|
Log-Analyse und Auswertung: Trotz Malwarebytes und Adawarecleaner PopupfensterWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
15.04.2016, 10:20 | #1 |
| Trotz Malwarebytes und Adawarecleaner Popupfenster Hallo und guten Tag, hab mich ja schon eingelesen in das Forum und gestern meinen Laptop mal mit den obengenannten Programmen versucht zu befreien. Da ich erst heute abend wieder an meinen Laptop komme, kann ich evtl. Logfiles auch hier posten. Aber wieso haben die beiden Programme das nicht geschafft, stellt sich mir halt die Frage!!! Ich öffne Firefox, will eine Seite laden und es öffnet sich erstens eine andere Seite die ich gar nicht will und / oder Popups und es wird mir andauernd Werbung auf Seiten eingeblendet. Für evtl. Antworten wäre ich Dankbar. LG Soehrgoz |
15.04.2016, 10:22 | #2 |
/// Malwareteam | Trotz Malwarebytes und Adawarecleaner PopupfensterMein Name ist Rafael und ich werde dir bei der Bereinigung helfen. Damit ich dir optimal helfen kann, halte dich bitte an folgende Regeln:
Ohne Logs weiß ich nix Poste bitte das Adwcleaner und Malwarebytes Logfile. Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
15.04.2016, 22:27 | #3 |
| Trotz Malwarebytes und Adawarecleaner Popupfenster schuldige war falsch eingegeben
__________________Geändert von Soehrgoz (15.04.2016 um 22:55 Uhr) |
15.04.2016, 22:45 | #4 |
| Trotz Malwarebytes und Adawarecleaner PopupfensterCode:
ATTFilter <?xml version="1.0" encoding="UTF-16" ?> <mbam-log> <header> <date>2016/04/15 22:11:05 +0200</date> <logfile>mbam-log-2016-04-15 (22-09-56).xml</logfile> <isadmin>yes</isadmin> </header> <engine> <version>2.2.1.1043</version> <malware-database>v2016.04.15.05</malware-database> <rootkit-database>v2016.04.09.01</rootkit-database> <license>trial</license> <file-protection>enabled</file-protection> <web-protection>enabled</web-protection> <self-protection>disabled</self-protection> </engine> <system> <hostname>SCHWARZEGIRL</hostname> <ip>192.168.0.29</ip> <osversion>Windows 8.1</osversion> <arch>x64</arch> <username>Schatz</username> <filesys>NTFS</filesys> </system> <summary> <type>threat</type> <result>completed</result> <objects>360877</objects> <time>1310</time> <processes>0</processes> <modules>0</modules> <keys>0</keys> <values>1</values> <datas>1</datas> <folders>54</folders> <files>179</files> <sectors>0</sectors> </summary> <options> <memory>enabled</memory> <startup>enabled</startup> <filesystem>enabled</filesystem> <archives>enabled</archives> <rootkits>disabled</rootkits> <deeprootkit>disabled</deeprootkit> <heuristics>enabled</heuristics> <pup>enabled</pup> <pum>enabled</pum> </options> <items> <value><path>HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS</path><valuename>AutoConfigUrl</valuename><vendor>Hijack.AutoConfigURL.ShrtCln</vendor><action>success</action><valuedata>hxxp://stopblock.me/wpad.dat?35ade8c4837d2e8a8976f6dffa3d5efb227413</valuedata><hash>42df139c99006dc97d929ae1a0648c74</hash></value> <data><path>HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES</path><valuename>DefaultScope</valuename><vendor>PUP.Optional.Qone8</vendor><action>replaced</action><valuedata>{33BB0A4E-99AF-4226-BDF6-49120163DE86}</valuedata><baddata>{33BB0A4E-99AF-4226-BDF6-49120163DE86}</baddata><gooddata>{0633EE93-D776-472f-A0FF-E1416B8B2E3A}</gooddata><hash>e73a7d32aeebb97dba9b81b6887d0ff1</hash></data> <folder><path>C:\Users\Schatz\AppData\Roaming\updates</path><vendor>PUP.Optional.PCProCleaner</vendor><action>success</action><hash>978ac9e60d8cc571adc2e374e71d0af6</hash></folder> <folder><path>C:\Users\Schatz\Documents\PPC-software</path><vendor>PUP.Optional.ProCleaningSoftware</vendor><action>success</action><hash>f1307936afea82b413cb069fda2ab848</hash></folder> <folder><path>C:\Program Files (x86)\Sosition</path><vendor>PUP.Optional.YesSearches</vendor><action>success</action><hash>928fb8f76336e94dbe25aff8fd070ff1</hash></folder> <folder><path>C:\Program Files (x86)\hohobnd</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></folder> <folder><path>C:\Program Files (x86)\hohobnd\dmp</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></folder> <folder><path>C:\Program Files (x86)\hohobnd\dmp\CCeuter.exe</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></folder> <folder><path>C:\Program Files (x86)\hohobnd\dmp\ghabuk.exe</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></folder> <folder><path>C:\Program Files (x86)\hohobnd\dmp\SstrprSrv.exe</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></folder> <folder><path>C:\Program Files (x86)\hohobnd\dmp\SstrprTsk.exe</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}</path><vendor>PUP.Optional.SetSearchSetting</vendor><action>success</action><hash>c35e7e319efbea4c0f1f95cf947106fa</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adblockplus</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz\antitracking</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz\telemetry-categories</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz_thumbnails</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\crashes</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\crashes\events</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\datareporting</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\components</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\META-INF</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\gmp</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\healthreport</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\gmp-gmpopenh264</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\gmp-gmpopenh264\1.1</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\gmp-gmpopenh264\1.3</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\searchplugins</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\minidumps</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionstore-backups</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\chrome</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\chrome\idb</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\chrome\idb\2588645841ssegtnti</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++web.de</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++web.de\idb</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++web.de\idb\301792106ttes</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++www.amazon.de</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++www.amazon.de\idb</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++www.amazon.de\idb\2153786202SecrroitpSt</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\moz-safe-about+home</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\moz-safe-about+home\idb</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\moz-safe-about+home\idb\818200132aebmoouht</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\temporary</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\temporary\https+++www.facebook.com</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\temporary\https+++www.facebook.com\asmjs</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\webapps</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <file><path>C:\Program Files (x86)\hohobnd\CCeuter.exe</path><vendor>PUP.Optional.YesSearches</vendor><action>success</action><hash>7fa2fcb354452e080a055ecb10f26d93</hash></file> <file><path>C:\Program Files (x86)\hohobnd\FFeuter.exe</path><vendor>PUP.Optional.YesSearches</vendor><action>success</action><hash>45dcddd2e7b2a393119955d3877bfc04</hash></file> <file><path>C:\Users\Schatz\Downloads\iMeshSetup-r1487-w-bf.exe</path><vendor>PUP.Optional.iMeshMusicBoxTB</vendor><action>success</action><hash>938e08a7a3f61422401b400e2fd250b0</hash></file> <file><path>C:\Users\Schatz\Downloads\SoftonicDownloader_fuer_icq(1).exe</path><vendor>PUP.Optional.SofTonic</vendor><action>success</action><hash>9b86149b178270c61b3d1d2ee71abc44</hash></file> <file><path>C:\Users\Schatz\Downloads\CDex_TSV44ML77.exe</path><vendor>PUP.Optional.Conduit</vendor><action>success</action><hash>9f82ebc46237e6507b21b19b1de4837d</hash></file> <file><path>C:\Users\Schatz\Downloads\CryptLoad_1.1.8.rar</path><vendor>PUP.Optional.NetCat</vendor><action>success</action><hash>849d901f2574a98de78f0c80df233dc3</hash></file> <file><path>C:\Users\Schatz\Downloads\SoftonicDownloader_fuer_icq.exe</path><vendor>PUP.Optional.SofTonic</vendor><action>success</action><hash>5bc609a6ff9afc3a74e459f2e120b24e</hash></file> <file><path>C:\Windows\Installer\57a7d3b8.msi</path><vendor>PUP.Optional.Iminent</vendor><action>success</action><hash>10112c834356c86e7be72b23966b06fa</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\adbeaverSG@adbeaver.org.xpi</path><vendor>PUP.Optional.AdBeaver</vendor><action>success</action><hash>3ce5604fe5b443f33c28ee4a72918977</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\adbeaverSG@adbeaver.org.xpi</path><vendor>PUP.Optional.AdBeaver</vendor><action>success</action><hash>48d9872804954aec85df25136e9528d8</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\updates\updates.aiu</path><vendor>PUP.Optional.PCProCleaner</vendor><action>success</action><hash>978ac9e60d8cc571adc2e374e71d0af6</hash></file> <file><path>C:\Users\Schatz\Documents\PPC-software\logerror.txt</path><vendor>PUP.Optional.ProCleaningSoftware</vendor><action>success</action><hash>f1307936afea82b413cb069fda2ab848</hash></file> <file><path>C:\Program Files (x86)\Sosition\{A16B1AF7-982D-40C3-B5C1-633E1A6A6678}</path><vendor>PUP.Optional.YesSearches</vendor><action>success</action><hash>928fb8f76336e94dbe25aff8fd070ff1</hash></file> <file><path>C:\Windows\System32\Tasks\Sosition Reports</path><vendor>PUP.Optional.YesSearches</vendor><action>success</action><hash>bb66802fadec1125994cffa8f60ed030</hash></file> <file><path>C:\Program Files (x86)\hohobnd\conf.json</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></file> <file><path>C:\Program Files (x86)\hohobnd\@E9438230-A7DF-4D1F-8F2D-CA1D0F0F7924.xpi</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></file> <file><path>C:\Program Files (x86)\hohobnd\Uninst.exe</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></file> <file><path>C:\Program Files (x86)\hohobnd\{A16B1AF7-982D-40C3-B5C1-633E1A6A6678}</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}\install.rdf</path><vendor>PUP.Optional.SetSearchSetting</vendor><action>success</action><hash>c35e7e319efbea4c0f1f95cf947106fa</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}\bootstrap.js</path><vendor>PUP.Optional.SetSearchSetting</vendor><action>success</action><hash>c35e7e319efbea4c0f1f95cf947106fa</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}\search.json</path><vendor>PUP.Optional.SetSearchSetting</vendor><action>success</action><hash>c35e7e319efbea4c0f1f95cf947106fa</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\prefs.js</path><vendor>PUP.Optional.DeskCut</vendor><action>replaced</action><baddata>deskCutv2@gmail.com</baddata><gooddata></gooddata><hash>889957581f7adc5a9ff1a8c15da8a15f</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js</path><vendor>PUP.Optional.DeskCut</vendor><action>replaced</action><baddata>deskCutv2@gmail.com</baddata><gooddata></gooddata><hash>cd54416ecdcc2a0cf79944252dd8dd23</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\searchplugins\DD1B66D4.xml</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>c160c2eda3f6b3832205c99e19ecba46</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adbeaver-log.txt</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\addons.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\addons.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\addons.sqlite-journal</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\blocklist.xml</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cert8.db</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils.zip</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz.db</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz.dbattrack</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz.dbhumanweb</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz.dbusafe</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\compatibility.ini</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\content-prefs.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cookies.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cookies.sqlite-shm</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cookies.sqlite-wal</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions.ini</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions.sqlite.protect</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\formhistory.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\healthreport.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\healthreport.sqlite-shm</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\healthreport.sqlite-wal</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\key3.db</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\lightnings.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\localstore.rdf</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\logins.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\marionette.log</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\smartcliqz-custom-data-cache.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\mimeTypes.rdf</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\permissions.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\places.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\places.sqlite-shm</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\places.sqlite-wal</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\pluginreg.dat</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\search-metadata.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\secmod.db</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionCheckpoints.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionstore.bak</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionstore.bak-20140825202822</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionstore.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\signons.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\SiteSecurityServiceState.txt</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\Telemetry.FailedProfileLocks.txt</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\times.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\urlclassifierkey3.txt</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\webappsstore.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\webappsstore.sqlite-shm</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\webappsstore.sqlite-wal</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\xulstore.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adblockplus\elemhide.css</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adblockplus\patterns-backup1.ini</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adblockplus\patterns-backup2.ini</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adblockplus\patterns-backup3.ini</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adblockplus\patterns-backup4.ini</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adblockplus\patterns-backup5.ini</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adblockplus\patterns.ini</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-02-15_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-02-17_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-02-19_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-02-26_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-03-05_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-03-23_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-03-27_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-03-31_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-04-22_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-08-17_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-09-18_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-12-07_28_5LeUQwpRPS1lEGYQvcieDA==.jsonlz4</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2015-11-15_28_lk0H1mCFKKIDCLw+hlHIaQ==.jsonlz4</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2016-04-07_29_ElanrkgLfmTAFxN436P3Bw==.jsonlz4</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\certutil.exe</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\freebl3.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\libnspr4.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\libplc4.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\libplds4.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\msvcr100.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\nss3.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\nssckbi.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\nssdbm3.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\nssutil3.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\smime3.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\softokn3.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\sqlite3.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\ssl3.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz\smartcliqz-trigger-urls-cache.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz\antitracking\cookie_whitelist.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz\antitracking\tracker_owners.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz\telemetry-categories\categories.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\crashes\store.json.mozlz4</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\datareporting\state.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\cliqz@cliqz.com.xpi</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\{b5ff4533-981b-4303-87ae-ff7b33382325}.xpi</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\chrome.jar</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\chrome.manifest</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\install.rdf</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\components\aboutNetError.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\components\mCollectAutoComplete.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-debug.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-general.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-highlight.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-login.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-neterror.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-newtab.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-pref.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-search.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-shopping.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-tracking.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-util.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\META-INF\manifest.mf</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\META-INF\mozilla.rsa</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\META-INF\mozilla.sf</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}\bootstrap.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}\install.rdf</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}\search.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\healthreport\state.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\gmp-gmpopenh264\1.1\gmpopenh264.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\gmp-gmpopenh264\1.1\gmpopenh264.info</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\gmp-gmpopenh264\1.3\gmpopenh264.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\gmp-gmpopenh264\1.3\gmpopenh264.info</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\searchplugins\bing-lavasoft.xml</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\searchplugins\youtube.xml</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\minidumps\16595f46-1b5b-4859-94ae-c8d31ba7fdc4.dmp</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\minidumps\18940f69-c432-49bd-a7ed-9ca8c0bfdd9e.dmp</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\minidumps\222ba3f1-322f-48cf-a608-a563f8142d64.dmp</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\minidumps\222ba3f1-322f-48cf-a608-a563f8142d64.extra</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\minidumps\49062ef6-033e-4fe6-b2cf-910ae14e6804.dmp</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\minidumps\9130cf14-4bb0-49ce-a24c-56d92ccdf2fa.dmp</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\minidumps\9130cf14-4bb0-49ce-a24c-56d92ccdf2fa.extra</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionstore-backups\previous.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionstore-backups\recovery.bak</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionstore-backups\recovery.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionstore-backups\upgrade.js-20150108202552</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\chrome\.metadata</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\chrome\idb\2588645841ssegtnti.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++web.de\.metadata</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++web.de\idb\301792106ttes.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++www.amazon.de\.metadata</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++www.amazon.de\idb\2153786202SecrroitpSt.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\moz-safe-about+home\.metadata</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\moz-safe-about+home\idb\818200132aebmoouht.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\temporary\https+++www.facebook.com\.metadata</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\temporary\https+++www.facebook.com\asmjs\metadata</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\temporary\https+++www.facebook.com\asmjs\module13</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\temporary\https+++www.facebook.com\asmjs\module14</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\temporary\https+++www.facebook.com\asmjs\module15</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\webapps\webapps.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js</path><vendor>PUP.Optional.HohoSearch</vendor><action>replaced</action><baddata>user_pref("browser.search.searchengine.hp", "hxxp://www.hohosearch.com/?ts=AHEqA3EtAHMlBE..&v=20160412&uid=E9FA6529327CEEC1BDEC07434F4F02E2&ptid=epf2&mode=ffsengext");</baddata><gooddata></gooddata><hash>63be7e31841561d52267e384cb3a2dd3</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js</path><vendor>PUP.Optional.HohoSearch</vendor><action>replaced</action><baddata>ile the application is running, * the changes will be overwritten when the application exits. * * To make a manual change to preferences, you can visit the URL about:config */ user_p</baddata><gooddata></gooddata><hash>4bd63e7110899d99ee9ba3c416efb44c</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js</path><vendor>PUP.Optional.HohoSearch</vendor><action>replaced</action><baddata>ning, * the changes will be overwritten when the application exits. * * To make a manual change to preferences, you can visit the URL about:config */ user_pref("accessibility.typeahea</baddata><gooddata></gooddata><hash>57ca129d712849edf49524439b6a55ab</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js</path><vendor>PUP.Optional.WinYahoo</vendor><action>replaced</action><baddata>user_pref("browser.startup.homepage", "https://de.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_adsafld_16_15&param1=1&param2=f%3D1%26b%3DFirefox%26cc%3Dde%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzuzzyE0AyC0Czz0Fzy0AyEzytBtD0DtDyDtN0D0Tzu0StCyDyCtAtN1L2XzutAtFtBtDtFtCtFtBtN1L1Czu1BtBtN1L1G1B1V1N2Y1L1Qzu2StAtByByEyCyEtBtBtGyD0EtDtAtGzzyB0E0FtGtC0ByBzytGzztBzy0AtC0Dzz0FyBzytDyB2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0Azy0FyByCtCyBtAtGyCtA0DyDtGyEtC0F0DtGzyyDyEtDtG0DtD0C0AtB0AtD0F0DyD0F0C2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCzzyDtA%26cr%3D489122474%26a%3Dwbf_adsafld_16_15%26os_ver%3D6.3%26os%3DWindows%2B8.1");</baddata><gooddata>user_pref("browser.startup.homepage", "https://www.malwarebytes.org/restorebrowser/</gooddata><hash>27fa3b74891042f4d2b3006918ed49b7</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js</path><vendor>PUP.Optional.DeskCut</vendor><action>replaced</action><baddata>deskCutv2@gmail.com</baddata><gooddata></gooddata><hash>e8390ca32f6a201619773732818454ac</hash></file> </items> </mbam-log> Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:13-04-2016 durchgeführt von Schatz (2016-04-15 23:42:26) Gestartet von C:\Users\Schatz\AppData\Local\Temp\scoped_dir7056_9558 Windows 8.1 (X64) (2015-08-21 23:35:56) Start-Modus: Normal ========================================================== ==================== Konten: ============================= Administrator (S-1-5-21-3205940643-3366264869-3578409839-500 - Administrator - Disabled) Gast (S-1-5-21-3205940643-3366264869-3578409839-501 - Limited - Disabled) HomeGroupUser$ (S-1-5-21-3205940643-3366264869-3578409839-1004 - Limited - Enabled) Schatz (S-1-5-21-3205940643-3366264869-3578409839-1002 - Administrator - Enabled) => C:\Users\Schatz ==================== Sicherheits-Center ======================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.) AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859} AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0} ==================== Installierte Programme ====================== (Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.) 7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version: - ) Adobe Flash Player 21 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 21.0.0.213 - Adobe Systems Incorporated) Apple Application Support (32-Bit) (HKLM-x32\...\{FE5C2FAA-118D-4509-B51D-3F71CC9E1B3E}) (Version: 4.3 - Apple Inc.) Apple Application Support (64-Bit) (HKLM\...\{2937FD88-C9D6-4B82-B539-37CD0A572F42}) (Version: 4.3 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{2E4AF2A6-50EA-4260-9BA4-5E582D11879A}) (Version: 9.3.0.15 - Apple Inc.) Apple Software Update (HKLM-x32\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.) Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.16.282 - Avira Operations GmbH & Co. KG) Avira Launcher (HKLM-x32\...\{3b87484e-d70b-4b4f-ad59-2ae89571e2cf}) (Version: 1.1.56.9119 - Avira Operations GmbH & Co. KG) Avira Launcher (HKLM-x32\...\{ccdc9cfe-8ba7-4c6c-ac5f-b2d6cfa49efc}) (Version: 1.1.54.24924 - Avira Operations GmbH & Co. KG) Avira Launcher (HKLM-x32\...\{d0e166af-1634-4c0b-ae96-2180e61f9d38}) (Version: 1.1.52.15531 - Avira Operations GmbH & Co. KG) Avira Launcher (HKLM-x32\...\{eac7da46-2097-4dd4-80a6-8b67cbb2b23f}) (Version: 1.1.53.13962 - Avira Operations GmbH & Co. KG) Avira Launcher (x32 Version: 1.1.56.9119 - Avira Operations GmbH & Co. KG) Hidden Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.) CDex - Open Source Digital Audio CD Extractor (HKLM-x32\...\CDex) (Version: 1.70.4.2009 - Georgy Berdyshev) Chromium (HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\Chromium) (Version: 51.0.2683.0 - Chromium) CyberLink PhotoNow (HKLM-x32\...\InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.1.7717 - CyberLink Corp.) CyberLink PowerDirector (Version: 9.0.0.3815c - CyberLink Corp.) Hidden CyberLink PowerRecover (HKLM-x32\...\InstallShield_{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}) (Version: 5.7.0.0913 - CyberLink Corp.) CyberLink PowerRecover (Version: 5.7.0.0913 - CyberLink Corp.) Hidden D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden Dolby Advanced Audio v2 (HKLM-x32\...\{B9E70C7A-9F85-4A39-A4A3-BFA3C3BF7613}) (Version: 7.2.8000.17 - Dolby Laboratories Inc) Fotogalerie (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden Fotogalerija (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden Fotogalleri (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden Fotogalleriet (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden Fotoğraf Galerisi (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden Fotótár (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden Galeria de Fotografias (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden Galería de fotos (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden Galeria fotografii (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden Galerie de photos (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden iCloud (HKLM\...\{4B48E22A-2FB0-4EFA-B99E-954B1E50CD69}) (Version: 5.1.0.34 - Apple Inc.) ICQ 8.1 (build 6337) (HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\ICQ) (Version: 8.1.6337.0 - Mail.Ru) Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation) Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2875 - Intel Corporation) Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (HKLM\...\{E77289CF-12B9-4CAB-A49E-FEAE947F4D95}) (Version: 15.5.4.0423 - Intel Corporation) Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\...\{DA2600C1-6BDF-4FD1-8F3D-148929CC1385}) (Version: 2.6.1210.0278 - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.6.0.1030 - Intel Corporation) Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation) Intel(R) WiDi (HKLM\...\{6097158B-0184-4140-BEC3-7885794D2571}) (Version: 3.5.40.0 - Intel Corporation) Intel® PROSet/Wireless WiFi Software (HKLM\...\{1593C708-5535-47A4-8C0F-F8D4BE2B4560}) (Version: 15.05.6000.1620 - Intel Corporation) Internet Updater (HKLM-x32\...\InternetUpdater) (Version: 2.6.57 - Parallel Lines Development, LLC) <==== ACHTUNG IrfanView 64 (remove only) (HKLM\...\IrfanView) (Version: 4.40 - Irfan Skiljan) iTunes (HKLM\...\{A31C5565-90D9-4615-AE13-94D86C3836C7}) (Version: 12.3.3.17 - Apple Inc.) Joan Jade und die Tore von Xibalba (HKLM-x32\...\Joan Jade und die Tore von Xibalba) (Version: - ) Magic Encyclopedia 3 - Illusionen (HKLM-x32\...\Magic Encyclopedia 3 - Illusionen) (Version: - ) Malwarebytes Anti-Malware Version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes) Margrave Manor: Der Fluch des gebrochenen Herzens (HKLM-x32\...\Margrave Manor: Der Fluch des gebrochenen Herzens) (Version: - ) McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.11.309.1 - McAfee, Inc.) Mediathek (HKLM-x32\...\{EFFED0C0-5299-422E-AFE6-8B8066D18A2A}) (Version: 1.4.0 - Medion) Medion Home Cinema 10 (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.) Medion Home Cinema 10 (x32 Version: 10.1924 - CyberLink Corp.) Hidden Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4805.1003 - Microsoft Corporation) Microsoft Office Excel Viewer (HKLM-x32\...\{95120000-003F-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation) Microsoft OneDrive (HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\OneDriveSetup.exe) (Version: 17.3.4604.0120 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation) Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation) Mobile Partner (HKLM-x32\...\Mobile Partner) (Version: 21.005.15.02.382 - Huawei Technologies Co.,Ltd) Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden Mozilla Firefox 35.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0 (x86 de)) (Version: 35.0 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 35.0 - Mozilla) Music Toolbar for Firefox (Dist. by iMesh, Inc.) (HKLM-x32\...\imeshmusicboxtoolbarhaFF) (Version: 1.6.2.0 - APN LLC) <==== ACHTUNG Music Toolbar for Internet Explorer (Dist. by iMesh, Inc.) (HKLM-x32\...\imeshmusicboxtoolbarhaIE) (Version: 1.6.2.0 - APN LLC) <==== ACHTUNG Mystery Murders - Jack the Ripper 2 (HKLM-x32\...\Mystery Murders - Jack the Ripper 2) (Version: 1.0.0.221.de - Rondomedia) Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4805.1003 - Microsoft Corporation) Hidden Office 15 Click-to-Run Licensing Component (Version: 15.0.4805.1003 - Microsoft Corporation) Hidden Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4805.1003 - Microsoft Corporation) Hidden Opera Stable 36.0.2130.65 (HKLM-x32\...\Opera 36.0.2130.65) (Version: 36.0.2130.65 - Opera Software) PHotkey (HKLM-x32\...\{E50C224A-BBF2-428D-9DCF-DBF9DF85C40E}) (Version: 1.00.0081 - Pegatron Corporation) Podstawowe programy Windows Live (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden QuickLaunch (HKLM-x32\...\{A802F1E3-34C8-4C84-9948-C1C4E37D0FA9}) (Version: 1.00.0019 - Lenovo Group Limited) QuickTime 7 (HKLM-x32\...\{FF59BD75-466A-4D5A-AD23-AAD87C5FD44C}) (Version: 7.79.80.95 - Apple Inc.) Raccolta foto (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6722 - Realtek Semiconductor Corp.) Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.30136 - Realtek Semiconductor Corp.) Sony PC Companion 2.10.188 (HKLM-x32\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.188 - Sony) SpringFiles (HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\SpringFiles) (Version: 29.15.39 - hxxp://www.spring-file.com) Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.16.0 - Synaptics Incorporated) Unsolved Mystery Club - Ancient Astronauts (HKLM-x32\...\Unsolved Mystery Club - Ancient Astronauts) (Version: - ) Updater (HKLM-x32\...\{D54E3D9F-FEB8-4D2D-A138-B69A5C80080B}) (Version: 2.6.53 - Creative Island Media, LLC) <==== ACHTUNG Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - ) Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - ) Web Companion (HKLM-x32\...\{503a5c39-884e-4cba-9e30-eacb1b81325c}) (Version: 2.1.1108.2313 - Lavasoft) Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation) WinRAR 5.21 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.21.0 - win.rar GmbH) WinZip 20.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C24101}) (Version: 20.0.11659 - WinZip Computing, S.L. ) ==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) CustomCLSID: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation) CustomCLSID: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32 -> C:\Program Files\WinZip\adxloader64.dll () ==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) ============= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) Task: {011761AD-7FDF-462E-A515-2ABF8A30BCEB} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-04-07] (Adobe Systems Incorporated) Task: {0539AB7B-C0A6-42F0-B8CB-0119260DE526} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\BrowserChoice\browserchoice.exe Task: {08F16DDA-5825-4A48-A46C-DE6E213FAA0D} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2016-03-22] (Microsoft Corporation) Task: {0D652EDE-957F-4837-8DE6-EA03BA82021D} - System32\Tasks\Search Provided by Yahoo litod => Wscript.exe "C:\ProgramData\{CEE80B8B-44AA-814D-C26C-1F0F582E94C1}\dide.txt" "687474703a2f2f7761676e672e636f6d" "433a5c50726f6772616d446174615c7b43454538304238422d343441412d383134442d433236432d3146304635383245393443317d5c6d6f736f7461" "433a5c50726f6772616d446174615c7b43454538304238422d343441412d383134442d433236 (Der Dateneintrag hat 78 mehr Zeichen). Task: {0E212A41-43C5-4E31-9EDB-EC1EC720C262} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.) Task: {24204B2E-0BE0-45F0-9F7A-9FBA23A33D70} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.) Task: {3014A5FD-762C-490E-BD4B-5C96E0AE1E50} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2014-06-24] (Safer-Networking Ltd.) Task: {5039D926-8E19-4B07-8915-38806EFA5509} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2014-06-24] (Safer-Networking Ltd.) Task: {67EABA3D-88EE-4D8D-ADB8-A27840D63463} - System32\Tasks\{4081A24E-DF42-4119-A43A-3BDCBE61108C} => pcalua.exe -a "C:\Program Files (x86)\iMesh Applications\iMesh\uninstall.exe" Task: {6F984935-BD8B-4815-A900-D1596DA9BBD1} - System32\Tasks\Opera scheduled Autoupdate 1442781566 => C:\Program Files (x86)\Opera\launcher.exe [2016-04-11] (Opera Software) Task: {788190E3-6C26-4971-954F-8CA8654008D6} - System32\Tasks\Clteyghuwph System => C:\Program Files (x86)\Clteyghuwph\clteyghuwphSystem.exe [2016-04-12] () Task: {7E9D12FA-7387-4DA4-A9E6-5CCE304263B2} - System32\Tasks\Synaptics TouchPad Enhancements => Program Files\Synaptics\SynTP\SynTPEnh.exe Task: {83632A60-0338-4F8B-B5BE-F31623FE621F} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2016-02-09] (Microsoft Corporation) Task: {B353DCC0-6453-4226-BDE2-8288B8E744C8} - System32\Tasks\Dolby Selector => C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [2012-08-31] (Dolby Laboratories Inc.) Task: {C626ED21-6382-4DE3-8F98-58C25FD091BC} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2016-02-09] (Microsoft Corporation) Task: {D90AC541-5D08-481E-B606-E24F068C2C75} - System32\Tasks\{2FE13EE9-AE44-25EE-1098-2BDFFC5F70F9} => C:\Users\Schatz\AppData\Local\{B9D18~1\UNINST~1.EXE [2013-05-03] () (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.) Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\WINDOWS\Tasks\Search Provided by Yahoo litod.job => Wscript.exe C:\ProgramData\{CEE80B8B-44AA-814D-C26C-1F0F582E94C1}\dide.txt <==== ACHTUNG Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe Task: C:\WINDOWS\Tasks\{2FE13EE9-AE44-25EE-1098-2BDFFC5F70F9}.job => C:\Users\Schatz\AppData\Local\{B9D18~1\UNINST~1.EXE ==================== Verknüpfungen ============================= (Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.) Shortcut: C:\Users\Schatz\Desktop\Neuer Ordner\router\FRITZ!Box\reconnect.bat - Verknüpfung.lnk -> D:\Dokumente\Visual Studio 2005\Projects\Linker\Linker\bin\Release\CryptLoad_Secure\router\FRITZ!Box\reconnect.bat (Keine Datei) ==================== Geladene Module (Nicht auf der Ausnahmeliste) ============== 2012-11-30 13:41 - 2012-11-29 15:53 - 00805888 _____ () C:\Program Files (x86)\PHotkey\GFNEXSrv.exe 2016-03-18 22:56 - 2016-03-18 22:56 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll 2016-03-18 22:56 - 2016-03-18 22:56 - 01329936 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll 2015-06-18 20:29 - 2015-10-13 05:34 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll 2011-03-14 17:27 - 2011-03-14 17:27 - 00346976 _____ () C:\ProgramData\DatacardService\HWDeviceService64.exe 2014-04-22 19:23 - 2014-04-22 19:23 - 00239968 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe 2012-11-28 11:35 - 2012-10-19 13:27 - 00386344 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe 2012-11-30 13:41 - 2012-11-27 17:18 - 02215424 _____ () C:\Program Files (x86)\PHotkey\PHotkey.exe 2012-11-30 13:41 - 2010-01-12 19:36 - 00117256 _____ () C:\Program Files (x86)\PHotkey\MsgTranAgt.exe 2012-11-30 13:41 - 2010-01-12 19:36 - 00121864 _____ () C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe 2012-11-30 13:41 - 2010-12-17 16:04 - 00449032 _____ () C:\Program Files (x86)\PHotkey\ATouch64.exe 2012-11-30 13:41 - 2012-10-23 20:07 - 03471872 _____ () C:\Program Files (x86)\PHotkey\POSD.exe 2012-11-30 13:41 - 2012-08-08 20:10 - 07536128 _____ () C:\Program Files (x86)\PHotkey\GPMTray.exe 2016-04-14 22:54 - 2016-04-14 22:54 - 03670016 _____ () C:\Users\Schatz\Downloads\adwcleaner_5.111.exe 2014-04-22 19:23 - 2014-04-22 19:23 - 00011362 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\mingwm10.dll 2014-04-22 19:23 - 2014-04-22 19:23 - 00043008 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\libgcc_s_dw2-1.dll 2014-04-22 19:23 - 2014-04-22 19:23 - 02415104 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QtCore4.dll 2014-04-22 19:23 - 2014-04-22 19:23 - 01148416 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QtNetwork4.dll 2014-04-22 19:23 - 2014-04-22 19:23 - 00383488 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QueryStrategy.dll 2014-04-22 19:23 - 2014-04-22 19:23 - 00398336 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QtXml4.dll 2015-01-18 21:13 - 2014-05-13 13:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl 2015-01-18 21:13 - 2014-05-13 13:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl 2015-01-18 21:13 - 2014-05-13 13:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl 2015-01-18 21:13 - 2012-08-23 11:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll 2015-01-18 21:13 - 2012-04-03 18:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll 2012-11-30 13:41 - 2009-12-18 17:36 - 00973432 _____ () C:\Program Files (x86)\PHotkey\acAuth.dll 2012-11-30 13:41 - 2009-12-18 17:41 - 00129544 _____ () C:\Program Files (x86)\PHotkey\GFNEX.dll 2012-11-23 05:16 - 2012-06-25 11:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll 2016-03-18 22:56 - 2016-03-18 22:56 - 01040656 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll 2016-03-18 22:56 - 2016-03-18 22:56 - 00080184 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll 2016-04-14 21:53 - 2016-04-14 21:52 - 63830568 _____ () C:\Program Files (x86)\Opera\36.0.2130.65\opera.dll 2016-04-14 21:52 - 2016-04-14 21:50 - 02134568 _____ () C:\Program Files (x86)\Opera\36.0.2130.65\libglesv2.dll 2016-04-14 21:52 - 2016-04-14 21:50 - 00082472 _____ () C:\Program Files (x86)\Opera\36.0.2130.65\libegl.dll ==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) ========= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.) AlternateDataStreams: C:\ProgramData\Temp:FC595E85 [286] ==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) =================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.) ==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) =============== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.) ==================== Internet Explorer Vertrauenswürdig/Eingeschränkt =============== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.) IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com Da befinden sich 7866 mehr Seiten. IE trusted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\localhost -> localhost IE trusted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\webcompanion.com -> hxxp://webcompanion.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\007guard.com -> install.007guard.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\008i.com -> 008i.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\008k.com -> www.008k.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\00hq.com -> www.00hq.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\010402.com -> 010402.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\0scan.com -> www.0scan.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\1-2005-search.com -> www.1-2005-search.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\1-domains-registrations.com -> www.1-domains-registrations.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\1000gratisproben.com -> www.1000gratisproben.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\1001namen.com -> www.1001namen.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\100888290cs.com -> mir.100888290cs.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\100sexlinks.com -> www.100sexlinks.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\10sek.com -> www.10sek.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\12-26.net -> user1.12-26.net IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\12-27.net -> user1.12-27.net IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\123fporn.info -> www.123fporn.info IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\123haustiereundmehr.com -> www.123haustiereundmehr.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\123moviedownload.com -> www.123moviedownload.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\123simsen.com -> www.123simsen.com Da befinden sich 7866 mehr Seiten. ==================== Hosts Inhalt: ========================== (Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.) 2013-08-22 15:25 - 2016-04-12 22:21 - 00001006 ____N C:\WINDOWS\system32\Drivers\etc\hosts 127.0.0.1 down.baidu2016.com 127.0.0.1 123.sogou.com 127.0.0.1 www.czzsyzgm.com 127.0.0.1 www.czzsyzxl.com 127.0.0.1 union.baidu2019.com ==================== Andere Bereiche ============================ (Aktuell gibt es keinen automatisierten Fix für diesen Bereich.) HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\Control Panel\Desktop\\Wallpaper -> DNS Servers: 192.168.0.1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) Windows Firewall ist aktiviert. ==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge == (Aktuell gibt es keinen automatisierten Fix für diesen Bereich.) HKLM\...\StartupApproved\Run32: => "Iminent" HKLM\...\StartupApproved\Run32: => "IminentMessenger" HKLM\...\StartupApproved\Run32: => "QuickTime Task" HKLM\...\StartupApproved\Run32: => "iTunesHelper" HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\StartupApproved\Run: => "icq" HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\StartupApproved\Run: => "iMesh" HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\StartupApproved\Run: => "Sony PC Companion" ==================== Firewall Regeln (Nicht auf der Ausnahmeliste) =============== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139 FirewallRules: [{59EC4CF5-609E-422F-8042-D9CDE0EB6829}] => (Allow) C:\Users\Schatz\AppData\Local\Microsoft\OneDrive\OneDrive.exe FirewallRules: [{C6EEC361-CE32-4231-ADDE-E5A7C67BEEFB}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe FirewallRules: [{5B967B63-630B-40F4-88C8-61F6D752D127}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{D6ACFA72-D875-4A6E-8D34-1C6AD3F3A06E}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{4F182DE5-4F27-4D5B-8701-9722B9F8662E}] => (Allow) C:\Users\Schatz\AppData\Local\Torch\Plugins\Hola\hola_plugin_x64.exe FirewallRules: [TCP Query User{BE4E9FEC-D914-4E4F-926F-E01F5DE598C1}C:\program files (x86)\cyberlink\powerdvd10\pdvd10serv.exe] => (Allow) C:\program files (x86)\cyberlink\powerdvd10\pdvd10serv.exe FirewallRules: [UDP Query User{9CD2DAFF-8500-4EF6-BBF2-E4F1F79E2001}C:\program files (x86)\cyberlink\powerdvd10\pdvd10serv.exe] => (Allow) C:\program files (x86)\cyberlink\powerdvd10\pdvd10serv.exe FirewallRules: [TCP Query User{4E9A1825-1730-44D7-8A82-7646F852914A}C:\program files (x86)\cyberlink\powerdvd10\pdvd10serv.exe] => (Block) C:\program files (x86)\cyberlink\powerdvd10\pdvd10serv.exe FirewallRules: [UDP Query User{505D4722-8D42-4D76-99DB-65DFF02FC215}C:\program files (x86)\cyberlink\powerdvd10\pdvd10serv.exe] => (Block) C:\program files (x86)\cyberlink\powerdvd10\pdvd10serv.exe FirewallRules: [{1E1249F9-4AEB-41B9-9534-E10A4AD394C2}] => (Allow) C:\Program Files (x86)\SpringFiles\SpringFiles.exe FirewallRules: [{DAD41EE2-07B1-45C1-87CA-AAB75AEA648E}] => (Allow) C:\Program Files (x86)\SpringFiles\SpringFiles.exe FirewallRules: [{EB85DE1E-22DB-4D7A-9929-4B1B2E98F7C7}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{2AF39E2D-44C3-4877-AACE-797D2BAB21DD}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{2CDD11C8-6D06-4571-AED2-0CC8596C9660}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{7C84D8A8-C127-4CE3-AF1E-985C5A1D50AA}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{8ED0F09F-D5B2-4021-9172-C6B1B1896518}] => (Allow) C:\Program Files\iTunes\iTunes.exe FirewallRules: [{7896FC6A-3D88-4BAD-ACE2-9D3EF6E710C8}] => (Allow) C:\Users\Schatz\AppData\Local\Chromium\Application\chrome.exe StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service ==================== Wiederherstellungspunkte ========================= 06-04-2016 09:40:02 Windows Update 10-04-2016 07:27:11 Windows Update 14-04-2016 00:47:36 Windows Update 14-04-2016 23:14:13 JRT Pre-Junkware Removal ==================== Fehlerhafte Geräte im Gerätemanager ============= ==================== Fehlereinträge in der Ereignisanzeige: ========================= Applikationsfehler: ================== Error: (04/15/2016 10:18:39 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: ) Description: Subscription licensing service failed: -1073422302 Error: (04/15/2016 10:08:19 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 81541907 Error: (04/15/2016 10:08:19 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 81541907 Error: (04/15/2016 10:08:19 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (04/14/2016 11:03:25 PM) (Source: Avira Service Host) (EventID: 0) (User: ) Description: Der Dienst kann nicht gestartet werden. Der Dienstprozess konnte keine Verbindung mit dem Dienstcontroller herstellen Error: (04/14/2016 10:59:44 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: Avira.ServiceHost.exe, Version: 1.1.56.9119, Zeitstempel: 0x56a8ea7a Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.18264, Zeitstempel: 0x56e1b34d Ausnahmecode: 0xe0434352 Fehleroffset: 0x00015b68 ID des fehlerhaften Prozesses: 0x17e4 Startzeit der fehlerhaften Anwendung: 0xAvira.ServiceHost.exe0 Pfad der fehlerhaften Anwendung: Avira.ServiceHost.exe1 Pfad des fehlerhaften Moduls: Avira.ServiceHost.exe2 Berichtskennung: Avira.ServiceHost.exe3 Vollständiger Name des fehlerhaften Pakets: Avira.ServiceHost.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Avira.ServiceHost.exe5 Error: (04/14/2016 10:59:42 PM) (Source: .NET Runtime) (EventID: 1026) (User: ) Description: Anwendung: Avira.ServiceHost.exe Frameworkversion: v4.0.30319 Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet. Ausnahmeinformationen: System.ComponentModel.Composition.CompositionException Stapel: bei System.ComponentModel.Composition.Hosting.CompositionServices.GetExportedValueFromComposedPart(System.ComponentModel.Composition.Hosting.ImportEngine, System.ComponentModel.Composition.Primitives.ComposablePart, System.ComponentModel.Composition.Primitives.ExportDefinition) bei System.ComponentModel.Composition.Hosting.CatalogExportProvider.GetExportedValue(CatalogPart, System.ComponentModel.Composition.Primitives.ExportDefinition, Boolean) bei System.ComponentModel.Composition.Hosting.CatalogExportProvider+CatalogExport.GetExportedValueCore() bei System.ComponentModel.Composition.Primitives.Export.get_Value() bei System.ComponentModel.Composition.ExportServices.GetCastedExportedValue[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.ComponentModel.Composition.Primitives.Export) bei System.ComponentModel.Composition.Hosting.ExportProvider.GetExportedValueCore[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.String, System.ComponentModel.Composition.Primitives.ImportCardinality) bei Avira.OE.ServiceHost.ServiceHost.Initialize() bei Avira.OE.ServiceHost.Program+<>c__DisplayClass1.<OnServiceStart>b__0(System.Object) bei System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object) bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem() bei System.Threading.ThreadPoolWorkQueue.Dispatch() bei System.Threading._ThreadPoolWaitCallback.PerformWaitCallback() Error: (04/14/2016 10:45:29 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: Lavasoft.SearchProtect.WinService.exe, Version: 1.0.0.0, Zeitstempel: 0x55ef18d9 Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.18264, Zeitstempel: 0x56e1bd71 Ausnahmecode: 0xe0434f4d Fehleroffset: 0x0000000000008a5c ID des fehlerhaften Prozesses: 0x17b0 Startzeit der fehlerhaften Anwendung: 0xLavasoft.SearchProtect.WinService.exe0 Pfad der fehlerhaften Anwendung: Lavasoft.SearchProtect.WinService.exe1 Pfad des fehlerhaften Moduls: Lavasoft.SearchProtect.WinService.exe2 Berichtskennung: Lavasoft.SearchProtect.WinService.exe3 Vollständiger Name des fehlerhaften Pakets: Lavasoft.SearchProtect.WinService.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Lavasoft.SearchProtect.WinService.exe5 Error: (04/14/2016 10:35:32 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: svchost.exe_PcaSvc, Version: 6.3.9600.17415, Zeitstempel: 0x54504177 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.3.9600.18194, Zeitstempel: 0x56951674 Ausnahmecode: 0xc0000008 Fehleroffset: 0x00000000000925fa ID des fehlerhaften Prozesses: 0x404 Startzeit der fehlerhaften Anwendung: 0xsvchost.exe_PcaSvc0 Pfad der fehlerhaften Anwendung: svchost.exe_PcaSvc1 Pfad des fehlerhaften Moduls: svchost.exe_PcaSvc2 Berichtskennung: svchost.exe_PcaSvc3 Vollständiger Name des fehlerhaften Pakets: svchost.exe_PcaSvc4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: svchost.exe_PcaSvc5 Error: (04/14/2016 10:00:02 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Programm Winzipro.exe, Version 2.0.72.3001 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: fe0 Startzeit: 01d1968635572989 Endzeit: 808 Anwendungspfad: C:\Program Files (x86)\WinZip Registry Optimizer\Winzipro.exe Berichts-ID: 73c02385-027b-11e6-bec1-84a6c8f9a492 Vollständiger Name des fehlerhaften Pakets: Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Systemfehler: ============= Error: (04/15/2016 10:57:10 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "IE Search Set" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (04/15/2016 10:56:53 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "Mobile Partner. OUC" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (04/15/2016 10:56:53 PM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Mobile Partner. OUC erreicht. Error: (04/15/2016 10:56:17 PM) (Source: Microsoft-Windows-TaskScheduler) (EventID: 413) (User: NT-AUTORITÄT) Description: Beim Start des Aufgabenplanungsdiensts konnten Aufgaben nicht geladen werden. Zusätzliche Daten: Fehlerwert: 2147942402. Error: (04/14/2016 11:05:39 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "Sosition Reports" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (04/14/2016 11:03:34 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Der Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts. Error: (04/14/2016 11:03:12 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "IE Search Set" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (04/14/2016 11:02:58 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "Mobile Partner. OUC" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (04/14/2016 11:02:58 PM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Mobile Partner. OUC erreicht. Error: (04/14/2016 11:01:06 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT) Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet. Modulpfad: C:\WINDOWS\System32\IWMSSvc.dll ==================== Speicherinformationen =========================== Prozessor: Intel(R) Celeron(R) CPU 1000M @ 1.80GHz Prozentuale Nutzung des RAM: 53% Installierter physikalischer RAM: 3977.11 MB Verfügbarer physikalischer RAM: 1855.8 MB Summe virtueller Speicher: 5129.11 MB Verfügbarer virtueller Speicher: 2291.94 MB ==================== Laufwerke ================================ Drive c: (Boot) (Fixed) (Total:403.61 GB) (Free:336.24 GB) NTFS Drive d: (Recover) (Fixed) (Total:60 GB) (Free:35.17 GB) NTFS ==================== MBR & Partitionstabelle ================== ======================================================== Disk: 0 (Size: 465.8 GB) (Disk ID: 00000000) Partition: GPT. ==================== Ende von Addition.txt ============================ |
