Trojaner-Board - Windows 7: 'EXP/CVE-2011-3402' [exploit] in 'C:\Windows\Fonts\gulim.ttc' + AntiVir lässt sich nicht mehr aktivieren

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Windows 7: 'EXP/CVE-2011-3402' [exploit] in 'C:\Windows\Fonts\gulim.ttc' + AntiVir lässt sich nicht mehr aktivieren (https://www.trojaner-board.de/140314-windows-7-exp-cve-2011-3402-exploit-c-windows-fonts-gulim-ttc-antivir-laesst-mehr-aktivieren.html)

Windows 7: 'EXP/CVE-2011-3402' [exploit] in 'C:\Windows\Fonts\gulim.ttc' + AntiVir lässt sich nicht mehr aktivieren

Hallo,

nach dem Hochfahren bekam ich die Meldung von AntiVir, dass beim Echtzeit-Scann, dass 'EXP/CVE-2011-3402' [exploit] gefunden wurde. Gestern hatte ich einen USB-Stick eines Freundes an meinen Rechner, um Dateien auf den Stick zu spielen. Direkt danach habe ich den Rechner runtergefahren und heute morgen erst wieder hochgefahren, worauf hin sofort die oben genannte Meldung kam.

Ich habe als erstes einen Virenscan mit AntiVir durchgeführt, aber das Programm hat nichts gemeldet. Dann habe ich das System zurückgesetzt und seit dem lässt sich das AntiVir Programm nicht aktvieren.

Ich habe sämtliche logs wie in der Anleitung beschrieben vorbereitet. Wie geht es jetzt weiter? Alle posten oder warten bis mir gesagt wird welche ich posten soll?

Vielen Dank schon mal für Hilfe!

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Hallo,
sorry, ich hatte den letzten Satz in der Anleitung übersehen. Hier sind alle Logs:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 23-08-2013

Ran by ***** (administrator) on 23-08-2013 13:09:25

Running from C:\Users\*****\Desktop

Microsoft Windows 7 Starter  Service Pack 1 (X86) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) ===================
 

(Cisco Systems, Inc.) C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe

(APN LLC.) C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe

(Dritek System Inc.) C:\Program Files\Launch Manager\dsiwmis.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe

(Acer Incorporated) C:\Program Files\Acer\Registration\GregHSRW.exe

(Acer Incorporated) C:\Program Files\Acer\Acer VCM\RS_Service.exe

(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe

(Yahoo! Inc.) C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe

(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe

(Egis Technology Inc.) C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe

(Egis Technology Inc.) C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Intel Corporation) C:\Windows\system32\igfxsrvc.exe

(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

(APN) C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe

(Dropbox, Inc.) C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe

(Intel Corporation) C:\Windows\system32\igfxext.exe

(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe

(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe

(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apntex.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [LManager] - C:\Program Files\Launch Manager\LManager.exe [1157640 2009-10-07] (Dritek System Inc.)

HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8120864 2009-12-09] (Realtek Semiconductor)

HKLM\...\Run: [Acer ePower Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [703008 2009-10-01] (Acer Incorporated)

HKLM\...\Run: [EgisTecLiveUpdate] - C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-08-04] (Egis Technology Inc.)

HKLM\...\Run: [mwlDaemon] - C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-09-10] (Egis Technology Inc.)

HKLM\...\Run: [Apoint] - C:\Program Files\Apoint2K\Apoint.exe [233472 2009-10-15] (Alps Electric Co., Ltd.)

HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [345144 2013-08-05] (Avira Operations GmbH & Co. KG)

HKLM\...\Run: [ApnTBMon] - C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1558480 2013-07-26] (APN)

HKCU\...\Run: [Google Update] - C:\Users\*****\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2010-09-14] (Google Inc.)

HKCU\...\Run: [pilad] - rundll32.exe ",RetrieveKey [x]

MountPoints2: {335fee57-c285-11df-92d4-705ab6374a96} - D:\AutoRun.exe

MountPoints2: {335fee78-c285-11df-92d4-705ab6374a96} - D:\AutoRun.exe

MountPoints2: {3bb6e629-cca0-11df-99bb-705ab6374a96} - D:\AutoRun.exe

MountPoints2: {4def93cc-b2a3-11df-844b-705ab6374a96} - E:\AutoRun.exe

MountPoints2: {5e5fe2ce-e7e7-11df-aa42-705ab6374a96} - D:\AutoRun.exe

MountPoints2: {d1780408-b809-11df-9a42-705ab6374a96} - D:\LaunchU3.exe -a

HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files\Acer\Screensaver\run_Acer.exe [ 2009-10-23] ()

HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files\Acer\Screensaver\run_Acer.exe [ 2009-10-23] ()

Startup: C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=ao532h&r=27b50810y975l0494ww35w64i2r59r

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=ao532h&r=27b50810y975l0494ww35w64i2r59r

URLSearchHook: (No Name) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} -  No File

Toolbar: HKLM - Avira SearchFree Toolbar plus Web Protection - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)

Toolbar: HKCU -No Name - {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} -  No File

Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)

Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)

Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 19 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

FireFox:

========

FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\b2bdk1s0.default

FF user.js: detected! => C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\b2bdk1s0.default\user.js

FF NetworkProxy: "type", 4

FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\*****\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File

FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\*****\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File

FF Extension: No Name - C:\Users\*****\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

FF Extension: No Name - C:\Users\*****\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}

FF Extension: ProxTube - Gesperrte YouTube Videos entsperren - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\b2bdk1s0.default\Extensions\ich@maltegoetz.de

FF Extension: dict.cc Community Toolbar - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\b2bdk1s0.default\Extensions\{3160baf9-cf68-48ec-9076-faed7ce49467}

FF Extension: No Name - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\b2bdk1s0.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi

FF Extension: No Name - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\b2bdk1s0.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi

FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
 

========================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-08-05] (Avira Operations GmbH & Co. KG)

S2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-05] (Avira Operations GmbH & Co. KG)

S2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [589368 2013-08-05] (Avira Operations GmbH & Co. KG)

R2 APNMCP; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [168400 2013-07-26] (APN LLC.)

R2 ePowerSvc; C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [727584 2009-10-01] (Acer Incorporated)

R2 Greg_Service; C:\Program Files\Acer\Registration\GregHSRW.exe [1150496 2009-08-28] (Acer Incorporated)

S3 MWLService; C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-10] (Egis Technology Inc.)

R2 RS_Service; C:\Program Files\Acer\Acer VCM\RS_Service.exe [253952 2009-07-10] (Acer Incorporated)

R2 Updater Service; C:\Program Files\Acer\Acer Updater\UpdaterService.exe [240160 2009-07-04] (Acer)
 

==================== Drivers (Whitelisted) ====================
 

S3 AF15BDA; C:\Windows\System32\DRIVERS\AF15BDA.sys [483200 2009-06-03] (ITETech                  )

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [84744 2013-08-05] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135136 2013-08-05] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-08-05] (Avira Operations GmbH & Co. KG)

R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)

S3 EUCR; C:\Windows\System32\DRIVERS\EUCR6SK.SYS [103296 2009-11-23] (ENE Technology Inc.)

R1 mwlPSDFilter; C:\Windows\System32\DRIVERS\mwlPSDFilter.sys [18992 2009-06-02] (Egis Technology Inc.)

R1 mwlPSDNServ; C:\Windows\System32\DRIVERS\mwlPSDNServ.sys [16432 2009-06-02] (Egis Technology Inc.)

R1 mwlPSDVDisk; C:\Windows\System32\DRIVERS\mwlPSDVDisk.sys [60976 2009-06-02] (Egis Technology Inc.)

S3 OXSDIDRV_x32; C:\Windows\System32\DRIVERS\OXSDIDRV_x32.sys [52656 2009-09-28] ()

S3 OXUDIDRV; C:\Windows\system32\Drivers\OXUDIDRV_X32.sys [24880 2010-05-25] ()

S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [89256 2008-05-16] (MCCI Corporation)

S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [15016 2008-05-16] (MCCI Corporation)

S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [120744 2008-05-16] (MCCI Corporation)

S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [114216 2008-05-16] (MCCI Corporation)

S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [25512 2008-05-16] (MCCI Corporation)

S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [110632 2008-05-16] (MCCI Corporation)

S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [115752 2008-05-16] (MCCI Corporation)

R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-05] (Avira GmbH)

S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [x]

S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]

S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-08-23 13:07 - 2013-08-23 13:07 - 01070315 _____ (Farbar) C:\Users\*****\Desktop\FRST.exe

2013-08-23 13:06 - 2013-08-23 13:06 - 00000470 _____ C:\Users\*****\Desktop\defogger_disable.log

2013-08-23 13:06 - 2013-08-23 13:06 - 00000000 _____ C:\Users\*****\defogger_reenable

2013-08-23 13:04 - 2013-08-23 13:04 - 00050477 _____ C:\Users\*****\Desktop\Defogger.exe

2013-08-17 18:28 - 2013-08-23 12:24 - 00000000 ____D C:\Program Files\TAP-Windows

2013-08-17 18:28 - 2013-08-23 12:24 - 00000000 ____D C:\Program Files\OpenVPN

2013-08-17 17:25 - 2013-08-17 17:25 - 00076405 _____ C:\Users\*****\Desktop\Zuerich Sept 2013.htm

2013-08-15 12:22 - 2013-08-15 12:22 - 00000000 ____D C:\Program Files\Common Files\Java

2013-08-15 12:21 - 2013-08-15 12:21 - 00000000 ____D C:\Program Files\Java

2013-08-15 10:59 - 2013-08-15 10:59 - 00000000 ____D C:\Users\*****\Desktop\JavaRa-2.2

2013-08-14 23:13 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-08-14 23:13 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-08-14 23:13 - 2013-07-26 05:13 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-08-14 23:13 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-08-14 23:13 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-08-14 23:13 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-08-14 23:13 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-08-14 23:13 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-08-14 23:13 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-08-14 23:13 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-08-14 23:13 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-08-14 23:13 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-08-14 23:13 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-08-14 23:13 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-08-14 23:13 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-08-14 23:13 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-08-14 13:24 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

2013-08-14 13:24 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2013-08-14 13:24 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe

2013-08-14 13:24 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2013-08-14 13:24 - 2013-07-09 06:53 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2013-08-14 13:24 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll

2013-08-14 13:24 - 2013-07-09 06:50 - 00652800 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll

2013-08-14 13:24 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll

2013-08-14 13:24 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll

2013-08-14 13:24 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll

2013-08-14 13:24 - 2013-07-06 07:05 - 01293760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2013-08-14 13:23 - 2013-06-15 05:38 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys

2013-08-05 11:09 - 2013-08-05 11:09 - 00000000 ____D C:\Users\*****\AppData\Roaming\Avira

2013-08-05 11:06 - 2013-08-05 11:06 - 00000000 ____D C:\ProgramData\AskPartnerNetwork

2013-08-05 11:06 - 2013-08-05 11:06 - 00000000 ____D C:\Program Files\AskPartnerNetwork

2013-08-05 11:05 - 2013-08-05 11:05 - 00067168 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2013-08-05 11:04 - 2013-08-05 11:04 - 00000000 ____D C:\ProgramData\APN

2013-08-05 11:02 - 2013-08-05 10:51 - 00135136 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2013-08-05 11:02 - 2013-08-05 10:51 - 00084744 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2013-08-05 11:02 - 2013-08-05 10:51 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2013-08-05 11:02 - 2013-08-05 10:51 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys

2013-08-05 11:01 - 2013-08-05 11:02 - 00000000 ____D C:\ProgramData\Avira

2013-08-05 11:01 - 2013-08-05 11:01 - 00000000 ____D C:\Program Files\Avira

2013-07-25 20:57 - 2013-08-14 23:32 - 00000000 ____D C:\Windows\system32\MRT
 

==================== One Month Modified Files and Folders =======
 

2013-08-23 13:08 - 2013-08-23 13:08 - 00000000 ____D C:\FRST

2013-08-23 13:07 - 2013-08-23 13:07 - 01070315 _____ (Farbar) C:\Users\*****\Desktop\FRST.exe

2013-08-23 13:06 - 2013-08-23 13:06 - 00000470 _____ C:\Users\*****\Desktop\defogger_disable.log

2013-08-23 13:06 - 2013-08-23 13:06 - 00000000 _____ C:\Users\*****\defogger_reenable

2013-08-23 13:06 - 2010-08-23 03:38 - 00000000 ____D C:\Users\*****

2013-08-23 13:04 - 2013-08-23 13:04 - 00050477 _____ C:\Users\*****\Desktop\Defogger.exe

2013-08-23 12:55 - 2009-07-14 06:34 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-08-23 12:55 - 2009-07-14 06:34 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-08-23 12:34 - 2013-02-20 13:33 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-08-23 12:32 - 2012-08-24 16:05 - 00000000 ___RD C:\Users\*****\Dropbox

2013-08-23 12:32 - 2012-06-03 16:51 - 00000000 ____D C:\Users\*****\AppData\Roaming\Dropbox

2013-08-23 12:25 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-08-23 12:25 - 2009-07-14 06:39 - 00177188 _____ C:\Windows\setupact.log

2013-08-23 12:25 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\wfp

2013-08-23 12:24 - 2013-08-17 18:28 - 00000000 ____D C:\Program Files\TAP-Windows

2013-08-23 12:24 - 2013-08-17 18:28 - 00000000 ____D C:\Program Files\OpenVPN

2013-08-23 12:24 - 2013-07-04 13:35 - 00000000 ____D C:\Program Files\Mozilla Firefox

2013-08-23 12:24 - 2012-05-04 20:47 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service

2013-08-23 12:24 - 2010-09-14 10:25 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome

2013-08-23 12:24 - 2010-09-04 19:31 - 00000000 ____D C:\Users\Gast

2013-08-23 12:24 - 2010-08-24 19:01 - 00000000 ____D C:\Users\*****\AppData\Local\Google

2013-08-23 12:24 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\NDF

2013-08-23 12:24 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache

2013-08-23 12:24 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\registration

2013-08-23 12:24 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET

2013-08-23 12:24 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\AppCompat

2013-08-19 09:21 - 2011-05-05 10:58 - 00000000 ____D C:\Users\*****\Büro

2013-08-17 17:25 - 2013-08-17 17:25 - 00076405 _____ C:\Users\*****\Desktop\Zuerich Sept 2013.htm

2013-08-15 12:46 - 2010-08-24 15:18 - 00000000 ____D C:\Users\*****\AppData\Local\Adobe

2013-08-15 12:22 - 2013-08-15 12:22 - 00000000 ____D C:\Program Files\Common Files\Java

2013-08-15 12:21 - 2013-08-15 12:21 - 00000000 ____D C:\Program Files\Java

2013-08-15 11:25 - 2010-09-14 10:23 - 00001116 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2791932712-1152507361-2035205960-1000UA.job

