Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Firefox-Symbol wird zur Lupe, Aufforderung zu Mediaplayer-Installationen, ungewünschte Search Engines (https://www.trojaner-board.de/153205-firefox-symbol-lupe-aufforderung-mediaplayer-installationen-ungewuenschte-search-engines.html)

littlesheep 28.04.2014 23:40
Firefox-Symbol wird zur Lupe, Aufforderung zu Mediaplayer-Installationen, ungewünschte Search Engines
 
Hallo,

ich bin auf dieses Forum gestoßen auf der Suche nach einer Erklärung für die plötzliche Umwandlung des Firefox-Logos (nur nach Anklicken) in eine Lupe und auf dieses Thema gestoßen:

http://www.trojaner-board.de/150386-...ownloader.html

Mein Problem ist wohl ähnlich - nein, ich habe (außer die ganzen genannten Tools runterzuladen) noch nichts gemacht, weil ich dann auf das Thema mit dem "Eigenes Thema erstellen" und "nichts machen ohne Anweisung" gekommen bin. Neben der Icon-Problematik sind folgende Sachen aufgefallen: häufiger ungefragte Icons auf dem Desktop (Programme habe ich dann wieder deinstalliert), hauptsächlich was mit PC Backup etc, dann nicht entfernbare Suchergebnisse (das ist dieses Pirrit Suggestor im ersten Log) als "weitere Angebote" z.B. auf eBay - so eine zusätzliche kleine Leiste am unteren Bildschirmrand, die man zwar schließen kann, die aber bei jeder neuen Seite wiederkommt), Search Engines werden zugefügt ohne das ich das selber gemacht habe, Startseite ändert sich (zu Yahoo - habe sonst Google), Seiten öffnen sich ungefragt (als würde der Popup-Blocker nicht mehr funktionieren), vor allem ständige Aufforderungen irgendwelche Mediaplayer zu installieren bzw. vielmehr upzudaten, weil sonst irgendwelche Inhalte (u.a. heute aufgefallen Java-Update) nicht gezeigt werden könnten, Virensoftware (ESET Smart Security 4) meldete in letzter Zeit einige Funde (in Quarantäne automatisch verschoben). Soviel zur Vorgeschichte. Habe jetzt wie gesagt die im obigen Thema genannten Programme geladen, aber noch nichts laufen lassen.

Hier die Logs der unter "Erste Schritte" geforderten Programme - zwei Anmerkungen noch dazu: 1. ich habe blöderweise das Log von dem defogger zuerst überspeichert mit dem von GMER, weil ich durcheinander gekommen bin (defogger hatte ich aber zuerst laufen lassen, da hatte ich auch keine Fehlermeldung vom PC). 2. Ich kann das FRST nicht starten (64bit System), der PC sagt mir das sei keine gültige Win32-Anwendung...? Die anderen inkl. der Virensoftware hier:


