT, Inc.)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-01-20] (Apple Inc.)
HKLM\...\Run: [AppleSyncNotifier] => C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [58656 2011-04-20] (Apple Inc.)
HKLM\...\Run: [CloneCDTray] => C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe [57344 2009-01-30] (SlySoft, Inc.)
HKLM\...\Run: [VirtualCloneDrive] => C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.)
HKLM\...\Run: [UIExec] => C:\Program Files\1&1 Surf-Stick\UIExec.exe [153424 2011-08-25] ()
HKLM\...\Run: [AVG_UI] => C:\Program Files\AVG\AVG2015\avgui.exe [3780520 2015-07-31] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [ToolboxFX] => C:\Program Files\HP\ToolboxFX\bin\HPTLBXFX.exe [58936 2010-10-25] (Hewlett-Packard Company)
HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)
Winlogon\Notify\DeviceNP: C:\windows\system32\DeviceNP.dll [2009-11-17] (Hewlett-Packard Limited)
HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Run: [HPADVISOR] => C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe [1685048 2009-09-30] (Hewlett-Packard)
HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Run: [LightScribe Control Panel] => C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2009-06-17] (Hewlett-Packard Company)
HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2011-02-08] (Google Inc.)
HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Run: [TomTomHOME.exe] => C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-03-22] (TomTom)
HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [53282944 2015-06-29] (Skype Technologies S.A.)
HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Run: [1&1 Internet-Radio-PlayerTimer] => C:\Program Files\1&1 Internet-Radio-Player\phonostarTimer.exe [42496 2014-12-04] ()
HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Run: [Dropbox Update] => C:\Users\Lya\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-20] (Dropbox, Inc.)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\windows\System32\SPReview\SPReview.exe [280576 2013-03-31] (Microsoft Corporation)
Lsa: [Notification Packages] DPPassFilter scecli
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lya\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lya\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lya\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-14] (Dropbox, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2010-06-26]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\Lya\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2014-11-17]
ShortcutTarget: Dropbox.lnk -> C:\Users\Lya\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Lya\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Enviar a OneNote.lnk [2015-01-09]
ShortcutTarget: Enviar a OneNote.lnk -> C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Lya\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk [2011-02-08]
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Winsock: Catalog5 06 C:\Program Files\Bonjour\mdnsNSP.dll [121704 2011-08-30] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.31.1
Tcpip\..\Interfaces\{C97CB71E-C566-44AA-8EB6-432FEFABE41E}: [DhcpNameServer] 192.168.31.1
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-430462746-378290837-44786878-1003\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-430462746-378290837-44786878-1003\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {3122535E-E748-4168-8EB4-87DB7EA63DF2} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
BHO: File Sanitizer for HP ProtectTools -> {3134413B-49B4-425C-98A5-893C1F195601} -> C:\Program Files\Hewlett-Packard\File Sanitizer\IEBHO.dll [2009-12-12] (Hewlett-Packard)
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-08-12] (Microsoft Corporation)
BHO: HP ProtectTools Security Manager Extension -> {395610AE-C624-4f58-B89E-23733EA00F9A} -> C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpOtsPluginIe8.dll [2011-05-02] (DigitalPersona, Inc.)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2013-12-18] (Oracle Corporation)
BHO: Windows Live Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22] (Microsoft Corporation)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-08-05] (Google Inc.)
BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2013-01-31] (Skype Technologies S.A.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-07-14] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2013-12-18] (Oracle Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)
Toolbar: HKLM - No Name - {0BF43445-2F28-4351-9252-17FE6E806AA0} - No File
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-08-05] (Google Inc.)
Toolbar: HKU\S-1-5-21-430462746-378290837-44786878-1003 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-08-05] (Google Inc.)
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll No File
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2015-02-17] (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2013-01-31] (Skype Technologies S.A.)
FireFox:
========
FF ProfilePath: C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-11] ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2013-12-18] ()
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll [2014-01-06] (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2013-12-18] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2013-12-18] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-03-31] (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-09-12] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-09-12] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2013-12-18] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-430462746-378290837-44786878-1003: @phonostar.de/1&1 Internet-Radio-Player -> C:\Program Files\1&1 Internet-Radio-Player\npphonostarDetectNP.dll [2012-11-21] ( )
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2015-03-31] (Microsoft Corporation)
FF Extension: preisspion.de - C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\Extensions\finder@meingutscheincode.de.xpi [2011-05-16]
FF Extension: yingBar - C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\Extensions\{fae08409-991d-414c-8113-68f37760339a}.xpi [2015-07-26]
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2015-09-02]
FF HKLM\...\Firefox\Extensions: [otis@digitalpersona.com] - C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt
FF Extension: DigitalPersona Extension - C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt [2011-12-24]
FF HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Firefox\Extensions: [finder@meingutscheincode.de] - C:\Program Files\Mein Gutscheincode Finder\Firefox
FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\itms.js [2015-09-02]
Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\Lya\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (preisspion.de) - C:\Users\Lya\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgfpelakfkbbkkdchaaaknckhoadkcbo [2013-01-05]
CHR Extension: (Skype Click to Call) - C:\Users\Lya\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2013-04-30]
CHR HKLM\...\Chrome\Extension: [jgfpelakfkbbkkdchaaaknckhoadkcbo] - C:\Program Files\Mein Gutscheincode Finder\Chrome\chrome-extension.crx <not found>
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2013-01-31]
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [109056 2009-09-28] (ArcSoft Inc.)
R2 AgereModemAudio; C:\Program Files\LSI SoftModem\agrsmsvc.exe [14336 2009-11-02] (LSI Corporation)
R2 AVGIDSAgent; C:\Program Files\AVG\AVG2015\avgidsagent.exe [3633576 2015-07-31] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG2015\avgwdsvc.exe [335656 2015-07-31] (AVG Technologies CZ, s.r.o.)
R2 avmike; C:\Program Files\FRITZ!Fernzugang\avmike.exe [255904 2012-11-28] (AVM Berlin)
R2 certsrv; C:\Program Files\FRITZ!Fernzugang\certsrv.exe [122272 2012-11-28] (AVM Berlin)
R2 DpHost; C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [300880 2010-07-16] (DigitalPersona, Inc.)
S3 FLCDLOCK; c:\Windows\system32\flcdlock.exe [362040 2009-11-17] (Hewlett-Packard Ltd)
R2 HP LaserJet Service; C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe [145920 2010-10-25] (HP) [File not signed]
R2 HP Power Assistant Service; C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe [102968 2009-12-16] (Hewlett-Packard)
R2 HP ProtectTools Service; C:\Program Files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [32768 2010-10-19] (Hewlett-Packard Development Company, L.P) [File not signed]
R2 HP Wireless Assistant Service; C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [103992 2010-04-05] (Hewlett-Packard)
R2 HPDayStarterService; c:\Program Files\Hewlett-Packard\HP QuickLook\HPDayStarterService.exe [90112 2010-05-10] (Hewlett-Packard Company) [File not signed]
R2 HpFkCryptService; c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [281192 2009-12-16] (McAfee, Inc.)
R2 HPFSService; C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe [297984 2009-12-12] (Hewlett-Packard) [File not signed]
R2 hpHotkeyMonitor; C:\Program Files\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe [264248 2010-03-01] (Hewlett-Packard Company)
R2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [73728 2009-06-17] (Hewlett-Packard Company) [File not signed]
S2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 Net Driver HPZ12; C:\windows\system32\HPZinw12.dll [44032 2010-01-18] (Hewlett-Packard) [File not signed]
R2 nwtsrv; C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe [155488 2013-06-10] (AVM Berlin)
R2 pdfcDispatcher; C:\Program Files\PDF Complete\pdfsvc.exe [635416 2009-10-23] (PDF Complete Inc)
R2 Pml Driver HPZ12; C:\windows\system32\HPZipm12.dll [53760 2010-01-18] (Hewlett-Packard) [File not signed]
R2 STacSV; C:\Program Files\IDT\WDM\STacSV.exe [254034 2011-08-06] (IDT, Inc.)
R2 uArcCapture; C:\windows\system32\uArcCapture.exe [506472 2009-12-04] (ArcSoft, Inc.)
R2 UI Assistant Service; C:\Program Files\1&1 Surf-Stick\AssistantServices.exe [270672 2011-08-25] ()
S2 vcsFPService; C:\windows\system32\vcsFPService.exe [1664304 2010-02-18] (Validity Sensors, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
R2 WtuSystemSupport; C:\Program Files\AVG Web TuneUp\WtuSystemSupport.exe [1205136 2015-09-10] ()
S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [X]
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 Afc; C:\windows\System32\drivers\Afc.sys [18688 2006-11-11] (Arcsoft, Inc.)
S3 Andbus; C:\windows\System32\DRIVERS\lgandbus.sys [14336 2012-03-02] (LG Electronics Inc.)
S3 AndDiag; C:\windows\System32\DRIVERS\lganddiag.sys [20736 2012-03-02] (LG Electronics Inc.)
S3 AndGps; C:\windows\System32\DRIVERS\lgandgps.sys [20096 2012-03-02] (LG Electronics Inc.)
S3 ANDModem; C:\windows\System32\DRIVERS\lgandmodem.sys [25088 2012-03-02] (LG Electronics Inc.)
S3 androidusb; C:\windows\System32\Drivers\lgandadb.sys [25728 2012-03-02] (Google Inc)
R3 ARCVCAM; C:\windows\System32\DRIVERS\ArcSoftVCapture.sys [29824 2009-12-04] (ArcSoft, Inc.)
R3 athr; C:\windows\System32\DRIVERS\athr.sys [2957312 2012-06-20] (Qualcomm Atheros Communications, Inc.)
R1 Avgdiskx; C:\windows\System32\DRIVERS\avgdiskx.sys [132576 2015-03-11] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\windows\System32\DRIVERS\avgidsdriverx.sys [250288 2015-07-28] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\windows\System32\DRIVERS\avgidshx.sys [190944 2015-05-12] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\windows\System32\DRIVERS\avgidsshimx.sys [31664 2015-07-23] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\windows\System32\DRIVERS\avgldx86.sys [207328 2015-06-16] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\windows\System32\DRIVERS\avglogx.sys [290272 2015-05-07] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\windows\System32\DRIVERS\avgmfx86.sys [186800 2015-07-28] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\windows\System32\DRIVERS\avgrkx86.sys [35808 2015-03-20] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\windows\System32\DRIVERS\avgtdix.sys [213984 2015-05-12] (AVG Technologies CZ, s.r.o.)
R3 btwampfl; C:\windows\System32\drivers\btwampfl.sys [286248 2010-03-18] (Broadcom Corporation.)
S3 DAMDrv; C:\windows\System32\DRIVERS\DAMDrv.sys [32312 2009-10-21] (Hewlett-Packard Development Company L.P.)
R3 ElbyCDFL; C:\windows\System32\Drivers\ElbyCDFL.sys [34760 2007-02-16] (SlySoft, Inc.)
R1 ElbyCDIO; C:\windows\System32\Drivers\ElbyCDIO.sys [30616 2013-03-04] (Elaborate Bytes AG)
R1 ISODrive; C:\Program Files\UltraISO\drivers\ISODrive.sys [82320 2010-01-29] (EZB Systems, Inc.)
S3 massfilter; C:\windows\System32\drivers\massfilter.sys [9216 2011-03-26] (MBB Incorporated)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [23256 2015-06-18] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [51928 2015-06-18] (Malwarebytes Corporation)
S3 MfeAVFK; C:\windows\System32\drivers\MfeAVFK.sys [79816 2009-05-16] (McAfee, Inc.)
S3 MfeBOPK; C:\windows\System32\drivers\MfeBOPK.sys [35272 2009-05-16] (McAfee, Inc.)
R1 mfehidk; C:\windows\System32\drivers\mfehidk.sys [214024 2009-05-16] (McAfee, Inc.)