2013-08-15 11:05 - 2011-06-14 15:52 - 00472808 _____ (Sun Microsystems, Inc.) C:\Windows\system32\deployJava1.dll

2013-08-15 10:59 - 2013-08-15 10:59 - 00000000 ____D C:\Users\*****\Desktop\JavaRa-2.2

2013-08-15 10:07 - 2010-02-20 11:08 - 01562168 _____ C:\Windows\WindowsUpdate.log

2013-08-15 09:46 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE

2013-08-14 23:32 - 2013-07-25 20:57 - 00000000 ____D C:\Windows\system32\MRT

2013-08-14 23:26 - 2010-09-23 13:33 - 75778376 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2013-08-14 23:25 - 2010-01-06 00:17 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-08-14 23:19 - 2010-01-05 23:42 - 01548086 _____ C:\Windows\system32\PerfStringBackup.INI

2013-08-14 16:25 - 2010-09-14 10:23 - 00001064 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2791932712-1152507361-2035205960-1000Core.job

2013-08-06 12:03 - 2009-07-14 06:53 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2013-08-06 11:09 - 2012-12-28 19:51 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2013-08-06 11:09 - 2012-12-28 19:51 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2013-08-06 10:53 - 2010-01-06 00:41 - 00877480 _____ C:\Windows\PFRO.log

2013-08-05 11:09 - 2013-08-05 11:09 - 00000000 ____D C:\Users\*****\AppData\Roaming\Avira

2013-08-05 11:06 - 2013-08-05 11:06 - 00000000 ____D C:\ProgramData\AskPartnerNetwork

2013-08-05 11:06 - 2013-08-05 11:06 - 00000000 ____D C:\Program Files\AskPartnerNetwork

2013-08-05 11:05 - 2013-08-05 11:05 - 00067168 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2013-08-05 11:04 - 2013-08-05 11:04 - 00000000 ____D C:\ProgramData\APN

2013-08-05 11:02 - 2013-08-05 11:01 - 00000000 ____D C:\ProgramData\Avira

2013-08-05 11:01 - 2013-08-05 11:01 - 00000000 ____D C:\Program Files\Avira

2013-08-05 10:51 - 2013-08-05 11:02 - 00135136 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2013-08-05 10:51 - 2013-08-05 11:02 - 00084744 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2013-08-05 10:51 - 2013-08-05 11:02 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2013-08-05 10:51 - 2013-08-05 11:02 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys

2013-08-01 13:17 - 2010-09-02 17:49 - 00000000 ____D C:\Users\*****\Austellung Lesvos

2013-07-30 19:03 - 2011-04-28 10:43 - 00000000 ____D C:\Users\*****\Unsers

2013-07-26 05:13 - 2013-08-14 23:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-07-26 05:13 - 2013-08-14 23:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-07-26 05:13 - 2013-08-14 23:13 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-07-26 05:12 - 2013-08-14 23:13 - 14329344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-07-26 05:12 - 2013-08-14 23:13 - 02877440 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-07-26 05:12 - 2013-08-14 23:13 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-07-26 05:12 - 2013-08-14 23:13 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-07-26 05:12 - 2013-08-14 23:13 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-07-26 05:12 - 2013-08-14 23:13 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-07-26 05:12 - 2013-08-14 23:13 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-07-26 05:12 - 2013-08-14 23:13 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-07-26 05:12 - 2013-08-14 23:13 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-07-26 05:11 - 2013-08-14 23:13 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-07-26 05:11 - 2013-08-14 23:13 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-07-26 04:49 - 2013-08-14 23:13 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-07-26 03:59 - 2013-08-14 23:13 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-07-25 10:57 - 2013-08-14 13:24 - 01620992 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
 

Files to move or delete:

====================

C:\ProgramData\ldsw_0paos.pad
 

==================== Bamital & volsnap Check =================
 

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-08-13 18:27
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Zitat:

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 23-08-2013
Ran by ***** at 2013-08-23 13:12:40
Running from C:\Users\*****\Desktop
Boot Mode: Normal
==========================================================

==================== Installed Programs =======================

Update for Microsoft Office 2007 (KB2508958)
7-Zip 9.20
Acer Crystal Eye webcam (Version: 0.933)
Acer ePower Management (Version: 4.05.3004)
Acer eRecovery Management (Version: 4.05.3005)
Acer Registration (Version: 1.02.3006)
Acer ScreenSaver (Version: 1.2.1026)
Acer Updater (Version: 1.01.3017)
Acer VCM (Version: 4.05.3000)
Adobe Flash Player 11 Plugin (Version: 11.8.800.94)
Adobe Reader XI (11.0.03) - Deutsch (Version: 11.0.03)
Adobe Shockwave Player 12.0 (Version: 12.0.3.133)
Alice Greenfingers
ALPS Touch Pad Driver (Version: 7.5.2002.1110)
Amazonia
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (Version: 1.0.0.14)
Avira Free Antivirus (Version: 13.0.0.4045)
Avira SearchFree Toolbar plus Web Protection (Version: 12.2.2.663)
Chicken Invaders 2
Cisco AnyConnect VPN Client (Version: 2.5.1025)
Compatibility Pack für 2007 Office System (Version: 12.0.6612.1000)
Cyberduck 4.2.1 (9350) (Version: 4.2.1 (9350))
Dairy Dash
Dropbox (HKCU Version: 2.0.22)
eSobi v2 (Version: 2.0.4.000274)
f4 3.1.0 (Version: 3.1.0)
Farm Frenzy 2
First Class Flurry
Google Chrome (HKCU Version: 28.0.1500.95)
Granny In Paradise
HashTab 5.0.0.19 (Version: 5.0.0.19)
Heroes of Hellas
Identity Card (Version: 1.00.3002)
Intel(R) Graphics Media Accelerator Driver (Version: 8.14.10.1929)
Intel® Matrix Storage Manager
Junk Mail filter update (Version: 14.0.8089.726)
Launch Manager (Version: 3.0.07)
Merriam Websters Spell Jam
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Choice Guard (Version: 2.0.48.0)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Excel MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Groove MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000)
Microsoft Office InfoPath MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Language Pack 2007 - German/Deutsch (Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Office O MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint Viewer 2007 (German) (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Spanish) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office SharePoint Designer 2007 Service Pack 3 (SP3)
Microsoft Office SharePoint Designer MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Suite Activation Assistant (Version: 2.9)
Microsoft Office Word MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office X MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Works (Version: 9.7.0621)
Mozilla Firefox 22.0 (x86 de) (Version: 22.0)
Mozilla Maintenance Service (Version: 22.0)
Mozilla Thunderbird (3.1.11) (Version: 3.1.11 (de))
MSVCRT (Version: 14.0.1468.721)
MyPhoneExplorer (Version: 1.8.4)
MyWinLocker (Version: 3.1.76.0)
Realtek High Definition Audio Driver (Version: 6.0.1.5999)
RemoteComms External Disk Access (Version: 1.25.0003)
SecureW2 EAP Suite 2.0.2 for Windows
Skype™ 6.0 (Version: 6.0.126)
swMSM (Version: 12.0.0.1)
Tavultesoft Keyman Desktop 8.0 (Version: 8.0.331.0)
Unlocker 1.9.1 (Version: 1.9.1)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Update für Microsoft Office Excel 2007 Help (KB963678)
Update für Microsoft Office Outlook 2007 Help (KB963677)
Update für Microsoft Office Powerpoint 2007 Help (KB963669)
Update für Microsoft Office Word 2007 Help (KB963665)
Welcome Center (Version: 1.00.3008)
Windows Live Anmelde-Assistent (Version: 5.000.818.5)
Windows Live Call (Version: 14.0.8064.0206)
Windows Live Communications Platform (Version: 14.0.8064.206)
Windows Live Essentials (Version: 14.0.8089.0726)
Windows Live Essentials (Version: 14.0.8089.726)
Windows Live Fotogalerie (Version: 14.0.8081.709)
Windows Live Mail (Version: 14.0.8089.0726)
Windows Live Messenger (Version: 14.0.8089.0726)
Windows Live Movie Maker (Version: 14.0.8091.0730)
Windows Live Sync (Version: 14.0.8089.726)
Windows Live Writer (Version: 14.0.8089.0726)
Windows Live-Uploadtool (Version: 14.0.8014.1029)
Yahoo! Messenger
Yahoo! Software Update

==================== Restore Points =========================

06-07-2013 08:48:13 Installed Java 7 Update 25
12-07-2013 15:18:43 Windows Update
25-07-2013 18:50:31 Windows Update
05-08-2013 08:55:27 Windows Update
14-08-2013 12:25:32 Geplanter Prüfpunkt
14-08-2013 21:11:42 Windows Update
15-08-2013 08:36:41 Removed Java 7 Update 25
15-08-2013 09:04:33 Installed Java(TM) 6 Update 26
15-08-2013 09:38:26 Removed Java(TM) 6 Update 26
15-08-2013 10:20:20 Installed Java 7 Update 25
17-08-2013 16:29:02 Gerätetreiber-Paketinstallation: TAP-Windows Provider V9 Netzwerkadapter
23-08-2013 10:17:36 Wiederherstellungsvorgang

==================== Hosts content: ==========================

2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {2522E5B3-4696-444B-A010-91A90324B573} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-06] (Adobe Systems Incorporated)
Task: {3675D9A9-6087-4343-9647-209A61801758} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-20] (Microsoft Corporation)
Task: {616B5B30-5F7C-4A29-BC39-271B1BEBC1B9} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)
Task: {63A481C4-6B43-4915-B66E-42D24FCE158E} - System32\Tasks\{CE24CFFC-8137-4E4D-BD32-234C8280EDCB} => C:\Program Files\Skype\Phone\Skype.exe [2012-11-09] (Skype Technologies S.A.)
Task: {72DC0656-DDE2-461C-9C52-F1370557844F} - System32\Tasks\{827E32A4-4128-41E1-AD81-810FF59B073A} => c:\program files\mozilla firefox\firefox.exe [2013-07-04] (Mozilla Corporation)
Task: {9BC5FAEE-5CD1-4179-BE9F-A8A8CC6721DB} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2791932712-1152507361-2035205960-1000Core => C:\Users\*****\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-14] (Google Inc.)
Task: {C8AA1331-1462-417C-864B-9DCB266F4FB9} - System32\Tasks\{DB2CFAF2-1793-4954-9F46-EEBD2BCA2E9D} => c:\program files\mozilla firefox\firefox.exe [2013-07-04] (Mozilla Corporation)
Task: {CA756BC4-82EA-4A8A-A16F-B6823EC817B0} - System32\Tasks\{28A650BE-AD52-4AAC-B9C7-389DE1C806D0} => c:\program files\mozilla firefox\firefox.exe [2013-07-04] (Mozilla Corporation)
Task: {D6445947-738F-4CE0-80AB-2E72C0D9552D} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2791932712-1152507361-2035205960-1000UA => C:\Users\*****\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-14] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2791932712-1152507361-2035205960-1000Core.job => C:\Users\*****\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2791932712-1152507361-2035205960-1000UA.job => C:\Users\*****\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Faulty Device Manager Devices =============

Name: Cisco AnyConnect VPN Virtual Miniport Adapter for Windows
Description: Cisco AnyConnect VPN Virtual Miniport Adapter for Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

==================== Event log errors: =========================

Application errors:
==================
Error: (08/23/2013 00:55:22 PM) (Source: Avira Antivirus) (User: NT-AUTORITÄT)
Description: Die Datei QueryInterface(57) konnte nicht geladen werden.
Fehlercode: 0x1

Error: (08/23/2013 00:54:57 PM) (Source: Avira Antivirus) (User: NT-AUTORITÄT)
Description: Die Datei QueryInterface(57) konnte nicht geladen werden.
Fehlercode: 0x1

Error: (08/23/2013 00:54:57 PM) (Source: Avira Antivirus) (User: NT-AUTORITÄT)
Description: Die Datei QueryInterface(57) konnte nicht geladen werden.
Fehlercode: 0x1

Error: (08/23/2013 00:54:49 PM) (Source: Avira Antivirus) (User: NT-AUTORITÄT)
Description: Die Datei QueryInterface(57) konnte nicht geladen werden.
Fehlercode: 0x1

Error: (08/23/2013 00:54:24 PM) (Source: Avira Antivirus) (User: NT-AUTORITÄT)
Description: Die Datei QueryInterface(57) konnte nicht geladen werden.
Fehlercode: 0x1

Error: (08/23/2013 00:53:51 PM) (Source: Avira Antivirus) (User: NT-AUTORITÄT)
Description: Die Datei QueryInterface(57) konnte nicht geladen werden.
Fehlercode: 0x1

Error: (08/23/2013 00:47:07 PM) (Source: Avira Antivirus) (User: NT-AUTORITÄT)
Description: Die Datei QueryInterface(57) konnte nicht geladen werden.
Fehlercode: 0x1

Error: (08/23/2013 00:36:02 PM) (Source: Windows Backup) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "D:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"

Error: (08/23/2013 00:30:51 PM) (Source: Avira Antivirus) (User: NT-AUTORITÄT)
Description: Die Datei QueryInterface(57) konnte nicht geladen werden.
Fehlercode: 0x1

Error: (08/23/2013 00:30:27 PM) (Source: Avira Antivirus) (User: NT-AUTORITÄT)
Description: Die Datei QueryInterface(57) konnte nicht geladen werden.
Fehlercode: 0x1

System errors:
=============
Error: (08/23/2013 00:55:22 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Avira Echtzeit-Scanner" wurde mit folgendem dienstspezifischem Fehler beendet: %%303.

Error: (08/23/2013 00:55:22 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Avira Browser-Schutz" ist vom Dienst "Avira Echtzeit-Scanner" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1066

Error: (08/23/2013 00:54:57 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Avira Echtzeit-Scanner" wurde mit folgendem dienstspezifischem Fehler beendet: %%303.

Error: (08/23/2013 00:54:57 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Avira Browser-Schutz" ist vom Dienst "Avira Echtzeit-Scanner" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1066

Error: (08/23/2013 00:54:57 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Avira Browser-Schutz" ist vom Dienst "Avira Echtzeit-Scanner" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1066

Error: (08/23/2013 00:54:57 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Avira Echtzeit-Scanner" wurde mit folgendem dienstspezifischem Fehler beendet: %%303.

Error: (08/23/2013 00:54:49 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Avira Echtzeit-Scanner" wurde mit folgendem dienstspezifischem Fehler beendet: %%303.

Error: (08/23/2013 00:54:24 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Avira Echtzeit-Scanner" wurde mit folgendem dienstspezifischem Fehler beendet: %%303.

Error: (08/23/2013 00:53:51 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Avira Echtzeit-Scanner" wurde mit folgendem dienstspezifischem Fehler beendet: %%303.

Error: (08/23/2013 00:47:07 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Avira Echtzeit-Scanner" wurde mit folgendem dienstspezifischem Fehler beendet: %%303.

Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
Date: 2013-07-08 17:03:42.399
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2013-06-28 23:36:37.213
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2013-06-28 23:21:39.592
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2013-06-28 22:37:16.337
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2013-06-28 22:36:55.920
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2013-06-28 20:21:25.064
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2013-06-28 20:06:36.411
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2013-06-28 20:03:27.388
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2013-06-28 17:18:35.231
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2013-06-28 17:18:21.342
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

==================== Memory info ===========================

Percentage of memory in use: 80%
Total physical RAM: 1013.23 MB
Available physical RAM: 197.37 MB
Total Pagefile: 2037.23 MB
Available Pagefile: 943.23 MB
Total Virtual: 2047.88 MB
Available Virtual: 1905.34 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:220.78 GB) (Free:135.01 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: ACDDD743)
Partition 1: (Not Active) - (Size=12 GB) - (Type=27)
Partition 2: (Active) - (Size=102 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=221 GB) - (Type=07 NTFS)

==================== End Of Log ============================

GMER Logfile:

Code:

GMER 2.1.19163 - hxxp://www.gmer.net

Rootkit scan 2013-08-23 13:55:36

Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 TOSHIBA_ rev.FG00 232,89GB

Running: gmer_2.1.19163.exe; Driver: C:\Users\*****\AppData\Local\Temp\axldqpoc.sys
 
 

---- System - GMER 2.1 ----
 

SSDT   80732766                                                                                                                            ZwCreateSection

SSDT   80732770                                                                                                                            ZwRequestWaitReplyPort

SSDT   8073276B                                                                                                                            ZwSetContextThread

SSDT   80732775                                                                                                                            ZwSetSecurityObject

SSDT   8073277A                                                                                                                            ZwSystemDebugControl

SSDT   80732707                                                                                                                            ZwTerminateProcess
 

---- Kernel code sections - GMER 2.1 ----
 

.text  ntoskrnl.exe!ZwRollbackEnlistment + 1409                                                                                            820729A5 1 Byte  [06]

.text  ntoskrnl.exe!KiDispatchInterrupt + 5A2                                                                                              82092512 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

.text  ntoskrnl.exe!KeRemoveQueueEx + 14BF                                                                                                 82099AB4 4 Bytes  [66, 27, 73, 80] {DAA ; JAE 0xffffff84}

.text  ntoskrnl.exe!KeRemoveQueueEx + 181B                                                                                                 82099E10 4 Bytes  [70, 27, 73, 80] {JO 0x29; JAE 0xffffff84}

.text  ntoskrnl.exe!KeRemoveQueueEx + 185F                                                                                                 82099E54 4 Bytes  [6B, 27, 73, 80]

.text  ntoskrnl.exe!KeRemoveQueueEx + 18DB                                                                                                 82099ED0 4 Bytes  [75, 27, 73, 80] {JNZ 0x29; JAE 0xffffff84}

.text  ntoskrnl.exe!KeRemoveQueueEx + 192F                                                                                                 82099F24 4 Bytes  [7A, 27, 73, 80] {JP 0x29; JAE 0xffffff84}

.text  ...                                                                                                                                 
 

---- User code sections - GMER 2.1 ----
 

.text  C:\Windows\Explorer.EXE[2360] SHELL32.dll!SHCreateDefaultExtractIcon + 736B                                                         76253454 4 Bytes  [80, 1B, 50, 00]
 

---- Registry - GMER 2.1 ----
 

Reg    HKLM\SOFTWARE\Microsoft\Windows Search\UsnNotifier\Windows\Catalogs\SystemIndex@{2044C530-1DFF-11DF-A292-806E6F6E6963}              2808785592

Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{AA943606-91AB-AA2A-8205-17078CE841DF}                     

Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{AA943606-91AB-AA2A-8205-17078CE841DF}@iajilbkkggakhkdmok  0x6A 0x61 0x6F 0x66 ...

Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{AA943606-91AB-AA2A-8205-17078CE841DF}@hadkbfpalgaehpkc    0x6A 0x61 0x6F 0x66 ...

Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{BDBB7E7E-BD6A-1FC0-DAFC-3A7B697B2AEF}                     

Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{BDBB7E7E-BD6A-1FC0-DAFC-3A7B697B2AEF}@dagohpja            0x64 0x62 0x66 0x6D ...

Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{BDBB7E7E-BD6A-1FC0-DAFC-3A7B697B2AEF}@iajmjhbangmobbpclo  0x6A 0x61 0x6E 0x68 ...

Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{BDBB7E7E-BD6A-1FC0-DAFC-3A7B697B2AEF}@hahmpbcicefablhl    0x6A 0x61 0x65 0x6C ...
 

---- EOF - GMER 2.1 ----

--- --- ---

und AntiVir:

Zitat:

Exportierte Ereignisse:

23.08.2013 08:35 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Fonts\gulim.ttc'
wurde ein Virus oder unerwünschtes Programm 'EXP/CVE-2011-3402' [exploit]
gefunden.
Ausgeführte Aktion: Zugriff verweigern

Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Hallo,

hier ist die ComboFix-Logfile:

Combofix Logfile:

Code:

ComboFix 13-08-25.01 - aida 25.08.2013  13:08:41.1.2 - x86

Microsoft Windows 7 Starter   6.1.7601.1.1252.49.1031.18.1013.325 [GMT 2:00]

ausgeführt von:: c:\users\aida\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files\Common Files\Acer GameZone online.ico

c:\program files\SecureW2

c:\program files\SecureW2\Uninstall.exe

c:\programdata\ldsw_0paos.pad

c:\programdata\Microsoft\Windows\Start Menu\Programs\SecureW2

c:\programdata\Microsoft\Windows\Start Menu\Programs\SecureW2\TTLS Manager.lnk

c:\programdata\Microsoft\Windows\Start Menu\Programs\SecureW2\Uninstall.lnk

c:\users\aida\AppData\Local\TempDIR

c:\users\aida\AppData\Roaming\Help\coredb\storage

c:\users\aida\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SecureW2

c:\windows\wininit.ini

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-07-25 bis 2013-08-25  ))))))))))))))))))))))))))))))

.

.

2013-08-25 11:25 . 2013-08-25 11:25        --------        d-----w-        c:\users\Default\AppData\Local\temp

2013-08-25 11:25 . 2013-08-25 11:27        --------        d-----w-        c:\users\aida\AppData\Local\temp

2013-08-25 11:25 . 2013-08-25 11:25        --------        d-----w-        c:\users\Gast\AppData\Local\temp

2013-08-23 11:08 . 2013-08-23 11:08        --------        d-----w-        C:\FRST

2013-08-17 16:28 . 2013-08-23 10:24        --------        d-----w-        c:\program files\TAP-Windows

2013-08-17 16:28 . 2013-08-23 10:24        --------        d-----w-        c:\program files\OpenVPN

2013-08-15 10:22 . 2013-08-15 10:22        --------        d-----w-        c:\program files\Common Files\Java

2013-08-15 10:21 . 2013-08-15 10:21        --------        d-----w-        c:\program files\Java

2013-08-15 09:06 . 2013-08-15 09:05        476904        ----a-w-        c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll

2013-08-14 11:24 . 2013-07-09 04:50        652800        ----a-w-        c:\windows\system32\rpcrt4.dll

2013-08-14 11:24 . 2013-07-09 04:52        175104        ----a-w-        c:\windows\system32\wintrust.dll

2013-08-14 11:24 . 2013-07-09 04:46        1166848        ----a-w-        c:\windows\system32\crypt32.dll

2013-08-14 11:24 . 2013-07-09 04:46        140288        ----a-w-        c:\windows\system32\cryptsvc.dll

2013-08-14 11:24 . 2013-07-09 04:46        103936        ----a-w-        c:\windows\system32\cryptnet.dll

2013-08-14 11:24 . 2013-07-09 05:03        3913664        ----a-w-        c:\windows\system32\ntoskrnl.exe

2013-08-14 11:24 . 2013-07-09 05:03        3968960        ----a-w-        c:\windows\system32\ntkrnlpa.exe

2013-08-14 11:24 . 2013-07-09 04:53        1289096        ----a-w-        c:\windows\system32\ntdll.dll

2013-08-14 11:24 . 2013-07-06 05:05        1293760        ----a-w-        c:\windows\system32\drivers\tcpip.sys

2013-08-14 11:24 . 2013-07-25 08:57        1620992        ----a-w-        c:\windows\system32\WMVDECOD.DLL

2013-08-14 11:24 . 2013-07-19 01:41        2048        ----a-w-        c:\windows\system32\tzres.dll

2013-08-14 11:23 . 2013-06-15 03:38        31232        ----a-w-        c:\windows\system32\drivers\tssecsrv.sys

2013-08-05 09:09 . 2013-08-05 09:09        --------        d-----w-        c:\users\aida\AppData\Roaming\Avira

2013-08-05 09:06 . 2013-08-05 09:06        --------        d-----w-        c:\programdata\AskPartnerNetwork

2013-08-05 09:06 . 2013-08-05 09:06        --------        d-----w-        c:\program files\AskPartnerNetwork

2013-08-05 09:05 . 2013-08-05 09:05        67168        ----a-w-        c:\windows\system32\drivers\avnetflt.sys

2013-08-05 09:04 . 2013-08-05 09:04        --------        d-----w-        c:\programdata\APN

2013-08-05 09:02 . 2013-08-05 08:51        37352        ----a-w-        c:\windows\system32\drivers\avkmgr.sys

2013-08-05 09:02 . 2013-08-05 08:51        135136        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2013-08-05 09:02 . 2013-08-05 08:51        84744        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2013-08-05 09:01 . 2013-08-05 09:02        --------        d-----w-        c:\programdata\Avira

2013-08-05 09:01 . 2013-08-05 09:01        --------        d-----w-        c:\program files\Avira

2013-08-05 08:56 . 2013-07-15 01:34        7143960        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{AF8551C1-801E-46C2-988D-3BA3A3F8E5B1}\mpengine.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-08-15 09:05 . 2011-06-14 13:52        472808        ----a-w-        c:\windows\system32\deployJava1.dll

2013-08-06 09:09 . 2012-12-28 17:51        71048        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2013-08-06 09:09 . 2012-12-28 17:51        692104        ----a-w-        c:\windows\system32\FlashPlayerApp.exe

2013-06-05 03:05 . 2013-07-12 14:05        2347520        ----a-w-        c:\windows\system32\win32k.sys

2013-06-04 04:53 . 2013-07-12 14:05        509440        ----a-w-        c:\windows\system32\qedit.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{41564952-412D-5637-00A7-7A786E7484D7}"= "c:\program files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll" [2013-07-26 12240]

.

[HKEY_CLASSES_ROOT\clsid\{41564952-412d-5637-00a7-7a786e7484d7}]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        130736        ----a-w-        c:\users\aida\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        130736        ----a-w-        c:\users\aida\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        130736        ----a-w-        c:\users\aida\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        130736        ----a-w-        c:\users\aida\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]

@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

2009-09-10 13:41        120104        ----a-w-        c:\program files\EgisTec\MyWinLocker 3\x86\PSDProtect.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LManager"="c:\program files\Launch Manager\LManager.exe" [2009-10-07 1157640]

"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-12-09 8120864]

"Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2009-09-30 703008]

"EgisTecLiveUpdate"="c:\program files\EgisTec Egis Software Update\EgisUpdate.exe" [2009-08-04 199464]

"mwlDaemon"="c:\program files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe" [2009-09-10 349480]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-10-05 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-10-05 173592]

"Persistence"="c:\windows\system32\igfxpers.exe" [2009-10-05 150552]

"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2009-10-15 233472]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-08-05 345144]

"ApnTBMon"="c:\program files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe" [2013-07-26 1558480]

.

c:\users\aida\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\aida\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-5-25 27776968]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Acer VCM.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Acer VCM.lnk

backup=c:\windows\pss\Acer VCM.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKLM\~\startupfolder\C:^Users^aida^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk]

path=c:\users\aida\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk

backup=c:\windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup

backupExtension=.Startup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2013-04-04 21:06        958576        ----a-w-        c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]

2010-09-14 08:23        136176        ----atw-        c:\users\aida\AppData\Local\Google\Update\GoogleUpdate.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]

2010-06-01 07:17        5252408        ----a-w-        c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe

.

R2 AntiVirWebService;Avira Browser-Schutz;c:\program files\Avira\AntiVir Desktop\AVWEBGRD.EXE [2013-08-05 589368]

R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2012-11-09 160944]

R3 EUCR;EUCR;c:\windows\system32\DRIVERS\EUCR6SK.SYS [2009-11-23 103296]

R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [x]

R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [x]

R3 MWLService;MyWinLocker Service;c:\program files\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2009-09-10 305448]

R3 OXSDIDRV_x32;Oxford Semi eSATA Filter (x32);c:\windows\system32\DRIVERS\OXSDIDRV_x32.sys [2009-09-28 52656]

R3 OXUDIDRV;OXUDIDRV;c:\windows\system32\Drivers\OXUDIDRV_X32.sys [2010-05-25 24880]

R3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\DRIVERS\s0016bus.sys [2008-05-16 89256]

R3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s0016mdfl.sys [2008-05-16 15016]

R3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s0016mdm.sys [2008-05-16 120744]

R3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s0016mgmt.sys [2008-05-16 114216]

R3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\DRIVERS\s0016nd5.sys [2008-05-16 25512]

R3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s0016obex.sys [2008-05-16 110632]

R3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\DRIVERS\s0016unic.sys [2008-05-16 115752]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2013-08-05 37352]

S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2009-06-02 18992]

S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2009-06-02 16432]

S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2009-06-02 60976]

S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2013-08-05 84024]

S2 APNMCP;Ask Aktualisierungsdienst;c:\program files\AskPartnerNetwork\Toolbar\apnmcp.exe [2013-07-26 168400]

S2 DsiWMIService;Dritek WMI Service;c:\program files\Launch Manager\dsiwmis.exe [2009-08-24 107016]

S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2009-09-30 727584]

S2 Greg_Service;GRegService;c:\program files\Acer\Registration\GregHSRW.exe [2009-08-28 1150496]

S2 RS_Service;Raw Socket Service;c:\program files\Acer\Acer VCM\RS_Service.exe [2009-07-10 253952]

S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2009-07-04 240160]

S2 vpnagent;Cisco AnyConnect VPN Agent;c:\program files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe [2010-08-24 592120]

S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x86.sys [2009-09-04 54784]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - AXLDQPOC

*Deregistered* - axldqpoc

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation        REG_MULTI_SZ           SSDPSRV upnphost SCardSvr TBS fdrespub AppIDSvc QWAVE wcncsvc

.

Inhalt des "geplante Tasks" Ordners

.

2013-08-25 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-12-28 09:09]

.

2013-08-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2791932712-1152507361-2035205960-1000Core.job

- c:\users\aida\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-14 08:23]

.