15.04.2016, 22:48 | #5 |
| Trotz Malwarebytes und Adawarecleaner PopupfensterCode:
ATTFilter <?xml version="1.0" encoding="UTF-16" ?> <mbam-log> <header> <date>2016/04/15 22:11:05 +0200</date> <logfile>mbam-log-2016-04-15 (22-09-56).xml</logfile> <isadmin>yes</isadmin> </header> <engine> <version>2.2.1.1043</version> <malware-database>v2016.04.15.05</malware-database> <rootkit-database>v2016.04.09.01</rootkit-database> <license>trial</license> <file-protection>enabled</file-protection> <web-protection>enabled</web-protection> <self-protection>disabled</self-protection> </engine> <system> <hostname>SCHWARZEGIRL</hostname> <ip>192.168.0.29</ip> <osversion>Windows 8.1</osversion> <arch>x64</arch> <username>Schatz</username> <filesys>NTFS</filesys> </system> <summary> <type>threat</type> <result>completed</result> <objects>360877</objects> <time>1310</time> <processes>0</processes> <modules>0</modules> <keys>0</keys> <values>1</values> <datas>1</datas> <folders>54</folders> <files>179</files> <sectors>0</sectors> </summary> <options> <memory>enabled</memory> <startup>enabled</startup> <filesystem>enabled</filesystem> <archives>enabled</archives> <rootkits>disabled</rootkits> <deeprootkit>disabled</deeprootkit> <heuristics>enabled</heuristics> <pup>enabled</pup> <pum>enabled</pum> </options> <items> <value><path>HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS</path><valuename>AutoConfigUrl</valuename><vendor>Hijack.AutoConfigURL.ShrtCln</vendor><action>success</action><valuedata>hxxp://stopblock.me/wpad.dat?35ade8c4837d2e8a8976f6dffa3d5efb227413</valuedata><hash>42df139c99006dc97d929ae1a0648c74</hash></value> <data><path>HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES</path><valuename>DefaultScope</valuename><vendor>PUP.Optional.Qone8</vendor><action>replaced</action><valuedata>{33BB0A4E-99AF-4226-BDF6-49120163DE86}</valuedata><baddata>{33BB0A4E-99AF-4226-BDF6-49120163DE86}</baddata><gooddata>{0633EE93-D776-472f-A0FF-E1416B8B2E3A}</gooddata><hash>e73a7d32aeebb97dba9b81b6887d0ff1</hash></data> <folder><path>C:\Users\Schatz\AppData\Roaming\updates</path><vendor>PUP.Optional.PCProCleaner</vendor><action>success</action><hash>978ac9e60d8cc571adc2e374e71d0af6</hash></folder> <folder><path>C:\Users\Schatz\Documents\PPC-software</path><vendor>PUP.Optional.ProCleaningSoftware</vendor><action>success</action><hash>f1307936afea82b413cb069fda2ab848</hash></folder> <folder><path>C:\Program Files (x86)\Sosition</path><vendor>PUP.Optional.YesSearches</vendor><action>success</action><hash>928fb8f76336e94dbe25aff8fd070ff1</hash></folder> <folder><path>C:\Program Files (x86)\hohobnd</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></folder> <folder><path>C:\Program Files (x86)\hohobnd\dmp</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></folder> <folder><path>C:\Program Files (x86)\hohobnd\dmp\CCeuter.exe</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></folder> <folder><path>C:\Program Files (x86)\hohobnd\dmp\ghabuk.exe</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></folder> <folder><path>C:\Program Files (x86)\hohobnd\dmp\SstrprSrv.exe</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></folder> <folder><path>C:\Program Files (x86)\hohobnd\dmp\SstrprTsk.exe</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}</path><vendor>PUP.Optional.SetSearchSetting</vendor><action>success</action><hash>c35e7e319efbea4c0f1f95cf947106fa</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adblockplus</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz\antitracking</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz\telemetry-categories</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz_thumbnails</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\crashes</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\crashes\events</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\datareporting</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\components</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\META-INF</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\gmp</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\healthreport</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\gmp-gmpopenh264</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\gmp-gmpopenh264\1.1</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\gmp-gmpopenh264\1.3</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\searchplugins</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\minidumps</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionstore-backups</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\chrome</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\chrome\idb</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\chrome\idb\2588645841ssegtnti</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++web.de</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++web.de\idb</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++web.de\idb\301792106ttes</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++www.amazon.de</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++www.amazon.de\idb</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++www.amazon.de\idb\2153786202SecrroitpSt</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\moz-safe-about+home</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\moz-safe-about+home\idb</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\moz-safe-about+home\idb\818200132aebmoouht</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\temporary</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\temporary\https+++www.facebook.com</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\temporary\https+++www.facebook.com\asmjs</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\webapps</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder> <file><path>C:\Program Files (x86)\hohobnd\CCeuter.exe</path><vendor>PUP.Optional.YesSearches</vendor><action>success</action><hash>7fa2fcb354452e080a055ecb10f26d93</hash></file> <file><path>C:\Program Files (x86)\hohobnd\FFeuter.exe</path><vendor>PUP.Optional.YesSearches</vendor><action>success</action><hash>45dcddd2e7b2a393119955d3877bfc04</hash></file> <file><path>C:\Users\Schatz\Downloads\iMeshSetup-r1487-w-bf.exe</path><vendor>PUP.Optional.iMeshMusicBoxTB</vendor><action>success</action><hash>938e08a7a3f61422401b400e2fd250b0</hash></file> <file><path>C:\Users\Schatz\Downloads\SoftonicDownloader_fuer_icq(1).exe</path><vendor>PUP.Optional.SofTonic</vendor><action>success</action><hash>9b86149b178270c61b3d1d2ee71abc44</hash></file> <file><path>C:\Users\Schatz\Downloads\CDex_TSV44ML77.exe</path><vendor>PUP.Optional.Conduit</vendor><action>success</action><hash>9f82ebc46237e6507b21b19b1de4837d</hash></file> <file><path>C:\Users\Schatz\Downloads\CryptLoad_1.1.8.rar</path><vendor>PUP.Optional.NetCat</vendor><action>success</action><hash>849d901f2574a98de78f0c80df233dc3</hash></file> <file><path>C:\Users\Schatz\Downloads\SoftonicDownloader_fuer_icq.exe</path><vendor>PUP.Optional.SofTonic</vendor><action>success</action><hash>5bc609a6ff9afc3a74e459f2e120b24e</hash></file> <file><path>C:\Windows\Installer\57a7d3b8.msi</path><vendor>PUP.Optional.Iminent</vendor><action>success</action><hash>10112c834356c86e7be72b23966b06fa</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\adbeaverSG@adbeaver.org.xpi</path><vendor>PUP.Optional.AdBeaver</vendor><action>success</action><hash>3ce5604fe5b443f33c28ee4a72918977</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\adbeaverSG@adbeaver.org.xpi</path><vendor>PUP.Optional.AdBeaver</vendor><action>success</action><hash>48d9872804954aec85df25136e9528d8</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\updates\updates.aiu</path><vendor>PUP.Optional.PCProCleaner</vendor><action>success</action><hash>978ac9e60d8cc571adc2e374e71d0af6</hash></file> <file><path>C:\Users\Schatz\Documents\PPC-software\logerror.txt</path><vendor>PUP.Optional.ProCleaningSoftware</vendor><action>success</action><hash>f1307936afea82b413cb069fda2ab848</hash></file> <file><path>C:\Program Files (x86)\Sosition\{A16B1AF7-982D-40C3-B5C1-633E1A6A6678}</path><vendor>PUP.Optional.YesSearches</vendor><action>success</action><hash>928fb8f76336e94dbe25aff8fd070ff1</hash></file> <file><path>C:\Windows\System32\Tasks\Sosition Reports</path><vendor>PUP.Optional.YesSearches</vendor><action>success</action><hash>bb66802fadec1125994cffa8f60ed030</hash></file> <file><path>C:\Program Files (x86)\hohobnd\conf.json</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></file> <file><path>C:\Program Files (x86)\hohobnd\@E9438230-A7DF-4D1F-8F2D-CA1D0F0F7924.xpi</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></file> <file><path>C:\Program Files (x86)\hohobnd\Uninst.exe</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></file> <file><path>C:\Program Files (x86)\hohobnd\{A16B1AF7-982D-40C3-B5C1-633E1A6A6678}</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}\install.rdf</path><vendor>PUP.Optional.SetSearchSetting</vendor><action>success</action><hash>c35e7e319efbea4c0f1f95cf947106fa</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}\bootstrap.js</path><vendor>PUP.Optional.SetSearchSetting</vendor><action>success</action><hash>c35e7e319efbea4c0f1f95cf947106fa</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}\search.json</path><vendor>PUP.Optional.SetSearchSetting</vendor><action>success</action><hash>c35e7e319efbea4c0f1f95cf947106fa</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\prefs.js</path><vendor>PUP.Optional.DeskCut</vendor><action>replaced</action><baddata>deskCutv2@gmail.com</baddata><gooddata></gooddata><hash>889957581f7adc5a9ff1a8c15da8a15f</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js</path><vendor>PUP.Optional.DeskCut</vendor><action>replaced</action><baddata>deskCutv2@gmail.com</baddata><gooddata></gooddata><hash>cd54416ecdcc2a0cf79944252dd8dd23</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\searchplugins\DD1B66D4.xml</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>c160c2eda3f6b3832205c99e19ecba46</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adbeaver-log.txt</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\addons.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\addons.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\addons.sqlite-journal</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\blocklist.xml</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cert8.db</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils.zip</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz.db</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz.dbattrack</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz.dbhumanweb</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz.dbusafe</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\compatibility.ini</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\content-prefs.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cookies.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cookies.sqlite-shm</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cookies.sqlite-wal</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions.ini</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions.sqlite.protect</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\formhistory.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\healthreport.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\healthreport.sqlite-shm</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\healthreport.sqlite-wal</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\key3.db</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\lightnings.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\localstore.rdf</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\logins.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\marionette.log</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\smartcliqz-custom-data-cache.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\mimeTypes.rdf</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\permissions.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\places.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\places.sqlite-shm</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\places.sqlite-wal</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\pluginreg.dat</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\search-metadata.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\secmod.db</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionCheckpoints.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionstore.bak</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionstore.bak-20140825202822</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionstore.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\signons.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\SiteSecurityServiceState.txt</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\Telemetry.FailedProfileLocks.txt</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\times.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\urlclassifierkey3.txt</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\webappsstore.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\webappsstore.sqlite-shm</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\webappsstore.sqlite-wal</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\xulstore.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adblockplus\elemhide.css</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adblockplus\patterns-backup1.ini</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adblockplus\patterns-backup2.ini</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adblockplus\patterns-backup3.ini</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adblockplus\patterns-backup4.ini</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adblockplus\patterns-backup5.ini</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adblockplus\patterns.ini</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-02-15_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-02-17_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-02-19_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-02-26_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-03-05_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-03-23_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-03-27_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-03-31_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-04-22_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-08-17_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-09-18_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-12-07_28_5LeUQwpRPS1lEGYQvcieDA==.jsonlz4</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2015-11-15_28_lk0H1mCFKKIDCLw+hlHIaQ==.jsonlz4</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2016-04-07_29_ElanrkgLfmTAFxN436P3Bw==.jsonlz4</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\certutil.exe</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\freebl3.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\libnspr4.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\libplc4.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\libplds4.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\msvcr100.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\nss3.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\nssckbi.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\nssdbm3.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\nssutil3.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\smime3.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\softokn3.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\sqlite3.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\ssl3.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz\smartcliqz-trigger-urls-cache.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz\antitracking\cookie_whitelist.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz\antitracking\tracker_owners.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz\telemetry-categories\categories.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\crashes\store.json.mozlz4</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\datareporting\state.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\cliqz@cliqz.com.xpi</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\{b5ff4533-981b-4303-87ae-ff7b33382325}.xpi</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\chrome.jar</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\chrome.manifest</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\install.rdf</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\components\aboutNetError.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\components\mCollectAutoComplete.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-debug.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-general.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-highlight.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-login.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-neterror.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-newtab.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-pref.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-search.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-shopping.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-tracking.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-util.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\META-INF\manifest.mf</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\META-INF\mozilla.rsa</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\META-INF\mozilla.sf</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}\bootstrap.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}\install.rdf</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}\search.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\healthreport\state.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\gmp-gmpopenh264\1.1\gmpopenh264.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\gmp-gmpopenh264\1.1\gmpopenh264.info</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\gmp-gmpopenh264\1.3\gmpopenh264.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\gmp-gmpopenh264\1.3\gmpopenh264.info</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\searchplugins\bing-lavasoft.xml</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\searchplugins\youtube.xml</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\minidumps\16595f46-1b5b-4859-94ae-c8d31ba7fdc4.dmp</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\minidumps\18940f69-c432-49bd-a7ed-9ca8c0bfdd9e.dmp</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\minidumps\222ba3f1-322f-48cf-a608-a563f8142d64.dmp</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\minidumps\222ba3f1-322f-48cf-a608-a563f8142d64.extra</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\minidumps\49062ef6-033e-4fe6-b2cf-910ae14e6804.dmp</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\minidumps\9130cf14-4bb0-49ce-a24c-56d92ccdf2fa.dmp</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\minidumps\9130cf14-4bb0-49ce-a24c-56d92ccdf2fa.extra</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionstore-backups\previous.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionstore-backups\recovery.bak</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionstore-backups\recovery.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionstore-backups\upgrade.js-20150108202552</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\chrome\.metadata</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\chrome\idb\2588645841ssegtnti.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++web.de\.metadata</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++web.de\idb\301792106ttes.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++www.amazon.de\.metadata</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++www.amazon.de\idb\2153786202SecrroitpSt.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\moz-safe-about+home\.metadata</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\moz-safe-about+home\idb\818200132aebmoouht.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\temporary\https+++www.facebook.com\.metadata</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\temporary\https+++www.facebook.com\asmjs\metadata</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\temporary\https+++www.facebook.com\asmjs\module13</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\temporary\https+++www.facebook.com\asmjs\module14</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\temporary\https+++www.facebook.com\asmjs\module15</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\webapps\webapps.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js</path><vendor>PUP.Optional.HohoSearch</vendor><action>replaced</action><baddata>user_pref("browser.search.searchengine.hp", "hxxp://www.hohosearch.com/?ts=AHEqA3EtAHMlBE..&v=20160412&uid=E9FA6529327CEEC1BDEC07434F4F02E2&ptid=epf2&mode=ffsengext"</baddata><gooddata></gooddata><hash>63be7e31841561d52267e384cb3a2dd3</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js</path><vendor>PUP.Optional.HohoSearch</vendor><action>replaced</action><baddata>ile the application is running, * the changes will be overwritten when the application exits. * * To make a manual change to preferences, you can visit the URL about:config */ user_p</baddata><gooddata></gooddata><hash>4bd63e7110899d99ee9ba3c416efb44c</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js</path><vendor>PUP.Optional.HohoSearch</vendor><action>replaced</action><baddata>ning, * the changes will be overwritten when the application exits. * * To make a manual change to preferences, you can visit the URL about:config */ user_pref("accessibility.typeahea</baddata><gooddata></gooddata><hash>57ca129d712849edf49524439b6a55ab</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js</path><vendor>PUP.Optional.WinYahoo</vendor><action>replaced</action><baddata>user_pref("browser.startup.homepage", "https://de.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_adsafld_16_15&param1=1&param2=f%3D1%26b%3DFirefox%26cc%3Dde%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzuzzyE0AyC0Czz0Fzy0 AyEzytBtD0DtDyDtN0D0Tzu0StCyDyCtAtN1L2XzutAtFtBtDtFtCtFtBtN1L1Czu1BtBtN1L1G1B1V1N2Y1L1Qzu2StAtByByEyCyEtBtBtGyD0EtDtAtGzzyB0E0FtGtC0ByBzytGzztBzy0AtC0 Dzz0FyBzytDyB2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0Azy0FyByCtCyBtAtGyCtA0DyDtGyEtC0F0DtGzyyDyEtDtG0DtD0C0AtB0AtD0F0DyD0F0C2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCzzyDtA%26 cr%3D489122474%26a%3Dwbf_adsafld_16_15%26os_ver%3D6.3%26os%3DWindows%2B8.1"</baddata><gooddata>user_pref("browser.startup.homepage", "https://www.malwarebytes.org/restorebrowser/</gooddata><hash>27fa3b74891042f4d2b3006918ed49b7</hash></file> <file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js</path><vendor>PUP.Optional.DeskCut</vendor><action>replaced</action><baddata>deskCutv2@gmail.com</baddata><gooddata></gooddata><hash>e8390ca32f6a201619773732818454ac</hash></file> </items> </mbam-log> Code:
ATTFilter Adaware Cleaner hat keine Bedrohung gefunden |
17.04.2016, 04:23 | #6 |
/// Malwareteam | Trotz Malwarebytes und Adawarecleaner Popupfenster Schritt: 1 Lade Dir bitte von hier Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
Hinweis: Falls bei der Deinstallation zu Beginn ein Fehler auftritt oder du den aufgerufenen Uninstaller nicht bedienen kannst, breche dieses Setup einfach ab und fahre mit der Entfernung durch Revo wie oben beschrieben fort. Schritt: 2 Starte bitte wieder Malwarebytes Anti-Malware
Schritt: 3 Bitte entferne evtl. alte Versionen auf deinem PC. Downloade Dir bitte AdwCleaner auf deinen Desktop.