S3 MfeRKDK; C:\windows\System32\drivers\MfeRKDK.sys [34248 2009-05-16] (McAfee, Inc.)
R1 mfetdik; C:\windows\System32\drivers\mfetdik.sys [55336 2009-05-16] (McAfee, Inc.)
R2 NPF; C:\windows\System32\drivers\npf.sys [35088 2010-06-25] (CACE Technologies, Inc.)
R3 NWIM; C:\windows\System32\DRIVERS\avmnwim.sys [334712 2011-07-05] (AVM Berlin)
R1 RsvLock; C:\windows\system32\Drivers\RsvLock.sys [40088 2009-12-16] (McAfee, Inc.)
S3 s116bus; C:\windows\System32\DRIVERS\s116bus.sys [83336 2007-04-03] (MCCI Corporation)
S3 s116mdfl; C:\windows\System32\DRIVERS\s116mdfl.sys [15112 2007-04-03] (MCCI Corporation)
S3 s116mdm; C:\windows\System32\DRIVERS\s116mdm.sys [108680 2007-04-03] (MCCI Corporation)
S3 s116mgmt; C:\windows\System32\DRIVERS\s116mgmt.sys [100488 2007-04-03] (MCCI Corporation)
S3 s116nd5; C:\windows\System32\DRIVERS\s116nd5.sys [23176 2007-04-03] (MCCI Corporation)
S3 s116obex; C:\windows\System32\DRIVERS\s116obex.sys [98696 2007-04-03] (MCCI Corporation)
S3 s116unic; C:\windows\System32\DRIVERS\s116unic.sys [99080 2007-04-03] (MCCI Corporation)
R0 SafeBoot; C:\windows\system32\Drivers\SafeBoot.sys [110520 2009-12-16] () [File not signed]
R0 SbAlg; C:\windows\system32\Drivers\SbAlg.sys [51800 2009-12-16] (McAfee, Inc.)
R0 SbFsLock; C:\windows\system32\Drivers\SbFsLock.sys [13256 2009-12-16] (McAfee, Inc.)
R3 SNP2UVC; C:\windows\System32\DRIVERS\snp2uvc.sys [1763968 2009-12-19] ()
R3 vpcbus; C:\windows\System32\DRIVERS\vpchbus.sys [172416 2010-11-20] (Microsoft Corporation)
R1 vpcnfltr; C:\windows\System32\DRIVERS\vpcnfltr.sys [48128 2010-11-20] (Microsoft Corporation)
R3 vpcusb; C:\windows\System32\DRIVERS\vpcusb.sys [78336 2010-11-20] (Microsoft Corporation)
R1 vpcvmm; C:\windows\System32\drivers\vpcvmm.sys [296064 2010-11-20] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Lya\AppData\Local\Temp\catchme.sys [X]
U5 ewusbnet; C:\Windows\System32\Drivers\ewusbnet.sys [201168 2009-12-07] (Huawei Technologies Co., Ltd.)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-09-12 02:05 - 2015-09-12 02:05 - 00000000 ____D C:\Users\Lya\Desktop\FRST-OlderVersion
2015-09-12 01:52 - 2015-09-12 01:52 - 00002328 _____ C:\Users\Lya\Desktop\JRT.txt
2015-09-12 01:21 - 2015-09-12 01:27 - 00000000 ____D C:\AdwCleaner
2015-09-12 01:16 - 2015-09-12 01:16 - 00062638 _____ C:\Users\Lya\Desktop\mbam.txt
2015-09-12 00:22 - 2015-09-12 00:22 - 01799392 _____ (Malwarebytes Corporation) C:\Users\Lya\Desktop\JRT_7600.exe
2015-09-12 00:20 - 2015-09-12 00:21 - 01660416 _____ C:\Users\Lya\Desktop\AdwCleaner_5.007.exe
2015-09-12 00:08 - 2015-09-12 01:15 - 00098520 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-09-12 00:07 - 2015-09-12 00:07 - 00001056 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-09-12 00:07 - 2015-09-12 00:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-09-12 00:07 - 2015-09-12 00:07 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-09-12 00:07 - 2015-09-12 00:07 - 00000000 ____D C:\Program Files\ Malwarebytes Anti-Malware
2015-09-12 00:07 - 2015-06-18 08:41 - 00094936 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2015-09-12 00:07 - 2015-06-18 08:41 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2015-09-12 00:07 - 2015-06-18 08:41 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2015-09-12 00:04 - 2015-09-12 00:04 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Lya\Desktop\mbam-setup-2.1.8.1057.exe
2015-09-11 00:47 - 2015-09-11 00:47 - 00037273 _____ C:\Users\Lya\Desktop\ComboFix.txt
2015-09-11 00:08 - 2011-06-26 08:45 - 00256000 _____ C:\windows\PEV.exe
2015-09-11 00:08 - 2010-11-07 19:20 - 00208896 _____ C:\windows\MBR.exe
2015-09-11 00:08 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2015-09-11 00:08 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2015-09-11 00:08 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2015-09-11 00:08 - 2000-08-31 02:00 - 00098816 _____ C:\windows\sed.exe
2015-09-11 00:08 - 2000-08-31 02:00 - 00080412 _____ C:\windows\grep.exe
2015-09-11 00:08 - 2000-08-31 02:00 - 00068096 _____ C:\windows\zip.exe
2015-09-11 00:06 - 2015-09-11 00:47 - 00000000 ____D C:\Qoobox
2015-09-11 00:05 - 2015-09-12 01:02 - 00000000 ____D C:\windows\erdnt
2015-09-11 00:03 - 2015-09-11 00:04 - 05635119 ____R (Swearware) C:\Users\Lya\Desktop\ComboFix.exe
2015-09-10 22:45 - 2015-09-10 22:45 - 00001218 _____ C:\Users\Lya\Desktop\Revo Uninstaller.lnk
2015-09-10 22:45 - 2015-09-10 22:45 - 00000000 ____D C:\Program Files\VS Revo Group
2015-09-10 22:44 - 2015-09-10 22:44 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Lya\Desktop\revosetup95.exe
2015-09-10 22:41 - 2015-09-10 22:41 - 00000781 _____ C:\Users\Lya\Desktop\Paola - Shortcut.lnk
2015-09-10 01:11 - 2015-09-10 01:11 - 00000000 ____D C:\Users\Lya\AppData\Local\AVG Web TuneUp
2015-09-10 01:10 - 2015-09-10 01:11 - 00000000 ____D C:\ProgramData\AVG Web TuneUp
2015-09-10 01:10 - 2015-09-10 01:10 - 00000000 ____D C:\Program Files\AVG Web TuneUp
2015-09-09 10:51 - 2015-09-02 04:48 - 00070656 _____ (Microsoft Corporation) C:\windows\system32\fontsub.dll
2015-09-09 10:51 - 2015-09-02 04:48 - 00034304 _____ (Adobe Systems) C:\windows\system32\atmlib.dll
2015-09-09 10:51 - 2015-09-02 04:48 - 00026624 _____ (Microsoft Corporation) C:\windows\system32\lpk.dll
2015-09-09 10:51 - 2015-09-02 04:48 - 00010240 _____ (Microsoft Corporation) C:\windows\system32\dciman32.dll
2015-09-09 10:51 - 2015-09-02 03:36 - 02384896 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2015-09-09 10:51 - 2015-09-02 03:33 - 00299520 _____ (Adobe Systems Incorporated) C:\windows\system32\atmfd.dll
2015-09-09 10:51 - 2015-08-27 19:58 - 01391104 _____ (Microsoft Corporation) C:\windows\system32\msxml6.dll
2015-09-09 10:51 - 2015-08-27 19:58 - 01241088 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll
2015-09-09 10:51 - 2015-08-27 19:51 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml6r.dll
2015-09-09 10:51 - 2015-08-27 19:51 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml3r.dll
2015-09-09 10:51 - 2015-08-05 19:41 - 00751104 _____ (Microsoft Corporation) C:\windows\system32\schedsvc.dll
2015-09-09 10:51 - 2015-08-05 19:40 - 00216064 _____ (Microsoft Corporation) C:\windows\system32\InkEd.dll
2015-09-09 10:51 - 2015-08-05 19:40 - 00019968 _____ (Microsoft Corporation) C:\windows\system32\jnwmon.dll
2015-09-09 10:51 - 2015-08-04 19:48 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\setbcdlocale.dll
2015-09-09 10:51 - 2015-08-04 19:47 - 00050688 _____ (Microsoft Corporation) C:\windows\system32\appidapi.dll
2015-09-09 10:51 - 2015-08-04 19:47 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\appidsvc.dll
2015-09-09 10:51 - 2015-08-04 19:46 - 00096768 _____ (Microsoft Corporation) C:\windows\system32\appidpolicyconverter.exe
2015-09-09 10:51 - 2015-08-04 19:46 - 00016896 _____ (Microsoft Corporation) C:\windows\system32\appidcertstorecheck.exe
2015-09-09 10:51 - 2015-08-04 18:53 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\Drivers\appid.sys
2015-09-09 10:50 - 2015-08-18 03:14 - 00344168 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2015-09-09 10:50 - 2015-08-15 08:06 - 19856896 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-09-09 10:50 - 2015-08-15 07:53 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2015-09-09 10:50 - 2015-08-15 07:53 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2015-09-09 10:50 - 2015-08-15 07:40 - 00504832 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-09-09 10:50 - 2015-08-15 07:40 - 00062464 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2015-09-09 10:50 - 2015-08-15 07:39 - 00341504 _____ (Microsoft Corporation) C:\windows\system32\html.iec
2015-09-09 10:50 - 2015-08-15 07:39 - 00047616 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2015-09-09 10:50 - 2015-08-15 07:38 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2015-09-09 10:50 - 2015-08-15 07:35 - 02279424 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2015-09-09 10:50 - 2015-08-15 07:33 - 00047104 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2015-09-09 10:50 - 2015-08-15 07:32 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2015-09-09 10:50 - 2015-08-15 07:30 - 00479232 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2015-09-09 10:50 - 2015-08-15 07:29 - 00665600 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2015-09-09 10:50 - 2015-08-15 07:29 - 00620032 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2015-09-09 10:50 - 2015-08-15 07:29 - 00115712 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2015-09-09 10:50 - 2015-08-15 07:29 - 00102912 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2015-09-09 10:50 - 2015-08-15 07:24 - 00667648 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2015-09-09 10:50 - 2015-08-15 07:21 - 00418304 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2015-09-09 10:50 - 2015-08-15 07:16 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2015-09-09 10:50 - 2015-08-15 07:14 - 00168960 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2015-09-09 10:50 - 2015-08-15 07:12 - 00076288 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2015-09-09 10:50 - 2015-08-15 07:11 - 00285696 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2015-09-09 10:50 - 2015-08-15 07:10 - 04520448 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-09-09 10:50 - 2015-08-15 07:04 - 12857344 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-09-09 10:50 - 2015-08-15 07:02 - 00689152 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-09-09 10:50 - 2015-08-15 07:02 - 00685568 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2015-09-09 10:50 - 2015-08-15 07:01 - 02052608 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2015-09-09 10:50 - 2015-08-15 07:01 - 01155072 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2015-09-09 10:50 - 2015-08-15 06:43 - 01951232 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-09-09 10:50 - 2015-08-15 06:39 - 01310720 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-09-09 10:50 - 2015-08-15 06:37 - 00710144 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2015-09-09 10:50 - 2015-07-22 19:57 - 03989952 _____ (Microsoft Corporation) C:\windows\system32\ntkrnlpa.exe