ESET Smart Security 4

Code:
28.04.2014 22:40:12        HTTP-Prüfung        Datei        hxxp://yourinstaller.com/o/FlashPlayerPro/Player-Firefox.exe?filedescription=FlashPlayerPro&subid=propeller_lightspark-display-de&user_id=041e4456-232c-4c17-b768-b181af01ebe8&thankYouUrl=hxxp://downloadactivation.com/thanks?source=propeller_lightspark-display-de&subid1=5677&userid=041e4456-232c-4c17-b768-b181af01ebe8&adprovider=propellerads&reason=complete&cancelUrl=hxxp://downloadactivation.com/thanks?source=propeller_lightspark-display-de&subid1=5677&userid=041e4456-232c-4c17-b768-b181af01ebe8&adprovider        Variante von Win32/AdWare.iBryte.Z Anwendung        Verbindung getrennt - in Quarantäne kopiert        LITTLESHEEP\Claudia        Bedrohung erkannt beim Zugriff auf das Web durch die Anwendung: C:\Users\Claudia\AppData\Local\PirritSuggestor\PirritDesktop.exe.
24.04.2014 22:16:34        HTTP-Prüfung        Datei        hxxp://yourinstaller.com/o/FlashPlayerPro/Player-Firefox.exe?filedescription=FlashPlayerPro&subid=propeller_lightspark-display-de&user_id=041e4456-232c-4c17-b768-b181af01ebe8&thankYouUrl=hxxp://downloadactivation.com/thanks?source=propeller_lightspark-display-de&subid1=5677&userid=041e4456-232c-4c17-b768-b181af01ebe8&adprovider=propellerads&reason=complete&cancelUrl=hxxp://downloadactivation.com/thanks?source=propeller_lightspark-display-de&subid1=5677&userid=041e4456-232c-4c17-b768-b181af01ebe8&adprovider        Variante von Win32/AdWare.iBryte.Y Anwendung        Verbindung getrennt - in Quarantäne kopiert        LITTLESHEEP\Claudia        Bedrohung erkannt beim Zugriff auf das Web durch die Anwendung: C:\Users\Claudia\AppData\Local\PirritSuggestor\PirritDesktop.exe.
24.04.2014 22:10:15        Echtzeit-Dateischutz        Datei        C:\Users\Claudia\AppData\Local\Temp\F3rMmR4k.exe.part        Variante von Win32/AdWare.iBryte.Y Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert        LITTLESHEEP\Claudia        Ereignis beim Bearbeiten einer Datei durch die Anwendung: C:\Program Files (x86)\Mozilla Firefox\firefox.exe.
24.04.2014 22:09:55        HTTP-Prüfung        Datei        hxxp://yourinstaller.com/o/FlashPlayerPro/Player-Firefox.exe?filedescription=FlashPlayerPro&subid=propeller_lightspark-display-de&user_id=041e4456-232c-4c17-b768-b181af01ebe8&thankYouUrl=hxxp://downloadactivation.com/thanks?source=propeller_lightspark-display-de&subid1=5677&userid=041e4456-232c-4c17-b768-b181af01ebe8&adprovider=propellerads&reason=complete&cancelUrl=hxxp://downloadactivation.com/thanks?source=propeller_lightspark-display-de&subid1=5677&userid=041e4456-232c-4c17-b768-b181af01ebe8&adprovider        Variante von Win32/AdWare.iBryte.Y Anwendung        Verbindung getrennt - in Quarantäne kopiert        LITTLESHEEP\Claudia        Bedrohung erkannt beim Zugriff auf das Web durch die Anwendung: C:\Users\Claudia\AppData\Local\PirritSuggestor\PirritDesktop.exe.
19.04.2014 00:31:10        Echtzeit-Dateischutz        Datei        C:\Users\Claudia\AppData\Local\Temp\nshC8A0.tmp        Variante von Win64/Adware.Adpeak.C Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert        LITTLESHEEP\Claudia        Ereignis beim Bearbeiten einer Datei durch die Anwendung: C:\Users\Claudia\AppData\Local\Temp\dlm390C.tmp\032939rr.exe.
19.04.2014 00:29:34        HTTP-Prüfung        Datei        hxxp://software-files-a.cnet.com/u/moff/passshow/FF_IE_PassShow_1030-4001.exe        Variante von Win32/AdWare.AddLyrics.AH Anwendung        Verbindung getrennt - in Quarantäne kopiert        LITTLESHEEP\Claudia        Bedrohung erkannt beim Zugriff auf das Web durch die Anwendung: C:\Users\Claudia\Downloads\WMV_to_MP4_Converter-ORG-75903117.exe.
18.04.2014 22:56:48        Echtzeit-Dateischutz        Datei        C:\Users\Claudia\AppData\Local\Temp\nss5518.tmp.exe        möglicherweise Variante von Win32/AdWare.AddLyrics.AJ Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert        LITTLESHEEP\Claudia        Ereignis beim Erstellen einer neuen Datei durch die Anwendung: C:\Users\Claudia\AppData\Local\Temp\nsrE0D1.tmp.exe.
18.04.2014 22:56:26        HTTP-Prüfung        Datei        hxxp://app.dcexpath.org/apps/dist/BlockAndSurf_2222-5510.exe        möglicherweise Variante von Win32/AdWare.AddLyrics.AJ Anwendung        Verbindung getrennt - in Quarantäne kopiert        LITTLESHEEP\Claudia        Bedrohung erkannt beim Zugriff auf das Web durch die Anwendung: C:\Users\Claudia\AppData\Local\PirritSuggestor\PirritDesktop.exe.