Schritt: 4 Bitte starte wieder FRST, setze den Haken bei Addition und drücke auf Untersuchen. Poste bitte wieder die beiden Textdateien, die so entstehen.
__________________ --> Trotz Malwarebytes und Adawarecleaner Popupfenster |
21.04.2016, 20:58 | #7 |
| Trotz Malwarebytes und Adawarecleaner PopupfensterCode:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlaufdatum: 21.04.2016 Suchlaufzeit: 20:47 Protokolldatei: mbam.txt Administrator: Ja Version: 2.2.1.1043 Malware-Datenbank: v2016.04.21.05 Rootkit-Datenbank: v2016.04.17.01 Lizenz: Testversion Malware-Schutz: Aktiviert Schutz vor bösartigen Websites: Aktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 8.1 CPU: x64 Dateisystem: NTFS Benutzer: Schatz Suchlauftyp: Bedrohungssuchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 361745 Abgelaufene Zeit: 36 Min., 37 Sek. Speicher: Aktiviert Start: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (keine bösartigen Elemente erkannt) Module: 0 (keine bösartigen Elemente erkannt) Registrierungsschlüssel: 6 PUP.Optional.YesSearches, HKU\S-1-5-18\SOFTWARE\{A16B1AF7-982D-40C3-B5C1-633E1A6A6678}, In Quarantäne, [7702723fb7e285b1332bedd56d95cb35], PUP.Optional.YesSearches, HKLM\SOFTWARE\{A16B1AF7-982D-40C3-B5C1-633E1A6A6678}, In Quarantäne, [5623c2ef2c6d2610312df0d2c43ea65a], PUP.Optional.WinYahoo, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{0D652EDE-957F-4837-8DE6-EA03BA82021D}, Löschen bei Neustart, [12678c258217c3732363c4eadf257789], PUP.Optional.YesSearches, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{788190E3-6C26-4971-954F-8CA8654008D6}, Löschen bei Neustart, [3e3b961b7d1c989e2c613d71af55619f], PUP.Optional.YesSearches, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Clteyghuwph System, Löschen bei Neustart, [6415bbf6c5d447ef098559559173a15f], PUP.Optional.WinYahoo, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Search Provided by Yahoo litod, Löschen bei Neustart, [e0997a37cdcc81b5028589259272916f], Registrierungswerte: 2 PUP.Optional.WinYahoo, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{0D652EDE-957F-4837-8DE6-EA03BA82021D}|Path, \Search Provided by Yahoo litod, Löschen bei Neustart, [12678c258217c3732363c4eadf257789] PUP.Optional.YesSearches, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{788190E3-6C26-4971-954F-8CA8654008D6}|Path, \Clteyghuwph System, Löschen bei Neustart, [3e3b961b7d1c989e2c613d71af55619f] Registrierungsdaten: 0 (keine bösartigen Elemente erkannt) Ordner: 1 PUP.Optional.YesSearches, C:\Program Files (x86)\Clteyghuwph, In Quarantäne, [abceecc50f8a1a1ca7e1dbd3f60e639d], Dateien: 2 PUP.Optional.WinYahoo, C:\Windows\System32\Tasks\Search Provided by Yahoo litod, In Quarantäne, [7efb4c65a5f495a1ef951f8f34d0926e], PUP.Optional.YesSearches, C:\Program Files (x86)\Clteyghuwph\{A16B1AF7-982D-40C3-B5C1-633E1A6A6678}, In Quarantäne, [abceecc50f8a1a1ca7e1dbd3f60e639d], Physische Sektoren: 0 (keine bösartigen Elemente erkannt) (end) Code:
ATTFilter # AdwCleaner v5.112 - Bericht erstellt am 21/04/2016 um 21:45:59 # Aktualisiert am 17/04/2016 von Xplode # Datenbank : 2016-04-19.5 [Server] # Betriebssystem : Windows 8.1 (X64) # Benutzername : Schatz - SCHWARZEGIRL # Gestartet von : C:\Users\Schatz\AppData\Local\Temp\scoped_dir5260_2502\AdwCleaner_5.112.exe # Option : Löschen # Unterstützung : hxxp://toolslib.net/forum ***** [ Dienste ] ***** ***** [ Ordner ] ***** [-] Ordner gelöscht : C:\Users\Schatz\AppData\Roaming\vnlgp ***** [ Dateien ] ***** ***** [ DLLs ] ***** ***** [ Verknüpfungen ] ***** ***** [ Aufgabenplanung ] ***** ***** [ Registrierungsdatenbank ] ***** [-] Schlüssel gelöscht : HKCU\Software\OCS ***** [ Internetbrowser ] ***** ************************* :: "Image File Execution Options" Schlüssel gelöscht :: "Tracing" Schlüssel gelöscht :: "Prefetch" Dateien gelöscht :: Proxy Einstellungen zurückgesetzt :: Winsock Einstellungen zurückgesetzt :: Internet Explorer Richtlinien gelöscht :: Chrome Richtlinien gelöscht ************************* C:\AdwCleaner\AdwCleaner[C1].txt - [21715 Bytes] - [14/04/2016 22:59:28] C:\AdwCleaner\AdwCleaner[C2].txt - [1177 Bytes] - [21/04/2016 21:45:59] C:\AdwCleaner\AdwCleaner[R0].txt - [50690 Bytes] - [21/01/2015 19:39:55] C:\AdwCleaner\AdwCleaner[S0].txt - [49615 Bytes] - [21/01/2015 19:43:49] C:\AdwCleaner\AdwCleaner[S1].txt - [25299 Bytes] - [14/04/2016 22:56:01] C:\AdwCleaner\AdwCleaner[S2].txt - [1100 Bytes] - [15/04/2016 23:31:49] C:\AdwCleaner\AdwCleaner[S3].txt - [1174 Bytes] - [15/04/2016 23:37:32] C:\AdwCleaner\AdwCleaner[S4].txt - [1461 Bytes] - [21/04/2016 21:43:10] ########## EOF - C:\AdwCleaner\AdwCleaner[C2].txt - [1691 Bytes] ########## Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:18-04-2016 durchgeführt von Schatz (Administrator) auf SCHWARZEGIRL (21-04-2016 21:52:12) Gestartet von C:\Users\Schatz\AppData\Local\Temp\scoped_dir3184_381 Geladene Profile: Schatz (Verfügbare Profile: Schatz) Platform: Windows 8.1 (X64) Sprache: Deutsch (Deutschland) Internet Explorer Version 11 (Standard-Browser: FF) Start-Modus: Normal Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Prozesse (Nicht auf der Ausnahmeliste) ================= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.) (Intel Corporation) C:\Windows\System32\igfxCUIService.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe () C:\Program Files (x86)\PHotkey\GFNEXSrv.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe (CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe (CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe () C:\ProgramData\DatacardService\HWDeviceService64.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (Malwarebytes) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe () C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe () C:\Program Files\CyberLink\Shared files\RichVideo64.exe (Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe () C:\Program Files (x86)\PHotkey\PHotkey.exe () C:\Program Files (x86)\PHotkey\MsgTranAgt.exe () C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe () C:\Program Files (x86)\PHotkey\Atouch64.exe (Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe () C:\Program Files (x86)\PHotkey\POsd.exe () C:\Program Files (x86)\PHotkey\GPMTray.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Intel Corporation) C:\Windows\System32\igfxEM.exe (Intel Corporation) C:\Windows\System32\igfxHK.exe (Intel Corporation) C:\Windows\System32\igfxTray.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe (Nico Mak Computing) C:\Program Files\WinZip\FAHWindow64.exe (McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.11.309\SSScheduler.exe (WinZip Computing, S.L.) C:\Program Files\WinZip\WZUpdateNotifier.exe (Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (WinZip Computing, S.L.) C:\Program Files\WinZip\WzPreloader.exe (CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe (Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Opera Software) C:\Program Files (x86)\Opera\36.0.2130.65\opera.exe (Opera Software) C:\Program Files (x86)\Opera\36.0.2130.65\opera_crashreporter.exe (Opera Software) C:\Program Files (x86)\Opera\36.0.2130.65\opera.exe (Opera Software) C:\Program Files (x86)\Opera\36.0.2130.65\opera.exe (Opera Software) C:\Program Files (x86)\Opera\36.0.2130.65\opera.exe (Opera Software) C:\Program Files (x86)\Opera\36.0.2130.65\opera.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe (Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Farbar) C:\Users\Schatz\Downloads\FRST64 (2).exe ==================== Registry (Nicht auf der Ausnahmeliste) =========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13192848 2012-08-30] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1215632 2012-08-17] (Realtek Semiconductor) HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2930488 2012-09-21] (Synaptics Incorporated) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176952 2016-03-19] (Apple Inc.) HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [258576 2012-07-30] (CyberLink Corp.) HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-09-01] (Intel Corporation) HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink) HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-20] (CyberLink Corp.) HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [807392 2016-03-22] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [67384 2016-03-18] (Apple Inc.) HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [66328 2016-03-30] (Avira Operations GmbH & Co. KG) Winlogon\Notify\igfxcui: igfxdev.dll [X] HKLM\...\Policies\Explorer: [ConfirmFileDelete] 1 HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\Run: [icq] => C:\Users\Schatz\AppData\Roaming\ICQM\icq.exe [28698984 2013-09-25] (ICQ) HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\Run: [Sony PC Companion] => C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [449760 2013-10-31] (Sony) HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.) HKU\S-1-5-18\...\RunOnce: [iCloud] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloud.exe [60688 2015-12-01] (Apple Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FAH.lnk [2016-04-21] ShortcutTarget: FAH.lnk -> C:\Program Files\WinZip\FAHConsole.exe (Nico Mak Computing) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2016-04-21] ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.309\SSScheduler.exe (McAfee, Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Update Benachrichtigungsdienst.lnk [2016-04-21] ShortcutTarget: Update Benachrichtigungsdienst.lnk -> C:\Program Files\WinZip\WZUpdateNotifier.exe (WinZip Computing, S.L.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Preloader.lnk [2016-04-21] ShortcutTarget: WinZip Preloader.lnk -> C:\Program Files\WinZip\WzPreloader.exe (WinZip Computing, S.L.) ==================== Internet (Nicht auf der Ausnahmeliste) ==================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.) Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 Tcpip\..\Interfaces\{2F7FF8A1-BF58-4A03-8C65-E511FFAD4E7F}: [DhcpNameServer] 192.168.0.1 ManualProxies: Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2016-03-22] (Microsoft Corporation) BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2016-04-21] (Microsoft Corporation) Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-06-18] (Microsoft Corporation) StartMenuInternet: IEXPLORE.EXE - iexplore.exe FireFox: ======== FF ProfilePath: C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1 FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_21_0_0_213.dll [2016-04-07] () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_213.dll [2016-04-07] () FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2016-03-08] () FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-06-18] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-09-12] (Microsoft Corporation) FF SearchPlugin: C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\searchplugins\youtube.xml [2015-11-15] FF SearchPlugin: C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\searchplugins\youtube.xml [2015-11-15] FF Extension: WEB.DE MailCheck - C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\extensions\browser-mailcheck@web.de [2016-04-12] FF Extension: DownThemAll! - C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2016-04-13] FF Extension: Kein Name - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 16.0.0\FFExt\light_plugin_firefox [nicht gefunden] FF Extension: WEB.DE MailCheck - C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\Extensions\browser-mailcheck@web.de [2016-04-12] FF Extension: Cliqz - C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\Extensions\cliqz@cliqz.com.xpi [2016-03-22] FF Extension: Adblock Plus - C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-12-08] FF Extension: Cliqz - C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\Extensions\cliqz@cliqz.com.xpi [2016-03-22] FF Extension: Adblock Plus - C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-12-08] FF HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\cliqz@cliqz.com => nicht gefunden ==================== Dienste (Nicht auf der Ausnahmeliste) ======================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [955736 2016-03-22] (Avira Operations GmbH & Co. KG) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [466504 2016-03-22] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [466504 2016-03-22] (Avira Operations GmbH & Co. KG) S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1424880 2016-03-22] (Avira Operations GmbH & Co. KG) R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-03-02] (Apple Inc.) R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [272304 2016-03-30] (Avira Operations GmbH & Co. KG) R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2829552 2016-03-08] (Microsoft Corporation) R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-13] (CyberLink) R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-13] (CyberLink) R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [805888 2012-11-29] () [Datei ist nicht signiert] R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] () R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [319376 2014-10-01] (Intel Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1514464 2016-03-10] (Malwarebytes) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1136608 2016-03-10] (Malwarebytes) S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.309\McCHSvc.exe [293128 2016-03-11] (McAfee, Inc.) S2 Mobile Partner. RunOuc; C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe [239968 2014-04-22] () S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272176 2012-09-24] () R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2012-10-19] () S3 Sony PC Companion; C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe [155824 2013-02-04] (Avanquest Software) [Datei ist nicht signiert] S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-08-22] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-08-22] (Microsoft Corporation) R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [1153840 2012-09-24] (Intel® Corporation) S2 SearchProtectionService; C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WinService.exe [X] ===================== Treiber (Nicht auf der Ausnahmeliste) ========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [150808 2013-11-25] (AVG Technologies CZ, s.r.o.) R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [243480 2013-11-25] (AVG Technologies CZ, s.r.o.) R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [196376 2013-11-25] (AVG Technologies CZ, s.r.o.) R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [294712 2013-10-31] (AVG Technologies CZ, s.r.o.) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128664 2016-03-22] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [137952 2016-03-22] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [35488 2016-01-04] (Avira Operations GmbH & Co. KG) R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [68936 2016-03-22] (Avira Operations GmbH & Co. KG) R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1337216 2012-10-01] (Motorola Solutions, Inc.) R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink) S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation) R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [27008 2016-03-10] (Malwarebytes) R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [192216 2016-04-21] (Malwarebytes) R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [65408 2016-03-10] (Malwarebytes Corporation) R3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3345376 2013-09-04] (Intel Corporation) R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON) S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [41272 2012-09-21] (Synaptics Incorporated) R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [44344 2012-09-21] (Synaptics Incorporated) R3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [47072 2012-10-09] (Windows (R) Win 7 DDK provider) S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-08-22] (Microsoft Corporation) R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [270168 2015-08-22] (Microsoft Corporation) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-08-22] (Microsoft Corporation) R3 XHCIPort; C:\Windows\System32\drivers\XHCIPort.sys [188896 2012-10-09] (Windows (R) Win 7 DDK provider) ==================== NetSvcs (Nicht auf der Ausnahmeliste) =================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) ==================== Ein Monat: Erstellte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2016-04-21 21:51 - 2016-04-21 21:51 - 02375680 _____ (Farbar) C:\Users\Schatz\Downloads\FRST64 (2).exe 2016-04-21 21:51 - 2016-04-21 21:51 - 01726464 _____ (Farbar) C:\Users\Schatz\Downloads\FRST (2).exe 2016-04-21 21:50 - 2016-04-21 21:50 - 01726464 _____ (Farbar) C:\Users\Schatz\Downloads\FRST (1).exe 2016-04-21 21:49 - 2016-04-21 21:49 - 00001773 _____ C:\Users\Schatz\Desktop\AdwCleaner[C2].txt 2016-04-21 21:40 - 2016-04-21 21:40 - 03683904 _____ C:\Users\Schatz\Downloads\AdwCleaner_5.112.exe 2016-04-21 21:27 - 2016-04-21 21:40 - 00002941 _____ C:\Users\Schatz\Desktop\mbam.txt 2016-04-21 17:41 - 2016-04-21 17:42 - 00000085 _____ C:\WINDOWS\wininit.ini 2016-04-21 17:13 - 2016-04-21 21:36 - 00001288 _____ C:\Users\Schatz\Desktop\Revo Uninstaller.lnk 2016-04-21 17:13 - 2016-04-21 17:13 - 00000000 ____D C:\Users\Schatz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller 2016-04-21 17:13 - 2016-04-21 17:13 - 00000000 ____D C:\Program Files (x86)\VS Revo Group 2016-04-21 17:12 - 2016-04-21 17:12 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Schatz\Downloads\revosetup95.exe 2016-04-16 22:50 - 2016-04-16 22:50 - 01733512 _____ (Kaspersky Lab) C:\Users\Schatz\Downloads\kts16.0.0.614a bcden_9319.exe 2016-04-16 22:24 - 2016-04-21 21:36 - 00000949 _____ C:\Users\Schatz\Desktop\VCDEasy.lnk 2016-04-16 22:24 - 2016-04-16 22:24 - 00000000 ____D C:\Users\Schatz\AppData\Roaming\VCDEasy 2016-04-16 22:24 - 2016-04-16 22:24 - 00000000 ____D C:\Users\Schatz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VCDEasy 2016-04-16 22:24 - 2016-04-16 22:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VCDEasy 2016-04-16 22:24 - 2016-04-16 22:24 - 00000000 ____D C:\Program Files (x86)\VCDEasy 2016-04-16 22:18 - 2016-04-16 22:18 - 01475080 _____ C:\Users\Schatz\Downloads\VCDEasy - CHIP-Installer.exe 2016-04-16 22:03 - 2016-04-16 22:03 - 00000000 ____D C:\Users\Schatz\MediaEspresso 2016-04-15 23:40 - 2016-04-21 21:52 - 00000000 ____D C:\FRST 2016-04-15 23:38 - 2016-04-15 23:38 - 02375168 _____ (Farbar) C:\Users\Schatz\Downloads\FRST64 (1).exe 2016-04-15 23:38 - 2016-04-15 23:38 - 01725952 _____ (Farbar) C:\Users\Schatz\Downloads\FRST.exe 2016-04-15 23:37 - 2016-04-15 23:37 - 02375168 _____ (Farbar) C:\Users\Schatz\Downloads\FRST64.exe 2016-04-15 23:09 - 2016-04-15 23:10 - 00010240 ___SH C:\Users\Schatz\Downloads\Thumbs.db 2016-04-14 23:13 - 2016-04-14 23:13 - 01610352 _____ (Malwarebytes) C:\Users\Schatz\Downloads\JRT.exe 2016-04-14 22:54 - 2016-04-14 22:54 - 03670016 _____ C:\Users\Schatz\Downloads\adwcleaner_5.111.exe 2016-04-14 22:53 - 2016-04-14 22:53 - 03465280 _____ C:\Users\Schatz\Downloads\AdwCleaner_5.110 (1).exe 2016-04-14 22:50 - 2016-04-14 22:50 - 03465280 _____ C:\Users\Schatz\Downloads\AdwCleaner_5.110.exe 2016-04-14 22:25 - 2016-04-21 21:52 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2016-04-14 22:24 - 2016-04-21 21:37 - 00001116 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2016-04-14 22:24 - 2016-04-14 22:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2016-04-14 22:24 - 2016-04-14 22:24 - 00000000 ____D C:\ProgramData\Malwarebytes 2016-04-14 22:24 - 2016-04-14 22:24 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 2016-04-14 22:24 - 2016-03-10 14:09 - 00065408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys 2016-04-14 22:24 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys 2016-04-14 22:24 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys 2016-04-14 22:22 - 2016-04-14 22:22 - 22851472 _____ (Malwarebytes ) C:\Users\Schatz\Downloads\mbam-setup-2.2.1.1043.exe 2016-04-14 22:16 - 2016-04-12 22:21 - 00001006 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20160414-221609.backup 2016-04-14 22:01 - 2016-04-14 22:01 - 00000000 ____D C:\Users\Schatz\Documents\ProcAlyzer Dumps 2016-04-13 23:07 - 2016-04-13 23:07 - 01475080 _____ C:\Users\Schatz\Downloads\CryptLoad - CHIP-Installer.exe 2016-04-13 22:58 - 2016-04-14 00:57 - 00002928 _____ C:\Users\Schatz\Downloads\Joey_1985_German_1080p_BluRay_x264-1ydj20o72sja6.dlc 2016-04-13 22:54 - 2016-04-13 22:54 - 00011557 _____ C:\Users\Schatz\Downloads\3d0dae370e_001.htm 2016-04-13 22:34 - 2016-04-13 22:34 - 00011557 _____ C:\Users\Schatz\Downloads\3d0dae370e.htm 2016-04-13 03:07 - 2016-03-31 02:54 - 25817600 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2016-04-13 03:07 - 2016-03-31 02:31 - 02892800 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2016-04-13 03:07 - 2016-03-31 02:25 - 06052352 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2016-04-13 03:07 - 2016-03-31 02:03 - 20352512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2016-04-13 03:07 - 2016-03-31 01:51 - 02285056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2016-04-13 03:07 - 2016-03-31 01:43 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll 2016-04-13 03:07 - 2016-03-31 01:43 - 00725504 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe 2016-04-13 03:07 - 2016-03-31 01:43 - 00379392 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll 2016-04-13 03:07 - 2016-03-31 01:42 - 02131968 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl 2016-04-13 03:07 - 2016-03-31 01:39 - 15415808 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2016-04-13 03:07 - 2016-03-31 01:30 - 02596864 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll 2016-04-13 03:07 - 2016-03-31 01:23 - 02056192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl 2016-04-13 03:07 - 2016-03-31 01:23 - 00693248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll 2016-04-13 03:07 - 2016-03-31 01:23 - 00330752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll 2016-04-13 03:07 - 2016-03-31 01:21 - 13811712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2016-04-13 03:07 - 2016-03-31 01:18 - 01547264 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2016-04-13 03:07 - 2016-03-31 01:05 - 02121216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll 2016-04-13 03:07 - 2016-03-16 01:00 - 00561952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys 2016-04-13 03:07 - 2016-03-15 16:14 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll 2016-04-13 03:07 - 2016-03-11 16:48 - 00833024 _____ (Microsoft Corporation) C:\WINDOWS\system32\samsrv.dll 2016-04-13 03:07 - 2016-03-10 20:22 - 00201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys 2016-04-13 03:07 - 2016-03-10 20:21 - 00401920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys 2016-04-13 03:07 - 2016-03-10 20:20 - 00284672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb10.sys 2016-04-13 03:07 - 2016-03-10 19:44 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll 2016-04-13 03:07 - 2016-03-10 19:16 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll 2016-04-13 03:07 - 2016-03-10 19:03 - 00111616 _____ (Microsoft Corporation) C:\WINDOWS\system32\samlib.dll 2016-04-13 03:07 - 2016-03-10 18:48 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\samlib.dll 2016-04-13 03:07 - 2016-02-02 20:16 - 00112640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rasl2tp.sys 2016-04-13 03:06 - 2016-03-31 02:28 - 00571904 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll 2016-04-13 03:06 - 2016-03-31 02:17 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll 2016-04-13 03:06 - 2016-03-31 01:56 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll 2016-04-13 03:06 - 2016-03-31 01:56 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll 2016-04-13 03:06 - 2016-03-31 01:55 - 00315392 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll 2016-04-13 03:06 - 2016-03-31 01:53 - 00496640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll 2016-04-13 03:06 - 2016-03-31 01:50 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll 2016-04-13 03:06 - 2016-03-31 01:45 - 00663552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll 2016-04-13 03:06 - 2016-03-31 01:45 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll 2016-04-13 03:06 - 2016-03-31 01:30 - 04611072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2016-04-13 03:06 - 2016-03-31 01:30 - 00279040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll 2016-04-13 03:06 - 2016-03-31 01:30 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll 2016-04-13 03:06 - 2016-03-31 01:27 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll 2016-04-13 03:06 - 2016-03-31 01:24 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll 2016-04-13 03:06 - 2016-03-31 01:06 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll 2016-04-13 03:06 - 2016-03-31 01:02 - 01311744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2016-04-13 03:06 - 2016-03-31 01:00 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll 2016-04-13 03:05 - 2016-03-03 18:47 - 02345472 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll 2016-04-13 03:05 - 2016-03-03 18:33 - 01556992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll 2016-04-13 03:05 - 2016-03-03 03:39 - 01661576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll 2016-04-13 03:05 - 2016-03-03 03:39 - 01212248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll 2016-04-13 03:05 - 2016-02-09 03:31 - 22365472 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll 2016-04-13 03:05 - 2016-02-09 03:31 - 19794896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll 2016-04-13 03:05 - 2016-02-09 03:31 - 02757616 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe 2016-04-13 03:05 - 2016-02-09 03:31 - 02412576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe 2016-04-13 03:05 - 2016-02-08 21:48 - 12879360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll 2016-04-13 03:05 - 2016-02-08 20:50 - 03120640 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExplorerFrame.dll 2016-04-13 03:05 - 2016-02-08 19:12 - 14466560 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll 2016-04-13 03:05 - 2016-02-05 16:46 - 01455104 _____ (Microsoft Corporation) C:\WINDOWS\system32\VSSVC.exe 2016-04-13 03:05 - 2016-02-03 17:14 - 00080896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\IPMIDrv.sys 2016-04-13 03:05 - 2016-02-03 17:11 - 01673728 _____ (Microsoft Corporation) C:\WINDOWS\system32\workfolderssvc.dll 2016-04-13 03:05 - 2016-02-02 19:51 - 00162304 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmAuto.dll 2016-04-13 03:05 - 2016-02-02 19:19 - 00144384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmAuto.dll 2016-04-13 03:05 - 2016-02-02 19:15 - 00787456 _____ (Microsoft Corporation) C:\WINDOWS\system32\WorkfoldersControl.dll 2016-04-13 03:05 - 2016-02-02 19:01 - 00031744 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmAgent.dll 2016-04-13 03:05 - 2016-02-02 18:51 - 02609152 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmSvc.dll 2016-04-13 03:05 - 2016-02-02 18:48 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmWmiPl.dll 2016-04-13 03:05 - 2016-02-02 18:46 - 00026112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmAgent.dll 2016-04-13 03:05 - 2016-02-02 18:41 - 02170880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmSvc.dll 2016-04-13 03:05 - 2016-02-02 18:39 - 00236032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmWmiPl.dll 2016-04-13 03:05 - 2016-01-27 17:18 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll 2016-04-13 03:05 - 2016-01-21 21:35 - 00952928 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll 2016-04-13 03:05 - 2016-01-21 20:42 - 00786152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll 2016-04-13 03:04 - 2016-04-04 08:35 - 00046768 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe 2016-04-13 03:04 - 2016-04-02 15:26 - 01386496 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll 2016-04-13 03:04 - 2016-04-02 15:26 - 01169408 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll 2016-04-13 03:04 - 2016-03-29 16:05 - 04175872 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys 2016-04-13 03:04 - 2016-03-28 15:21 - 00698368 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll 2016-04-13 03:04 - 2016-03-28 15:21 - 00499200 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll 2016-04-13 03:04 - 2016-03-28 15:21 - 00279040 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll 2016-04-13 03:04 - 2016-03-28 15:21 - 00215040 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll 2016-04-13 03:04 - 2016-03-28 15:21 - 00076800 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll 2016-04-13 03:04 - 2016-03-10 21:19 - 07452512 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe 2016-04-13 03:04 - 2016-03-10 21:17 - 01663192 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi 2016-04-13 03:04 - 2016-03-10 21:17 - 01523216 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe 2016-04-13 03:04 - 2016-03-10 21:17 - 01490128 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi 2016-04-13 03:04 - 2016-03-10 21:17 - 01358960 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe 2016-04-13 03:04 - 2016-03-10 21:17 - 01133752 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll 2016-04-13 03:04 - 2016-03-10 19:48 - 00862720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll 2016-04-13 03:04 - 2016-03-10 19:43 - 00161280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msorcl32.dll 2016-04-13 03:04 - 2016-03-10 18:55 - 00166400 _____ (Microsoft Corporation) C:\WINDOWS\system32\mtxoci.dll 2016-04-13 03:04 - 2016-03-10 18:42 - 00116736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mtxoci.dll 2016-04-13 03:04 - 2016-03-03 18:13 - 00059392 _____ (Microsoft Corporation) C:\WINDOWS\system32\basesrv.dll 2016-04-13 03:04 - 2016-02-09 03:31 - 00273264 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlows.exe 2016-04-13 03:04 - 2016-02-08 22:55 - 02712576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll 2016-04-13 03:04 - 2016-02-08 22:15 - 02551808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\themecpl.dll 2016-04-13 03:04 - 2016-02-08 22:02 - 01197056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usercpl.dll 2016-04-13 03:04 - 2016-02-08 21:43 - 00524288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe 2016-04-13 03:04 - 2016-02-08 21:40 - 00539648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hgcpl.dll 2016-04-13 03:04 - 2016-02-08 21:39 - 00305152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\stobject.dll 2016-04-13 03:04 - 2016-02-08 21:37 - 00141312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingMonitor.dll 2016-04-13 03:04 - 2016-02-08 21:35 - 00954880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll 2016-04-13 03:04 - 2016-02-08 21:34 - 00667648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll 2016-04-13 03:04 - 2016-02-08 21:33 - 00520192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSync.dll 2016-04-13 03:04 - 2016-02-08 19:55 - 02592256 _____ (Microsoft Corporation) C:\WINDOWS\system32\themecpl.dll 2016-04-13 03:04 - 2016-02-08 19:33 - 01278464 _____ (Microsoft Corporation) C:\WINDOWS\system32\usercpl.dll 2016-04-13 03:04 - 2016-02-08 19:02 - 00653824 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe 2016-04-13 03:04 - 2016-02-08 19:00 - 00599552 _____ (Microsoft Corporation) C:\WINDOWS\system32\hgcpl.dll 2016-04-13 03:04 - 2016-02-08 18:58 - 00336384 _____ (Microsoft Corporation) C:\WINDOWS\system32\stobject.dll 2016-04-13 03:04 - 2016-02-08 18:55 - 00173056 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingMonitor.dll 2016-04-13 03:04 - 2016-02-08 18:53 - 02171904 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlowUI.dll 2016-04-13 03:04 - 2016-02-08 18:53 - 01348096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll 2016-04-13 03:04 - 2016-02-08 18:50 - 01220096 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.appcore.dll 2016-04-13 03:04 - 2016-02-08 18:50 - 00841728 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll 2016-04-13 03:04 - 2016-02-08 18:48 - 00655872 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSync.dll 2016-04-13 03:04 - 2016-02-08 18:47 - 02819584 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll 2016-04-13 03:04 - 2016-02-08 18:44 - 00955392 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll 2016-04-13 03:04 - 2016-02-07 01:05 - 00551256 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys 2016-04-13 03:04 - 2016-02-07 00:41 - 00316760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volsnap.sys 2016-04-13 03:04 - 2016-02-05 21:07 - 00378712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys 2016-04-13 03:04 - 2016-02-05 17:11 - 00845312 _____ (Microsoft Corporation) C:\WINDOWS\system32\BFE.DLL 2016-04-13 03:04 - 2016-02-05 17:11 - 00422400 _____ (Microsoft Corporation) C:\WINDOWS\system32\FWPUCLNT.DLL 2016-04-13 03:04 - 2016-02-05 17:07 - 00272384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FWPUCLNT.DLL 2016-04-13 03:04 - 2016-02-05 17:02 - 01083904 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL 2016-04-13 03:04 - 2016-02-04 20:07 - 00222720 _____ (Microsoft Corporation) C:\WINDOWS\system32\dhcpsapi.dll 2016-04-13 03:04 - 2016-02-04 19:35 - 00142848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dhcpsapi.dll 2016-04-13 03:04 - 2016-02-04 18:23 - 00713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll 2016-04-13 03:04 - 2016-02-04 18:22 - 00561664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll 2016-04-13 03:04 - 2016-02-02 19:18 - 01574912 _____ (Microsoft Corporation) C:\WINDOWS\system32\wbengine.exe 2016-04-13 03:04 - 2016-01-31 19:17 - 00779264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsAnytimeUpgradeui.exe 2016-04-13 03:04 - 2016-01-26 21:15 - 00072024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vpci.sys 2016-04-13 03:04 - 2016-01-22 07:22 - 02487296 _____ (Microsoft Corporation) C:\WINDOWS\system32\storagewmi.dll 2016-04-13 03:04 - 2016-01-22 07:11 - 01482240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\storagewmi.dll 2016-04-13 03:04 - 2016-01-21 00:40 - 00099672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\disk.sys 2016-04-12 23:02 - 2016-04-21 21:36 - 00002324 _____ C:\Users\Schatz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chromium.lnk 2016-04-12 23:02 - 2016-04-21 21:36 - 00002316 _____ C:\Users\Schatz\Desktop\Chromium.lnk 2016-04-12 22:14 - 2016-04-12 22:14 - 00003180 _____ C:\Users\Schatz\Downloads\post_reply.htm 2016-04-12 22:13 - 2016-04-21 21:37 - 00002275 _____ C:\Users\Public\Desktop\WinZip.lnk 2016-04-12 22:13 - 2016-04-21 21:36 - 00002287 _____ C:\ProgramData\Microsoft\Windows\Start Menu\WinZip.lnk 2016-04-12 22:13 - 2016-04-12 22:15 - 00000000 ____D C:\ProgramData\WinZip 2016-04-12 22:13 - 2016-04-12 22:13 - 00000000 ____D C:\Users\Schatz\AppData\Local\WinZip Computing, S.L 2016-04-12 22:13 - 2016-04-12 22:13 - 00000000 ____D C:\Users\Schatz\AppData\Local\WinZip 2016-04-12 22:13 - 2016-04-12 22:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip 2016-04-12 22:12 - 2016-04-12 22:13 - 00000000 ____D C:\Program Files\WinZip 2016-04-12 22:10 - 2016-04-21 21:45 - 00000300 _____ C:\WINDOWS\Tasks\{2FE13EE9-AE44-25EE-1098-2BDFFC5F70F9}.job 2016-04-12 22:10 - 2016-04-13 06:45 - 00002638 _____ C:\WINDOWS\System32\Tasks\{2FE13EE9-AE44-25EE-1098-2BDFFC5F70F9} 2016-04-12 22:10 - 2016-04-12 23:02 - 00000000 ____D C:\Users\Schatz\AppData\Local\Chromium 2016-04-12 22:10 - 2016-04-12 22:10 - 00000000 ____D C:\Users\Schatz\AppData\Local\PPC-software 2016-04-12 22:09 - 2016-04-21 21:46 - 00000008 __RSH C:\ProgramData\ntuser.pol 2016-04-12 22:09 - 2016-04-21 21:09 - 00001006 _____ C:\WINDOWS\Tasks\Search Provided by Yahoo litod.job 2016-04-12 22:09 - 2016-04-12 22:09 - 00000000 ____D C:\Users\Schatz\AppData\Local\Setup225257734 2016-04-12 22:08 - 2016-04-12 22:08 - 00060548 _____ C:\Users\Schatz\Downloads\installer [1].exe 2016-04-12 22:07 - 2016-04-12 22:07 - 00000000 ____D C:\Users\Public\Documents\dmp 2016-04-12 22:01 - 2016-04-21 21:37 - 00001763 _____ C:\Users\Public\Desktop\iTunes.lnk 2016-04-12 22:01 - 2016-04-12 22:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2016-04-12 22:00 - 2016-04-12 22:01 - 00000000 ____D C:\Program Files\iTunes 2016-04-12 22:00 - 2016-04-12 22:00 - 00000000 ____D C:\Program Files\iPod 2016-04-12 22:00 - 2016-04-12 22:00 - 00000000 ____D C:\Program Files (x86)\iTunes 2016-04-12 21:55 - 2016-04-12 21:55 - 00000000 ____D C:\WINDOWS\System32\Tasks\Apple 2016-04-12 21:55 - 2016-04-12 21:55 - 00000000 ____D C:\Program Files (x86)\Apple Software Update 2016-04-12 21:49 - 2016-04-21 21:37 - 00001915 _____ C:\Users\Public\Desktop\QuickTime Player.lnk 2016-04-12 21:49 - 2016-04-12 21:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime 2016-04-12 21:49 - 2016-04-12 21:49 - 00000000 ____D C:\Program Files (x86)\QuickTime Alternative 2016-04-10 07:41 - 2016-04-05 23:53 - 00829944 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2016-04-10 07:41 - 2016-04-05 23:53 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl 2016-04-07 21:35 - 2015-12-17 20:29 - 00131584 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll 2016-04-07 21:35 - 2015-12-17 18:17 - 03547648 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll 2016-04-06 09:34 - 2016-02-08 22:29 - 00099328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hlink.dll 2016-04-06 09:34 - 2016-02-08 20:14 - 00108544 _____ (Microsoft Corporation) C:\WINDOWS\system32\hlink.dll 2016-04-06 09:34 - 2016-02-08 19:15 - 02880000 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll 2016-04-06 09:34 - 2016-01-06 20:25 - 00416768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv.sys 2016-04-06 09:34 - 2015-12-30 23:53 - 02017624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys 2016-04-06 09:32 - 2016-02-05 16:59 - 07784960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll 2016-04-06 09:32 - 2016-02-05 16:55 - 05264384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll 2016-04-06 09:32 - 2016-02-05 16:48 - 07075840 _____ (Microsoft Corporation) C:\WINDOWS\system32\glcndFilter.dll 2016-04-06 09:32 - 2016-02-05 16:47 - 05268480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\glcndFilter.dll 2016-04-06 09:31 - 2015-12-20 16:57 - 00839168 _____ (Microsoft