2015-09-09 10:50 - 2015-07-22 19:57 - 03934656 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-09-09 10:50 - 2015-07-22 19:57 - 00137664 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2015-09-09 10:50 - 2015-07-22 19:57 - 00067520 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2015-09-09 10:50 - 2015-07-22 19:54 - 01308160 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 01061376 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00937984 _____ (Microsoft Corporation) C:\windows\system32\diagtrack.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00655360 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00641536 _____ (Microsoft Corporation) C:\windows\system32\advapi32.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00635392 _____ (Microsoft Corporation) C:\windows\system32\tdh.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00552960 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00400896 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00259584 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00248832 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00221184 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00172032 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00100352 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00065536 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00043008 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00038912 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00036864 _____ (Microsoft Corporation) C:\windows\system32\cryptbase.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00017408 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00015872 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2015-09-09 10:50 - 2015-07-22 19:52 - 00262656 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
2015-09-09 10:50 - 2015-07-22 19:52 - 00069632 _____ (Microsoft Corporation) C:\windows\system32\smss.exe
2015-09-09 10:50 - 2015-07-22 19:52 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe
2015-09-09 10:50 - 2015-07-22 19:52 - 00022528 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2015-09-09 10:50 - 2015-07-22 19:47 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll
2015-09-09 10:50 - 2015-07-22 19:46 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2015-09-09 10:50 - 2015-07-22 19:42 - 00686080 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2015-09-09 10:50 - 2015-07-22 19:42 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll
2015-09-09 10:50 - 2015-07-22 18:38 - 00041984 _____ (Microsoft Corporation) C:\windows\system32\UtcResources.dll
2015-09-09 10:50 - 2015-07-22 18:34 - 00225792 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb10.sys
2015-09-09 10:50 - 2015-07-22 18:34 - 00098304 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb20.sys
2015-09-09 10:50 - 2015-07-22 18:33 - 00124416 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb.sys
2015-09-09 10:50 - 2015-07-09 19:42 - 01372160 _____ (Microsoft Corporation) C:\windows\system32\dwmcore.dll
2015-09-09 10:50 - 2015-07-09 19:42 - 00067584 _____ (Microsoft Corporation) C:\windows\system32\dwmapi.dll
2015-09-09 10:49 - 2015-08-26 19:56 - 02953728 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2015-09-09 10:49 - 2015-08-26 19:56 - 02061824 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2015-09-09 10:49 - 2015-08-26 19:56 - 00566784 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2015-09-09 10:49 - 2015-08-26 19:56 - 00173056 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
2015-09-09 10:49 - 2015-08-26 19:56 - 00093184 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2015-09-09 10:49 - 2015-08-26 19:56 - 00035840 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll
2015-09-09 10:49 - 2015-08-26 19:56 - 00030208 _____ (Microsoft Corporation) C:\windows\system32\wups.dll
2015-09-09 10:49 - 2015-08-26 19:55 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2015-09-09 10:49 - 2015-08-26 19:55 - 00073728 _____ (Microsoft Corporation) C:\windows\system32\WinSetupUI.dll
2015-09-09 10:49 - 2015-08-26 19:55 - 00034816 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
2015-09-09 10:49 - 2015-08-26 19:55 - 00011776 _____ (Microsoft Corporation) C:\windows\system32\wu.upgrade.ps.dll
2015-09-09 10:49 - 2015-07-15 04:54 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
2015-09-09 10:49 - 2015-06-25 11:48 - 00105408 _____ (Microsoft Corporation) C:\windows\system32\consent.exe
2015-09-09 10:49 - 2015-06-25 11:44 - 01805824 _____ (Microsoft Corporation) C:\windows\system32\authui.dll
2015-09-09 10:49 - 2015-06-25 11:44 - 00047104 _____ (Microsoft Corporation) C:\windows\system32\appinfo.dll
2015-09-08 23:58 - 2015-09-08 23:59 - 00288550 _____ C:\Users\Lya\Desktop\Trojaner-board post.txt
2015-09-08 22:57 - 2015-09-08 22:57 - 00064492 _____ C:\Users\Lya\Desktop\gmer.txt
2015-09-08 12:38 - 2015-09-08 12:38 - 00131072 _____ C:\windows\Minidump\090815-57891-01.dmp
2015-09-08 08:42 - 2015-09-08 08:42 - 00104960 _____ (GMER) C:\fxldapow.sys
2015-09-08 08:36 - 2015-09-08 08:37 - 00131072 _____ C:\windows\Minidump\090815-46893-01.dmp
2015-09-07 23:50 - 2015-09-09 11:29 - 00057728 _____ C:\Users\Lya\Desktop\Addition.txt
2015-09-07 23:49 - 2015-09-12 02:05 - 00028827 _____ C:\Users\Lya\Desktop\FRST.txt
2015-09-07 23:48 - 2015-09-12 02:06 - 00000000 ____D C:\FRST
2015-09-07 23:46 - 2015-09-07 23:47 - 00000526 _____ C:\Users\Lya\Desktop\defogger_disable.log
2015-09-07 23:46 - 2015-09-07 23:46 - 00000000 _____ C:\Users\Lya\defogger_reenable
2015-09-07 21:10 - 2015-09-07 21:10 - 00380416 _____ C:\Users\Lya\Desktop\Gmer-19357.exe
2015-09-07 21:09 - 2015-09-12 02:05 - 01692672 _____ (Farbar) C:\Users\Lya\Desktop\FRST.exe
2015-09-07 21:02 - 2015-09-07 21:02 - 00050477 _____ C:\Users\Lya\Desktop\Defogger.exe
2015-09-06 01:04 - 2015-09-06 01:04 - 00001874 ___RS C:\Users\Lya\Desktop\LGМоbile Suрроrt Toоl.lnk
2015-09-06 01:04 - 2015-09-06 01:04 - 00001425 ___RS C:\Users\Lya\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Intеrnet Eхplоrer.lnk
2015-09-06 01:04 - 2015-09-06 01:04 - 00001227 ___RS C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Мozilla Firеfоx.lnk
2015-09-06 01:04 - 2015-09-06 01:04 - 00001181 ___RS C:\Users\Lya\Desktop\Gооglе Chrоmе.lnk
2015-09-05 16:28 - 2015-09-05 16:28 - 00597338 _____ C:\Users\Lya\Downloads\FRITZ.Box 7330 SL (UI) 116.06.30_05.09.15_1628.export
2015-09-05 16:26 - 2015-09-05 16:26 - 00190087 _____ C:\Users\Lya\Downloads\FRITZ.Box Fon WLAN 7390 84.06.30_05.09.15_1626.export
2015-09-02 22:23 - 2015-09-02 22:23 - 00000000 ____D C:\Users\Lya\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-09-02 21:44 - 2015-09-10 01:11 - 00000000 ____D C:\Program Files\Mozilla Firefox
2015-08-23 19:24 - 2015-09-12 01:59 - 00000312 _____ C:\windows\Tasks\HPCeeScheduleForLya.job
2015-08-23 19:17 - 2015-09-08 12:38 - 366280212 _____ C:\windows\MEMORY.DMP
2015-08-23 19:17 - 2015-08-23 19:17 - 00235008 _____ C:\windows\Minidump\082315-43430-01.dmp
2015-08-22 19:36 - 2015-08-22 19:36 - 03007048 _____ (AVM Berlin ) C:\Users\Lya\Downloads\FRITZ!BoxMonitor_1_02_05.exe
2015-08-13 07:28 - 2015-07-30 15:13 - 00103120 _____ (Microsoft Corporation) C:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-09-12 02:05 - 2009-07-14 06:34 - 00025648 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-09-12 02:05 - 2009-07-14 06:34 - 00025648 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-09-12 02:02 - 2010-06-07 16:43 - 00782510 _____ C:\windows\system32\PerfStringBackup.INI
2015-09-12 01:59 - 2013-02-01 00:31 - 00000000 ___RD C:\Users\Lya\Dropbox
2015-09-12 01:59 - 2013-02-01 00:27 - 00000000 ____D C:\Users\Lya\AppData\Roaming\Dropbox
2015-09-12 01:58 - 2013-06-18 23:28 - 00000000 ____D C:\Users\Lya\AppData\Local\Apps\2.0
2015-09-12 01:58 - 2009-07-14 06:39 - 00158060 _____ C:\windows\setupact.log
2015-09-12 01:57 - 2010-06-07 16:56 - 00000000 ____D C:\ProgramData\HPQLOG
2015-09-12 01:56 - 2011-02-08 11:05 - 00000000 ____D C:\Users\Lya\AppData\Roaming\Skype
2015-09-12 01:55 - 2011-02-08 11:06 - 00001094 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-09-12 01:55 - 2009-07-14 06:53 - 00000006 ____H C:\windows\Tasks\SA.DAT
2015-09-12 01:54 - 2010-06-26 12:39 - 01239157 _____ C:\windows\WindowsUpdate.log
2015-09-12 01:44 - 2013-01-05 12:03 - 00000830 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2015-09-12 01:31 - 2013-01-05 12:05 - 00002189 ____H C:\Users\Lya\Desktop\Google Chrome.lnk
2015-09-12 01:31 - 2010-10-29 15:33 - 00273072 _____ C:\windows\PFRO.log
2015-09-12 01:27 - 2011-02-07 14:10 - 00000000 ____D C:\Users\Lya
2015-09-12 01:20 - 2015-06-20 01:43 - 00001216 _____ C:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-430462746-378290837-44786878-1003UA.job
2015-09-12 01:17 - 2011-02-08 11:06 - 00001098 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-09-11 23:05 - 2012-06-22 18:46 - 00000000 ____D C:\ProgramData\MFAData
2015-09-11 15:20 - 2015-06-20 01:43 - 00001164 _____ C:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-430462746-378290837-44786878-1003Core.job
2015-09-11 09:36 - 2014-11-15 15:05 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-09-11 09:36 - 2014-11-15 14:59 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-09-11 00:47 - 2009-07-14 04:37 - 00000000 __RHD C:\Users\Default
2015-09-11 00:47 - 2009-07-14 04:37 - 00000000 ___RD C:\Users\Public
2015-09-11 00:37 - 2009-07-14 04:04 - 00000215 _____ C:\windows\system.ini
2015-09-11 00:29 - 2011-10-08 17:16 - 00000000 __SHD C:\Users\Lya\AppData\Local\95c8f457
2015-09-10 23:59 - 2011-10-02 11:33 - 00000000 ____D C:\Program Files\SCHLECKER
2015-09-10 23:54 - 2012-04-15 14:44 - 00000000 ____D C:\ProgramData\Lexware
2015-09-10 23:54 - 2012-03-19 00:25 - 00000000 ____D C:\Program Files\Common Files\Lexware
2015-09-10 23:39 - 2012-04-15 14:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lexware
2015-09-10 23:39 - 2012-04-15 14:44 - 00000000 ____D C:\Program Files\Lexware
2015-09-10 22:33 - 2009-07-14 04:37 - 00000000 ____D C:\windows\system32\NDF
2015-09-10 10:18 - 2009-07-14 04:37 - 00000000 ____D C:\windows\rescache
2015-09-10 09:14 - 2009-07-14 06:33 - 00472848 _____ C:\windows\system32\FNTCACHE.DAT
2015-09-10 09:08 - 2010-04-25 22:36 - 00000000 ____D C:\Program Files\Windows Journal
2015-09-10 08:59 - 2009-07-14 04:37 - 00000000 ____D C:\windows\Microsoft.NET
2015-09-10 08:56 - 2009-07-14 04:04 - 00000478 _____ C:\windows\win.ini