30.03.2014 22:43:08        HTTP-Prüfung        Datei        hxxp://app.dcexpath.org/apps/dist/BlockAndSurf_2222-5510.exe        Variante von Win32/AdWare.AddLyrics.AH Anwendung        Verbindung getrennt - in Quarantäne kopiert        LITTLESHEEP\Claudia        Bedrohung erkannt beim Zugriff auf das Web durch die Anwendung: C:\Users\Claudia\AppData\Local\Temp\nsb2D91.tmp.exe.
30.03.2014 22:29:48        Echtzeit-Dateischutz        Datei        C:\Users\Claudia\AppData\Local\Temp\sptemp\jre-7u51-windows-i586-iftw.exe_635318153874190000        Win32/RiskWare.PEMalform.E Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert        LITTLESHEEP\Claudia        Ereignis beim Erstellen einer neuen Datei durch die Anwendung: C:\Program Files (x86)\Advanced System Protector\clamunpack\clamscan.exe.
30.03.2014 22:29:47        Echtzeit-Dateischutz        Datei        C:\Users\Claudia\AppData\Local\Temp\sptemp\jre-7u45-windows-i586-iftw.exe_635318153864620000        Win32/RiskWare.PEMalform.E Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert        LITTLESHEEP\Claudia        Ereignis beim Erstellen einer neuen Datei durch die Anwendung: C:\Program Files (x86)\Advanced System Protector\clamunpack\clamscan.exe.
30.03.2014 22:29:46        Echtzeit-Dateischutz        Datei        C:\Users\Claudia\AppData\Local\Temp\sptemp\jre-7u25-windows-i586-iftw.exe_635318153855530000        Win32/RiskWare.PEMalform.E Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert        LITTLESHEEP\Claudia        Ereignis beim Erstellen einer neuen Datei durch die Anwendung: C:\Program Files (x86)\Advanced System Protector\clamunpack\clamscan.exe.
30.03.2014 22:29:45        Echtzeit-Dateischutz        Datei        C:\Users\Claudia\AppData\Local\Temp\sptemp\jre-7u21-windows-i586-iftw.exe_635318153845670000        Win32/RiskWare.PEMalform.E Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert        LITTLESHEEP\Claudia        Ereignis beim Erstellen einer neuen Datei durch die Anwendung: C:\Program Files (x86)\Advanced System Protector\clamunpack\clamscan.exe.
30.03.2014 22:29:44        Echtzeit-Dateischutz        Datei        C:\Users\Claudia\AppData\Local\Temp\sptemp\jre-6u37-windows-i586-iftw.exe_635318153836510000        Win32/RiskWare.PEMalform.E Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert        LITTLESHEEP\Claudia        Ereignis beim Erstellen einer neuen Datei durch die Anwendung: C:\Program Files (x86)\Advanced System Protector\clamunpack\clamscan.exe.
30.03.2014 22:29:43        Echtzeit-Dateischutz        Datei        C:\Users\Claudia\AppData\Local\Temp\sptemp\jre-6u35-windows-i586-iftw.exe_635318153826620000        Win32/RiskWare.PEMalform.E Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert        LITTLESHEEP\Claudia        Ereignis beim Erstellen einer neuen Datei durch die Anwendung: C:\Program Files (x86)\Advanced System Protector\clamunpack\clamscan.exe.
30.03.2014 22:29:42        Echtzeit-Dateischutz        Datei        C:\Users\Claudia\AppData\Local\Temp\sptemp\jre-6u29-windows-i586-iftw-rv.exe_635318153816540000        Win32/RiskWare.PEMalform.E Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert        LITTLESHEEP\Claudia        Ereignis beim Erstellen einer neuen Datei durch die Anwendung: C:\Program Files (x86)\Advanced System Protector\clamunpack\clamscan.exe.
30.03.2014 22:29:41        Echtzeit-Dateischutz        Datei        C:\Users\Claudia\AppData\Local\Temp\sptemp\jre-6u26-windows-i586-iftw-rv.exe_635318153807200000        Win32/RiskWare.PEMalform.E Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert        LITTLESHEEP\Claudia        Ereignis beim Erstellen einer neuen Datei durch die Anwendung: C:\Program Files (x86)\Advanced System Protector\clamunpack\clamscan.exe.
30.03.2014 22:29:40        Echtzeit-Dateischutz        Datei        C:\Users\Claudia\AppData\Local\Temp\sptemp\jre-6u24-windows-i586-iftw-rv.exe_635318153793170000        Win32/RiskWare.PEMalform.E Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert        LITTLESHEEP\Claudia        Ereignis beim Erstellen einer neuen Datei durch die Anwendung: C:\Program Files (x86)\Advanced System Protector\clamunpack\clamscan.exe.
30.03.2014 22:29:19        Echtzeit-Dateischutz        Datei        C:\Users\Claudia\AppData\Local\Temp\sptemp\toolkitpro1331vc90u.dll_635318153582190000        Win32/RiskWare.PEMalform.E Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert        LITTLESHEEP\Claudia        Ereignis beim Erstellen einer neuen Datei durch die Anwendung: C:\Program Files (x86)\Advanced System Protector\clamunpack\clamscan.exe.