Corporation) C:\WINDOWS\system32\netlogon.dll 2016-04-06 09:31 - 2015-12-20 16:43 - 00696320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netlogon.dll 2016-04-06 09:30 - 2016-02-12 21:14 - 00136904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe 2016-04-06 09:30 - 2016-02-12 17:14 - 03708416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll 2016-04-06 09:30 - 2016-02-12 16:55 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll 2016-04-06 09:30 - 2016-02-12 16:54 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll 2016-04-06 09:30 - 2016-02-12 16:54 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll 2016-04-06 09:30 - 2016-02-12 16:54 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe 2016-04-06 09:30 - 2016-02-12 16:51 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll 2016-04-06 09:30 - 2016-02-12 16:51 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll 2016-04-06 09:30 - 2016-02-12 16:51 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe 2016-04-06 09:30 - 2016-02-12 16:48 - 02244096 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll 2016-04-06 09:30 - 2016-02-12 16:47 - 00897024 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll 2016-04-06 09:30 - 2016-02-12 16:46 - 00726528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll 2016-04-06 09:30 - 2016-02-06 20:08 - 00031744 _____ (Microsoft Corporation) C:\WINDOWS\system32\seclogon.dll 2016-04-06 09:30 - 2016-01-05 17:00 - 00570880 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe 2016-04-06 09:29 - 2016-02-03 17:09 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll 2016-04-06 09:29 - 2016-02-03 17:00 - 00091136 _____ (Microsoft Corporation) C:\WINDOWS\system32\asycfilt.dll 2016-04-06 09:29 - 2016-02-03 17:00 - 00077824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\asycfilt.dll 2016-04-06 09:29 - 2016-01-24 20:19 - 00419160 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys 2016-04-06 09:29 - 2016-01-24 20:19 - 00331608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Classpnp.sys 2016-04-06 09:29 - 2016-01-24 13:57 - 01335296 _____ (Microsoft Corporation) C:\WINDOWS\system32\mispace.dll 2016-04-06 09:29 - 2016-01-24 13:45 - 01063424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mispace.dll 2016-04-06 09:29 - 2016-01-09 03:38 - 00091992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbehci.sys 2016-04-06 09:29 - 2016-01-07 01:46 - 00148752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wscapi.dll 2016-04-06 09:29 - 2016-01-07 01:45 - 00177712 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscapi.dll 2016-04-06 09:29 - 2016-01-06 18:47 - 00146944 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscsvc.dll 2016-04-06 09:27 - 2016-02-05 21:07 - 00292696 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMASF.DLL 2016-04-06 09:27 - 2016-02-05 21:07 - 00243032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMASF.DLL 2016-04-06 09:27 - 2016-02-05 17:03 - 15432704 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll 2016-04-06 09:27 - 2016-02-05 17:00 - 13318144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll 2016-04-06 09:27 - 2016-01-13 23:26 - 01737080 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll 2016-04-06 09:27 - 2016-01-13 23:26 - 01501488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll 2016-04-06 09:27 - 2016-01-10 20:18 - 00246784 _____ (Microsoft Corporation) C:\WINDOWS\system32\microsoft-windows-system-events.dll 2016-04-06 09:27 - 2016-01-10 18:41 - 01707008 _____ (Microsoft Corporation) C:\WINDOWS\system32\comsvcs.dll 2016-04-06 09:27 - 2016-01-10 18:31 - 01344512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comsvcs.dll 2016-04-06 09:27 - 2015-12-20 16:56 - 00616960 _____ (Microsoft Corporation) C:\WINDOWS\system32\msra.exe 2016-04-06 09:27 - 2015-11-19 16:33 - 00994760 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase.dll 2016-04-06 09:27 - 2015-11-19 16:26 - 00922432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ucrtbase.dll 2016-04-06 09:26 - 2016-02-11 16:21 - 00869576 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvcr120_clr0400.dll 2016-04-06 09:26 - 2016-02-11 16:21 - 00678600 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvcp120_clr0400.dll 2016-04-06 09:26 - 2016-02-11 16:20 - 00875720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcr120_clr0400.dll 2016-04-06 09:26 - 2016-02-11 16:20 - 00536776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcp120_clr0400.dll 2016-04-06 09:26 - 2016-02-04 20:18 - 00358912 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll 2016-04-06 09:26 - 2016-02-04 20:12 - 00044032 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll 2016-04-06 09:26 - 2016-02-04 19:44 - 00301568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll 2016-04-06 09:26 - 2016-02-04 19:39 - 00035840 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll 2016-04-06 09:26 - 2016-02-04 19:24 - 00603648 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfds.dll 2016-04-06 09:26 - 2016-02-04 19:02 - 00483328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfds.dll 2016-04-06 09:26 - 2016-01-31 21:16 - 00148832 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBSTOR.SYS 2016-04-06 09:26 - 2016-01-09 03:49 - 00218448 _____ (Microsoft Corporation) C:\WINDOWS\system32\rsaenh.dll 2016-04-06 09:26 - 2016-01-09 03:49 - 00192120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rsaenh.dll 2016-04-06 09:26 - 2015-12-30 22:49 - 00470360 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netio.sys 2016-04-06 09:25 - 2016-02-06 18:58 - 00987648 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll 2016-04-06 09:25 - 2016-02-06 18:32 - 00801792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll 2016-04-06 09:21 - 2016-01-10 19:50 - 00062464 _____ (Microsoft Corporation) C:\WINDOWS\system32\cfgbkend.dll 2016-04-06 09:21 - 2016-01-10 19:16 - 00898048 _____ (Microsoft Corporation) C:\WINDOWS\system32\CPFilters.dll 2016-04-06 09:21 - 2016-01-10 19:14 - 00048640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cfgbkend.dll 2016-04-06 09:21 - 2016-01-10 19:12 - 00532480 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDec.dll 2016-04-06 09:21 - 2016-01-10 18:51 - 00702976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CPFilters.dll 2016-04-06 09:21 - 2016-01-10 18:49 - 00443392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EncDec.dll 2016-04-06 09:13 - 2016-01-22 07:07 - 02778624 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll 2016-04-06 09:13 - 2016-01-22 06:58 - 02464256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll 2016-04-06 09:13 - 2016-01-19 21:13 - 02175008 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll 2016-04-06 09:13 - 2016-01-19 21:13 - 01063464 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinTypes.dll 2016-04-06 09:13 - 2016-01-19 20:23 - 01564496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll 2016-04-06 09:13 - 2016-01-19 20:23 - 00548024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinTypes.dll 2016-04-06 09:13 - 2016-01-19 18:37 - 00267776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wincorlib.dll 2016-04-06 09:13 - 2016-01-10 21:37 - 00442720 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll 2016-04-06 09:13 - 2016-01-10 20:39 - 00332640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll 2016-04-06 09:13 - 2016-01-10 18:56 - 00186880 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpapisrv.dll 2016-04-06 09:13 - 2016-01-06 20:25 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys 2016-04-06 09:13 - 2015-12-28 23:42 - 00713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSync.dll 2016-04-06 09:13 - 2015-12-28 22:31 - 00578048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinSync.dll 2016-04-06 08:15 - 2016-04-06 08:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus ==================== Ein Monat: Geänderte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2016-04-21 21:53 - 2013-07-02 22:33 - 00003598 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3205940643-3366264869-3578409839-1002 2016-04-21 21:49 - 2015-10-03 19:14 - 00000000 ____D C:\Users\Schatz\OneDrive 2016-04-21 21:47 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT 2016-04-21 21:45 - 2015-01-21 19:39 - 00000000 ____D C:\AdwCleaner 2016-04-21 21:37 - 2016-02-25 16:03 - 00002022 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk 2016-04-21 21:37 - 2016-01-13 20:37 - 00001152 _____ C:\Users\Public\Desktop\Avira Launcher.lnk 2016-04-21 21:37 - 2015-09-20 22:39 - 00001055 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk 2016-04-21 21:37 - 2015-09-20 22:39 - 00000996 _____ C:\Users\Public\Desktop\Opera.lnk 2016-04-21 21:37 - 2015-08-22 01:10 - 00001535 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk 2016-04-21 21:37 - 2015-06-18 19:09 - 00002555 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Excel Viewer.lnk 2016-04-21 21:37 - 2014-08-17 19:16 - 00000930 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk 2016-04-21 21:37 - 2014-08-17 18:59 - 00001067 _____ C:\Users\Public\Desktop\posterXXL Designer.lnk 2016-04-21 21:37 - 2014-08-17 16:05 - 00002523 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk 2016-04-21 21:37 - 2014-03-27 20:03 - 00002701 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Word Viewer 2003.lnk 2016-04-21 21:37 - 2014-01-20 19:57 - 00002100 _____ C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk 2016-04-21 21:37 - 2013-12-28 10:12 - 00000979 _____ C:\Users\Public\Desktop\AVG 2014.lnk 2016-04-21 21:37 - 2013-07-03 20:48 - 00001149 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2016-04-21 21:37 - 2013-07-03 20:48 - 00001069 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2016-04-21 21:37 - 2012-12-12 13:36 - 00001112 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MEDIONhome.lnk 2016-04-21 21:37 - 2012-11-23 13:19 - 00002210 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickLaunch.lnk 2016-04-21 21:37 - 2012-11-23 05:44 - 00002014 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel(R) WiDi.lnk 2016-04-21 21:37 - 2012-11-22 14:42 - 00001366 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk 2016-04-21 21:37 - 2012-11-22 14:42 - 00001297 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk 2016-04-21 21:36 - 2015-10-03 17:53 - 00001218 _____ C:\Users\Schatz\Desktop\DSCN0420 - Verknüpfung.lnk 2016-04-21 21:36 - 2015-10-03 17:53 - 00001218 _____ C:\Users\Schatz\Desktop\DSCN0419 - Verknüpfung.lnk 2016-04-21 21:36 - 2015-10-03 17:53 - 00001218 _____ C:\Users\Schatz\Desktop\DSCN0418 - Verknüpfung.lnk 2016-04-21 21:36 - 2015-10-03 17:53 - 00001218 _____ C:\Users\Schatz\Desktop\DSCN0417 - Verknüpfung.lnk 2016-04-21 21:36 - 2015-10-03 17:53 - 00001218 _____ C:\Users\Schatz\Desktop\DSCN0416 - Verknüpfung.lnk 2016-04-21 21:36 - 2015-10-03 17:53 - 00001218 _____ C:\Users\Schatz\Desktop\DSCN0414 - Verknüpfung.lnk 2016-04-21 21:36 - 2015-09-24 22:06 - 00000954 _____ C:\Users\Schatz\Desktop\RS File Repair.lnk 2016-04-21 21:36 - 2015-09-20 22:38 - 00001219 _____ C:\Users\Schatz\Desktop\File Repair.lnk 2016-04-21 21:36 - 2015-09-20 22:27 - 00002193 _____ C:\Users\Schatz\Desktop\File Repair - CHIP Downloader.lnk 2016-04-21 21:36 - 2015-09-20 21:25 - 00001868 _____ C:\Users\Schatz\Desktop\IrfanView 64 Thumbnails.lnk 2016-04-21 21:36 - 2015-09-20 21:25 - 00000998 _____ C:\Users\Schatz\Desktop\IrfanView 64.lnk 2016-04-21 21:36 - 2015-08-22 01:39 - 00001057 _____ C:\Users\Schatz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2016-04-21 21:36 - 2015-08-22 01:00 - 00000469 _____ C:\Users\Schatz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk 2016-04-21 21:36 - 2015-08-22 01:00 - 00000467 _____ C:\Users\Schatz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk 2016-04-21 21:36 - 2015-06-18 20:40 - 00002250 _____ C:\Users\Schatz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk 2016-04-21 21:36 - 2014-08-17 19:26 - 00001112 _____ C:\Users\Schatz\Desktop\GIMP 2.lnk 2016-04-21 21:36 - 2014-01-11 20:51 - 00000996 _____ C:\Users\Schatz\Desktop\Nightmares from the Deep.lnk 2016-04-21 21:36 - 2014-01-11 20:46 - 00000789 _____ C:\Users\Schatz\Desktop\Invisible Man.lnk 2016-04-21 21:36 - 2014-01-11 20:35 - 00002311 _____ C:\Users\Schatz\Desktop\Play Margrave Manor Der Fluch des gebrochenen Herzens.lnk 2016-04-21 21:36 - 2014-01-11 20:28 - 00001831 _____ C:\Users\Schatz\Desktop\Abyss - Grauen der Tiefe.lnk 2016-04-21 21:36 - 2014-01-11 20:23 - 00001613 _____ C:\Users\Schatz\Desktop\Shadows.lnk 2016-04-21 21:36 - 2014-01-11 20:05 - 00001075 _____ C:\Users\Schatz\Desktop\Nightfall Mysteries - Die Ashburg Verschwörung.lnk 2016-04-21 21:36 - 2013-09-25 09:48 - 00001771 _____ C:\Users\Schatz\Desktop\ICQ.lnk 2016-04-21 21:36 - 2013-09-25 09:48 - 00001629 _____ C:\Users\Schatz\AppData\Roaming\Microsoft\Windows\Start Menu\ICQ.lnk 2016-04-21 21:36 - 2013-09-06 08:53 - 00001479 _____ C:\Users\Schatz\Desktop\Das Schicksal der Marie Antoinette.lnk 2016-04-21 21:36 - 2013-09-04 08:59 - 00001311 _____ C:\Users\Schatz\Desktop\Der Fluch des Blutes.lnk 2016-04-21 21:36 - 2013-08-19 17:06 - 00001467 _____ C:\Users\Schatz\Desktop\Magic Encyclopedia 3 - Illusionen.lnk 2016-04-21 21:36 - 2013-07-01 22:19 - 00002976 _____ C:\Users\Schatz\Desktop\MEDIONmail.lnk 2016-04-21 21:36 - 2013-07-01 22:19 - 00001711 _____ C:\Users\Schatz\Desktop\Kindersicherung einrichten.lnk 2016-04-21 21:36 - 2013-07-01 22:19 - 00001132 _____ C:\Users\Schatz\Desktop\MEDION Serviceportal.lnk 2016-04-21 21:36 - 2013-07-01 22:19 - 00001128 _____ C:\Users\Schatz\Desktop\Gutscheine bei coupons4u.lnk 2016-04-21 21:36 - 2013-07-01 22:19 - 00001112 _____ C:\Users\Schatz\Desktop\MEDIONplay.lnk 2016-04-21 21:36 - 2013-07-01 22:19 - 00001112 _____ C:\Users\Schatz\Desktop\LIFESTORE.lnk 2016-04-21 21:36 - 2013-07-01 22:16 - 00002439 _____ C:\Users\Schatz\Desktop\MEDIONmediathek.lnk 2016-04-21 21:36 - 2013-07-01 22:16 - 00001122 _____ C:\Users\Schatz\Desktop\Windows 8 Info.lnk 2016-04-21 21:29 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\L2Schemas 2016-04-21 21:23 - 2013-08-22 15:36 - 00000000 ____D C:\WINDOWS\Inf 2016-04-21 21:03 - 2013-08-18 07:42 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2016-04-21 17:42 - 2015-01-18 21:13 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2016-04-21 17:42 - 2015-01-18 21:13 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2 2016-04-21 17:37 - 2014-08-17 15:25 - 00000000 ____D C:\ProgramData\Package Cache 2016-04-21 17:37 - 2014-03-05 22:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2016-04-21 17:33 - 2013-08-22 15:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI 2016-04-21 17:31 - 2012-11-23 04:35 - 00000000 ____D C:\ProgramData\Kaspersky Lab 2016-04-21 17:29 - 2012-07-26 10:12 - 00000000 ___HD C:\WINDOWS\ELAMBKUP 2016-04-21 17:26 - 2013-08-22 15:25 - 00262144 ___SH C:\WINDOWS\system32\config\ELAM 2016-04-21 17:25 - 2015-06-18 20:29 - 00000000 ____D C:\Program Files\Microsoft Office 15 2016-04-21 17:08 - 2015-09-22 23:16 - 00003950 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{03F45FC3-221C-4A0C-A47F-43723DBBE507} 2016-04-21 16:56 - 2015-09-20 22:38 - 00000000 ____D C:\Program Files (x86)\Opera 2016-04-16 22:53 - 2012-07-26 07:37 - 00000000 ____D C:\Users\Default.migrated 2016-04-16 22:27 - 2013-07-01 22:17 - 00000000 ____D C:\Users\Schatz\AppData\Local\VirtualStore 2016-04-16 22:03 - 2015-08-22 01:00 - 00000000 ____D C:\Users\Schatz 2016-04-16 21:59 - 2013-07-02 22:53 - 00000000 ____D C:\Users\Schatz\AppData\Roaming\CyberLink 2016-04-16 21:58 - 2013-07-01 22:22 - 00000000 ____D C:\Users\Schatz\AppData\Local\CyberLink 2016-04-15 22:55 - 2013-08-22 17:36 - 00000000 __RSD C:\WINDOWS\Media 2016-04-14 22:59 - 2015-09-20 22:33 - 00000000 ____D C:\Users\Schatz\AppData\Roaming\Lavasoft 2016-04-14 22:59 - 2015-09-20 22:33 - 00000000 ____D C:\Program Files (x86)\Lavasoft 2016-04-14 22:59 - 2015-09-20 22:32 - 00000000 ____D C:\ProgramData\Lavasoft 2016-04-14 22:24 - 2015-10-03 17:38 - 00726528 ___SH C:\Users\Schatz\Desktop\Thumbs.db 2016-04-14 21:53 - 2015-09-20 22:39 - 00003876 _____ C:\WINDOWS\System32\Tasks\Opera scheduled Autoupdate 1442781566 2016-04-14 21:42 - 2013-08-22 16:44 - 00488336 _____ C:\WINDOWS\system32\FNTCACHE.DAT 2016-04-14 07:08 - 2015-01-21 19:58 - 00000000 ____D C:\WINDOWS\system32\appraiser 2016-04-14 07:08 - 2013-08-22 17:36 - 00000000 ___RD C:\WINDOWS\ToastData 2016-04-14 02:55 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\rescache 2016-04-14 01:15 - 2012-07-26 09:59 - 00000000 ____D C:\WINDOWS\CbsTemp 2016-04-14 01:11 - 2013-08-19 20:10 - 00000000 ____D C:\WINDOWS\system32\MRT 2016-04-14 01:03 - 2012-11-22 13:29 - 135176864 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2016-04-13 21:50 - 2014-11-21 05:35 - 01780340 _____ C:\WINDOWS\system32\PerfStringBackup.INI 2016-04-13 21:50 - 2014-11-21 04:45 - 00766620 _____ C:\WINDOWS\system32\perfh007.dat 2016-04-13 21:50 - 2014-11-21 04:45 - 00159902 _____ C:\WINDOWS\system32\perfc007.dat 2016-04-12 23:24 - 2013-09-05 18:55 - 00000285 _____ C:\Users\Schatz\AppData\Roaming\WB.CFG 2016-04-12 22:00 - 2014-10-31 11:29 - 00000000 ____D C:\Program Files\Common Files\Apple 2016-04-07 22:03 - 2016-02-25 16:03 - 19924672 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerInstaller.exe 2016-04-07 22:03 - 2013-08-18 07:42 - 00003772 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater 2016-04-06 09:57 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\AppReadiness 2016-04-06 09:56 - 2013-08-22 17:36 - 00000000 ___HD C:\Program Files\WindowsApps 2016-04-06 09:44 - 2015-08-22 01:34 - 00000000 ___SD C:\WINDOWS\SysWOW64\GWX 2016-04-06 09:44 - 2015-08-22 01:34 - 00000000 ___SD C:\WINDOWS\system32\GWX 2016-04-06 09:44 - 2014-11-21 05:13 - 00000000 ____D C:\Program Files\Windows Journal 2016-04-06 08:15 - 2015-11-13 20:24 - 00000000 ____D C:\Program Files\McAfee Security Scan 2016-03-22 19:43 - 2013-08-22 17:36 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft 2016-03-22 19:34 - 2014-03-05 22:36 - 00137952 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys 2016-03-22 19:34 - 2014-03-05 22:36 - 00128664 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys 2016-03-22 19:34 - 2014-03-05 22:36 - 00068936 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avnetflt.sys ==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ======= 2013-09-05 18:55 - 2016-04-12 23:24 - 0000285 _____ () C:\Users\Schatz\AppData\Roaming\WB.CFG 2013-09-05 18:55 - 2014-01-20 20:24 - 0000005 _____ () C:\Users\Schatz\AppData\Roaming\WBPU-TTL.DAT 2016-01-04 17:55 - 2016-01-04 17:55 - 0003584 _____ () C:\Users\Schatz\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2015-12-30 13:31 - 2015-12-30 13:31 - 0000838 _____ () C:\Users\Schatz\AppData\Local\recently-used.xbel 2012-11-23 05:38 - 2012-11-23 05:38 - 0000000 ____H () C:\ProgramData\DP45977C.lfl 2012-11-28 11:00 - 2012-11-28 11:00 - 0000032 _____ () C:\ProgramData\Temp.log Dateien, die verschoben oder gelöscht werden sollten: ==================== C:\Windows\Tasks\{2FE13EE9-AE44-25EE-1098-2BDFFC5F70F9}.job Einige Dateien in TEMP: ==================== C:\Users\Schatz\AppData\Local\Temp\avgnt.exe C:\Users\Schatz\AppData\Local\Temp\libeay32.dll C:\Users\Schatz\AppData\Local\Temp\msvcr120.dll C:\Users\Schatz\AppData\Local\Temp\pruq8rtd.dll C:\Users\Schatz\AppData\Local\Temp\sqlite3.dll ==================== Bamital & volsnap ================= (Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.) C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert C:\WINDOWS\explorer.