2013-08-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2791932712-1152507361-2035205960-1000UA.job

- c:\users\aida\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-14 08:23]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=ao532h&r=27b50810y975l0494ww35w64i2r59r

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll

TCP: DhcpNameServer = 192.168.1.1

DPF: 55963676-2F5E-4BAF-AC28-CF26AA587566 - vpnweb.cab

FF - ProfilePath - c:\users\aida\AppData\Roaming\Mozilla\Firefox\Profiles\b2bdk1s0.default\

FF - prefs.js: network.proxy.type - 4

FF - ExtSQL: 2013-08-06 12:00; {fe272bd1-5f76-4ea4-8501-a05d35d823fc}; c:\users\aida\AppData\Roaming\Mozilla\Firefox\Profiles\b2bdk1s0.default\extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi

FF - user.js: yahoo.ytff.general.dontshowhpoffer - true

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

URLSearchHooks-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)

Toolbar-Locked - (no file)

WebBrowser-{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - (no file)

HKCU-Run-pilad - (no file)

SafeBoot-Wdf01000.sys

SafeBoot-mcmscsvc

SafeBoot-MCODS

MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe

AddRemove-SecureW2 EAP Suite - c:\program files\SecureW2\Uninstall.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-2791932712-1152507361-2035205960-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*»öE]

@Class="Shell"

.

[HKEY_USERS\S-1-5-21-2791932712-1152507361-2035205960-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*»öE\OpenWithList]

@Class="Shell"

"a"="vlc.exe"

"MRUList"="a"

.

[HKEY_USERS\S-1-5-21-2791932712-1152507361-2035205960-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*»öE]

"0"=hex:43,3a,5c,55,73,65,72,73,5c,61,69,64,61,5c,4d,75,73,69,63,5c,54,61,6c,

   63,6f,20,2d,20,54,75,74,74,69,20,41,73,73,6f,6c,74,69,5c,30,39,20,2d,20,4c,\

"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff

.

[HKEY_USERS\S-1-5-21-2791932712-1152507361-2035205960-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{AA943606-91AB-AA2A-8205-17078CE841DF}*]

@Allowed: (Read) (RestrictedCode)

"iajilbkkggakhkdmok"=hex:6a,61,6f,66,61,63,6f,6d,69,6d,68,64,62,6c,68,6a,69,6e,

   69,61,00,00

"hadkbfpalgaehpkc"=hex:6a,61,6f,66,61,63,6f,6d,69,6d,68,64,62,6c,68,6a,69,6e,

   69,61,00,00

.

[HKEY_USERS\S-1-5-21-2791932712-1152507361-2035205960-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{BDBB7E7E-BD6A-1FC0-DAFC-3A7B697B2AEF}*]

"dagohpja"=hex:64,62,66,6d,6c,64,66,68,69,67,6c,67,6f,63,66,70,70,68,61,68,6e,

   6b,63,69,67,6c,62,6c,6f,69,6b,6a,63,62,67,6e,66,6f,6f,6b,00,00

"iajmjhbangmobbpclo"=hex:6a,61,6e,68,63,66,6d,6a,62,69,6e,6a,70,67,6a,6b,64,65,

   6c,67,00,f8

"hahmpbcicefablhl"=hex:6a,61,65,6c,6f,6d,6e,68,68,6b,64,70,63,6f,63,6d,69,69,

   64,67,00,00

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2013-08-25  15:24:35

ComboFix-quarantined-files.txt  2013-08-25 13:24

.

Vor Suchlauf: 12 Verzeichnis(se), 144.057.917.440 Bytes frei

Nach Suchlauf: 17 Verzeichnis(se), 144.682.799.104 Bytes frei

.

- - End Of File - - C536C9950B34198A56122CB45A28038F

--- --- ---
A36C5E4F47E84449FF07ED3517B43A31
[/QUOTE]

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Hallo,

weiter unten sind die Logs bis auf das FRST. Das wollte ich erstellen, allerdings kam die Warnung, dass das Programm nicht mehr aktuell ist. Um es zu aktualisieren sollte 'Yes' angeklickt werden, was ich auch getan habe. Darauf hin ist IE aufgegangen (den Browser nutze ich nie). Nachdem die Seite nicht geladen hat, habe ich das Fenster geschlossen und die Meldung erhalten, dass der Link nicht funktioniert hat. Das Icon zum Programm ist dann von meinem Desktop verschwunden. Soll ich es von Neuem runterladen und einen FRST-Log erstellen?

2 weitere Sachen:

1. Ich habe in dem Ordner, in dem die Maleware-Logdatei abgespeichert wurde ältere Logs entdeckt. Soll ich die auch hier posten?

2. Neben der 'C:\AdwCleaner\AdwCleaner[S0].txt' wurde eine 'C:\AdwCleaner\AdwCleaner[R0].txt' erstellt. Brauchst du die auch?

Hier erstmal die geforderten Berichte:

Zitat:

Malwarebytes Anti-Malware 1.75.0.1300
Malwarebytes : Free anti-malware download

Datenbank Version: v2013.08.25.06

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 10.0.9200.16660
***** :: COOKIE [Administrator]

26.08.2013 11:16:43
mbam-log-2013-08-26 (11-16-43).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 245393
Laufzeit: 12 Minute(n), 12 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 2
C:\Users\*****\AppData\Roaming\OpenCandy (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\*****\AppData\Roaming\OpenCandy\OpenCandy_B6E9420EF0CE44049A142426F1501DF1 (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 3
C:\Users\*****\AppData\Roaming\OpenCandy\OpenCandy_B6E9420EF0CE44049A142426F1501DF1\LatestDLMgr.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\*****\AppData\Roaming\OpenCandy\OpenCandy_B6E9420EF0CE44049A142426F1501DF1\2170.ico (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\*****\AppData\Roaming\OpenCandy\OpenCandy_B6E9420EF0CE44049A142426F1501DF1\driverscanner (9).exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

AdwCleaner Logfile:

Code:

# AdwCleaner v3.001 - Report created 26/08/2013 at 11:45:59

# Updated 24/08/2013 by Xplode

# Operating System : Windows 7 Starter Service Pack 1 (32 bits)

# Username : ***** - COOKIE

# Running from : C:\Users\*****\Desktop\adwcleaner.exe

# Option : Clean
 

***** [ Services ] *****
 

Service Deleted : APNMCP
 

***** [ Files / Folders ] *****
 

Folder Deleted : C:\ProgramData\apn

Folder Deleted : C:\ProgramData\AskPartnerNetwork

Folder Deleted : C:\ProgramData\Partner

Folder Deleted : C:\ProgramData\Uniblue\DriverScanner

Folder Deleted : C:\Program Files\AskPartnerNetwork

Folder Deleted : C:\Users\*****\AppData\Local\OpenCandy

Folder Deleted : C:\Users\*****\AppData\Local\Temp\apn

Folder Deleted : C:\Users\*****\AppData\LocalLow\Conduit

Folder Deleted : C:\Users\*****\AppData\LocalLow\PriceGong

Folder Deleted : C:\Users\Gast\AppData\LocalLow\Conduit

Folder Deleted : C:\Users\Gast\AppData\LocalLow\PriceGong

Folder Deleted : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\b2bdk1s0.default\Conduit

Folder Deleted : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\b2bdk1s0.default\ConduitCommon

Folder Deleted : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\b2bdk1s0.default\CT65619

Folder Deleted : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\b2bdk1s0.default\Extensions\{3160baf9-cf68-48ec-9076-faed7ce49467}

File Deleted : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\b2bdk1s0.default\foxydeal.sqlite

File Deleted : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\b2bdk1s0.default\user.js
 

***** [ Shortcuts ] *****
 
 

***** [ Registry ] *****
 

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\aaaaacalgebmfelllfiaoknifldpngjh

Key Deleted : HKLM\SOFTWARE\Classes\Conduit.Engine

Key Deleted : HKLM\SOFTWARE\Classes\driverscanner

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\driverscanner_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\driverscanner_RASMANCS

Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnTbMon]

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKCU\Software\AskPartnerNetwork

Key Deleted : HKCU\Software\Conduit

Key Deleted : HKCU\Software\YahooPartnerToolbar

Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong

Key Deleted : HKCU\Software\AppDataLow\Software\Toolbar

Key Deleted : HKLM\Software\AskPartnerNetwork

Key Deleted : HKLM\Software\Conduit

Key Deleted : HKLM\Software\Uniblue\DriverScanner
 

***** [ Browsers ] *****
 

-\\ Internet Explorer v10.0.9200.16660
 
 

-\\ Mozilla Firefox v23.0.1 (de)
 

[ File : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\b2bdk1s0.default\prefs.js ]
 

Line Deleted : user_pref("CT65619..clientLogIsEnabled", false);

Line Deleted : user_pref("CT65619..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asmx/ReportDiagnosticsEvent");

Line Deleted : user_pref("CT65619..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/RegisterToolbarUninstallation");

Line Deleted : user_pref("CT65619.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);

Line Deleted : user_pref("CT65619.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");

Line Deleted : user_pref("CT65619.AppTrackingLastCheckTime", "Sun Nov 25 2012 16:11:42 GMT+0100");

Line Deleted : user_pref("CT65619.BrowserCompStateIsOpen_1367156971000", true);

Line Deleted : user_pref("CT65619.CTID", "CT65619");

Line Deleted : user_pref("CT65619.CommunitiesChangesLastCheckTime", "0");

Line Deleted : user_pref("CT65619.CurrentServerDate", "26-8-2013");

Line Deleted : user_pref("CT65619.DialogsAlignMode", "LTR");

Line Deleted : user_pref("CT65619.DialogsGetterLastCheckTime", "Fri Aug 23 2013 12:31:50 GMT+0200");

Line Deleted : user_pref("CT65619.DownloadReferralCookieData", "{\"BannerName\":\"\",\"BannerTypeId\":\"\",\"BannerCulture\":\"\",\"DownloadTime\":\"9/11/2010 7:34:53 PM\",\"SourceId\":0,\"OriginSource\":0,\"Referra[...]

Line Deleted : user_pref("CT65619.FirstServerDate", "11-9-2010");

Line Deleted : user_pref("CT65619.FirstTime", true);

Line Deleted : user_pref("CT65619.FirstTimeFF3", true);

Line Deleted : user_pref("CT65619.FirstTimeSettingsDone", true);

Line Deleted : user_pref("CT65619.FixPageNotFoundErrors", true);

Line Deleted : user_pref("CT65619.GroupingInvalidateCache", false);

Line Deleted : user_pref("CT65619.GroupingLastCheckTime", "0");

Line Deleted : user_pref("CT65619.GroupingLastServerUpdateTime", "0");

Line Deleted : user_pref("CT65619.GroupingServerCheckInterval", 1440);

Line Deleted : user_pref("CT65619.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");

Line Deleted : user_pref("CT65619.HasUserGlobalKeys", true);

Line Deleted : user_pref("CT65619.HomePageProtectorEnabled", false);

Line Deleted : user_pref("CT65619.Initialize", true);

Line Deleted : user_pref("CT65619.InitializeCommonPrefs", true);

Line Deleted : user_pref("CT65619.InstallationAndCookieDataSentCount", 3);

Line Deleted : user_pref("CT65619.InstalledDate", "Sat Sep 11 2010 19:36:09 GMT+0200");

Line Deleted : user_pref("CT65619.InvalidateCache", false);

Line Deleted : user_pref("CT65619.IsAlertDBUpdated", true);

Line Deleted : user_pref("CT65619.IsGrouping", false);

Line Deleted : user_pref("CT65619.IsMulticommunity", false);

Line Deleted : user_pref("CT65619.IsOpenThankYouPage", true);

Line Deleted : user_pref("CT65619.IsOpenUninstallPage", true);

Line Deleted : user_pref("CT65619.LanguagePackLastCheckTime", "Sun Aug 25 2013 12:52:44 GMT+0200");

Line Deleted : user_pref("CT65619.LanguagePackReloadIntervalMM", 1440);

Line Deleted : user_pref("CT65619.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx");

Line Deleted : user_pref("CT65619.LastLogin_2.7.2.0", "Sat Apr 16 2011 14:31:03 GMT+0200");

Line Deleted : user_pref("CT65619.LastLogin_3.10.0.1", "Sun Apr 29 2012 01:01:10 GMT+0200");

Line Deleted : user_pref("CT65619.LastLogin_3.11.0.3", "Sun May 06 2012 23:25:16 GMT+0200");

Line Deleted : user_pref("CT65619.LastLogin_3.12.2.3", "Tue May 22 2012 09:14:06 GMT+0200");

Line Deleted : user_pref("CT65619.LastLogin_3.13.0.6", "Mon Jul 09 2012 01:02:52 GMT+0200");

Line Deleted : user_pref("CT65619.LastLogin_3.14.1.0", "Fri Sep 07 2012 16:26:54 GMT+0200");

Line Deleted : user_pref("CT65619.LastLogin_3.15.1.0", "Mon Nov 12 2012 11:29:20 GMT+0100");

Line Deleted : user_pref("CT65619.LastLogin_3.16.0.3", "Thu Feb 14 2013 18:32:31 GMT+0100");

Line Deleted : user_pref("CT65619.LastLogin_3.18.0.7", "Fri Jul 19 2013 15:24:56 GMT+0300");

Line Deleted : user_pref("CT65619.LastLogin_3.19.0.3", "Mon Aug 26 2013 10:05:59 GMT+0200");

Line Deleted : user_pref("CT65619.LastLogin_3.2.3.3", "Fri Nov 26 2010 13:17:49 GMT+0100");

Line Deleted : user_pref("CT65619.LastLogin_3.3.3.2", "Mon Jun 27 2011 21:04:56 GMT+0200");

Line Deleted : user_pref("CT65619.LastLogin_3.5.0.12", "Mon Aug 01 2011 16:55:14 GMT+0200");

Line Deleted : user_pref("CT65619.LastLogin_3.6.0.10", "Sun Oct 02 2011 19:50:42 GMT+0300");

Line Deleted : user_pref("CT65619.LastLogin_3.7.0.6", "Mon Oct 10 2011 23:08:32 GMT+0200");

Line Deleted : user_pref("CT65619.LastLogin_3.8.0.8", "Thu Dec 01 2011 10:28:05 GMT+0100");

Line Deleted : user_pref("CT65619.LastLogin_3.8.1.0", "Mon Jan 30 2012 22:38:46 GMT+0100");

Line Deleted : user_pref("CT65619.LastLogin_3.9.0.3", "Mon Feb 13 2012 14:27:07 GMT+0100");

Line Deleted : user_pref("CT65619.LatestVersion", "3.19.0.3");

Line Deleted : user_pref("CT65619.Locale", "en-US");

Line Deleted : user_pref("CT65619.LoginCache", 4);

Line Deleted : user_pref("CT65619.MCDetectTooltipHeight", "83");

Line Deleted : user_pref("CT65619.MCDetectTooltipShow", false);

Line Deleted : user_pref("CT65619.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");

Line Deleted : user_pref("CT65619.MCDetectTooltipWidth", "295");