30.03.2014 22:29:17        Echtzeit-Dateischutz        Datei        C:\Users\Claudia\AppData\Local\Temp\sptemp\kiespdlr.exe_635318153570010000        Win32/RiskWare.PEMalform.E Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert        LITTLESHEEP\Claudia        Ereignis beim Erstellen einer neuen Datei durch die Anwendung: C:\Program Files (x86)\Advanced System Protector\clamunpack\clamscan.exe.
30.03.2014 22:29:16        Echtzeit-Dateischutz        Datei        C:\Users\Claudia\AppData\Local\Temp\sptemp\globalutil.dll_635318153561980000        Win32/RiskWare.PEMalform.E Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert        LITTLESHEEP\Claudia        Ereignis beim Erstellen einer neuen Datei durch die Anwendung: C:\Program Files (x86)\Advanced System Protector\clamunpack\clamscan.exe.
30.03.2014 22:29:15        Echtzeit-Dateischutz        Datei        C:\Users\Claudia\AppData\Local\Temp\sptemp\agentdialogs.dll_635318153551190000        Win32/RiskWare.PEMalform.E Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert        LITTLESHEEP\Claudia        Ereignis beim Erstellen einer neuen Datei durch die Anwendung: C:\Program Files (x86)\Advanced System Protector\clamunpack\clamscan.exe.
30.03.2014 22:29:15        Echtzeit-Dateischutz        Datei        C:\Users\Claudia\AppData\Local\Temp\sptemp\agent.dll_635318153542880000        Win32/RiskWare.PEMalform.E Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert        LITTLESHEEP\Claudia        Ereignis beim Erstellen einer neuen Datei durch die Anwendung: C:\Program Files (x86)\Advanced System Protector\clamunpack\clamscan.exe.
30.03.2014 22:29:14        Echtzeit-Dateischutz        Datei        C:\Users\Claudia\AppData\Local\Temp\sptemp\admindelegator.exe_635318153534410000        Win32/RiskWare.PEMalform.E Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert        LITTLESHEEP\Claudia        Ereignis beim Erstellen einer neuen Datei durch die Anwendung: C:\Program Files (x86)\Advanced System Protector\clamunpack\clamscan.exe.
30.03.2014 22:28:10        Echtzeit-Dateischutz        Datei        C:\Users\Claudia\AppData\Local\Temp\sptemp\toolkitpro1331vc90u.dll_635318152895700000        Win32/RiskWare.PEMalform.E Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert        LITTLESHEEP\Claudia        Ereignis beim Erstellen einer neuen Datei durch die Anwendung: C:\Program Files (x86)\Advanced System Protector\clamunpack\clamscan.exe.
30.03.2014 22:28:08        Echtzeit-Dateischutz        Datei        C:\Users\Claudia\AppData\Local\Temp\sptemp\globalutil.dll_635318152878290000        Win32/RiskWare.PEMalform.E Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert        LITTLESHEEP\Claudia        Ereignis beim Erstellen einer neuen Datei durch die Anwendung: C:\Program Files (x86)\Advanced System Protector\clamunpack\clamscan.exe.
30.03.2014 22:28:07        Echtzeit-Dateischutz        Datei        C:\Users\Claudia\AppData\Local\Temp\sptemp\agentdialogs.dll_635318152868140000        Win32/RiskWare.PEMalform.E Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert        LITTLESHEEP\Claudia        Ereignis beim Erstellen einer neuen Datei durch die Anwendung: C:\Program Files (x86)\Advanced System Protector\clamunpack\clamscan.exe.
30.03.2014 22:28:06        Echtzeit-Dateischutz        Datei        C:\Users\Claudia\AppData\Local\Temp\sptemp\kiespdlr.exe_635318152852450000        Win32/RiskWare.PEMalform.E Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert        LITTLESHEEP\Claudia        Ereignis beim Erstellen einer neuen Datei durch die Anwendung: C:\Program Files (x86)\Advanced System Protector\clamunpack\clamscan.exe.
23.02.2014 01:16:20        HTTP-Prüfung        Datei        hxxp://www.freecardsmaker.com/default/ga/sa/?dl=1&ts=1&tschnl=FL_4&adnm=32468201486&i=s&grid=&lg=EN&cc=DE&clg=en&c=1&d=0&cid=_627412451&kw=zip&mt=&mn=napster-rienf-repair.updatestar.com&ct=&nt=D&expr=&ap=none&dv=c&color=green&agid=_6063576989        Variante von Win32/TrojanDownloader.FakeNSIS.A Trojaner        Verbindung getrennt - in Quarantäne kopiert        LITTLESHEEP\Claudia        Bedrohung erkannt beim Zugriff auf das Web durch die Anwendung: C:\Program Files (x86)\Mozilla Firefox\firefox.exe.