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert C:\WINDOWS\system32\services.exe => Datei ist digital signiert C:\WINDOWS\system32\User32.dll => Datei ist digital signiert C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert LastRegBack: 2016-04-21 17:53 ==================== Ende von FRST.txt ============================ Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:18-04-2016 durchgeführt von Schatz (2016-04-21 21:53:56) Gestartet von C:\Users\Schatz\AppData\Local\Temp\scoped_dir3184_381 Windows 8.1 (X64) (2015-08-21 23:35:56) Start-Modus: Normal ========================================================== ==================== Konten: ============================= Administrator (S-1-5-21-3205940643-3366264869-3578409839-500 - Administrator - Disabled) Gast (S-1-5-21-3205940643-3366264869-3578409839-501 - Limited - Disabled) HomeGroupUser$ (S-1-5-21-3205940643-3366264869-3578409839-1004 - Limited - Enabled) Schatz (S-1-5-21-3205940643-3366264869-3578409839-1002 - Administrator - Enabled) => C:\Users\Schatz ==================== Sicherheits-Center ======================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.) AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859} AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installierte Programme ====================== (Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.) 7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version: - ) Adobe Flash Player 21 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 21.0.0.213 - Adobe Systems Incorporated) Apple Application Support (32-Bit) (HKLM-x32\...\{FE5C2FAA-118D-4509-B51D-3F71CC9E1B3E}) (Version: 4.3 - Apple Inc.) Apple Application Support (64-Bit) (HKLM\...\{2937FD88-C9D6-4B82-B539-37CD0A572F42}) (Version: 4.3 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{2E4AF2A6-50EA-4260-9BA4-5E582D11879A}) (Version: 9.3.0.15 - Apple Inc.) Apple Software Update (HKLM-x32\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.) Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.16.282 - Avira Operations GmbH & Co. KG) Avira Launcher (HKLM-x32\...\{74d1ef14-dd39-4749-b051-e183a1e27f5e}) (Version: 1.1.58.35540 - Avira Operations GmbH & Co. KG) Avira Launcher (x32 Version: 1.1.58.35540 - Avira Operations GmbH & Co. KG) Hidden Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.) CDex - Open Source Digital Audio CD Extractor (HKLM-x32\...\CDex) (Version: 1.70.4.2009 - Georgy Berdyshev) Chromium (HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\Chromium) (Version: 51.0.2683.0 - Chromium) CyberLink PhotoNow (HKLM-x32\...\InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.1.7717 - CyberLink Corp.) CyberLink PowerDirector (Version: 9.0.0.3815c - CyberLink Corp.) Hidden CyberLink PowerRecover (HKLM-x32\...\InstallShield_{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}) (Version: 5.7.0.0913 - CyberLink Corp.) CyberLink PowerRecover (Version: 5.7.0.0913 - CyberLink Corp.) Hidden D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden Dolby Advanced Audio v2 (HKLM-x32\...\{B9E70C7A-9F85-4A39-A4A3-BFA3C3BF7613}) (Version: 7.2.8000.17 - Dolby Laboratories Inc) Fotogalerie (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden Fotogalerija (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden Fotogalleri (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden Fotogalleriet (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden Fotoğraf Galerisi (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden Fotótár (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden Galeria de Fotografias (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden Galería de fotos (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden Galeria fotografii (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden Galerie de photos (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden iCloud (HKLM\...\{4B48E22A-2FB0-4EFA-B99E-954B1E50CD69}) (Version: 5.1.0.34 - Apple Inc.) ICQ 8.1 (build 6337) (HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\ICQ) (Version: 8.1.6337.0 - Mail.Ru) Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation) Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2875 - Intel Corporation) Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (HKLM\...\{E77289CF-12B9-4CAB-A49E-FEAE947F4D95}) (Version: 15.5.4.0423 - Intel Corporation) Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\...\{DA2600C1-6BDF-4FD1-8F3D-148929CC1385}) (Version: 2.6.1210.0278 - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.6.0.1030 - Intel Corporation) Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation) Intel(R) WiDi (HKLM\...\{6097158B-0184-4140-BEC3-7885794D2571}) (Version: 3.5.40.0 - Intel Corporation) Intel® PROSet/Wireless WiFi Software (HKLM\...\{1593C708-5535-47A4-8C0F-F8D4BE2B4560}) (Version: 15.05.6000.1620 - Intel Corporation) IrfanView 64 (remove only) (HKLM\...\IrfanView) (Version: 4.40 - Irfan Skiljan) iTunes (HKLM\...\{A31C5565-90D9-4615-AE13-94D86C3836C7}) (Version: 12.3.3.17 - Apple Inc.) Joan Jade und die Tore von Xibalba (HKLM-x32\...\Joan Jade und die Tore von Xibalba) (Version: - ) Magic Encyclopedia 3 - Illusionen (HKLM-x32\...\Magic Encyclopedia 3 - Illusionen) (Version: - ) Margrave Manor: Der Fluch des gebrochenen Herzens (HKLM-x32\...\Margrave Manor: Der Fluch des gebrochenen Herzens) (Version: - ) McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.11.309.1 - McAfee, Inc.) Mediathek (HKLM-x32\...\{EFFED0C0-5299-422E-AFE6-8B8066D18A2A}) (Version: 1.4.0 - Medion) Medion Home Cinema 10 (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.) Medion Home Cinema 10 (x32 Version: 10.1924 - CyberLink Corp.) Hidden Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4815.1001 - Microsoft Corporation) Microsoft Office Excel Viewer (HKLM-x32\...\{95120000-003F-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation) Microsoft OneDrive (HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\OneDriveSetup.exe) (Version: 17.3.4604.0120 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation) Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation) Mobile Partner (HKLM-x32\...\Mobile Partner) (Version: 21.005.15.02.382 - Huawei Technologies Co.,Ltd) Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden Mozilla Firefox 35.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0 (x86 de)) (Version: 35.0 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 35.0 - Mozilla) Mystery Murders - Jack the Ripper 2 (HKLM-x32\...\Mystery Murders - Jack the Ripper 2) (Version: 1.0.0.221.de - Rondomedia) Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4805.1003 - Microsoft Corporation) Hidden Office 15 Click-to-Run Licensing Component (Version: 15.0.4805.1003 - Microsoft Corporation) Hidden Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4805.1003 - Microsoft Corporation) Hidden Opera Stable 36.0.2130.65 (HKLM-x32\...\Opera 36.0.2130.65) (Version: 36.0.2130.65 - Opera Software) PHotkey (HKLM-x32\...\{E50C224A-BBF2-428D-9DCF-DBF9DF85C40E}) (Version: 1.00.0081 - Pegatron Corporation) Podstawowe programy Windows Live (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden QuickLaunch (HKLM-x32\...\{A802F1E3-34C8-4C84-9948-C1C4E37D0FA9}) (Version: 1.00.0019 - Lenovo Group Limited) QuickTime 7 (HKLM-x32\...\{FF59BD75-466A-4D5A-AD23-AAD87C5FD44C}) (Version: 7.79.80.95 - Apple Inc.) Raccolta foto (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6722 - Realtek Semiconductor Corp.) Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.30136 - Realtek Semiconductor Corp.) Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group) Sony PC Companion 2.10.188 (HKLM-x32\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.188 - Sony) SpringFiles (HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\SpringFiles) (Version: 29.15.39 - hxxp://www.spring-file.com) Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.16.0 - Synaptics Incorporated) Unsolved Mystery Club - Ancient Astronauts (HKLM-x32\...\Unsolved Mystery Club - Ancient Astronauts) (Version: - ) Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - ) Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - ) Web Companion (HKLM-x32\...\{503a5c39-884e-4cba-9e30-eacb1b81325c}) (Version: 2.1.1108.2313 - Lavasoft) Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation) WinRAR 5.21 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.21.0 - win.rar GmbH) WinZip 20.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C24101}) (Version: 20.0.11659 - WinZip Computing, S.L. ) ==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) CustomCLSID: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation) CustomCLSID: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32 -> C:\Program Files\WinZip\adxloader64.dll () ==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) ============= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) Task: {011761AD-7FDF-462E-A515-2ABF8A30BCEB} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-04-07] (Adobe Systems Incorporated) Task: {0539AB7B-C0A6-42F0-B8CB-0119260DE526} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\BrowserChoice\browserchoice.exe Task: {08F16DDA-5825-4A48-A46C-DE6E213FAA0D} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2016-03-22] (Microsoft Corporation) Task: {24204B2E-0BE0-45F0-9F7A-9FBA23A33D70} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.) Task: {56B876E6-1CBB-4572-B3B5-80FA98933DED} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2016-02-09] (Microsoft Corporation) Task: {67EABA3D-88EE-4D8D-ADB8-A27840D63463} - System32\Tasks\{4081A24E-DF42-4119-A43A-3BDCBE61108C} => pcalua.exe -a "C:\Program Files (x86)\iMesh Applications\iMesh\uninstall.exe" Task: {6F984935-BD8B-4815-A900-D1596DA9BBD1} - System32\Tasks\Opera scheduled Autoupdate 1442781566 => C:\Program Files (x86)\Opera\launcher.exe [2016-04-11] (Opera Software) Task: {7E9D12FA-7387-4DA4-A9E6-5CCE304263B2} - System32\Tasks\Synaptics TouchPad Enhancements => Program Files\Synaptics\SynTP\SynTPEnh.exe Task: {ADF6A9A1-67AE-4A55-8621-B7D6A353B75B} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2016-02-09] (Microsoft Corporation) Task: {B353DCC0-6453-4226-BDE2-8288B8E744C8} - System32\Tasks\Dolby Selector => C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [2012-08-31] (Dolby Laboratories Inc.) Task: {D90AC541-5D08-481E-B606-E24F068C2C75} - System32\Tasks\{2FE13EE9-AE44-25EE-1098-2BDFFC5F70F9} => C:\Users\Schatz\AppData\Local\{B9D18~1\UNINST~1.EXE (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.) Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\WINDOWS\Tasks\Search Provided by Yahoo litod.job => Wscript.exe C:\ProgramData\{CEE80B8B-44AA-814D-C26C-1F0F582E94C1}\dide.txt <==== ACHTUNG Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe Task: C:\WINDOWS\Tasks\{2FE13EE9-AE44-25EE-1098-2BDFFC5F70F9}.job => C:\Users\Schatz\AppData\Local\{B9D18~1\UNINST~1.EXE ==================== Verknüpfungen ============================= (Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.) Shortcut: C:\Users\Schatz\Desktop\Neuer Ordner\router\FRITZ!Box\reconnect.bat - Verknüpfung.lnk -> D:\Dokumente\Visual Studio 2005\Projects\Linker\Linker\bin\Release\CryptLoad_Secure\router\FRITZ!Box\reconnect.bat (Keine Datei) ==================== Geladene Module (Nicht auf der Ausnahmeliste) ============== 2012-11-30 13:41 - 2012-11-29 15:53 - 00805888 _____ () C:\Program Files (x86)\PHotkey\GFNEXSrv.exe 2016-03-18 22:56 - 2016-03-18 22:56 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll 2016-03-18 22:56 - 2016-03-18 22:56 - 01329936 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll 2015-06-18 20:29 - 2015-10-13 05:34 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll 2011-03-14 17:27 - 2011-03-14 17:27 - 00346976 _____ () C:\ProgramData\DatacardService\HWDeviceService64.exe 2014-04-22 19:23 - 2014-04-22 19:23 - 00239968 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe 2012-11-28 11:35 - 2012-10-19 13:27 - 00386344 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe 2012-11-30 13:41 - 2012-11-27 17:18 - 02215424 _____ () C:\Program Files (x86)\PHotkey\PHotkey.exe 2012-11-30 13:41 - 2010-01-12 19:36 - 00117256 _____ () C:\Program Files (x86)\PHotkey\MsgTranAgt.exe 2012-11-30 13:41 - 2010-01-12 19:36 - 00121864 _____ () C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe 2012-11-30 13:41 - 2010-12-17 16:04 - 00449032 _____ () C:\Program Files (x86)\PHotkey\ATouch64.exe 2012-11-30 13:41 - 2012-10-23 20:07 - 03471872 _____ () C:\Program Files (x86)\PHotkey\POSD.exe 2012-11-30 13:41 - 2012-08-08 20:10 - 07536128 _____ () C:\Program Files (x86)\PHotkey\GPMTray.exe 2014-04-22 19:23 - 2014-04-22 19:23 - 00011362 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\mingwm10.dll 2014-04-22 19:23 - 2014-04-22 19:23 - 00043008 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\libgcc_s_dw2-1.dll 2014-04-22 19:23 - 2014-04-22 19:23 - 02415104 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QtCore4.dll 2014-04-22 19:23 - 2014-04-22 19:23 - 01148416 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QtNetwork4.dll 2014-04-22 19:23 - 2014-04-22 19:23 - 00383488 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QueryStrategy.dll 2014-04-22 19:23 - 2014-04-22 19:23 - 00398336 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QtXml4.dll 2012-11-30 13:41 - 2009-12-18 17:36 - 00973432 _____ () C:\Program Files (x86)\PHotkey\acAuth.dll 2012-11-30 13:41 - 2009-12-18 17:41 - 00129544 _____ () C:\Program Files (x86)\PHotkey\GFNEX.dll 2016-04-14 21:53 - 2016-04-14 21:52 - 63830568 _____ () C:\Program Files (x86)\Opera\36.0.2130.65\opera.dll 2016-04-14 21:52 - 2016-04-14 21:50 - 02134568 _____ () C:\Program Files (x86)\Opera\36.0.2130.65\libglesv2.dll 2016-04-14 21:52 - 2016-04-14 21:50 - 00082472 _____ () C:\Program Files (x86)\Opera\36.0.2130.65\libegl.dll 2016-04-21 18:09 - 2016-04-21 18:09 - 00016384 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PSIClient\6e7eaf9e7d8430aae7aacf25610e4eec\PSIClient.ni.dll 2012-11-23 05:16 - 2012-06-25 11:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll ==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) ========= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.) AlternateDataStreams: C:\ProgramData\Temp:FC595E85 [286] ==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) =================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.) ==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) =============== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.) ==================== Internet Explorer Vertrauenswürdig/Eingeschränkt =============== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.) IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com Da befinden sich 7866 mehr Seiten. IE trusted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\localhost -> localhost IE trusted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\webcompanion.com -> hxxp://webcompanion.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\007guard.com -> install.007guard.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\008i.com -> 008i.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\008k.com -> www.008k.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\00hq.com -> www.00hq.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\010402.com -> 010402.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\0scan.com -> www.0scan.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\1-2005-search.com -> www.1-2005-search.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\1-domains-registrations.com -> www.1-domains-registrations.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\1000gratisproben.com -> www.1000gratisproben.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\1001namen.com -> www.1001namen.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\100888290cs.com -> mir.100888290cs.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\100sexlinks.com -> www.100sexlinks.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\10sek.com -> www.10sek.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\12-26.net -> user1.12-26.net IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\12-27.net -> user1.12-27.net IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\123fporn.info -> www.123fporn.info IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\123haustiereundmehr.com -> www.123haustiereundmehr.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\123moviedownload.com -> www.123moviedownload.com IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\123simsen.com -> www.123simsen.com Da befinden sich 7866 mehr Seiten. ==================== Hosts Inhalt: ========================== (Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.) 2013-08-22 15:25 - 2016-04-12 22:21 - 00001006 ____N C:\WINDOWS\system32\Drivers\etc\hosts 127.0.0.1 down.baidu2016.com 127.0.0.1 123.sogou.com 127.0.0.1 www.czzsyzgm.com 127.0.0.1 www.czzsyzxl.com 127.0.0.1 union.baidu2019.com ==================== Andere Bereiche ============================ (Aktuell gibt es keinen automatisierten Fix für diesen Bereich.) HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\Control Panel\Desktop\\Wallpaper -> DNS Servers: 192.168.0.1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) Windows Firewall ist aktiviert. ==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge == (Aktuell gibt es keinen automatisierten Fix für diesen Bereich.) HKLM\...\StartupApproved\Run32: => "Iminent" HKLM\...\StartupApproved\Run32: => "IminentMessenger" HKLM\...\StartupApproved\Run32: => "QuickTime Task" HKLM\...