Line Deleted : user_pref("CT65619.MyStuffEnabledAtInstallation", true);

Line Deleted : user_pref("CT65619.RadioLastCheckTime", "0");

Line Deleted : user_pref("CT65619.RadioLastUpdateIPServer", "0");

Line Deleted : user_pref("CT65619.RadioLastUpdateServer", "0");

Line Deleted : user_pref("CT65619.SHRINK_TOOLBAR", 1);

Line Deleted : user_pref("CT65619.SearchBoxWidth", 205);

Line Deleted : user_pref("CT65619.SearchEngine", "Search||hxxp://search.conduit.com/Results.aspx?q=UCM_SEARCH_TERM&ctid=CT65619&octid=EB_ORIGINAL_CTID&SearchSource=1");

Line Deleted : user_pref("CT65619.SearchEngineBeforeUnload", "chrome://browser-region/locale/region.properties");

Line Deleted : user_pref("CT65619.SearchFromAddressBarIsInit", true);

Line Deleted : user_pref("CT65619.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT65619&q=");

Line Deleted : user_pref("CT65619.SearchInNewTabEnabled", true);

Line Deleted : user_pref("CT65619.SearchInNewTabIntervalMM", 1440);

Line Deleted : user_pref("CT65619.SearchInNewTabLastCheckTime", "Sun Aug 25 2013 12:52:38 GMT+0200");

Line Deleted : user_pref("CT65619.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_TOOLBAR_ID&UM=UM_ID");

Line Deleted : user_pref("CT65619.SearchInNewTabUsageUrl", "hxxp://usage.hosting.toolbar.conduit-services.com/usage.ashx?ctid=EB_TOOLBAR_ID");

Line Deleted : user_pref("CT65619.SearchInNewTabUserEnabled", false);

Line Deleted : user_pref("CT65619.SearchProtectorEnabled", false);

Line Deleted : user_pref("CT65619.SearchProtectorToolbarDisabled", false);

Line Deleted : user_pref("CT65619.ServiceMapLastCheckTime", "Sun Aug 25 2013 12:52:44 GMT+0200");

Line Deleted : user_pref("CT65619.SettingsCheckIntervalMin", 120);

Line Deleted : user_pref("CT65619.SettingsLastCheckTime", "Mon Aug 26 2013 10:05:56 GMT+0200");

Line Deleted : user_pref("CT65619.SettingsLastUpdate", "1377501733");

Line Deleted : user_pref("CT65619.ThirdPartyComponentsInterval", 504);

Line Deleted : user_pref("CT65619.ThirdPartyComponentsLastCheck", "Fri Aug 23 2013 12:31:30 GMT+0200");

Line Deleted : user_pref("CT65619.ThirdPartyComponentsLastUpdate", "1331805997");

Line Deleted : user_pref("CT65619.TrusteLinkUrl", "hxxp://trust.conduit.com/CT65619");

Line Deleted : user_pref("CT65619.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,client.conduit-storage.com,OurToolbar.com,CommunityToolbars.com,ForumToolbar.com,MyBlogToolbar.com,MyCityTo[...]

Line Deleted : user_pref("CT65619.UserID", "UN78602090773883565");

Line Deleted : user_pref("CT65619.ValidationData_Search", 2);

Line Deleted : user_pref("CT65619.ValidationData_Toolbar", 2);

Line Deleted : user_pref("CT65619.WeatherNetwork", "");

Line Deleted : user_pref("CT65619.WeatherPollDate", "Mon Aug 26 2013 11:39:05 GMT+0200");

Line Deleted : user_pref("CT65619.WeatherUnit", "C");

Line Deleted : user_pref("CT65619.alertChannelId", "45127");

Line Deleted : user_pref("CT65619.approveUntrustedApps", false);

Line Deleted : user_pref("CT65619.backendstorage./9b+7e+x305", "247E27413334363379453A3D2A722C797A7E7A3128333B474953462D584D503D263F2D2E3135443B464E4F5B565E695B426D6265523B544243464959505B637D737B6E55217578654E67555[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e,x305", "247E28412F3F3E3779453A3D2A722C797B787D3128333C4748402C574C4F3C253E2C2E2B2F433A454E59505B57676A66426D62455E69543D56444643465B525D66716C216E6B587D7367506[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e-x305", "247E29327641363937333545397E3F493B2F77317E202520362D3842474A58515A5C585D505F593964595C49324B393A3F395047525C4173686B6965677B796F6D7B6E55217578592676685[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e.:2z527", "247E70716B71773C37276F2979757475772F26312323234F484B4C552E53493D263F302B30352F453C4739383C3D64605C5B5F716571704974696C4D7A675C455E4F4A4F4E4D645B66585[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e.x305", "247E2A4137374434337A463B3E2B732D7A7D7C213229343F564654524C474A595A4851505E51523964595C49324B393C3B3E5047525D6C6A6B6F786D68506A6F7171742256227679664F685[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e/x305", "247E2B413536327844393C29712B787C7B773027323E4C4343534E2D585B3C253E2C302E34433A45515862695E675A416C6164513A5341454348584F5A666D7B7C7174726E702174745B277[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e06cg5el8:", "6E6D6A6B6E7471727671");

Line Deleted : user_pref("CT65619.backendstorage./9b+7e06cg5el;8i:k", "247E2D2F226A74737071747A77787C77242F4B49474F42357D5D5C3D");

Line Deleted : user_pref("CT65619.backendstorage./9b+7e0x305", "247E2C403A407743383B28702A777C757D2F26313E41295547484D515A4E5A59325D5255422B443237303749404B585E685E706E6E6674626E696B4D786D705D465F4D524B51645B6673237[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e1x305", "247E2D41313D403279453A3D2A722C7A77797E31283341473E454745482F5A4F523F2841302D2F33463D48566265685C6B675F6D70604873686B58415A4946484B5F56616F7C217D74747A7[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e2x305", "247E2E3542313D3D393A7B473C3F2C742E79207D3229344356554E472E594E51325E4F412A4335373231483F4A59655F5F626C5B717369756975744D786D70517E6B60496252505451675E6[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e31;cj0j@l@ka$nn", "247E61393F236B25707879742A212C6E414F444D327A343C564C584C574D305A5A3F364124615651595457514A334C2B2B4F465134717462563F58485A515C3F6B6C75614A635[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e31;cj69c=mk:h?db(rr", "247E61393F236B25767175757A2B222D6F4250454E337B354346504A5A5847554C514F355F5F443B46296669574B344D3F3A5047525F636A563F5E596977765D465F66714[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e31;cj7;:d@hk?%peh", "247E61393F236B2575717674782B222D6F4250454E337B35444847514D55584C325D52554239442764675549324B3D3D4E4550335F6069553E5748475A515C6E6D717D6D217[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e31;cj7;chgjd$nn", "247E61393F236B25717277732A212C6E414F444D327A3443474F54535650305A5A3F364124615651595457514A334C2B2B4F465134717462563F584A4A5B525D406C6D76624B6[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e31;cj7fk;kg#ncep@mc+vkn", "247E61393F236B25737471712A212C6E414F444D327A344352574757532F5A4F515C4C594F3762575A473E492C58545E6A4F38513C534A553864656E5A435C4B5E556[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e31;cj8fj85\"ll", "247E61393F236B2576737174732B222D6F4250454E337B3545535745422F59593E3540236055505853565049324B272D4E4550335F6069553E5748475A515C696D746049686373[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e31;cj96=bm\"ll", "247E61393F236B25757773717B2B222D6F4250454E337B3546434A4F5A2F59593E3540236055505853565049324B2A2A4E4550626165716174645841605B3E6B7A6E6B79212064[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e31;cj;y=?bfbl%oo", "247E61393F236B256F7679742A212C6E414F444D327A344726494B4E524E58315B5B403742256257525A5558524B344D2C2C504752357275635740594B445C535E416D6E7763[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e31;cja>hk!lad", "247E61393F236B257572777A2A212C6E414F444D327A344D4A54572D584D503D343F225F6250442D46383849404B2E5A5B645039524342554C5769686C78687B6B5F48676277257[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e31;cjagglb@#mm", "247E61393F236B257577727A742B222D6F4250454E337B354E5454594F4D305A5A3F364124615651595457514A334C2B2B4F46513460616A563F5849485B525D6A6E75614A6964[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e31;cjbfc:i\"ll", "247E61393F236B25757473777B2B222D6F4250454E337B354F535047562F59593E3540236055505853565049324B2A2A4E4550626165716174645841605B707D6B7D79614A6964[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e31;cjc<=fbj#cf", "247E61393F236B25757674722A212C6E414F444D327A344F4849524E562F4F523E3540234F4B5561462F483A4A414C2F6B616E73706568666B7365757C7878727E676049625356[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e31;cjc<=fbj#mm", "247E61393F236B257576737A2A212C6E414F444D327A344F4849524E562F59593E3540236055505853565049324B2A2A4E4550335F5B6571563F58435A515C3F7B717E24217578[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e31;cjeik4!kk", "247E61393F236B25767177722A212C6E414F444D327A34515557402D57573C333E215E534E5651544E47304928284C434E315D5E67533C554645584F5A6A7E72767276614A696472[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e31;cjh6gjfj>$nn", "247E61393F236B25717370752A212C6E414F444D327A345442535652564A305A5A3F364124615651595457514A334C2B2B4F46513460616A563F5849485B525D6A6E75614A696[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e31;cjh<=b;\"ibclhp)til", "247E61393F236B25766F7571792B222D6F4250454E337B3555494A4F482F564F5059555D36615659463D482B5758614D364F403F524954666569756578685C45645F74[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e31;cjh<=bb@afma'qq", "247E61393F236B256F7672742A212C6E414F444D327A345448494E4E4C4D52594D335D5D423944276459545C575A544D364F2E2E5249543774776559425B4D4D5E5560436F[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e31;cji5c;m\"mbe", "247E61393F236B256F77767A2A212C6E414F444D327A3455414F47592E594E513E3540236055505853565049324B272D4E455033707361553E57484B5A515C3F6B6C75614A635[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e31;cji>k3?a#mm", "247E61393F236B257377287E2A6C3F4D424B3078325348553D494B2D57573C333E215E534E5651544E47304928284C434E315D5E67533C5544574E59666A715D4665604371206D[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e31;cji?ckmmo$odg", "247E61393F236B257373287E2A6C3F4D424B30783253494D555757592E594E513E3540236055505853565049324B787B4E4550335F6069553E574659505B686C735F48676272[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e31;cjig=ki\"mbe", "247E61393F236B2574717829202B6D404E434C31793354524856542D584D503D343F225F6250442D46383649404B2E5A5B645039524342554C5764686F5B44635E6E7C7B624B6[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e31;cjii=8:\"mbe", "247E61393F236B2576717373792B222D6F4250454E337B3556564A45472F5A4F523F36414E5259452E6D4E495967664D364F566F6B6F726B6863657B777B69794326215669445[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e3x305", "247E2F413F3B36333F47463F7D493E412E76307E222421352C37474B59574B4A4858584E5E3762573A535E49324B3A3D3F3B504752626C625D75786D766A7C517C7174614A6352555752685[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e4x305", "247E302C407642373A276F29777B74762E2530413E4F494A522B55553A233C2B2F282941384354515E5D56615F56685C426D6265523B544346494A59505B6C697A7E21702370765925797C5[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e5x305", "247E3136422B7743383B28702A79757A772F2631434B3D49564A50592E594E314A55402942322E332F473E495B5D595A6A5E58707262674974696C59425B4B474B51605762747C247373772[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e6x305", "247E322C3E32323238453E7C483D402D752F7E7B2424342B364953545259585A5A50524E36615659462F4838353D3C4D444F626C6D6B72716A77614D786D705D465F4F4C5451645B66797B2[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e7x305", "247E333D2C3F3E3F79453A3D2A722C7B7A797A31283347513F445559424C5A315C5154412A4333323037483F4A5E68565B5970606E6C666164734C776C6F5C455E4E4D4B51635A6579247A2[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e8x305", "247E343D3F3B35373B3F367C47472C742E7E782332293449565540472E594E513E274030323533453C475C5558636A656E625E6C616B7068734B766B6E5B445D4D4F524F625964792776722[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e9x305", "247E35332C3F327844393C29712B7B757979302732484C4F4F44504C4754585C5048345F5457442D46373135344B424D636B5D5F5F73696B4A756A6D5A435C4D474B4961586379226F74252[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e:x305", "247E36333B38327844393C29712B7B76797A30273249485545442C574C4F3C253E2F2A2D2D433A455C67555B5E3F6A5F624F3851423D403F564D586F7A68786C717154207477644D6657525[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e;x305", "247E373F333F3738422F7B473C3F2C742E7E7A7A22332A354D462C574C4F3C253E2F2B2B31433A455D6356575C5C5A416C6164513A5344404045584F5A7273717A786D2256227679664F685[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e<x305", "247E38343030442F463644377D493E412E7630217D2426352C37504C4757514B4F47345F5457442D4637343A3A4B424D665E705B646571634A756A6D5A435C4D4A504F6158637C717920752[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e=x305", "247E3933363F41413739357C483D402D752F207E2022342B36505459574C554F515B345F5457442D46373637384B424D676B706E606F61666B63664D786D705D465F504F5050645B6621257[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e>x305", "247E3A41363F323238387B473C3F2C742E7E20217C332A35504F5346482F5A4F523F28413233342F463D48635C5D66626A436E6366533C55464748425A515C77707773202371215925797C6[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e?x305", "247E3B2D2F2F334134403A3A7D494C2D752F2023207E342B3652504C5249555256525C35605558452E47383B38364C434E6A706F5F65635D736F677578684C65706B54207477644D66575A5[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7e@x305", "247E3C40422B7743383B28702A7B767E782F26314E52543D2A554A2D46513C253E302B332C433A45626756516259655F5F436E63465F6A553E5749444C445C535E7B21747C7821745A267A7[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7eax305", "247E3D3D37387743383B28702A7B7A757E2F26314F4B524B4445494B49485450585952535F513863585B48314A3C3B363D4F46516F6B6E6D63776D687666507B707360496254534E54675E6[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7ebe3g=;d9n9=d", "372C2D326975762E3A3C7B3A39434A494841434B265146492965504656496571734D334B57");

Line Deleted : user_pref("CT65619.backendstorage./9b+7ebx305", "247E3E393141303D33454036327E4A3F422F77317B7D23352C37565949484E4F51525C4E4C55535B54605A5A3E695E614E37503B3D41544B567575656D7367796D6D7C55217578654E67525[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7ecx305", "247E3F3D303043312E7A463B3E2B732D7B207E3128335351565551575A4F584C5E335E5356432C4534383649404B6B59566C686B46716669563F58474B485C535E7E6C6956227679664F685[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7edx305", "247E4035422A363879453A3D2A722C7D202F26315247543C484A2C574C2F48533E27403233433A45665B68505C5E406B6E4F38514343544B56776C79616D6F517C71547873634C655756685[...]