Defogger (wie gesagt, zweiter Lauf da zuerst überspeichert :balla:)

Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 00:16 on 29/04/2014 (Claudia)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...
SPTD -> Already disabled


-=E.O.F=-

GMER

Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-04-29 00:14:18
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000062 WDC_WD15 rev.01.0 1397,27GB
Running: Gmer-19357.exe; Driver: C:\Users\Claudia\AppData\Local\Temp\pxlcqaow.sys


---- User code sections - GMER 2.1 ----

.text    C:\ProgramData\IePluginService\PluginService.exe[1652] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                                    0000000075a81465 2 bytes [A8, 75]
.text    C:\ProgramData\IePluginService\PluginService.exe[1652] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                                  0000000075a814bb 2 bytes [A8, 75]
.text    ...                                                                                                                                                                                                                                                              * 2
.text    C:\Windows\SysWOW64\rundll32.exe[2732] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                                                    0000000075a81465 2 bytes [A8, 75]
.text    C:\Windows\SysWOW64\rundll32.exe[2732] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                                                  0000000075a814bb 2 bytes [A8, 75]
.text    ...                                                                                                                                                                                                                                                              * 2
.text    C:\Program Files\Creative\ZEN Media Explorer\CTCheck.exe[2572] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                            0000000075a81465 2 bytes [A8, 75]
.text    C:\Program Files\Creative\ZEN Media Explorer\CTCheck.exe[2572] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                          0000000075a814bb 2 bytes [A8, 75]
.text    ...                                                                                                                                                                                                                                                              * 2
.text    C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe[2640] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                  0000000075a81465 2 bytes [A8, 75]
.text    C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe[2640] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                0000000075a814bb 2 bytes [A8, 75]
.text    ...                                                                                                                                                                                                                                                              * 2
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2696] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                0000000075a81465 2 bytes [A8, 75]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2696] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                0000000075a814bb 2 bytes [A8, 75]
.text    ...                                                                                                                                                                                                                                                              * 2
.text    C:\Program Files\V-bates\notifier.exe[3056] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                                              0000000075a81465 2 bytes [A8, 75]
.text    C:\Program Files\V-bates\notifier.exe[3056] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                                              0000000075a814bb 2 bytes [A8, 75]
.text    ...                                                                                                                                                                                                                                                              * 2
.text    C:\Program Files (x86)\Vtune\TBPANEL.exe[3060] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                                            0000000075a81465 2 bytes [A8, 75]
.text    C:\Program Files (x86)\Vtune\TBPANEL.exe[3060] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                                          0000000075a814bb 2 bytes [A8, 75]
.text    ...                                                                                                                                                                                                                                                              * 2
.text    C:\Program Files (x86)\GMX\GMX SMS-Manager\SMSMngr.exe[2740] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                              0000000075a81465 2 bytes [A8, 75]
.text    C:\Program Files (x86)\GMX\GMX SMS-Manager\SMSMngr.exe[2740] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                            0000000075a814bb 2 bytes [A8, 75]
.text    ...                                                                                                                                                                                                                                                              * 2
.text    C:\Program Files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe[2748] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                    0000000075a81465 2 bytes [A8, 75]
.text    C:\Program Files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe[2748] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                  0000000075a814bb 2 bytes [A8, 75]
.text    ...                                                                                                                                                                                                                                                              * 2
.text    C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe[2764] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                          0000000075a81465 2 bytes [A8, 75]
.text    C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe[2764] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                          0000000075a814bb 2 bytes [A8, 75]
.text    ...                                                                                                                                                                                                                                                              * 2
.text    C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2752] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                      0000000075a81465 2 bytes [A8, 75]
.text    C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2752] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                    0000000075a814bb 2 bytes [A8, 75]
.text    ...                                                                                                                                                                                                                                                              * 2
.text    C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2372] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                  0000000075a81465 2 bytes [A8, 75]
.text    C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2372] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                  0000000075a814bb 2 bytes [A8, 75]
.text    ...                                                                                                                                                                                                                                                              * 2
.text    C:\Program Files (x86)\Common Files\Apple\Internet Services\BookmarkDAV_client.exe[1796] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                  0000000075a81465 2 bytes [A8, 75]
.text    C:\Program Files (x86)\Common Files\Apple\Internet Services\BookmarkDAV_client.exe[1796] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                0000000075a814bb 2 bytes [A8, 75]
.text    ...                                                                                                                                                                                                                                                              * 2