\StartupApproved\Run32: => "iTunesHelper" HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\StartupApproved\Run: => "icq" HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\StartupApproved\Run: => "iMesh" HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\StartupApproved\Run: => "Sony PC Companion" ==================== Firewall Regeln (Nicht auf der Ausnahmeliste) =============== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139 FirewallRules: [{59EC4CF5-609E-422F-8042-D9CDE0EB6829}] => (Allow) C:\Users\Schatz\AppData\Local\Microsoft\OneDrive\OneDrive.exe FirewallRules: [{C6EEC361-CE32-4231-ADDE-E5A7C67BEEFB}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe FirewallRules: [{5B967B63-630B-40F4-88C8-61F6D752D127}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{D6ACFA72-D875-4A6E-8D34-1C6AD3F3A06E}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{4F182DE5-4F27-4D5B-8701-9722B9F8662E}] => (Allow) C:\Users\Schatz\AppData\Local\Torch\Plugins\Hola\hola_plugin_x64.exe FirewallRules: [TCP Query User{BE4E9FEC-D914-4E4F-926F-E01F5DE598C1}C:\program files (x86)\cyberlink\powerdvd10\pdvd10serv.exe] => (Allow) C:\program files (x86)\cyberlink\powerdvd10\pdvd10serv.exe FirewallRules: [UDP Query User{9CD2DAFF-8500-4EF6-BBF2-E4F1F79E2001}C:\program files (x86)\cyberlink\powerdvd10\pdvd10serv.exe] => (Allow) C:\program files (x86)\cyberlink\powerdvd10\pdvd10serv.exe FirewallRules: [TCP Query User{4E9A1825-1730-44D7-8A82-7646F852914A}C:\program files (x86)\cyberlink\powerdvd10\pdvd10serv.exe] => (Block) C:\program files (x86)\cyberlink\powerdvd10\pdvd10serv.exe FirewallRules: [UDP Query User{505D4722-8D42-4D76-99DB-65DFF02FC215}C:\program files (x86)\cyberlink\powerdvd10\pdvd10serv.exe] => (Block) C:\program files (x86)\cyberlink\powerdvd10\pdvd10serv.exe FirewallRules: [{1E1249F9-4AEB-41B9-9534-E10A4AD394C2}] => (Allow) C:\Program Files (x86)\SpringFiles\SpringFiles.exe FirewallRules: [{DAD41EE2-07B1-45C1-87CA-AAB75AEA648E}] => (Allow) C:\Program Files (x86)\SpringFiles\SpringFiles.exe FirewallRules: [{EB85DE1E-22DB-4D7A-9929-4B1B2E98F7C7}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{2AF39E2D-44C3-4877-AACE-797D2BAB21DD}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{2CDD11C8-6D06-4571-AED2-0CC8596C9660}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{7C84D8A8-C127-4CE3-AF1E-985C5A1D50AA}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{8ED0F09F-D5B2-4021-9172-C6B1B1896518}] => (Allow) C:\Program Files\iTunes\iTunes.exe FirewallRules: [{7896FC6A-3D88-4BAD-ACE2-9D3EF6E710C8}] => (Allow) C:\Users\Schatz\AppData\Local\Chromium\Application\chrome.exe ==================== Wiederherstellungspunkte ========================= 14-04-2016 00:47:36 Windows Update 14-04-2016 23:14:13 JRT Pre-Junkware Removal 21-04-2016 17:15:00 Revo Uninstaller's restore point - Kaspersky Total Security ==================== Fehlerhafte Geräte im Gerätemanager ============= ==================== Fehlereinträge in der Ereignisanzeige: ========================= Applikationsfehler: ================== Error: (04/21/2016 05:14:54 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: ) Description: Subscription licensing service failed: -1073422302 Error: (04/21/2016 05:07:16 PM) (Source: ESENT) (EventID: 454) (User: ) Description: svchost (1668) SRUJet: Bei Datenbankwiederherstellung trat ein unerwarteter Fehler -1216 auf. Error: (04/21/2016 05:07:16 PM) (Source: ESENT) (EventID: 494) (User: ) Description: svchost (1668) SRUJet: Bei der Datenbankwiederherstellung ist ein Fehler aufgetreten (Fehler -1216), da Verweise auf Datenbank "C:\WINDOWS\system32\SRU\SRUDB.dat" festgestellt wurden, die nicht mehr vorhanden ist. Die Datenbank wurde nicht sauber heruntergefahren, bevor sie entfernt (oder möglicherweise verschoben oder umbenannt) wurde. Das Datenbankmodul lässt den Abschluss der Wiederherstellung für diese Instanz erst dann zu, wenn die fehlende Datenbank wieder verfügbar gemacht wird. Wenn die Datenbank tatsächlich nicht mehr verfügbar oder nicht mehr erforderlich ist, finden Sie Informationen zum Beheben dieses Fehlers in der Microsoft Knowledge Base oder unter dem Link "Weitere Informationen" am Ende dieser Meldung. Error: (04/21/2016 04:52:52 PM) (Source: ESENT) (EventID: 470) (User: ) Description: svchost (1392) SRUJet: Datenbank C:\WINDOWS\system32\SRU\SRUDB.dat wurde teilweise angehängt. Anhängungsstufe: 3. Fehler: -1019. Error: (04/21/2016 04:52:52 PM) (Source: ESENT) (EventID: 476) (User: ) Description: svchost (1392) SRUJet: Bei Überprüfung der aus Datei "C:\WINDOWS\system32\SRU\SRUDB.dat" bei Offset 8192 (0x0000000000002000) (Datenbankseite 1 (0x1)) für 4096 (0x00001000) Bytes gelesenen Datenbankseite ist ein Fehler aufgetreten, weil sie keine Seitendaten enthält. Fehler -1019 (0xfffffc05) bei Leseoperation. Wenn dieser Zustand andauert, stellen Sie die Datenbank aus einer vorherigen Sicherung wieder her. Dieses Problem ist vermutlich durch fehlerhafte Hardware bedingt. Wenden Sie sich für weitere Unterstützung bei der Diagnose des Problems an Ihren Hardwarehersteller. Error: (04/17/2016 07:33:18 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 13234 Error: (04/17/2016 07:33:18 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 13234 Error: (04/17/2016 07:33:18 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (04/17/2016 07:30:33 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: SDUpdate.exe, Version: 2.4.40.94, Zeitstempel: 0x53ad3eee Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.18264, Zeitstempel: 0x56e1b34d Ausnahmecode: 0x0eedfade Fehleroffset: 0x00015b68 ID des fehlerhaften Prozesses: 0x1acc Startzeit der fehlerhaften Anwendung: 0xSDUpdate.exe0 Pfad der fehlerhaften Anwendung: SDUpdate.exe1 Pfad des fehlerhaften Moduls: SDUpdate.exe2 Berichtskennung: SDUpdate.exe3 Vollständiger Name des fehlerhaften Pakets: SDUpdate.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: SDUpdate.exe5 Error: (04/16/2016 10:11:04 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SCHWARZEGIRL) Description: Bei der Aktivierung der App „CyberLinkCorp.me.PowerDVDforMedion_fyjd2029wheaw!App“ ist folgender Fehler aufgetreten: -2144927142. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“. Systemfehler: ============= Error: (04/21/2016 09:47:56 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "IE Search Set" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (04/21/2016 09:47:56 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "Mobile Partner. OUC" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (04/21/2016 09:47:56 PM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Mobile Partner. OUC erreicht. Error: (04/21/2016 09:46:57 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT) Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet. Modulpfad: C:\WINDOWS\System32\IWMSSvc.dll Error: (04/21/2016 09:46:57 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT) Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet. Modulpfad: C:\WINDOWS\System32\IWMSSvc.dll Error: (04/21/2016 09:46:57 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "Apple Mobile Device Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%109 Error: (04/21/2016 09:46:55 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" ist vom Dienst "Windows Search" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1069 Error: (04/21/2016 09:46:55 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet: %%1069 Error: (04/21/2016 09:46:55 PM) (Source: Service Control Manager) (EventID: 7038) (User: ) Description: Der Dienst "WSearch" konnte sich nicht als "NT AUTHORITY\SYSTEM" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%50 Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC). Error: (04/21/2016 09:46:55 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet: %%1069 ==================== Speicherinformationen =========================== Prozessor: Intel(R) Celeron(R) CPU 1000M @ 1.80GHz Prozentuale Nutzung des RAM: 47% Installierter physikalischer RAM: 3977.11 MB Verfügbarer physikalischer RAM: 2086.32 MB Summe virtueller Speicher: 5129.11 MB Verfügbarer virtueller Speicher: 2728.57 MB ==================== Laufwerke ================================ Drive c: (Boot) (Fixed) (Total:403.61 GB) (Free:336.07 GB) NTFS Drive d: (Recover) (Fixed) (Total:60 GB) (Free:35.17 GB) NTFS ==================== MBR & Partitionstabelle ================== ======================================================== Disk: 0 (Size: 465.8 GB) (Disk ID: 00000000) Partition: GPT. ==================== Ende von Addition.txt ============================ |
22.04.2016, 15:58 | #8 |
/// Malwareteam | Trotz Malwarebytes und Adawarecleaner PopupfensterESET Online Scanner
Hinweis: Dieser Scan kann schon einmal mehrere Stunden dauern... Hast du noch irgendwelche Probleme mit deinem Rechner?
__________________ Mfg, Rafael ~ I'm storm. I'm calm. I'm fire. I'm ice. I'm burningice. ~ Unterstütze uns mit einer Spende ......... Lob, Kritik oder Wünsche ......... .......... Folge uns auf Facebook .......... |
24.04.2016, 08:33 | #9 |
| Trotz Malwarebytes und Adawarecleaner PopupfensterCode:
ATTFilter ESETSmartInstaller@High as downloader log: all ok # product=EOS # version=8 # OnlineScannerApp.exe=1.0.0.1 # EOSSerial=4b6667a6ddadab40a533c2ce1a2fb359 # end=init # utc_time=2016-04-24 04:39:32 # local_time=2016-04-24 06:39:32 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # osver=6.2.9200 NT Update Init Update Download Update Finalize Updated modules version: 29211 # product=EOS # version=8 # OnlineScannerApp.exe=1.0.0.1 # EOSSerial=4b6667a6ddadab40a533c2ce1a2fb359 # end=updated # utc_time=2016-04-24 04:42:16 # local_time=2016-04-24 06:42:16 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # osver=6.2.9200 NT # product=EOS # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.7777 # api_version=3.1.1 # EOSSerial=4b6667a6ddadab40a533c2ce1a2fb359 # engine=29211 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2016-04-24 07:14:49 # local_time=2016-04-24 09:14:49 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1031 # osver=6.2.9200 NT # compatibility_mode_1='Avira Antivirus' # compatibility_mode=1815 16777213 100 100 9451 53200536 0 0 # compatibility_mode_1='' # compatibility_mode=5893 16776574 100 94 21282363 110209405 0 0 # scanned=281732 # found=33 # cleaned=0 # scan_time=9152 sh=F3B5A5383BEC4F0ADF8EAD2C4C9D1CD13A9A083B ft=1 fh=3b6eecfc8fe20b29 vn="Win32/Systweak.O evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\FileQuarantine\C\Program Files (x86)\WinZip Registry Optimizer\CleanSchedule.exe.vir" sh=7BD40B943D61C6193BD584657363ECAD79BC3D3D ft=0 fh=0000000000000000 vn="JS/Lightning.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\FileQuarantine\C\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\deskCutv2@gmail.com\chrome\content\index.html.vir" sh=F338AF05B3C8FF9D60FB7FF772B2D9EE293353C9 ft=0 fh=0000000000000000 vn="JS/Lightning.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\FileQuarantine\C\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\deskCutv2@gmail.com\chrome\content\js\lib\jquery-2.1.0.min.js.vir" sh=66709C08173480EF5BC22ED8BF5CFD427276520B ft=0 fh=0000000000000000 vn="JS/Lightning.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\FileQuarantine\C\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\deskCutv2@gmail.com\chrome\content\js\module\mostgrid.js.vir" sh=827BD4E023C5CD9C32A65F39BE4F76B00879B8CB ft=0 fh=0000000000000000 vn="JS/Lightning.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\FileQuarantine\C\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\deskCutv2@gmail.com\chrome\content\js\pack\common.js.vir" sh=BF187F6391DE04E413BDEA876241194418C2732A ft=0 fh=0000000000000000 vn="JS/Lightning.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\FileQuarantine\C\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\deskCutv2@gmail.com\chrome\content\js\pack\xagainit.js.vir" sh=7BD40B943D61C6193BD584657363ECAD79BC3D3D ft=0 fh=0000000000000000 vn="JS/Lightning.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\FileQuarantine\C\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\extensions\deskCutv2@gmail.com\chrome\content\index.html.vir" sh=F338AF05B3C8FF9D60FB7FF772B2D9EE293353C9 ft=0 fh=0000000000000000 vn="JS/Lightning.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\FileQuarantine\C\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\extensions\deskCutv2@gmail.com\chrome\content\js\lib\jquery-2.1.0.min.js.vir" sh=66709C08173480EF5BC22ED8BF5CFD427276520B ft=0 fh=0000000000000000 vn="JS/Lightning.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\FileQuarantine\C\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\extensions\deskCutv2@gmail.com\chrome\content\js\module\mostgrid.js.vir" sh=827BD4E023C5CD9C32A65F39BE4F76B00879B8CB ft=0 fh=0000000000000000 vn="JS/Lightning.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\FileQuarantine\C\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\extensions\deskCutv2@gmail.com\chrome\content\js\pack\common.js.vir" sh=BF187F6391DE04E413BDEA876241194418C2732A ft=0 fh=0000000000000000 vn="JS/Lightning.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\FileQuarantine\C\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\extensions\deskCutv2@gmail.com\chrome\content\js\pack\xagainit.js.vir" sh=96D28CD2C73BCFA3BA0B69305972110122C78C13 ft=1 fh=d67a8f0fce9576c9 vn="Variante von Win32/Toolbar.Iminent.K evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Iminent\inst\Bootstrapper\Bootstrapper.exe.vir" sh=FB5064BA698293D937411707C29F1A38DEFDF2EF ft=1 fh=87edca7535116eae vn="Win32/Somoto.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Schatz\AppData\Local\webplayer\Uninstall.exe.vir" sh=4C1A2BEACA0702A3EA3EF5005CD064605850813E ft=1 fh=c71c0011871ed107 vn="Win32/Somoto.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Schatz\AppData\Local\webplayer\WebPlayer.exe.vir" sh=4C1A2BEACA0702A3EA3EF5005CD064605850813E ft=1 fh=c71c0011871ed107 vn="Win32/Somoto.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Schatz\AppData\Local\webplayer\FLV Player\WebPlayer.exe.vir" sh=C1C66AA7FFD537DF1720DD63E3BE4E009B0793F2 ft=1 fh=c25b5c4dff3942af vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Schatz\AppData\Local\Temp\DMR\dmr_72.exe" sh=612FD279DC51D1C4E45A6709981ECAD922DCDB08 ft=1 fh=9663c83becf71abd vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Schatz\Desktop\Alte Firefox-Daten\tlw1tx93.default\extensions\{13058AF4-66EB-75FE-B521-F5B654EE2BA4}\components\DatamngrHlpFF20.dll" sh=832524EB1BFEFA2C8F8918107E6FFA5E9A52C148 ft=1 fh=a3e1f6168899090a vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Schatz\Desktop\Alte Firefox-Daten\tlw1tx93.default\extensions\{13058AF4-66EB-75FE-B521-F5B654EE2BA4}\components\DatamngrHlpFF21.dll" sh=7B7BF93E3FB5C37A6492B3F3D96E852A6A7D29EF ft=1 fh=18d97f52c40abca4 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Schatz\Desktop\Alte Firefox-Daten\tlw1tx93.default\extensions\{13058AF4-66EB-75FE-B521-F5B654EE2BA4}\components\DatamngrHlpFF22.dll" sh=A3E1F14C641FCC37DBB94D64DE6E27B0C9ADD598 ft=1 fh=0266f8938a90014c vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Schatz\Desktop\Alte Firefox-Daten\tlw1tx93.default\extensions\{13058AF4-66EB-75FE-B521-F5B654EE2BA4}\components\DatamngrHlpFF23.dll" sh=D3017C0CADE7B394791990FF5DD2819F0D403271 ft=1 fh=f752dd0e50ca63ee vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Schatz\Desktop\Alte Firefox-Daten\tlw1tx93.default\extensions\{13058AF4-66EB-75FE-B521-F5B654EE2BA4}\components\DatamngrHlpFF24.dll" sh=614DD490C351752E7F99A373C55207FEFD9B4D2C ft=1 fh=3dfe5dc3fa3a36e2 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Schatz\Desktop\Alte Firefox-Daten\tlw1tx93.default\extensions\{13058AF4-66EB-75FE-B521-F5B654EE2BA4}\components\DatamngrHlpFF4.dll" sh=8EF7DD9A122BC536BA48289B5A0E1B94526ED513 ft=1 fh=de50e42c2fb03b15 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Schatz\Desktop\Alte Firefox-Daten\tlw1tx93.default\extensions\{13058AF4-66EB-75FE-B521-F5B654EE2BA4}\components\DatamngrHlpFF5.dll" sh=8FD8EFFBC6CB06DE6F76EFF293EFF664C1A0BA9E ft=1 fh=88ae1dac69ae59e6 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Schatz\Desktop\Alte Firefox-Daten\tlw1tx93.default\extensions\{13058AF4-66EB-75FE-B521-F5B654EE2BA4}\components\DatamngrHlpFF6.dll" sh=4E463F3331D9FD46EC3DCA4E60B242B723B0BFCE ft=1 fh=19d210181369822b vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Schatz\Desktop\Alte Firefox-Daten\tlw1tx93.default\extensions\{13058AF4-66EB-75FE-B521-F5B654EE2BA4}\components\DatamngrHlpFF7.dll" sh=E617CFA653F4345B58E5D56B0AAE6ED160C7FFDF ft=1 fh=a8dd0787c9413f1b vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Schatz\Desktop\Alte Firefox-Daten\tlw1tx93.default\extensions\{13058AF4-66EB-75FE-B521-F5B654EE2BA4}\components\DatamngrHlpFF8.dll" sh=5F38D11E3C3C10213EBCC97561517C06D5703151 ft=1 fh=54435087bca079c1 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Schatz\Desktop\Alte Firefox-Daten\tlw1tx93.default\extensions\{13058AF4-66EB-75FE-B521-F5B654EE2BA4}\components\DatamngrHlpFF9.dll" sh=99979C1A780E1E7C06F8493A704669D2A4DACBAC ft=1 fh=ac779f0373f0b3cb vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Schatz\Downloads\CryptLoad - CHIP-Installer.exe" sh=F388221319B0F8865E608A6A3CC1DA9708E55C5D ft=1 fh=39c436cfaae15843 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Schatz\Downloads\File Repair - CHIP-Installer.exe" sh=B696D5BDCC5B6F8EA404FA4E45AD433D01190F5D ft=1 fh=46094d2e116729d7 vn="NSIS/Agent.NBQ Trojaner" ac=I fn="C:\Users\Schatz\Downloads\installer [1].exe" sh=7C871804734886A7174B3590E2899F878CD61986 ft=1 fh=1d8b661cd02ab52f vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Schatz\Downloads\SpyBot Search Destroy - CHIP-Installer.exe" sh=41BEC17709241C0E92CD986F8209FC471164ADAF ft=1 fh=0e63d8bc5a93992e vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Schatz\Downloads\VCDEasy - CHIP-Installer.exe" sh=258347E9CA0319EDFACB8194FC022A453DE417E3 ft=0 fh=0000000000000000 vn="Variante von Win32/Systweak.L evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\d6facf6.msi" |
24.04.2016, 23:15 | #10 |
/// Malwareteam | Trotz Malwarebytes und Adawarecleaner Popupfenster Was ist mit meiner Frage?
__________________ Mfg, Rafael ~ I'm storm. I'm calm. I'm fire. I'm ice. I'm burningice. ~ Unterstütze uns mit einer Spende ......... Lob, Kritik oder Wünsche ......... .......... Folge uns auf Facebook .......... |
25.04.2016, 09:35 | #11 |
| Trotz Malwarebytes und Adawarecleaner Popupfenster Ach ich habe ganz vergessen das ich die letzten Schritte noch machen muss !!! was mich noch ein wenig stört ist das er solange beim Hochfahren brauch, was aber auch an den Spielen liegen kann die installiert sind. Ausserdem sagt er mir das mein Mediaplayer angeblich nicht installiert ist. Danke dir !!! LG |
25.04.2016, 17:41 | #12 |
/// Malwareteam | Trotz Malwarebytes und Adawarecleaner Popupfenster Schritt: 1 Bitte deinstalliere dieses Programm: Web Companion Schritt: 2 Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Users\Schatz\AppData\Local\Temp\DMR\dmr_72.exe C:\Users\Schatz\Downloads\installer [1].exe C:\Windows\Installer\d6facf6.msi emptytemp: FF HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\cliqz@cliqz.com => nicht gefunden FF Extension: Cliqz - C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\Extensions\cliqz@cliqz.com.xpi [2016-03-22] FF Extension: Cliqz - C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\Extensions\cliqz@cliqz.com.xpi [2016-03-22] S2 SearchProtectionService; C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WinService.exe [X] C:\Program Files (x86)\Lavasoft Task: C:\WINDOWS\Tasks\{2FE13EE9-AE44-25EE-1098-2BDFFC5F70F9}.job => C:\Users\Schatz\AppData\Local\{B9D18~1\UNINST~1.EXE C:\Users\Schatz\AppData\Local\{B9D18~1 Task: C:\WINDOWS\Tasks\Search Provided by Yahoo litod.job => Wscript.exe C:\ProgramData\{CEE80B8B-44AA-814D-C26C-1F0F582E94C1}\dide.txt <==== ACHTUNG C:\ProgramData\{CEE80B8B-44AA-814D-C26C-1F0F582E94C1} Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Schritt: 3 Bitte starte wieder FRST, setze den Haken bei Addition und drücke auf Untersuchen. Poste bitte wieder die beiden Textdateien, die so entstehen.
__________________ Mfg, Rafael ~ I'm storm. I'm calm. I'm fire. I'm ice. I'm burningice. ~ Unterstütze uns mit einer Spende ......... Lob, Kritik oder Wünsche ......... .......... Folge uns auf Facebook .......... |
Themen zu Trotz Malwarebytes und Adawarecleaner Popupfenster |
andauernd, antworten, js/lightning.a, logfiles, malware / spyware, malwarebytes, nsis/agent.nbq, programme, programmen, pup.optional.winyahoo, pup.optional.yessearches, versucht, win32/downloadsponsor.c, win32/somoto.i, win32/systweak.l, win32/systweak.o, win32/toolbar.iminent.k, win32/toolbar.searchsuite.q |