2015-09-10 08:46 - 2013-08-01 08:14 - 00000000 ____D C:\windows\system32\MRT
2015-09-09 22:51 - 2014-11-06 23:15 - 00000000 ____D C:\Users\Lya\AppData\Roaming\HpUpdate
2015-09-09 00:56 - 2010-06-07 16:56 - 00000000 ____D C:\ProgramData\PDFC
2015-09-08 12:44 - 2015-01-27 00:19 - 00000000 ____D C:\Program Files\BubbleUPnP Server
2015-09-08 12:38 - 2013-03-25 10:46 - 00000000 ____D C:\windows\Minidump
2015-09-08 08:36 - 2012-05-06 14:01 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2015-09-06 01:04 - 2013-12-30 01:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LGMobile Support Tool
2015-09-06 01:04 - 2013-01-05 12:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-09-06 01:04 - 2010-06-07 17:18 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LightScribe Direct Disc Labeling
2015-09-05 10:40 - 2011-02-12 12:04 - 00000052 _____ C:\windows\system32\DOErrors.log
2015-09-03 15:37 - 2012-04-28 00:48 - 00000000 ____D C:\Users\Lya\Documents\Lya´s folder
2015-08-26 18:36 - 2011-07-24 21:30 - 132039072 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-08-20 08:18 - 2010-04-25 10:41 - 00000000 ____D C:\windows\Panther
2015-08-20 08:14 - 2015-07-10 13:17 - 00000000 ____D C:\$Windows.~BT
2015-08-18 06:46 - 2014-10-29 23:43 - 00000935 _____ C:\Users\Public\Desktop\AVG 2015.lnk
2015-08-18 06:46 - 2013-11-14 21:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-08-13 11:05 - 2011-02-07 14:44 - 00000000 ___RD C:\Users\Lya\Virtual Machines
2015-08-13 11:03 - 2014-08-27 01:17 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-08-13 10:59 - 2014-12-13 16:36 - 00000000 ____D C:\windows\system32\appraiser
2015-08-13 10:59 - 2014-05-01 00:00 - 00000000 ___SD C:\windows\system32\CompatTel
2015-08-13 10:41 - 2014-08-27 01:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
==================== Files in the root of some directories =======
2013-06-26 15:11 - 2014-06-24 12:19 - 0003728 _____ () C:\Program Files\Mozilla Firefoxavg-secure-search.xml
2011-05-22 17:22 - 2011-05-22 17:22 - 0001849 _____ () C:\Users\Lya\AppData\Roaming\GhostObjGAFix.xml
2011-08-02 19:57 - 2011-08-03 21:16 - 0000047 _____ () C:\Users\Lya\AppData\Local\Images.fl
2013-06-14 22:54 - 2013-10-06 20:14 - 0001516 _____ () C:\Users\Lya\AppData\Local\MiniAssist.ini
2013-06-14 22:54 - 2013-06-14 22:54 - 0001516 _____ () C:\Users\Lya\AppData\Local\MiniAssist.ini.bak
2013-06-14 22:54 - 2013-10-08 08:16 - 0007506 _____ () C:\Users\Lya\AppData\Local\MiniAssist.log
2011-10-01 15:33 - 2011-10-01 15:33 - 0007608 _____ () C:\Users\Lya\AppData\Local\Resmon.ResmonCfg
2013-06-05 01:17 - 2013-06-05 01:17 - 0000041 ___SH () C:\ProgramData\.zreglib
2011-02-08 11:13 - 2011-02-08 11:13 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2011-03-28 01:09 - 2011-03-28 01:09 - 0000848 ___SH () C:\ProgramData\KGyGaAvL.sys
ZeroAccess:
C:\Users\Lya\AppData\Local\95c8f457
C:\Users\Lya\AppData\Local\95c8f457\@
Some files in TEMP:
====================
C:\Users\Lya\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpezcj4b.dll
C:\Users\Lya\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\dnsapi.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-09-11 11:28
==================== End of FRST.txt ============================
--- --- --- Hallo, Die Startseite kann ich jetzt ändern, aber das Programm Icon von Firefox und Internetexplorer sind jetzt auch weg. Kannst du mir da weiterhelfen, wie ich die wieder zuordnen kann? Vielen dank Wolfgang |
|
12.09.2015, 14:15
| #11 |
| /// the machine /// TB-Ausbilder | Windows 7: gotut.ru als Startseite beim Firefox, IExplorer und crome Du meinst jetzt die Icons auf dem Desktop?? ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
12.09.2015, 21:08
| #12 |
| | icon Hallo, die icons auf der Taskleiste zwischen Teamviewer und Paint sind Firefox, Internetexplorer und Chrome. Der rest kommt dann auch... Danke |
|
13.09.2015, 01:31
| #13 |
| | Windows 7: gotut.ru als Startseite beim Firefox, IExplorer und cromeCode:
ATTFilter C:\Program Files\Google\Chrome\Application\39.0.2171.95\chrome.dll Win32/Patched.NFQ Trojaner
C:\Qoobox\Quarantine\C\Users\Lya\AppData\Local\95c8f457\U\80000000.@.vir Variante von Win32/Sirefef.DV Trojaner
C:\Qoobox\Quarantine\C\Users\Lya\AppData\Local\Google\Chrome\User Data\Default\Extensions\idknbmbdnapjicclomlijcgfpikmndhd\123\content.js.vir JS/Adware.MultiPlug.B Anwendung
C:\Qoobox\Quarantine\C\Users\Lya\Videos\iLividSetup-r0-n-bi.exe.vir Win32/Toolbar.SearchSuite evtl. unerwünschte Anwendung
C:\Qoobox\Quarantine\C\Windows\System32\roboot.exe.vir Variante von Win32/Systweak.A evtl. unerwünschte Anwendung
C:\Users\Lya\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\134554d0-3882d842 Variante von Java/Agent.DU Trojaner
C:\Users\Lya\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24\dfe2818-247b857f Java/Exploit.Agent.NBV Trojaner
C:\Users\Lya\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\451d1fdf-69e7da8c Mehrere Bedrohungen
C:\Users\Lya\Desktop\light_image_resizer4_setup_4.0.8.0d_linkular.exe Win32/Adware.Linkular.AB Anwendung
C:\Users\Lya\Desktop\Downloads\uhr.exe Variante von Win32/DownloadSponsor.B evtl. unerwünschte Anwendung
C:\Wolfgang\Renault englisch\Renault Megane Scenic Service Manual En(0).rar Win32/Kapucen.NAM Wurm
C:\Wolfgang\Renault englisch\renault_megane_scenic_service_manual_en.zip Variante von Win32/Agent.OMV Trojaner
C:\Wolfgang\ZipRar\biodiesel book diesel generator energy free energy system gas generator information stirling engine power electricity solar generator.zip Variante von Win32/TrojanClicker.Delf.NNQ Trojaner
C:\Wolfgang\ZipRar\completely free energy magniwork power generator.zip Variante von Win32/Agent.WRY Trojaner
C:\Wolfgang\ZipRar\Full Plans(English) Free Energy,Plans Complets Énergie Libre,Tesla,Surunité,Révolutioniscoming By Peruperuperu!!(1) updated-fixed 06-2007.rar Win32/Kapucen.B Wurm
Log.txt Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=2370fe1901bdf647bde1c7dc0ddd6db3
# end=init
# utc_time=2015-09-12 08:15:56
# local_time=2015-09-12 10:15:56 (+0100, W. Europe Daylight Time)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
Update Init
Update Download
Update Finalize
Updated modules version: 25732
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=2370fe1901bdf647bde1c7dc0ddd6db3
# end=updated
# utc_time=2015-09-12 08:20:56
# local_time=2015-09-12 10:20:56 (+0100, W. Europe Daylight Time)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=2370fe1901bdf647bde1c7dc0ddd6db3
# engine=25732
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-09-12 11:10:35
# local_time=2015-09-13 01:10:35 (+0100, W. Europe Daylight Time)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='AVG AntiVirus Free Edition 2015'
# compatibility_mode=1055 16777213 100 100 49512 129229819 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 68482456 193730626 0 0
# scanned=471944
# found=15
# cleaned=0
# scan_time=10179
sh=E978937AC7FAAC9A69609B2A4A3B8E2D43466DF9 ft=1 fh=b7b8c96c17c22525 vn="Win32/Patched.NFQ Trojaner" ac=I fn="C:\Program Files\Google\Chrome\Application\39.0.2171.95\chrome.dll"
sh=E3176F39FB39DD46DDF6F70E4329A9AEB539CF0E ft=1 fh=739f5a826c903025 vn="Variante von Win32/Sirefef.DV Trojaner" ac=I fn="C:\Qoobox\Quarantine\C\Users\Lya\AppData\Local\95c8f457\U\80000000.@.vir"
sh=C4575D836FFC319C7FBFE7E38981E83980D6DE2B ft=0 fh=0000000000000000 vn="JS/Adware.MultiPlug.B Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Lya\AppData\Local\Google\Chrome\User Data\Default\Extensions\idknbmbdnapjicclomlijcgfpikmndhd\123\content.js.vir"
sh=D08BD350E0531B2DDDC4E81A69B001B2D0550003 ft=1 fh=f6585e7df79a84bc vn="Win32/Toolbar.SearchSuite evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Lya\Videos\iLividSetup-r0-n-bi.exe.vir"
sh=035AA67A5CAB31D980D23CEE3A818676D5597818 ft=1 fh=6ab57b98dcd244fa vn="Variante von Win32/Systweak.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Windows\System32\roboot.exe.vir"
sh=E6698B36FC4034B2B79C9B75D37DF003756406EB ft=0 fh=0000000000000000 vn="Variante von Java/Agent.DU Trojaner" ac=I fn="C:\Users\Lya\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\134554d0-3882d842"
sh=98A4AF5952E0BE5C594B54E2F2FE8E862653AB11 ft=0 fh=0000000000000000 vn="Java/Exploit.Agent.NBV Trojaner" ac=I fn="C:\Users\Lya\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24\dfe2818-247b857f"
sh=97C06D980035D3B3A78BA82B0B5273244C32D830 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\Lya\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\451d1fdf-69e7da8c"
sh=DDC1BFE11195C1A1A06B529CB5A1823FEDE4AD96 ft=1 fh=0e442f1f8db42694 vn="Win32/Adware.Linkular.AB Anwendung" ac=I fn="C:\Users\Lya\Desktop\light_image_resizer4_setup_4.0.8.0d_linkular.exe"
sh=109803F4FA90B4C085A8919BC14EC5265048B2AD ft=1 fh=77b67014c21a5d01 vn="Variante von Win32/DownloadSponsor.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Lya\Desktop\Downloads\uhr.exe"
sh=87DAF77FE3C503600FB399ADD8F2A6E98E0B0F78 ft=0 fh=0000000000000000 vn="Win32/Kapucen.NAM Wurm" ac=I fn="C:\Wolfgang\Renault englisch\Renault Megane Scenic Service Manual En(0).rar"
sh=17D10AC5D46166F3D36738889E9AEFD284427497 ft=0 fh=0000000000000000 vn="Variante von Win32/Agent.OMV Trojaner" ac=I fn="C:\Wolfgang\Renault englisch\renault_megane_scenic_service_manual_en.zip"
sh=028A67ED3567E8169C821003A54C80B478E07065 ft=0 fh=0000000000000000 vn="Variante von Win32/TrojanClicker.Delf.NNQ Trojaner" ac=I fn="C:\Wolfgang\ZipRar\biodiesel book diesel generator energy free energy system gas generator information stirling engine power electricity solar generator.zip"
sh=328BE71A93981754CA52638698086688C6EE997B ft=0 fh=0000000000000000 vn="Variante von Win32/Agent.WRY Trojaner" ac=I fn="C:\Wolfgang\ZipRar\completely free energy magniwork power generator.zip"
sh=E15C8A8E32809C1564BDB39031AE11384B193C22 ft=0 fh=0000000000000000 vn="Win32/Kapucen.B Wurm" ac=I fn="C:\Wolfgang\ZipRar\Full Plans(English) Free Energy,Plans Complets Énergie Libre,Tesla,Surunité,Révolutioniscoming By Peruperuperu!!(1) updated-fixed 06-2007.rar"
Code:
ATTFilter Results of screen317's Security Check version 1.008
Windows 7 Service Pack 1 x86 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
AVG AntiVirus Free Edition 2015
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
AVG Web TuneUp
Java 7 Update 51
Java version 32-bit out of Date!