.text    C:\Program Files (x86)\Samsung\Kies\Kies.exe[2104] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                                        0000000075a81465 2 bytes [A8, 75]
.text    C:\Program Files (x86)\Samsung\Kies\Kies.exe[2104] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                                      0000000075a814bb 2 bytes [A8, 75]
.text    ...                                                                                                                                                                                                                                                              * 2
.text    C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3064] C:\Windows\SysWOW64\ntdll.dll!DbgBreakPoint                                                                                                                                        0000000077a9000c 1 byte [C3]
.text    C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3064] C:\Windows\SysWOW64\ntdll.dll!DbgUiRemoteBreakin                                                                                                                                  0000000077b1f8ea 5 bytes JMP 0000000177acd5c1
.text    C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3064] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                            0000000075a81465 2 bytes [A8, 75]
.text    C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3064] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                          0000000075a814bb 2 bytes [A8, 75]
.text    ...                                                                                                                                                                                                                                                              * 2
.text    C:\Users\Claudia\AppData\Local\Smartbar\Application\Smartbar.exe[3012] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                    0000000075a81465 2 bytes [A8, 75]
.text    C:\Users\Claudia\AppData\Local\Smartbar\Application\Smartbar.exe[3012] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                  0000000075a814bb 2 bytes [A8, 75]
.text    ...                                                                                                                                                                                                                                                              * 2
.text    C:\Users\Claudia\AppData\Local\Genesis\Genesis.exe[2872] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                                  0000000075a81465 2 bytes [A8, 75]
.text    C:\Users\Claudia\AppData\Local\Genesis\Genesis.exe[2872] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                                0000000075a814bb 2 bytes [A8, 75]
.text    ...                                                                                                                                                                                                                                                              * 2
.text    C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe[3180] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                0000000075a81465 2 bytes [A8, 75]
.text    C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe[3180] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                0000000075a814bb 2 bytes [A8, 75]
.text    ...                                                                                                                                                                                                                                                              * 2
.text    C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[3244] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter                                                                                                                                        0000000077078791 4 bytes [C2, 04, 00, 00]
.text    C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[3244] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                                                                                                                                              0000000075a81465 2 bytes [A8, 75]
.text    C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[3244] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                                                                                                                                            0000000075a814bb 2 bytes [A8, 75]
.text    ...                                                                                                                                                                                                                                                              * 2
.text    C:\Program Files (x86)\iTunes\iTunesHelper.exe[2844] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                                      0000000075a81465 2 bytes [A8, 75]
.text    C:\Program Files (x86)\iTunes\iTunesHelper.exe[2844] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                                    0000000075a814bb 2 bytes [A8, 75]
.text    ...                                                                                                                                                                                                                                                              * 2
.text    C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[2852] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                              0000000075a81465 2 bytes [A8, 75]
.text    C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[2852] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                              0000000075a814bb 2 bytes [A8, 75]
.text    ...                                                                                                                                                                                                                                                              * 2
.text    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4044] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                    0000000075a81465 2 bytes [A8, 75]
.text    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4044] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                  0000000075a814bb 2 bytes [A8, 75]
.text    ...                                                                                                                                                                                                                                                              * 2
.text    C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[5020] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                  0000000075a81465 2 bytes [A8, 75]
.text    C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[5020] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                  0000000075a814bb 2 bytes [A8, 75]
.text    ...                                                                                                                                                                                                                                                              * 2
.text    C:\Users\Claudia\AppData\Local\PirritSuggestor\PirritDesktop.exe[4372] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                    0000000075a81465 2 bytes [A8, 75]
.text    C:\Users\Claudia\AppData\Local\PirritSuggestor\PirritDesktop.exe[4372] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                  0000000075a814bb 2 bytes [A8, 75]
.text    ...                                                                                                                                                                                                                                                              * 2
.text    C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[1848] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                            0000000075a81465 2 bytes [A8, 75]
.text    C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[1848] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                          0000000075a814bb 2 bytes [A8, 75]
.text    ...                                                                                                                                                                                                                                                              * 2