Line Deleted : user_pref("CT65619.backendstorage./9b+7etx305", "247E6E2F2E3B323342357B44392B732D7A7B7B7C32293423524C5457474A4E50565D4A61515F5D575255643D685D604D364F3D3E3E3D544B5645486A736D696F527D7275624B64525353516[...]

Line Deleted : user_pref("CT65619.backendstorage./9b-0?3g>d", "6E68716C3D416D6F7A4348757A207C754A4B254C4E50532A512625552B585A2D5E2F5E2D");

Line Deleted : user_pref("CT65619.backendstorage./9b-0?3g@6:5;", "");

Line Deleted : user_pref("CT65619.backendstorage./9b-0?3gfa7ef", "2B2E2C3D");

Line Deleted : user_pref("CT65619.backendstorage./9b-3=3eccja=f>", "247E333D2C452F4135276F292A212C393D44307832332A354448584C3A232E333E58604F6456604F6852645858635E604E376B7167617059");

Line Deleted : user_pref("CT65619.backendstorage./9b/>01=9a6k6<im;krie@pdawm", "6A696B7273747576");

Line Deleted : user_pref("CT65619.backendstorage./9b3=>@44i48?", "372C2D3269757633423633414847203E3D474E4D4C45474F2A554A4D2D5858585E4B554E366352564F");

Line Deleted : user_pref("CT65619.backendstorage./9b5ba==9cjag", "663F693E416F40407A47787948497B77494D217B4D");

Line Deleted : user_pref("CT65619.backendstorage./9b6b11g4c56b>f;p;anr@p", "6E6D6A6B6E7471727670727574");

Line Deleted : user_pref("CT65619.backendstorage./9b9643g3/9e", "6A");

Line Deleted : user_pref("CT65619.backendstorage./9b;45>:bi9i7ie", "2B2E2C3D");

Line Deleted : user_pref("CT65619.backendstorage./9b<:222h64<", "393F352F3E");

Line Deleted : user_pref("CT65619.backendstorage./9b<:222h64<l8daj", "6D70706F76747179756F2A797872787E75217B");

Line Deleted : user_pref("CT65619.backendstorage./9b=+03eh8h8j?:", "4443");

Line Deleted : user_pref("CT65619.backendstorage./9b?+e2a52d8", "372C2D326975762E3A3C7B3A39434A494841434B2651464929655046566470727951555E5E52");

Line Deleted : user_pref("CT65619.backendstorage./9b?b0d:8aj62<h", "6D");

Line Deleted : user_pref("CT65619.backendstorage./9ba@0<0bi6a7gn:6@l?", "6C");

Line Deleted : user_pref("CT65619.backendstorage.acp_personal.appstate", "656E61626C65");

Line Deleted : user_pref("CT65619.backendstorage.cb_experience_000", "343033");

Line Deleted : user_pref("CT65619.backendstorage.cb_firstuse0100", "31");

Line Deleted : user_pref("CT65619.backendstorage.cb_user_id_000", "43423234303736313331353236325F313336373235313834353632355F46697265666F78");

Line Deleted : user_pref("CT65619.backendstorage.cbfirsttime", "4D6F6E2041707220323920323031332031383A31303A343520474D542B30323030");

Line Deleted : user_pref("CT65619.backendstorage.last_client_stats_submit_2", "31333736353630353830");

Line Deleted : user_pref("CT65619.backendstorage.local_cookie_stats_last_submit_6", "31333737343238323932");

Line Deleted : user_pref("CT65619.backendstorage.local_cookie_stats_stats_site_irrelevant", "32");

Line Deleted : user_pref("CT65619.backendstorage.local_cookie_stats_stats_site_new", "30");

Line Deleted : user_pref("CT65619.backendstorage.local_cookie_stats_stats_site_not_supported", "30");

Line Deleted : user_pref("CT65619.backendstorage.local_cookie_stats_stats_site_supported", "3137");

Line Deleted : user_pref("CT65619.backendstorage.local_cookie_stats_stats_use_history", "30");

Line Deleted : user_pref("CT65619.backendstorage.local_cookie_stats_stats_use_pop", "30");

Line Deleted : user_pref("CT65619.backendstorage.local_cookie_stats_stats_use_related", "30");

Line Deleted : user_pref("CT65619.backendstorage.local_cookie_stats_stats_use_typed", "30");

Line Deleted : user_pref("CT65619.backendstorage.local_cookie_throttle_baseadd_stats|0|local_cookie_stats_stats_site_irrelevant", "31333737353034383437");

Line Deleted : user_pref("CT65619.backendstorage.local_cookie_throttle_baseadd_stats|0|local_cookie_stats_stats_site_supported", "31333737353130303535");

Line Deleted : user_pref("CT65619.backendstorage.mam_gk_appsdata", "7B2261707073223A5B7B226964223A225072696365476F6E67222C2275726C223A22687474703A2F2F7072696365676F6E672E636F6E64756974617070732E636F6D2F4D414D2F76312[...]

Line Deleted : user_pref("CT65619.backendstorage.mam_gk_appsdefaultenabled", "6E756C6C");

Line Deleted : user_pref("CT65619.backendstorage.mam_gk_appstate_couponbuddy", "6F6E");

Line Deleted : user_pref("CT65619.backendstorage.mam_gk_appstate_easytobook", "6F6E");

Line Deleted : user_pref("CT65619.backendstorage.mam_gk_appstate_easytobook_targeted", "6F6E");

Line Deleted : user_pref("CT65619.backendstorage.mam_gk_appstate_pricegong", "6F6E");

Line Deleted : user_pref("CT65619.backendstorage.mam_gk_appstate_windowshopper", "6F6E");

Line Deleted : user_pref("CT65619.backendstorage.mam_gk_appstatereporttime", "31333737353034333637323030");

Line Deleted : user_pref("CT65619.backendstorage.mam_gk_calledsetupservice", "31");

Line Deleted : user_pref("CT65619.backendstorage.mam_gk_configuration", "7B22636F6E66696775726174696F6E223A5B7B226964223A225069636C69636B56322D576562536561726368222C22637269746572696173223A5B7B2263726974657269614964[...]

Line Deleted : user_pref("CT65619.backendstorage.mam_gk_currentversion", "312E31302E322E35");

Line Deleted : user_pref("CT65619.backendstorage.mam_gk_eventscache", "7B2239613339613034332D666533632D343464322D613565322D313666353836666135353233223A7B22746F706963223A2273656E645573616765222C2264617461223A7B226361[...]

Line Deleted : user_pref("CT65619.backendstorage.mam_gk_existingusersrecoverydone", "31");

Line Deleted : user_pref("CT65619.backendstorage.mam_gk_first_time", "31");

Line Deleted : user_pref("CT65619.backendstorage.mam_gk_gadgetopen", "30");

Line Deleted : user_pref("CT65619.backendstorage.mam_gk_lastlogintime", "31333737353034333633353733");

Line Deleted : user_pref("CT65619.backendstorage.mam_gk_localization", "7B22676164676574436F6E74656E74506F6C696379223A7B2254657874223A22436F6E74656E742D52696368746C696E6965227D2C226761646765744465736372697074696F6E5[...]

Line Deleted : user_pref("CT65619.backendstorage.mam_gk_mamenabled", "66616C7365");

Line Deleted : user_pref("CT65619.backendstorage.mam_gk_settings1.10.2.5", "7B22537461747573223A22737563636565646564222C2244617461223A7B22696E74657276616C223A3234302C227374616D70223A2233355F30222C22697354657374223A7[...]

Line Deleted : user_pref("CT65619.backendstorage.mam_gk_settings1.4.4.6", "7B22537461747573223A22737563636565646564222C2244617461223A7B22696E74657276616C223A3234302C227374616D70223A2236315F2D31222C22697354657374223A[...]

Line Deleted : user_pref("CT65619.backendstorage.mam_gk_settings1.6.0.1", "7B22537461747573223A22737563636565646564222C2244617461223A7B22696E74657276616C223A3234302C227374616D70223A2236315F2D31222C22697354657374223A[...]

Line Deleted : user_pref("CT65619.backendstorage.mam_gk_settings1.8.0.4", "7B22537461747573223A22737563636565646564222C2244617461223A7B22696E74657276616C223A3234302C227374616D70223A2234365F30222C22697354657374223A74[...]

Line Deleted : user_pref("CT65619.backendstorage.mam_gk_settings1.9.0.4", "7B22537461747573223A22737563636565646564222C2244617461223A7B22696E74657276616C223A3234302C227374616D70223A2234365F30222C22697354657374223A74[...]

Line Deleted : user_pref("CT65619.backendstorage.mam_gk_showclosebutton", "74727565");

Line Deleted : user_pref("CT65619.backendstorage.mam_gk_showwelcomegadget", "66616C7365");

Line Deleted : user_pref("CT65619.backendstorage.mam_gk_user_approval_interacted", "31");

Line Deleted : user_pref("CT65619.backendstorage.mam_gk_userid", "36336265343832662D396336612D343736622D623838622D653663373661336462373266");

Line Deleted : user_pref("CT65619.backendstorage.mam_gk_welcomedialogmode", "31");

Line Deleted : user_pref("CT65619.backendstorage.pg_enable", "74727565");

Line Deleted : user_pref("CT65619.backendstorage.sf_just_installed", "46414C5345");

Line Deleted : user_pref("CT65619.backendstorage.sf_status", "454E41424C4544");

Line Deleted : user_pref("CT65619.backendstorage.sf_user_id", "6369645F3239343230313331353530313338353134373733");

Line Deleted : user_pref("CT65619.backendstorage.url_history0001", "687474703A2F2F66696C65706F6E792E64652F646F776E6C6F61642D6D616C7761726562797465735F616E74695F6D616C776172652F6765742D6D6972726F722D7365727665722E687[...]

Line Deleted : user_pref("CT65619.clientLogIsEnabled", false);

Line Deleted : user_pref("CT65619.clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asmx/ReportDiagnosticsEvent");

Line Deleted : user_pref("CT65619.components.1000034", false);

Line Deleted : user_pref("CT65619.components.1000082", false);

Line Deleted : user_pref("CT65619.components.1000234", true);

Line Deleted : user_pref("CT65619.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.conduit.com;apps.conduit.com;services.apps.conduit.com\",\"AppsDetectionUrlPattern\":\"hxxp://appdownlo[...]

Line Deleted : user_pref("CT65619.globalFirstTimeInfoLastCheckTime", "Sun Aug 25 2013 12:52:44 GMT+0200");

Line Deleted : user_pref("CT65619.homepageProtectorEnableByLogin", true);

Line Deleted : user_pref("CT65619.initDone", true);

Line Deleted : user_pref("CT65619.isAppTrackingManagerOn", false);

Line Deleted : user_pref("CT65619.myStuffEnabled", true);

Line Deleted : user_pref("CT65619.myStuffPublihserMinWidth", 400);

Line Deleted : user_pref("CT65619.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOrigin=29&ctid=EB_TOOLBAR_ID&octid=EB_ORIGINAL_CTID");

Line Deleted : user_pref("CT65619.myStuffServiceIntervalMM", 1440);

Line Deleted : user_pref("CT65619.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?ComponentId=EB_MY_STUFF_INSTANCE_GUID&lut=EB_MY_STUFF_LUT");

Line Deleted : user_pref("CT65619.oldAppsList", "128299243212250987,127759438892500272,111,127861388111562721,128055585236813047,1000034,1000080,1000082,1000234,1000515,1000,1001,1002,1003,1004,1005,1006,1007,1008,1[...]

Line Deleted : user_pref("CT65619.revertSettingsEnabled", true);

Line Deleted : user_pref("CT65619.searchProtectorDialogDelayInSec", 10);

Line Deleted : user_pref("CT65619.searchProtectorEnableByLogin", true);

Line Deleted : user_pref("CT65619.testingCtid", "");

Line Deleted : user_pref("CT65619.toolbarAppMetaDataLastCheckTime", "Sun Aug 25 2013 12:52:44 GMT+0200");

Line Deleted : user_pref("CT65619.toolbarContextMenuLastCheckTime", "Tue Aug 13 2013 13:07:36 GMT+0200");

Line Deleted : user_pref("CT65619.uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/RegisterToolbarUninstallation");

Line Deleted : user_pref("CT65619.usagesFlag", 2);

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT65619/CT65619", "\"4375e2c3f0b68dbf60f4af3bd255a0743\"");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1178763/1174448/DEFAULT", "\"0\"");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/45127/44604/DE", "\"0\"");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/909619/905414/DE", "\"0\"");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/909619/905414/DEFAULT", "\"0\"");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2786678", "\"1288731025\"");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT65619", "\"1367218526\"");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&locale=en-US", "G9mW7heT/8xIX1frcduu0A==");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&locale=en-US&ctid=CT65619", "b5I8zzzMgsg0XG/fawLlFw==");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&locale=en-US", "2E1/v7EfCEDbv3VaBQMELg==");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&locale=en-US&ctid=CT65619", "9uXRY86McHhmOreOHsv6MA==");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&locale=en-US", "UgzXjW7BIkfdx+x39Ruv3w==");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&locale=en-US&ctid=CT65619", "I1tfz7EBg4DmNytL9x55lQ==");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&locale=en-US", "4BgM4MhF/sOgPsDNmIs3Yw==");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&locale=en-US&ctid=CT65619", "ZI41WLbm1fFgx4gn0bs99Q==");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\"ea2cd4d5b586ce1:0\"");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.engine.conduit-services.com/DLG.pkg?ver=3.3.3.2", "\"807dc126dd28cc1:0\"");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.10.0.1", "\"4ead38b3e6bcd1:0\"");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.11.0.3", "\"4ead38b3e6bcd1:0\"");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12.2.3", "\"4ead38b3e6bcd1:0\"");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.13.0.6", "\"0d648794549cd1:0\"");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.14.1.0", "\"0e0a4327275cd1:0\"");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.15.1.0", "\"0343677cfb1cd1:0\"");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.16.0.3", "\"0343677cfb1cd1:0\"");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.18.0.7", "\"0343677cfb1cd1:0\"");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.19.0.3", "\"2a1a0d7b586ce1:0\"");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.3.3.2", "\"07b2625f8cb1:0\"");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.5.0.12", "\"8028f138140cc1:0\"");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.6.0.10", "\"80ee9485875dcc1:0\"");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.7.0.6", "\"0ee90707f77cc1:0\"");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.8.0.8", "\"80ee9485875dcc1:0\"");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.8.1.0", "\"80ee9485875dcc1:0\"");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.9.0.3", "\"801a319dd78ccc1:0\"");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT65619", "\"9971ee9815a5fc569766cf6ddcaaca8e\"");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/toolbar/", "\"634250095346670000\"");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=0", "634356118310000000");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=3/13/2011 11:17:11 AM", "634356118310000000");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.conduit-services.com/?ctid=CT2786678&octid=CT2786678", "\"1290629275\"");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.conduit-services.com/?ctid=CT65619&octid=CT65619", "\"1321973086\"");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.search.conduit.com/root/CT65619/CT65619", "\"1310989086\"");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=EB_LOCALE", "\"ad9cd3b32c68906c8c16d35d5ffc7f70\"");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"634168576518470000\"");

Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en-US", "\"ac6547200eccf72d3c751805a83c1597\"");

Line Deleted : user_pref("CommunityToolbar.EngineOwner", "");

Line Deleted : user_pref("CommunityToolbar.EngineOwnerGuid", "{3160baf9-cf68-48ec-9076-faed7ce49467}");

Line Deleted : user_pref("CommunityToolbar.EngineOwnerToolbarId", "dict.cc");

Line Deleted : user_pref("CommunityToolbar.IsEngineShown", true);

Line Deleted : user_pref("CommunityToolbar.IsMyStuffImportedToEngine", true);

Line Deleted : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\*****\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\b2bdk1s0.default\\conduitCommon\\modules\\3.19.0.3");

Line Deleted : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.19.0.3");

Line Deleted : user_pref("CommunityToolbar.OriginalEngineOwner", "CT2786678");

Line Deleted : user_pref("CommunityToolbar.OriginalEngineOwnerGuid", "{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}");

Line Deleted : user_pref("CommunityToolbar.OriginalEngineOwnerToolbarId", "utorrentbar");

Line Deleted : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "chrome://browser-region/locale/region.properties");

Line Deleted : user_pref("CommunityToolbar.ToolbarsList", "CT65619");

Line Deleted : user_pref("CommunityToolbar.ToolbarsList2", "CT65619");

Line Deleted : user_pref("CommunityToolbar.alert.alertDialogsGetterLastCheckTime", "Sun Apr 17 2011 13:35:39 GMT+0200");

Line Deleted : user_pref("CommunityToolbar.alert.alertInfoInterval", 1440);

Line Deleted : user_pref("CommunityToolbar.alert.alertInfoLastCheckTime", "Sat Jun 18 2011 23:00:00 GMT+0200");

Line Deleted : user_pref("CommunityToolbar.alert.clientsServerUrl", "hxxp://alert.client.conduit.com");

Line Deleted : user_pref("CommunityToolbar.alert.locale", "en");

Line Deleted : user_pref("CommunityToolbar.alert.loginIntervalMin", 1440);

Line Deleted : user_pref("CommunityToolbar.alert.loginLastCheckTime", "Mon Jun 27 2011 21:04:54 GMT+0200");

Line Deleted : user_pref("CommunityToolbar.alert.loginLastUpdateTime", "1305622559");

Line Deleted : user_pref("CommunityToolbar.alert.messageShowTimeSec", 20);

Line Deleted : user_pref("CommunityToolbar.alert.servicesServerUrl", "hxxp://alert.services.conduit.com");

Line Deleted : user_pref("CommunityToolbar.alert.showTrayIcon", false);

Line Deleted : user_pref("CommunityToolbar.alert.userCloseIntervalMin", 300);

Line Deleted : user_pref("CommunityToolbar.alert.userId", "{a339caa7-fa23-45c1-9056-f95baf85b516}");

Line Deleted : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Fri Nov 26 2010 13:17:49 GMT+0100");

Line Deleted : user_pref("CommunityToolbar.globalUserId", "aee73cd1-4df1-428e-b848-66e391fc2e36");

Line Deleted : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);

Line Deleted : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);

Line Deleted : user_pref("CommunityToolbar.killedEngine", true);

Line Deleted : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Tue Aug 13 2013 13:07:39 GMT+0200");

Line Deleted : user_pref("CommunityToolbar.notifications.alertInfoInterval", 1440);

Line Deleted : user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Sun Aug 25 2013 12:52:47 GMT+0200");

Line Deleted : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com");

Line Deleted : user_pref("CommunityToolbar.notifications.locale", "en");

Line Deleted : user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440);

Line Deleted : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Sun Aug 25 2013 12:52:39 GMT+0200");

Line Deleted : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611");

Line Deleted : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);

Line Deleted : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com");

Line Deleted : user_pref("CommunityToolbar.notifications.showTrayIcon", false);

Line Deleted : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);

Line Deleted : user_pref("CommunityToolbar.notifications.userId", "44027f3d-7690-4f94-9d3e-b53442e82ebf");

Line Deleted : user_pref("CommunityToolbar.undefined", "");

Line Deleted : user_pref("extensions.enabledItems", "{3160baf9-cf68-48ec-9076-faed7ce49467}:3.3.3.2,{73a6fe31-595d-460b-a920-fcc0f8843232}:2.1.0.2,{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}:6.0.07,engine@conduit.com:3.3[...]
 

[ File : C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\vmpia8wi.default\prefs.js ]
 
 

*************************
 

AdwCleaner[R0].txt - [43287 octets] - [26/08/2013 11:42:42]

AdwCleaner[S0].txt - [43969 octets] - [26/08/2013 11:45:59]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [44030 octets] ##########

--- --- ---

Zitat:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.5.4 (08.22.2013:1)
OS: Windows 7 Starter x86
Ran by aida on 26.08.2013 at 11:54:34,60
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\utorrentbar
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\uniblue
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Toolbar.CT2786678

~~~ Files