Adobe Flash Player 18.0.0.232
Adobe Reader 10.1.9 Adobe Reader out of Date!
Mozilla Firefox (40.0.3)
Google Chrome 39.0.2171.95 Google Chrome out of date!
````````Process Check: objlist.exe by Laurent````````
AVG avgwdsvc.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:12-09-2015
Ran by Lya (administrator) on LYA-HP (13-09-2015 02:29:07)
Running from C:\Users\Lya\Desktop
Loaded Profiles: Lya (Available Profiles: Lya)
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgcsrvx.exe
() C:\Program Files\AVG Web TuneUp\WtuSystemSupport.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe
(McAfee, Inc.) C:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AEstSrv.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agrsmsvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgwdsvc.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\avmike.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\certsrv.exe
(HP) C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgnsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgemcx.exe
(Hewlett-Packard Development Company, L.P) C:\Program Files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP HotKey Support\QLBController.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\File Sanitizer\coreshredder.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP QuickLook\HPDayStarterService.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(SlySoft, Inc.) C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
(Elaborate Bytes AG) C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
() C:\Program Files\1&1 Surf-Stick\UIExec.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe
(PDF Complete Inc) C:\Program Files\PDF Complete\pdfsvc.exe
(Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgui.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
(TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
() C:\Program Files\1&1 Internet-Radio-Player\phonostarTimer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Dropbox, Inc.) C:\Users\Lya\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE
(ArcSoft, Inc.) C:\Windows\System32\uArcCapture.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\mspaint.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgrsx.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [QLBController] => C:\Program Files\Hewlett-Packard\HP HotKey Support\QLBController.exe [256056 2010-03-01] (Hewlett-Packard Company)
HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-08-25] (Intel Corporation)
HKLM\...\Run: [HPPowerAssistant] => C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe [1690680 2009-12-16] (Hewlett-Packard)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1791272 2010-06-04] (Synaptics Incorporated)
HKLM\...\Run: [HPWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-04-05] (Hewlett-Packard)
HKLM\...\Run: [File Sanitizer] => C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe [11265536 2009-12-12] (Hewlett-Packard)
HKLM\...\Run: [DTRun] => c:\Program Files\ArcSoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe [518656 2009-11-19] (ArcSoft Inc.)
HKLM\...\Run: [NortonOnlineBackupReminder] => C:\Program Files\Symantec\Norton Online Backup\Activation\NobuActivation.exe [600936 2009-06-29] (Symantec Corporation)
HKLM\...\Run: [PDF Complete] => C:\Program Files\PDF Complete\pdfsty.exe [563736 2009-10-23] (PDF Complete Inc)
HKLM\...\Run: [Windows Mobile Device Center] => C:\windows\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray.exe [495708 2011-08-06] (IDT, Inc.)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-01-20] (Apple Inc.)
HKLM\...\Run: [AppleSyncNotifier] => C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [58656 2011-04-20] (Apple Inc.)
HKLM\...\Run: [CloneCDTray] => C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe [57344 2009-01-30] (SlySoft, Inc.)
HKLM\...\Run: [VirtualCloneDrive] => C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.)
HKLM\...\Run: [UIExec] => C:\Program Files\1&1 Surf-Stick\UIExec.exe [153424 2011-08-25] ()
HKLM\...\Run: [AVG_UI] => C:\Program Files\AVG\AVG2015\avgui.exe [3780520 2015-07-31] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [ToolboxFX] => C:\Program Files\HP\ToolboxFX\bin\HPTLBXFX.exe [58936 2010-10-25] (Hewlett-Packard Company)
HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)
Winlogon\Notify\DeviceNP: C:\windows\system32\DeviceNP.dll [2009-11-17] (Hewlett-Packard Limited)
HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Run: [HPADVISOR] => C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe [1685048 2009-09-30] (Hewlett-Packard)
HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Run: [LightScribe Control Panel] => C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2009-06-17] (Hewlett-Packard Company)
HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2011-02-08] (Google Inc.)
HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Run: [TomTomHOME.exe] => C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-03-22] (TomTom)
HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [53282944 2015-06-29] (Skype Technologies S.A.)
HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Run: [1&1 Internet-Radio-PlayerTimer] => C:\Program Files\1&1 Internet-Radio-Player\phonostarTimer.exe [42496 2014-12-04] ()
HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Run: [Dropbox Update] => C:\Users\Lya\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-20] (Dropbox, Inc.)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\windows\System32\SPReview\SPReview.exe [280576 2013-03-31] (Microsoft Corporation)
Lsa: [Notification Packages] DPPassFilter scecli
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lya\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lya\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lya\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-14] (Dropbox, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2010-06-26]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\Lya\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2014-11-17]
ShortcutTarget: Dropbox.lnk -> C:\Users\Lya\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Lya\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Enviar a OneNote.lnk [2015-01-09]
ShortcutTarget: Enviar a OneNote.lnk -> C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Lya\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk [2011-02-08]
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Winsock: Catalog5 06 C:\Program Files\Bonjour\mdnsNSP.dll [121704 2011-08-30] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.31.1
Tcpip\..\Interfaces\{C97CB71E-C566-44AA-8EB6-432FEFABE41E}: [DhcpNameServer] 192.168.31.1
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-430462746-378290837-44786878-1003\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-430462746-378290837-44786878-1003\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {3122535E-E748-4168-8EB4-87DB7EA63DF2} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
BHO: File Sanitizer for HP ProtectTools -> {3134413B-49B4-425C-98A5-893C1F195601} -> C:\Program Files\Hewlett-Packard\File Sanitizer\IEBHO.dll [2009-12-12] (Hewlett-Packard)
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-08-12] (Microsoft Corporation)
BHO: HP ProtectTools Security Manager Extension -> {395610AE-C624-4f58-B89E-23733EA00F9A} -> C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpOtsPluginIe8.dll [2011-05-02] (DigitalPersona, Inc.)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2013-12-18] (Oracle Corporation)
BHO: Windows Live Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22] (Microsoft Corporation)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-08-05] (Google Inc.)
BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2013-01-31] (Skype Technologies S.A.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-07-14] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2013-12-18] (Oracle Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)
Toolbar: HKLM - No Name - {0BF43445-2F28-4351-9252-17FE6E806AA0} - No File
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-08-05] (Google Inc.)
Toolbar: HKU\S-1-5-21-430462746-378290837-44786878-1003 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-08-05] (Google Inc.)
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll No File
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2015-02-17] (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2013-01-31] (Skype Technologies S.A.)
FireFox:
========
FF ProfilePath: C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-11] ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2013-12-18] ()
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll [2014-01-06] (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2013-12-18] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2013-12-18] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-03-31] (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-09-12] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-09-12] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2013-12-18] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-430462746-378290837-44786878-1003: @phonostar.de/1&1 Internet-Radio-Player -> C:\Program Files\1&1 Internet-Radio-Player\npphonostarDetectNP.dll [2012-11-21] ( )
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2015-03-31] (Microsoft Corporation)
FF Extension: preisspion.de - C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\Extensions\finder@meingutscheincode.de.xpi [2011-05-16]
FF Extension: yingBar - C:\Users\Lya\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\Extensions\{fae08409-991d-414c-8113-68f37760339a}.xpi [2015-07-26]
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2015-09-02]
FF HKLM\...\Firefox\Extensions: [otis@digitalpersona.com] - C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt
FF Extension: DigitalPersona Extension - C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt [2011-12-24]
FF HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Firefox\Extensions: [finder@meingutscheincode.de] - C:\Program Files\Mein Gutscheincode Finder\Firefox
FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\itms.js [2015-09-02]
Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\Lya\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Lya\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-09-12]
CHR Extension: (Skype Click to Call) - C:\Users\Lya\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2013-04-30]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Lya\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-09-12]
CHR HKLM\...\Chrome\Extension: [jgfpelakfkbbkkdchaaaknckhoadkcbo] - C:\Program Files\Mein Gutscheincode Finder\Chrome\chrome-extension.crx <not found>
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2013-01-31]
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [109056 2009-09-28] (ArcSoft Inc.)
R2 AgereModemAudio; C:\Program Files\LSI SoftModem\agrsmsvc.exe [14336 2009-11-02] (LSI Corporation)
R2 AVGIDSAgent; C:\Program Files\AVG\AVG2015\avgidsagent.exe [3633576 2015-07-31] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG2015\avgwdsvc.exe [335656 2015-07-31] (AVG Technologies CZ, s.r.o.)
R2 avmike; C:\Program Files\FRITZ!Fernzugang\avmike.exe [255904 2012-11-28] (AVM Berlin)
R2 certsrv; C:\Program Files\FRITZ!Fernzugang\certsrv.exe [122272 2012-11-28] (AVM Berlin)
R2 DpHost; C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [300880 2010-07-16] (DigitalPersona, Inc.)
S3 FLCDLOCK; c:\Windows\system32\flcdlock.exe [362040 2009-11-17] (Hewlett-Packard Ltd)
R2 HP LaserJet Service; C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe [145920 2010-10-25] (HP) [File not signed]
R2 HP Power Assistant Service; C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe [102968 2009-12-16] (Hewlett-Packard)
R2 HP ProtectTools Service; C:\Program Files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [32768 2010-10-19] (Hewlett-Packard Development Company, L.P) [File not signed]
R2 HP Wireless Assistant Service; C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [103992 2010-04-05] (Hewlett-Packard)
R2 HPDayStarterService; c:\Program Files\Hewlett-Packard\HP QuickLook\HPDayStarterService.exe [90112 2010-05-10] (Hewlett-Packard Company) [File not signed]
R2 HpFkCryptService; c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [281192 2009-12-16] (McAfee, Inc.)
R2 HPFSService; C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe [297984 2009-12-12] (Hewlett-Packard) [File not signed]
R2 hpHotkeyMonitor; C:\Program Files\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe [264248 2010-03-01] (Hewlett-Packard Company)
R2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [73728 2009-06-17] (Hewlett-Packard Company) [File not signed]
S2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 Net Driver HPZ12; C:\windows\system32\HPZinw12.dll [44032 2010-01-18] (Hewlett-Packard) [File not signed]
R2 nwtsrv; C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe [155488 2013-06-10] (AVM Berlin)
R2 pdfcDispatcher; C:\Program Files\PDF Complete\pdfsvc.exe [635416 2009-10-23] (PDF Complete Inc)
R2 Pml Driver HPZ12; C:\windows\system32\HPZipm12.dll [53760 2010-01-18] (Hewlett-Packard) [File not signed]
R2 STacSV; C:\Program Files\IDT\WDM\STacSV.exe [254034 2011-08-06] (IDT, Inc.)
R2 uArcCapture; C:\windows\system32\uArcCapture.exe [506472 2009-12-04] (ArcSoft, Inc.)
S2 UI Assistant Service; C:\Program Files\1&1 Surf-Stick\AssistantServices.exe [270672 2011-08-25] ()
S2 vcsFPService; C:\windows\system32\vcsFPService.exe [1664304 2010-02-18] (Validity Sensors, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
R2 WtuSystemSupport; C:\Program Files\AVG Web TuneUp\WtuSystemSupport.exe [1205136 2015-09-10] ()
S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [X]
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 Afc; C:\windows\System32\drivers\Afc.sys [18688 2006-11-11] (Arcsoft, Inc.)
S3 Andbus; C:\windows\System32\DRIVERS\lgandbus.sys [14336 2012-03-02] (LG Electronics Inc.)
S3 AndDiag; C:\windows\System32\DRIVERS\lganddiag.sys [20736 2012-03-02] (LG Electronics Inc.)
S3 AndGps; C:\windows\System32\DRIVERS\lgandgps.sys [20096 2012-03-02] (LG Electronics Inc.)
S3 ANDModem; C:\windows\System32\DRIVERS\lgandmodem.sys [25088 2012-03-02] (LG Electronics Inc.)
S3 androidusb; C:\windows\System32\Drivers\lgandadb.sys [25728 2012-03-02] (Google Inc)
R3 ARCVCAM; C:\windows\System32\DRIVERS\ArcSoftVCapture.sys [29824 2009-12-04] (ArcSoft, Inc.)
R3 athr; C:\windows\System32\DRIVERS\athr.sys [2957312 2012-06-20] (Qualcomm Atheros Communications, Inc.)
R1 Avgdiskx; C:\windows\System32\DRIVERS\avgdiskx.sys [132576 2015-03-11] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\windows\System32\DRIVERS\avgidsdriverx.sys [250288 2015-07-28] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\windows\System32\DRIVERS\avgidshx.sys [190944 2015-05-12] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\windows\System32\DRIVERS\avgidsshimx.sys [31664 2015-07-23] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\windows\System32\DRIVERS\avgldx86.sys [207328 2015-06-16] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\windows\System32\DRIVERS\avglogx.sys [290272 2015-05-07] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\windows\System32\DRIVERS\avgmfx86.sys [186800 2015-07-28] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\windows\System32\DRIVERS\avgrkx86.sys [35808 2015-03-20] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\windows\System32\DRIVERS\avgtdix.sys [213984 2015-05-12] (AVG Technologies CZ, s.r.o.)
R3 btwampfl; C:\windows\System32\drivers\btwampfl.sys [286248 2010-03-18] (Broadcom Corporation.)
S3 DAMDrv; C:\windows\System32\DRIVERS\DAMDrv.sys [32312 2009-10-21] (Hewlett-Packard Development Company L.P.)
R3 eapihdrv; C:\Users\Lya\AppData\Local\Temp\ehdrv.sys [135760 2015-09-12] (ESET)
R3 ElbyCDFL; C:\windows\System32\Drivers\ElbyCDFL.sys [34760 2007-02-16] (SlySoft, Inc.)
R1 ElbyCDIO; C:\windows\System32\Drivers\ElbyCDIO.sys [30616 2013-03-04] (Elaborate Bytes AG)
R1 ISODrive; C:\Program Files\UltraISO\drivers\ISODrive.sys [82320 2010-01-29] (EZB Systems, Inc.)
S3 massfilter; C:\windows\System32\drivers\massfilter.sys [9216 2011-03-26] (MBB Incorporated)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [23256 2015-06-18] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [51928 2015-06-18] (Malwarebytes Corporation)
S3 MfeAVFK; C:\windows\System32\drivers\MfeAVFK.sys [79816 2009-05-16] (McAfee, Inc.)
S3 MfeBOPK; C:\windows\System32\drivers\MfeBOPK.sys [35272 2009-05-16] (McAfee, Inc.)
R1 mfehidk; C:\windows\System32\drivers\mfehidk.sys [214024 2009-05-16] (McAfee, Inc.)
S3 MfeRKDK; C:\windows\System32\drivers\MfeRKDK.sys [34248 2009-05-16] (McAfee, Inc.)
R1 mfetdik; C:\windows\System32\drivers\mfetdik.sys [55336 2009-05-16] (McAfee, Inc.)
R2 NPF; C:\windows\System32\drivers\npf.sys [35088 2010-06-25] (CACE Technologies, Inc.)
R3 NWIM; C:\windows\System32\DRIVERS\avmnwim.sys [334712 2011-07-05] (AVM Berlin)
R1 RsvLock; C:\windows\system32\Drivers\RsvLock.sys [40088 2009-12-16] (McAfee, Inc.)
S3 s116bus; C:\windows\System32\DRIVERS\s116bus.sys [83336 2007-04-03] (MCCI Corporation)
S3 s116mdfl; C:\windows\System32\DRIVERS\s116mdfl.sys [15112 2007-04-03] (MCCI Corporation)
S3 s116mdm; C:\windows\System32\DRIVERS\s116mdm.sys [108680 2007-04-03] (MCCI Corporation)
S3 s116mgmt; C:\windows\System32\DRIVERS\s116mgmt.sys [100488 2007-04-03] (MCCI Corporation)
S3 s116nd5; C:\windows\System32\DRIVERS\s116nd5.sys [23176 2007-04-03] (MCCI Corporation)
S3 s116obex; C:\windows\System32\DRIVERS\s116obex.sys [98696 2007-04-03] (MCCI Corporation)
S3 s116unic; C:\windows\System32\DRIVERS\s116unic.sys [99080 2007-04-03] (MCCI Corporation)
R0 SafeBoot; C:\windows\system32\Drivers\SafeBoot.sys [110520 2009-12-16] () [File not signed]
R0 SbAlg; C:\windows\system32\Drivers\SbAlg.sys [51800 2009-12-16] (McAfee, Inc.)
R0 SbFsLock; C:\windows\system32\Drivers\SbFsLock.sys [13256 2009-12-16] (McAfee, Inc.)
R3 SNP2UVC; C:\windows\System32\DRIVERS\snp2uvc.sys [1763968 2009-12-19] ()
R3 vpcbus; C:\windows\System32\DRIVERS\vpchbus.sys [172416 2010-11-20] (Microsoft Corporation)
R1 vpcnfltr; C:\windows\System32\DRIVERS\vpcnfltr.sys [48128 2010-11-20] (Microsoft Corporation)
R3 vpcusb; C:\windows\System32\DRIVERS\vpcusb.sys [78336 2010-11-20] (Microsoft Corporation)
R1 vpcvmm; C:\windows\System32\drivers\vpcvmm.sys [296064 2010-11-20] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Lya\AppData\Local\Temp\catchme.sys [X]
U5 ewusbnet; C:\Windows\System32\Drivers\ewusbnet.sys [201168 2009-12-07] (Huawei Technologies Co., Ltd.)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-09-13 02:18 - 2015-09-13 02:18 - 00852704 _____ C:\Users\Lya\Desktop\SecurityCheck.exe
2015-09-13 02:12 - 2015-09-13 02:12 - 00003766 _____ C:\Users\Lya\Desktop\eset.txt
2015-09-12 22:57 - 2015-09-12 22:57 - 00001463 _____ C:\Users\Lya\Desktop\iexplore.exe - Shortcut.lnk
2015-09-12 22:15 - 2015-09-12 22:15 - 00000000 ____D C:\Program Files\ESET
2015-09-12 22:08 - 2015-09-12 22:08 - 02870984 _____ (ESET) C:\Users\Lya\Desktop\esetsmartinstaller_deu.exe
2015-09-12 02:05 - 2015-09-13 02:28 - 00000000 ____D C:\Users\Lya\Desktop\FRST-OlderVersion
2015-09-12 01:52 - 2015-09-12 01:52 - 00002328 _____ C:\Users\Lya\Desktop\JRT.txt
2015-09-12 01:21 - 2015-09-12 01:27 - 00000000 ____D C:\AdwCleaner
2015-09-12 01:16 - 2015-09-12 01:16 - 00062638 _____ C:\Users\Lya\Desktop\mbam.txt
2015-09-12 00:22 - 2015-09-12 00:22 - 01799392 _____ (Malwarebytes Corporation) C:\Users\Lya\Desktop\JRT_7600.exe
2015-09-12 00:20 - 2015-09-12 00:21 - 01660416 _____ C:\Users\Lya\Desktop\AdwCleaner_5.007.exe
2015-09-12 00:08 - 2015-09-12 01:15 - 00098520 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-09-12 00:07 - 2015-09-12 00:07 - 00001056 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-09-12 00:07 - 2015-09-12 00:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-09-12 00:07 - 2015-09-12 00:07 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-09-12 00:07 - 2015-09-12 00:07 - 00000000 ____D C:\Program Files\ Malwarebytes Anti-Malware
2015-09-12 00:07 - 2015-06-18 08:41 - 00094936 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2015-09-12 00:07 - 2015-06-18 08:41 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2015-09-12 00:07 - 2015-06-18 08:41 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2015-09-12 00:04 - 2015-09-12 00:04 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Lya\Desktop\mbam-setup-2.1.8.1057.exe
2015-09-11 00:47 - 2015-09-11 00:47 - 00037273 _____ C:\Users\Lya\Desktop\ComboFix.txt
2015-09-11 00:08 - 2011-06-26 08:45 - 00256000 _____ C:\windows\PEV.exe
2015-09-11 00:08 - 2010-11-07 19:20 - 00208896 _____ C:\windows\MBR.exe
2015-09-11 00:08 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2015-09-11 00:08 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2015-09-11 00:08 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2015-09-11 00:08 - 2000-08-31 02:00 - 00098816 _____ C:\windows\sed.exe
2015-09-11 00:08 - 2000-08-31 02:00 - 00080412 _____ C:\windows\grep.exe
2015-09-11 00:08 - 2000-08-31 02:00 - 00068096 _____ C:\windows\zip.exe
2015-09-11 00:06 - 2015-09-11 00:47 - 00000000 ____D C:\Qoobox
2015-09-11 00:05 - 2015-09-12 01:02 - 00000000 ____D C:\windows\erdnt
2015-09-11 00:03 - 2015-09-11 00:04 - 05635119 ____R (Swearware) C:\Users\Lya\Desktop\ComboFix.exe
2015-09-10 22:45 - 2015-09-10 22:45 - 00001218 _____ C:\Users\Lya\Desktop\Revo Uninstaller.lnk
2015-09-10 22:45 - 2015-09-10 22:45 - 00000000 ____D C:\Program Files\VS Revo Group
2015-09-10 22:44 - 2015-09-10 22:44 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Lya\Desktop\revosetup95.exe
2015-09-10 22:41 - 2015-09-10 22:41 - 00000781 _____ C:\Users\Lya\Desktop\Paola - Shortcut.lnk
2015-09-10 01:11 - 2015-09-10 01:11 - 00000000 ____D C:\Users\Lya\AppData\Local\AVG Web TuneUp
2015-09-10 01:10 - 2015-09-10 01:11 - 00000000 ____D C:\ProgramData\AVG Web TuneUp
2015-09-10 01:10 - 2015-09-10 01:10 - 00000000 ____D C:\Program Files\AVG Web TuneUp
2015-09-09 10:51 - 2015-09-02 04:48 - 00070656 _____ (Microsoft Corporation) C:\windows\system32\fontsub.dll
2015-09-09 10:51 - 2015-09-02 04:48 - 00034304 _____ (Adobe Systems) C:\windows\system32\atmlib.dll
2015-09-09 10:51 - 2015-09-02 04:48 - 00026624 _____ (Microsoft Corporation) C:\windows\system32\lpk.dll
2015-09-09 10:51 - 2015-09-02 04:48 - 00010240 _____ (Microsoft Corporation) C:\windows\system32\dciman32.dll
2015-09-09 10:51 - 2015-09-02 03:36 - 02384896 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2015-09-09 10:51 - 2015-09-02 03:33 - 00299520 _____ (Adobe Systems Incorporated) C:\windows\system32\atmfd.dll
2015-09-09 10:51 - 2015-08-27 19:58 - 01391104 _____ (Microsoft Corporation) C:\windows\system32\msxml6.dll
2015-09-09 10:51 - 2015-08-27 19:58 - 01241088 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll
2015-09-09 10:51 - 2015-08-27 19:51 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml6r.dll
2015-09-09 10:51 - 2015-08-27 19:51 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml3r.dll
2015-09-09 10:51 - 2015-08-05 19:41 - 00751104 _____ (Microsoft Corporation) C:\windows\system32\schedsvc.dll
2015-09-09 10:51 - 2015-08-05 19:40 - 00216064 _____ (Microsoft Corporation) C:\windows\system32\InkEd.dll
2015-09-09 10:51 - 2015-08-05 19:40 - 00019968 _____ (Microsoft Corporation) C:\windows\system32\jnwmon.dll
2015-09-09 10:51 - 2015-08-04 19:48 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\setbcdlocale.dll
2015-09-09 10:51 - 2015-08-04 19:47 - 00050688 _____ (Microsoft Corporation) C:\windows\system32\appidapi.dll
2015-09-09 10:51 - 2015-08-04 19:47 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\appidsvc.dll
2015-09-09 10:51 - 2015-08-04 19:46 - 00096768 _____ (Microsoft Corporation) C:\windows\system32\appidpolicyconverter.exe
2015-09-09 10:51 - 2015-08-04 19:46 - 00016896 _____ (Microsoft Corporation) C:\windows\system32\appidcertstorecheck.exe
2015-09-09 10:51 - 2015-08-04 18:53 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\Drivers\appid.sys
2015-09-09 10:50 - 2015-08-18 03:14 - 00344168 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2015-09-09 10:50 - 2015-08-15 08:06 - 19856896 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-09-09 10:50 - 2015-08-15 07:53 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2015-09-09 10:50 - 2015-08-15 07:53 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2015-09-09 10:50 - 2015-08-15 07:40 - 00504832 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-09-09 10:50 - 2015-08-15 07:40 - 00062464 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2015-09-09 10:50 - 2015-08-15 07:39 - 00341504 _____ (Microsoft Corporation) C:\windows\system32\html.iec