~~~ Folders

Successfully deleted: [Folder] "C:\Users\aida\appdata\locallow\utorrentbar"

~~~ FireFox

Emptied folder: C:\Users\aida\AppData\Roaming\mozilla\firefox\profiles\b2bdk1s0.default\minidumps [87 files]

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 26.08.2013 at 12:00:03,46
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Nee passt so schon :)

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Eset-Log

Zitat:

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=f972efa4beafc14d819b65e619dc367d
# engine=14908
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-08-26 07:58:49
# local_time=2013-08-26 09:58:49 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775166 100 95 21043 148218434 13777 0
# compatibility_mode=5893 16776574 100 94 1854150 129178320 0 0
# scanned=140180
# found=0
# cleaned=0
# scan_time=7710

SecurityCheck-Bericht

Zitat:

Results of screen317's Security Check version 0.99.72
Windows 7 Service Pack 1 x86
Internet Explorer 10
``````````````Antivirus/Firewall Check:``````````````
Avira Desktop
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware Version 1.75.0.1300
Adobe Flash Player 11.8.800.94
Adobe Reader XI
Mozilla Firefox (23.0.1)
Mozilla Thunderbird (3.1.11) Thunderbird out of Date!
Google Chrome 28.0.1500.72
Google Chrome 28.0.1500.95
````````Process Check: objlist.exe by Laurent````````
Avira Antivir avgnt.exe
Malwarebytes' Anti-Malware mbamscheduler.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````

Und das frische FRST Log

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 26-08-2013

Ran by ***** (administrator) on 26-08-2013 22:19:10

Running from C:\Users\*****\Desktop

Microsoft Windows 7 Starter  Service Pack 1 (X86) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) ===================
 

(Cisco Systems, Inc.) C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe

(Dritek System Inc.) C:\Program Files\Launch Manager\dsiwmis.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe

(Acer Incorporated) C:\Program Files\Acer\Registration\GregHSRW.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Acer Incorporated) C:\Program Files\Acer\Acer VCM\RS_Service.exe

(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe

(Yahoo! Inc.) C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe

(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe

(Egis Technology Inc.) C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe

(Egis Technology Inc.) C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

(Dropbox, Inc.) C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe

(Intel Corporation) C:\Windows\system32\igfxsrvc.exe

(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe

(Intel Corporation) C:\Windows\system32\igfxext.exe

(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apntex.exe

(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [LManager] - C:\Program Files\Launch Manager\LManager.exe [1157640 2009-10-07] (Dritek System Inc.)

HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8120864 2009-12-09] (Realtek Semiconductor)

HKLM\...\Run: [Acer ePower Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [703008 2009-10-01] (Acer Incorporated)

HKLM\...\Run: [EgisTecLiveUpdate] - C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-08-04] (Egis Technology Inc.)

HKLM\...\Run: [mwlDaemon] - C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-09-10] (Egis Technology Inc.)

HKLM\...\Run: [Apoint] - C:\Program Files\Apoint2K\Apoint.exe [233472 2009-10-15] (Alps Electric Co., Ltd.)

HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [345144 2013-08-05] (Avira Operations GmbH & Co. KG)

HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files\Acer\Screensaver\run_Acer.exe [ 2009-10-23] ()

HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files\Acer\Screensaver\run_Acer.exe [ 2009-10-23] ()

Startup: C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = iGoogle Redirect

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Sign In

SearchScopes: HKLM - DefaultScope value is missing.

Toolbar: HKLM - Avira SearchFree Toolbar plus Web Protection - {41564952-412D-5637-00A7-7A786E7484D7} - "C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll" No File

Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)

Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)

Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 19 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)

Tcpip\Parameters: [DhcpNameServer] 10.112.1.1 10.112.14.1
 

FireFox:

========

FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\b2bdk1s0.default

FF NetworkProxy: "type", 4

FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\*****\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File

FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\*****\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File

FF Extension: No Name - C:\Users\*****\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

FF Extension: No Name - C:\Users\*****\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}

FF Extension: ProxTube - Gesperrte YouTube Videos entsperren - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\b2bdk1s0.default\Extensions\ich@maltegoetz.de

FF Extension: No Name - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\b2bdk1s0.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi

FF Extension: No Name - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\b2bdk1s0.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi

FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
 

========================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-08-05] (Avira Operations GmbH & Co. KG)

S2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-05] (Avira Operations GmbH & Co. KG)

S2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [589368 2013-08-05] (Avira Operations GmbH & Co. KG)

R2 ePowerSvc; C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [727584 2009-10-01] (Acer Incorporated)

R2 Greg_Service; C:\Program Files\Acer\Registration\GregHSRW.exe [1150496 2009-08-28] (Acer Incorporated)

R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

S3 MWLService; C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-10] (Egis Technology Inc.)

R2 RS_Service; C:\Program Files\Acer\Acer VCM\RS_Service.exe [253952 2009-07-10] (Acer Incorporated)

R2 Updater Service; C:\Program Files\Acer\Acer Updater\UpdaterService.exe [240160 2009-07-04] (Acer)
 

==================== Drivers (Whitelisted) ====================
 

S3 AF15BDA; C:\Windows\System32\DRIVERS\AF15BDA.sys [483200 2009-06-03] (ITETech                  )

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [84744 2013-08-05] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135136 2013-08-05] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-08-05] (Avira Operations GmbH & Co. KG)

R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)

S3 EUCR; C:\Windows\System32\DRIVERS\EUCR6SK.SYS [103296 2009-11-23] (ENE Technology Inc.)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)

R1 mwlPSDFilter; C:\Windows\System32\DRIVERS\mwlPSDFilter.sys [18992 2009-06-02] (Egis Technology Inc.)

R1 mwlPSDNServ; C:\Windows\System32\DRIVERS\mwlPSDNServ.sys [16432 2009-06-02] (Egis Technology Inc.)

R1 mwlPSDVDisk; C:\Windows\System32\DRIVERS\mwlPSDVDisk.sys [60976 2009-06-02] (Egis Technology Inc.)

R3 OXSDIDRV_x32; C:\Windows\System32\DRIVERS\OXSDIDRV_x32.sys [52656 2009-09-28] ()

S3 OXUDIDRV; C:\Windows\system32\Drivers\OXUDIDRV_X32.sys [24880 2010-05-25] ()

S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [89256 2008-05-16] (MCCI Corporation)

S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [15016 2008-05-16] (MCCI Corporation)

S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [120744 2008-05-16] (MCCI Corporation)

S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [114216 2008-05-16] (MCCI Corporation)

S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [25512 2008-05-16] (MCCI Corporation)

S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [110632 2008-05-16] (MCCI Corporation)

S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [115752 2008-05-16] (MCCI Corporation)

R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-05] (Avira GmbH)

S3 catchme; \??\C:\Users\*****\AppData\Local\Temp\catchme.sys [x]

S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [x]

S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]

S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-08-26 19:36 - 2013-08-26 19:36 - 00000000 ____D C:\Program Files\ESET

2013-08-26 19:32 - 2013-08-26 19:33 - 02347384 _____ (ESET) C:\Users\*****\Desktop\esetsmartinstaller_enu.exe

2013-08-26 16:50 - 2013-08-26 16:50 - 01070979 _____ (Farbar) C:\Users\*****\Desktop\FRST.exe

2013-08-26 12:00 - 2013-08-26 12:00 - 00001094 _____ C:\Users\*****\Desktop\JRT.txt

2013-08-26 11:54 - 2013-08-26 11:54 - 00000000 ____D C:\Windows\ERUNT

2013-08-26 11:53 - 2013-08-26 11:53 - 01021434 _____ (Thisisu) C:\Users\*****\Desktop\JRT.exe

2013-08-26 11:42 - 2013-08-26 11:46 - 00000000 ____D C:\AdwCleaner

2013-08-26 11:41 - 2013-08-26 11:41 - 00994642 _____ C:\Users\*****\Desktop\adwcleaner.exe

2013-08-26 11:18 - 2013-08-26 11:18 - 00000000 ____D C:\Program Files\Mozilla Firefox

2013-08-26 11:11 - 2013-08-26 11:11 - 00001035 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-08-26 11:11 - 2013-08-26 11:11 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware

2013-08-26 11:11 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2013-08-26 11:09 - 2013-08-26 11:09 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\*****\Desktop\mbam-setup-1.75.0.1300.exe

2013-08-25 15:24 - 2013-08-25 15:24 - 00017506 _____ C:\ComboFix.txt

2013-08-25 13:03 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe

2013-08-25 13:03 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe

2013-08-25 13:03 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2013-08-25 13:03 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2013-08-25 13:03 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2013-08-25 13:03 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe

2013-08-25 13:03 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe

2013-08-25 13:03 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe

2013-08-25 13:02 - 2013-08-25 15:24 - 00000000 ____D C:\Qoobox

2013-08-25 13:01 - 2013-08-25 13:29 - 00000000 ____D C:\Windows\erdnt

2013-08-25 12:59 - 2013-08-25 12:59 - 05113393 ____R (Swearware) C:\Users\*****\Desktop\ComboFix.exe

2013-08-23 14:41 - 2013-08-23 14:41 - 00013602 _____ C:\Users\*****\Desktop\Unbenannt 1.odt

2013-08-23 14:03 - 2013-08-23 14:03 - 00000556 _____ C:\Users\*****\Desktop\AntiVirEreignisse.txt

2013-08-23 13:55 - 2013-08-23 14:13 - 00004417 _____ C:\Users\*****\Desktop\Gmer.txt

2013-08-23 13:15 - 2013-08-23 13:15 - 00377856 _____ C:\Users\*****\Desktop\gmer_2.1.19163.exe

2013-08-23 13:12 - 2013-08-23 14:12 - 00018766 _____ C:\Users\*****\Desktop\Addition.txt

2013-08-23 13:08 - 2013-08-23 13:08 - 00000000 ____D C:\FRST

2013-08-23 13:06 - 2013-08-23 14:10 - 00000474 _____ C:\Users\*****\Desktop\defogger_disable.log

2013-08-23 13:06 - 2013-08-23 13:06 - 00000000 _____ C:\Users\*****\defogger_reenable

2013-08-23 13:04 - 2013-08-23 13:04 - 00050477 _____ C:\Users\*****\Desktop\Defogger.exe

2013-08-17 18:28 - 2013-08-23 12:24 - 00000000 ____D C:\Program Files\TAP-Windows

2013-08-17 18:28 - 2013-08-23 12:24 - 00000000 ____D C:\Program Files\OpenVPN

2013-08-17 17:25 - 2013-08-17 17:25 - 00076405 _____ C:\Users\*****\Desktop\Zuerich Sept 2013.htm

2013-08-15 12:22 - 2013-08-15 12:22 - 00000000 ____D C:\Program Files\Common Files\Java

2013-08-15 12:21 - 2013-08-15 12:21 - 00000000 ____D C:\Program Files\Java

2013-08-15 10:59 - 2013-08-15 10:59 - 00000000 ____D C:\Users\*****\Desktop\JavaRa-2.2

2013-08-14 23:13 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-08-14 23:13 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-08-14 23:13 - 2013-07-26 05:13 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-08-14 23:13 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-08-14 23:13 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-08-14 23:13 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-08-14 23:13 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-08-14 23:13 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-08-14 23:13 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-08-14 23:13 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-08-14 23:13 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-08-14 23:13 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-08-14 23:13 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-08-14 23:13 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-08-14 23:13 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-08-14 23:13 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-08-14 13:24 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

2013-08-14 13:24 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2013-08-14 13:24 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe

2013-08-14 13:24 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2013-08-14 13:24 - 2013-07-09 06:53 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2013-08-14 13:24 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll

2013-08-14 13:24 - 2013-07-09 06:50 - 00652800 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll

2013-08-14 13:24 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll

2013-08-14 13:24 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll

2013-08-14 13:24 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll

2013-08-14 13:24 - 2013-07-06 07:05 - 01293760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2013-08-14 13:23 - 2013-06-15 05:38 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys

2013-08-05 11:09 - 2013-08-05 11:09 - 00000000 ____D C:\Users\*****\AppData\Roaming\Avira

2013-08-05 11:05 - 2013-08-05 11:05 - 00067168 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2013-08-05 11:02 - 2013-08-05 10:51 - 00135136 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2013-08-05 11:02 - 2013-08-05 10:51 - 00084744 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2013-08-05 11:02 - 2013-08-05 10:51 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2013-08-05 11:02 - 2013-08-05 10:51 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys

2013-08-05 11:01 - 2013-08-05 11:02 - 00000000 ____D C:\ProgramData\Avira

2013-08-05 11:01 - 2013-08-05 11:01 - 00000000 ____D C:\Program Files\Avira
 

==================== One Month Modified Files and Folders =======
 

2013-08-26 22:07 - 2013-08-26 22:06 - 00891115 _____ C:\Users\*****\Desktop\SecurityCheck.exe

2013-08-26 21:34 - 2013-02-20 13:33 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-08-26 21:25 - 2010-09-14 10:23 - 00001116 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2791932712-1152507361-2035205960-1000UA.job

2013-08-26 20:42 - 2010-02-20 11:08 - 01606816 _____ C:\Windows\WindowsUpdate.log

2013-08-26 19:37 - 2009-07-14 06:34 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-08-26 19:37 - 2009-07-14 06:34 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-08-26 19:36 - 2013-08-26 19:36 - 00000000 ____D C:\Program Files\ESET

2013-08-26 19:33 - 2013-08-26 19:32 - 02347384 _____ (ESET) C:\Users\*****\Desktop\esetsmartinstaller_enu.exe

2013-08-26 19:32 - 2010-01-05 23:42 - 01526094 _____ C:\Windows\system32\PerfStringBackup.INI

2013-08-26 19:28 - 2012-06-03 16:51 - 00000000 ____D C:\Users\*****\AppData\Roaming\Dropbox

2013-08-26 19:27 - 2012-08-24 16:05 - 00000000 ___RD C:\Users\*****\Dropbox

2013-08-26 19:26 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-08-26 19:26 - 2009-07-14 06:39 - 00177356 _____ C:\Windows\setupact.log

2013-08-26 16:52 - 2009-07-14 06:53 - 00000000 ____D C:\Users\Administrator

2013-08-26 16:50 - 2013-08-26 16:50 - 01070979 _____ (Farbar) C:\Users\*****\Desktop\FRST.exe

2013-08-26 16:25 - 2010-09-14 10:23 - 00001064 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2791932712-1152507361-2035205960-1000Core.job

2013-08-26 12:00 - 2013-08-26 12:00 - 00001094 _____ C:\Users\*****\Desktop\JRT.txt

2013-08-26 11:54 - 2013-08-26 11:54 - 00000000 ____D C:\Windows\ERUNT

2013-08-26 11:53 - 2013-08-26 11:53 - 01021434 _____ (Thisisu) C:\Users\*****\Desktop\JRT.exe

2013-08-26 11:49 - 2012-05-04 20:47 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service

2013-08-26 11:46 - 2013-08-26 11:42 - 00000000 ____D C:\AdwCleaner

2013-08-26 11:46 - 2011-07-29 00:15 - 00000000 ____D C:\ProgramData\Uniblue

2013-08-26 11:41 - 2013-08-26 11:41 - 00994642 _____ C:\Users\*****\Desktop\adwcleaner.exe

2013-08-26 11:36 - 2010-01-06 00:41 - 00879570 _____ C:\Windows\PFRO.log

2013-08-26 11:36 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\SchCache

2013-08-26 11:18 - 2013-08-26 11:18 - 00000000 ____D C:\Program Files\Mozilla Firefox

2013-08-26 11:11 - 2013-08-26 11:11 - 00001035 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-08-26 11:11 - 2013-08-26 11:11 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware

2013-08-26 11:09 - 2013-08-26 11:09 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\*****\Desktop\mbam-setup-1.75.0.1300.exe

2013-08-25 15:24 - 2013-08-25 15:24 - 00017506 _____ C:\ComboFix.txt

2013-08-25 15:24 - 2013-08-25 13:02 - 00000000 ____D C:\Qoobox

2013-08-25 15:24 - 2009-07-14 04:37 - 00000000 __RHD C:\Users\Default

2013-08-25 15:24 - 2009-07-14 04:37 - 00000000 ___RD C:\Users\Public

2013-08-25 13:29 - 2013-08-25 13:01 - 00000000 ____D C:\Windows\erdnt

2013-08-25 13:27 - 2009-07-14 04:04 - 00000215 _____ C:\Windows\system.ini

2013-08-25 13:08 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET

2013-08-25 12:59 - 2013-08-25 12:59 - 05113393 ____R (Swearware) C:\Users\*****\Desktop\ComboFix.exe

2013-08-23 16:55 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\NDF

2013-08-23 14:41 - 2013-08-23 14:41 - 00013602 _____ C:\Users\*****\Desktop\Unbenannt 1.odt

2013-08-23 14:13 - 2013-08-23 13:55 - 00004417 _____ C:\Users\*****\Desktop\Gmer.txt

2013-08-23 14:12 - 2013-08-23 13:12 - 00018766 _____ C:\Users\*****\Desktop\Addition.txt

2013-08-23 14:10 - 2013-08-23 13:06 - 00000474 _____ C:\Users\*****\Desktop\defogger_disable.log

2013-08-23 14:03 - 2013-08-23 14:03 - 00000556 _____ C:\Users\*****\Desktop\AntiVirEreignisse.txt

2013-08-23 13:15 - 2013-08-23 13:15 - 00377856 _____ C:\Users\*****\Desktop\gmer_2.1.19163.exe

2013-08-23 13:08 - 2013-08-23 13:08 - 00000000 ____D C:\FRST

2013-08-23 13:06 - 2013-08-23 13:06 - 00000000 _____ C:\Users\*****\defogger_reenable

2013-08-23 13:06 - 2010-08-23 03:38 - 00000000 ____D C:\Users\*****

2013-08-23 13:04 - 2013-08-23 13:04 - 00050477 _____ C:\Users\*****\Desktop\Defogger.exe

2013-08-23 12:25 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\wfp

2013-08-23 12:24 - 2013-08-17 18:28 - 00000000 ____D C:\Program Files\TAP-Windows

2013-08-23 12:24 - 2013-08-17 18:28 - 00000000 ____D C:\Program Files\OpenVPN

2013-08-23 12:24 - 2010-09-14 10:25 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome

2013-08-23 12:24 - 2010-09-04 19:31 - 00000000 ____D C:\Users\Gast

2013-08-23 12:24 - 2010-08-24 19:01 - 00000000 ____D C:\Users\*****\AppData\Local\Google

2013-08-23 12:24 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache

2013-08-23 12:24 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\registration

2013-08-23 12:24 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\AppCompat

2013-08-19 09:21 - 2011-05-05 10:58 - 00000000 ____D C:\Users\*****\Büro

2013-08-17 17:25 - 2013-08-17 17:25 - 00076405 _____ C:\Users\*****\Desktop\Zuerich Sept 2013.htm

2013-08-15 12:46 - 2010-08-24 15:18 - 00000000 ____D C:\Users\*****\AppData\Local\Adobe

2013-08-15 12:22 - 2013-08-15 12:22 - 00000000 ____D C:\Program Files\Common Files\Java

2013-08-15 12:21 - 2013-08-15 12:21 - 00000000 ____D C:\Program Files\Java

2013-08-15 11:05 - 2011-06-14 15:52 - 00472808 _____ (Sun Microsystems, Inc.) C:\Windows\system32\deployJava1.dll

2013-08-15 10:59 - 2013-08-15 10:59 - 00000000 ____D C:\Users\*****\Desktop\JavaRa-2.2

2013-08-15 09:46 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE

2013-08-14 23:32 - 2013-07-25 20:57 - 00000000 ____D C:\Windows\system32\MRT

2013-08-14 23:26 - 2010-09-23 13:33 - 75778376 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2013-08-14 23:25 - 2010-01-06 00:17 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-08-06 12:03 - 2009-07-14 06:53 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2013-08-06 11:09 - 2012-12-28 19:51 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2013-08-06 11:09 - 2012-12-28 19:51 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2013-08-05 11:09 - 2013-08-05 11:09 - 00000000 ____D C:\Users\*****\AppData\Roaming\Avira

2013-08-05 11:05 - 2013-08-05 11:05 - 00067168 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2013-08-05 11:02 - 2013-08-05 11:01 - 00000000 ____D C:\ProgramData\Avira

2013-08-05 11:01 - 2013-08-05 11:01 - 00000000 ____D C:\Program Files\Avira

2013-08-05 10:51 - 2013-08-05 11:02 - 00135136 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2013-08-05 10:51 - 2013-08-05 11:02 - 00084744 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2013-08-05 10:51 - 2013-08-05 11:02 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2013-08-05 10:51 - 2013-08-05 11:02 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys

2013-08-01 13:17 - 2010-09-02 17:49 - 00000000 ____D C:\Users\*****\Austellung Lesvos

2013-07-30 19:03 - 2011-04-28 10:43 - 00000000 ____D C:\Users\*****\Unsers
 

Files to move or delete:

====================

C:\Users\*****\AppData\Local\Temp\Quarantine.exe

C:\Users\*****\AppData\Local\Temp\jrt\erunt\ERUNT.EXE
 

==================== Bamital & volsnap Check =================
 

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-08-13 18:27
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Hallo,
ich habe tatsächlich noch ein paar Fragen:

Soll ich die Programme, die ich auf deine Anweisung runtergeladen habe und die dazugehörigen Logs desinstallieren bzw. löschen?
Muss ich dabei etwas beachten?

Wie gehe ich jetzt mit Avira Free Antivirus weiter vor? Es ist nach wie vor deaktiv. Kann ich es einfach wieder aktivieren?

Ich werde bald sowieso auf Linux umsteigen, aber bis dahin suche ich ein sicheres Freeware Anti-Viren-Programm - kannst du mir da etwas empfehlen? (Ich hoffe, ich verstoße nicht gegen irgenwelche Regeln mit meiner Frage!) Ich würde mir auch ein Programm kaufen, aber das lohnt sich für die kurze Zeit bevor ich zu Linux wechsel nicht.

Und noch etwas wichtiges: Vielen, vielen Dank, dass du dir Zeit für mich genommen hast! Ausgezeichnet angeleitet :daumenhoc!

Lesestoff:
Warum wir Avira nicht mehr empfehlen
Avira liefert seit einiger Zeit mit der Standardinstallation die Ask Toolbar mit aus. Diese Toolbar ist Voraussetzung dafür, dass der Webguard zuverlässig funktioniert. Die Ask Toolbar ist dafür bekannt, dass sie das Surfverhalten des Benutzers ausspioniert, um damit in letzter Konsequenz Geld zu verdienen. Daher wird von uns auf diesem Board als "schädlich" eingestuft. Mehr Informationen.

Eine Sicherheitsfirma, die dem Benutzer praktisch ungefragt schädliche Software "unterjubelt", scheidet für uns daher aus. Wir empfehlen daher allen Nutzern von Avira aufgrund dieser Geschäftspraktik, der teilweise äußerst schlechten Erkennungsrate und der überaus nervtötenden Werbung Avira zu deinstallieren und auf ein alternatives Produkt auszuweichen.

Solltest du dich zu einem Wechsel entscheiden, empfehlen wir dir nach der Deinstallation mit dem Avira-Cleaner alle Reste zu entfernen.

Nimm Avast :)

Fertig :)

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Sorry, eine Frage habe ich tatsächlich noch:

Wie finde ich das heraus ob ich Google Chrome komplett von meinem Rechner entfernt habe? :wtf:
Mir ist gerade folgenden passiert:
Ich war dabei GoogleChrome zu deinstallieren, als IE aufsprang und ein weiteres kleines Fenster aufging mit der Meldung, dass ich jetzt auf eine sichere Seite weitergeleitet würde und die Daten für Dritte nicht einsehbar seien. Ich habe nicht auf ok geklickt, sondern den IE sofort geschlossen. Die Seite auf die ich weitergeleitet werden sollte war google - zumindest der Adressleiste nach. Jedenfalls ist das GoogleChrome-Icon verschwunden und ich hab keine Ahnung ob es jetzt sauber deinstalliert ist oder nicht.

Du hast aber schon über die Systemsteuerung deinstalliert? dann passt das. Google, und viele andere Hersteller, öffnen beim Deinstallieren eine Inet-Seite mit ner kurzen Befragung, warum du deinstallieren willst. Das kann man aber einfach weg klicken :)

Ja ich hab über die Systemsteuerung deinstalliert. Tip top :Boogie: keine Fragen mehr! Danke für deine Hilfe und Geduld.
Ciao