2015-09-09 10:50 - 2015-08-15 07:39 - 00047616 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2015-09-09 10:50 - 2015-08-15 07:38 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2015-09-09 10:50 - 2015-08-15 07:35 - 02279424 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2015-09-09 10:50 - 2015-08-15 07:33 - 00047104 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2015-09-09 10:50 - 2015-08-15 07:32 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2015-09-09 10:50 - 2015-08-15 07:30 - 00479232 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2015-09-09 10:50 - 2015-08-15 07:29 - 00665600 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2015-09-09 10:50 - 2015-08-15 07:29 - 00620032 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2015-09-09 10:50 - 2015-08-15 07:29 - 00115712 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2015-09-09 10:50 - 2015-08-15 07:29 - 00102912 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2015-09-09 10:50 - 2015-08-15 07:24 - 00667648 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2015-09-09 10:50 - 2015-08-15 07:21 - 00418304 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2015-09-09 10:50 - 2015-08-15 07:16 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2015-09-09 10:50 - 2015-08-15 07:14 - 00168960 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2015-09-09 10:50 - 2015-08-15 07:12 - 00076288 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2015-09-09 10:50 - 2015-08-15 07:11 - 00285696 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2015-09-09 10:50 - 2015-08-15 07:10 - 04520448 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-09-09 10:50 - 2015-08-15 07:04 - 12857344 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-09-09 10:50 - 2015-08-15 07:02 - 00689152 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-09-09 10:50 - 2015-08-15 07:02 - 00685568 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2015-09-09 10:50 - 2015-08-15 07:01 - 02052608 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2015-09-09 10:50 - 2015-08-15 07:01 - 01155072 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2015-09-09 10:50 - 2015-08-15 06:43 - 01951232 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-09-09 10:50 - 2015-08-15 06:39 - 01310720 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-09-09 10:50 - 2015-08-15 06:37 - 00710144 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2015-09-09 10:50 - 2015-07-22 19:57 - 03989952 _____ (Microsoft Corporation) C:\windows\system32\ntkrnlpa.exe
2015-09-09 10:50 - 2015-07-22 19:57 - 03934656 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-09-09 10:50 - 2015-07-22 19:57 - 00137664 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2015-09-09 10:50 - 2015-07-22 19:57 - 00067520 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2015-09-09 10:50 - 2015-07-22 19:54 - 01308160 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 01061376 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00937984 _____ (Microsoft Corporation) C:\windows\system32\diagtrack.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00655360 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00641536 _____ (Microsoft Corporation) C:\windows\system32\advapi32.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00635392 _____ (Microsoft Corporation) C:\windows\system32\tdh.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00552960 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00400896 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00259584 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00248832 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00221184 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00172032 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00100352 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00065536 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00043008 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00038912 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00036864 _____ (Microsoft Corporation) C:\windows\system32\cryptbase.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00017408 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2015-09-09 10:50 - 2015-07-22 19:53 - 00015872 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2015-09-09 10:50 - 2015-07-22 19:52 - 00262656 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
2015-09-09 10:50 - 2015-07-22 19:52 - 00069632 _____ (Microsoft Corporation) C:\windows\system32\smss.exe
2015-09-09 10:50 - 2015-07-22 19:52 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe
2015-09-09 10:50 - 2015-07-22 19:52 - 00022528 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2015-09-09 10:50 - 2015-07-22 19:47 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll
2015-09-09 10:50 - 2015-07-22 19:46 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2015-09-09 10:50 - 2015-07-22 19:42 - 00686080 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2015-09-09 10:50 - 2015-07-22 19:42 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll
2015-09-09 10:50 - 2015-07-22 18:38 - 00041984 _____ (Microsoft Corporation) C:\windows\system32\UtcResources.dll
2015-09-09 10:50 - 2015-07-22 18:34 - 00225792 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb10.sys
2015-09-09 10:50 - 2015-07-22 18:34 - 00098304 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb20.sys
2015-09-09 10:50 - 2015-07-22 18:33 - 00124416 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb.sys
2015-09-09 10:50 - 2015-07-09 19:42 - 01372160 _____ (Microsoft Corporation) C:\windows\system32\dwmcore.dll
2015-09-09 10:50 - 2015-07-09 19:42 - 00067584 _____ (Microsoft Corporation) C:\windows\system32\dwmapi.dll
2015-09-09 10:49 - 2015-08-26 19:56 - 02953728 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2015-09-09 10:49 - 2015-08-26 19:56 - 02061824 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2015-09-09 10:49 - 2015-08-26 19:56 - 00566784 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2015-09-09 10:49 - 2015-08-26 19:56 - 00173056 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
2015-09-09 10:49 - 2015-08-26 19:56 - 00093184 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2015-09-09 10:49 - 2015-08-26 19:56 - 00035840 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll
2015-09-09 10:49 - 2015-08-26 19:56 - 00030208 _____ (Microsoft Corporation) C:\windows\system32\wups.dll
2015-09-09 10:49 - 2015-08-26 19:55 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2015-09-09 10:49 - 2015-08-26 19:55 - 00073728 _____ (Microsoft Corporation) C:\windows\system32\WinSetupUI.dll
2015-09-09 10:49 - 2015-08-26 19:55 - 00034816 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
2015-09-09 10:49 - 2015-08-26 19:55 - 00011776 _____ (Microsoft Corporation) C:\windows\system32\wu.upgrade.ps.dll
2015-09-09 10:49 - 2015-07-15 04:54 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
2015-09-09 10:49 - 2015-06-25 11:48 - 00105408 _____ (Microsoft Corporation) C:\windows\system32\consent.exe
2015-09-09 10:49 - 2015-06-25 11:44 - 01805824 _____ (Microsoft Corporation) C:\windows\system32\authui.dll
2015-09-09 10:49 - 2015-06-25 11:44 - 00047104 _____ (Microsoft Corporation) C:\windows\system32\appinfo.dll
2015-09-08 23:58 - 2015-09-08 23:59 - 00288550 _____ C:\Users\Lya\Desktop\Trojaner-board post.txt
2015-09-08 22:57 - 2015-09-08 22:57 - 00064492 _____ C:\Users\Lya\Desktop\gmer.txt
2015-09-08 12:38 - 2015-09-08 12:38 - 00131072 _____ C:\windows\Minidump\090815-57891-01.dmp
2015-09-08 08:42 - 2015-09-08 08:42 - 00104960 _____ (GMER) C:\fxldapow.sys
2015-09-08 08:36 - 2015-09-08 08:37 - 00131072 _____ C:\windows\Minidump\090815-46893-01.dmp
2015-09-07 23:50 - 2015-09-09 11:29 - 00057728 _____ C:\Users\Lya\Desktop\Addition.txt
2015-09-07 23:49 - 2015-09-13 02:29 - 00029429 _____ C:\Users\Lya\Desktop\FRST.txt
2015-09-07 23:48 - 2015-09-13 02:29 - 00000000 ____D C:\FRST
2015-09-07 23:46 - 2015-09-07 23:47 - 00000526 _____ C:\Users\Lya\Desktop\defogger_disable.log
2015-09-07 23:46 - 2015-09-07 23:46 - 00000000 _____ C:\Users\Lya\defogger_reenable
2015-09-07 21:10 - 2015-09-07 21:10 - 00380416 _____ C:\Users\Lya\Desktop\Gmer-19357.exe
2015-09-07 21:09 - 2015-09-13 02:28 - 01692160 _____ (Farbar) C:\Users\Lya\Desktop\FRST.exe
2015-09-07 21:02 - 2015-09-07 21:02 - 00050477 _____ C:\Users\Lya\Desktop\Defogger.exe
2015-09-06 01:04 - 2015-09-06 01:04 - 00001874 ___RS C:\Users\Lya\Desktop\LGМоbile Suрроrt Toоl.lnk
2015-09-06 01:04 - 2015-09-06 01:04 - 00001425 ___RS C:\Users\Lya\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Intеrnet Eхplоrer.lnk
2015-09-06 01:04 - 2015-09-06 01:04 - 00001227 ___RS C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Мozilla Firеfоx.lnk
2015-09-06 01:04 - 2015-09-06 01:04 - 00001181 ___RS C:\Users\Lya\Desktop\Gооglе Chrоmе.lnk
2015-09-02 22:23 - 2015-09-02 22:23 - 00000000 ____D C:\Users\Lya\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-09-02 21:44 - 2015-09-10 01:11 - 00000000 ____D C:\Program Files\Mozilla Firefox
2015-08-23 19:24 - 2015-09-12 11:34 - 00000312 _____ C:\windows\Tasks\HPCeeScheduleForLya.job
2015-08-23 19:17 - 2015-09-08 12:38 - 366280212 _____ C:\windows\MEMORY.DMP
2015-08-23 19:17 - 2015-08-23 19:17 - 00235008 _____ C:\windows\Minidump\082315-43430-01.dmp
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-09-13 02:20 - 2015-06-20 01:43 - 00001216 _____ C:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-430462746-378290837-44786878-1003UA.job
2015-09-13 02:11 - 2011-02-08 11:06 - 00001098 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-09-13 01:44 - 2013-01-05 12:03 - 00000830 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2015-09-13 01:11 - 2011-02-08 11:06 - 00001094 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-09-12 23:26 - 2012-06-22 18:46 - 00000000 ____D C:\ProgramData\MFAData
2015-09-12 22:56 - 2010-06-26 12:39 - 01261032 _____ C:\windows\WindowsUpdate.log
2015-09-12 22:10 - 2011-02-07 14:10 - 00000000 ____D C:\Users\Lya
2015-09-12 21:52 - 2013-01-05 12:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-09-12 21:24 - 2009-07-14 06:34 - 00025648 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-09-12 21:24 - 2009-07-14 06:34 - 00025648 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-09-12 15:20 - 2015-06-20 01:43 - 00001164 _____ C:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-430462746-378290837-44786878-1003Core.job
2015-09-12 11:33 - 2011-02-12 12:04 - 00000052 _____ C:\windows\system32\DOErrors.log
2015-09-12 11:29 - 2010-06-07 16:43 - 00782510 _____ C:\windows\system32\PerfStringBackup.INI
2015-09-12 11:23 - 2013-02-01 00:31 - 00000000 ___RD C:\Users\Lya\Dropbox
2015-09-12 11:23 - 2013-02-01 00:27 - 00000000 ____D C:\Users\Lya\AppData\Roaming\Dropbox
2015-09-12 11:23 - 2010-06-07 16:56 - 00000000 ____D C:\ProgramData\HPQLOG
2015-09-12 11:22 - 2011-02-08 11:05 - 00000000 ____D C:\Users\Lya\AppData\Roaming\Skype
2015-09-12 11:21 - 2009-07-14 06:53 - 00000006 ____H C:\windows\Tasks\SA.DAT
2015-09-12 11:21 - 2009-07-14 06:39 - 00158116 _____ C:\windows\setupact.log
2015-09-12 01:58 - 2013-06-18 23:28 - 00000000 ____D C:\Users\Lya\AppData\Local\Apps\2.0
2015-09-12 01:31 - 2013-01-05 12:05 - 00002189 ____H C:\Users\Lya\Desktop\Google Chrome.lnk
2015-09-12 01:31 - 2010-10-29 15:33 - 00273072 _____ C:\windows\PFRO.log
2015-09-11 09:36 - 2014-11-15 15:05 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-09-11 09:36 - 2014-11-15 14:59 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-09-11 00:47 - 2009-07-14 04:37 - 00000000 __RHD C:\Users\Default
2015-09-11 00:47 - 2009-07-14 04:37 - 00000000 ___RD C:\Users\Public
2015-09-11 00:37 - 2009-07-14 04:04 - 00000215 _____ C:\windows\system.ini
2015-09-11 00:29 - 2011-10-08 17:16 - 00000000 __SHD C:\Users\Lya\AppData\Local\95c8f457
2015-09-10 23:59 - 2011-10-02 11:33 - 00000000 ____D C:\Program Files\SCHLECKER
2015-09-10 23:54 - 2012-04-15 14:44 - 00000000 ____D C:\ProgramData\Lexware
2015-09-10 23:54 - 2012-03-19 00:25 - 00000000 ____D C:\Program Files\Common Files\Lexware
2015-09-10 23:39 - 2012-04-15 14:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lexware
2015-09-10 23:39 - 2012-04-15 14:44 - 00000000 ____D C:\Program Files\Lexware
2015-09-10 22:33 - 2009-07-14 04:37 - 00000000 ____D C:\windows\system32\NDF
2015-09-10 10:18 - 2009-07-14 04:37 - 00000000 ____D C:\windows\rescache
2015-09-10 09:14 - 2009-07-14 06:33 - 00472848 _____ C:\windows\system32\FNTCACHE.DAT
2015-09-10 09:08 - 2010-04-25 22:36 - 00000000 ____D C:\Program Files\Windows Journal
2015-09-10 08:59 - 2009-07-14 04:37 - 00000000 ____D C:\windows\Microsoft.NET
2015-09-10 08:56 - 2009-07-14 04:04 - 00000478 _____ C:\windows\win.ini
2015-09-10 08:46 - 2013-08-01 08:14 - 00000000 ____D C:\windows\system32\MRT
2015-09-09 22:51 - 2014-11-06 23:15 - 00000000 ____D C:\Users\Lya\AppData\Roaming\HpUpdate
2015-09-09 00:56 - 2010-06-07 16:56 - 00000000 ____D C:\ProgramData\PDFC
2015-09-08 12:44 - 2015-01-27 00:19 - 00000000 ____D C:\Program Files\BubbleUPnP Server
2015-09-08 12:38 - 2013-03-25 10:46 - 00000000 ____D C:\windows\Minidump
2015-09-08 08:36 - 2012-05-06 14:01 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2015-09-06 01:04 - 2013-12-30 01:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LGMobile Support Tool
2015-09-06 01:04 - 2010-06-07 17:18 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LightScribe Direct Disc Labeling
2015-09-03 15:37 - 2012-04-28 00:48 - 00000000 ____D C:\Users\Lya\Documents\Lya´s folder
2015-08-26 18:36 - 2011-07-24 21:30 - 132039072 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-08-20 08:18 - 2010-04-25 10:41 - 00000000 ____D C:\windows\Panther
2015-08-20 08:14 - 2015-07-10 13:17 - 00000000 ____D C:\$Windows.~BT
2015-08-18 06:46 - 2014-10-29 23:43 - 00000935 _____ C:\Users\Public\Desktop\AVG 2015.lnk
2015-08-18 06:46 - 2013-11-14 21:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
==================== Files in the root of some directories =======
2013-06-26 15:11 - 2014-06-24 12:19 - 0003728 _____ () C:\Program Files\Mozilla Firefoxavg-secure-search.xml
2011-05-22 17:22 - 2011-05-22 17:22 - 0001849 _____ () C:\Users\Lya\AppData\Roaming\GhostObjGAFix.xml
2011-08-02 19:57 - 2011-08-03 21:16 - 0000047 _____ () C:\Users\Lya\AppData\Local\Images.fl
2013-06-14 22:54 - 2013-10-06 20:14 - 0001516 _____ () C:\Users\Lya\AppData\Local\MiniAssist.ini
2013-06-14 22:54 - 2013-06-14 22:54 - 0001516 _____ () C:\Users\Lya\AppData\Local\MiniAssist.ini.bak
2013-06-14 22:54 - 2013-10-08 08:16 - 0007506 _____ () C:\Users\Lya\AppData\Local\MiniAssist.log
2011-10-01 15:33 - 2011-10-01 15:33 - 0007608 _____ () C:\Users\Lya\AppData\Local\Resmon.ResmonCfg
2013-06-05 01:17 - 2013-06-05 01:17 - 0000041 ___SH () C:\ProgramData\.zreglib
2011-02-08 11:13 - 2011-02-08 11:13 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2011-03-28 01:09 - 2011-03-28 01:09 - 0000848 ___SH () C:\ProgramData\KGyGaAvL.sys
ZeroAccess:
C:\Users\Lya\AppData\Local\95c8f457
C:\Users\Lya\AppData\Local\95c8f457\@
Some files in TEMP:
====================
C:\Users\Lya\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpgjczop.dll
C:\Users\Lya\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\dnsapi.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-09-11 11:28
==================== End of FRST.txt ============================
--- --- --- |
|
13.09.2015, 10:06
| #14 |
| /// the machine /// TB-Ausbilder | Windows 7: gotut.ru als Startseite beim Firefox, IExplorer und crome Entfernen wir jetzt. Java und Adobe updaten. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Program Files\Google\Chrome\Application\39.0.2171.95\chrome.dll
C:\Qoobox\Quarantine\C\Users\Lya\AppData\Local\95c8f457\U\80000000.@.vir
C:\Qoobox\Quarantine\C\Users\Lya\AppData\Local\Google\Chrome\User Data\Default\Extensions\idknbmbdnapjicclomlijcgfpikmndhd\123\content.js.vir
C:\Qoobox\Quarantine\C\Users\Lya\Videos\iLividSetup-r0-n-bi.exe.vir
C:\Qoobox\Quarantine\C\Windows\System32\roboot.exe.vir
C:\Users\Lya\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\134554d0-3882d842
C:\Users\Lya\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24\dfe2818-247b857f
C:\Users\Lya\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\451d1fdf-69e7da8c
C:\Users\Lya\Desktop\light_image_resizer4_setup_4.0.8.0d_linkular.exe
C:\Users\Lya\Desktop\Downloads\uhr.exe
C:\Wolfgang\Renault englisch\Renault Megane Scenic Service Manual En(0).rar
C:\Wolfgang\Renault englisch\renault_megane_scenic_service_manual_en.zip
C:\Wolfgang\ZipRar\biodiesel book diesel generator energy free energy system gas generator information stirling engine power electricity solar generator.zip
C:\Wolfgang\ZipRar\completely free energy magniwork power generator.zip
C:\Wolfgang\ZipRar\Full Plans
S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [X]
Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Revo Uninstaller - Download - Filepony damit Chrome deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren. Dann: https://support.google.com/chrome/answer/3296214?hl=de Die Icons wurden gelöscht weil dort Malware dran hing. Icons mit Rechtsklick aus der Taskleiste löschen, neu anlegen.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
13.09.2015, 20:37
| #15 |
| | Windows 7: gotut.ru als Startseite beim Firefox, IExplorer und crome Fix.Log Code:
ATTFilter Fix result of Farbar Recovery Scan Tool (x86) Version:12-09-2015
Ran by Lya (2015-09-13 14:20:05) Run:1
Running from C:\Users\Lya\Desktop
Loaded Profiles: Lya (Available Profiles: Lya)
Boot Mode: Normal
==============================================
fixlist content:
*****************
C:\Program Files\Google\Chrome\Application\39.0.2171.95\chrome.dll
C:\Qoobox\Quarantine\C\Users\Lya\AppData\Local\95c8f457\U\80000000.@.vir
C:\Qoobox\Quarantine\C\Users\Lya\AppData\Local\Google\Chrome\User Data\Default\Extensions\idknbmbdnapjicclomlijcgfpikmndhd\123\content.js.vir
C:\Qoobox\Quarantine\C\Users\Lya\Videos\iLividSetup-r0-n-bi.exe.vir
C:\Qoobox\Quarantine\C\Windows\System32\roboot.exe.vir
C:\Users\Lya\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\134554d0-3882d842
C:\Users\Lya\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24\dfe2818-247b857f
C:\Users\Lya\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\451d1fdf-69e7da8c
C:\Users\Lya\Desktop\light_image_resizer4_setup_4.0.8.0d_linkular.exe
C:\Users\Lya\Desktop\Downloads\uhr.exe
C:\Wolfgang\Renault englisch\Renault Megane Scenic Service Manual En(0).rar
C:\Wolfgang\Renault englisch\renault_megane_scenic_service_manual_en.zip
C:\Wolfgang\ZipRar\biodiesel book diesel generator energy free energy system gas generator information stirling engine power electricity solar generator.zip
C:\Wolfgang\ZipRar\completely free energy magniwork power generator.zip
C:\Wolfgang\ZipRar\Full Plans
S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [X]
Emptytemp:
*****************
C:\Program Files\Google\Chrome\Application\39.0.2171.95\chrome.dll => moved successfully
C:\Qoobox\Quarantine\C\Users\Lya\AppData\Local\95c8f457\U\80000000.@.vir => moved successfully
C:\Qoobox\Quarantine\C\Users\Lya\AppData\Local\Google\Chrome\User Data\Default\Extensions\idknbmbdnapjicclomlijcgfpikmndhd\123\content.js.vir => moved successfully
C:\Qoobox\Quarantine\C\Users\Lya\Videos\iLividSetup-r0-n-bi.exe.vir => moved successfully
C:\Qoobox\Quarantine\C\Windows\System32\roboot.exe.vir => moved successfully
C:\Users\Lya\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\134554d0-3882d842 => moved successfully
C:\Users\Lya\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24\dfe2818-247b857f => moved successfully
C:\Users\Lya\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\451d1fdf-69e7da8c => moved successfully
C:\Users\Lya\Desktop\light_image_resizer4_setup_4.0.8.0d_linkular.exe => moved successfully
C:\Users\Lya\Desktop\Downloads\uhr.exe => moved successfully
C:\Wolfgang\Renault englisch\Renault Megane Scenic Service Manual En(0).rar => moved successfully
C:\Wolfgang\Renault englisch\renault_megane_scenic_service_manual_en.zip => moved successfully
C:\Wolfgang\ZipRar\biodiesel book diesel generator energy free energy system gas generator information stirling engine power electricity solar generator.zip => moved successfully
C:\Wolfgang\ZipRar\completely free energy magniwork power generator.zip => moved successfully
"C:\Wolfgang\ZipRar\Full Plans" => File/Folder not found.
rpcapd => service removed successfully.
EmptyTemp: => 8.9 GB temporary data Removed.
The system needed a reboot.
==== End of Fixlog 14:26:27 ====
|
|
| Themen zu Windows 7: gotut.ru als Startseite beim Firefox, IExplorer und crome |
| anhang, antivirus, autostart, avg, code, datei, edition, entfern, explorer, firefox, free, geänderte, geänderte startseite, iexplorer, inter, interne, internetexplorer, konnte, link, log, log datei, schei, seite, startseite, windows, windows 7 |
dann auf 
und dann auf 
. 
WARNUNG an die MITLESER: 
Linear-Darstellung