---- Threads - GMER 2.1 ----

Thread  System [4:1100]                                                                                                                                                                                                                                                  fffffa8009adca40
---- Processes - GMER 2.1 ----

Process  C:\Users\Claudia\AppData\Local\Genesis\Genesis.exe (*** suspicious ***) @ C:\Users\Claudia\AppData\Local\Genesis\Genesis.exe [2872](2014-04-28 20:49:14)                                                                                                          0000000000400000
Library  C:\Users\Claudia\AppData\Local\PirritSuggestor\QtCore4.dll (*** suspicious ***) @ C:\Users\Claudia\AppData\Local\PirritSuggestor\PirritService.exe [3416] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-04-18 20:55:13)    000000006a040000
Library  C:\Users\Claudia\AppData\Local\PirritSuggestor\QtNetwork4.dll (*** suspicious ***) @ C:\Users\Claudia\AppData\Local\PirritSuggestor\PirritDesktop.exe [4372] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-04-18 20:55:13)  000000005e010000
Library  C:\Users\Claudia\AppData\Local\PirritSuggestor\QtCore4.dll (*** suspicious ***) @ C:\Users\Claudia\AppData\Local\PirritSuggestor\PirritDesktop.exe [4372] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-04-18 20:55:13)    000000006a040000

---- Registry - GMER 2.1 ----

Reg      HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                                                                                                                                                                 
Reg      HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                                                                                                                                                              C:\Program Files (x86)\DAEMON Tools Lite\
Reg      HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                                                                                                                                                              0x00 0x00 0x00 0x00 ...
Reg      HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                                                                                                                                              0
Reg      HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                                                                                                                                            0xBA 0xCC 0x94 0x5D ...
Reg      HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                                                                                                                                                                       
Reg      HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                                                                                                                                                                      0x20 0x01 0x00 0x00 ...
Reg      HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                                                                                                                                                                  0x5B 0x63 0xE0 0x7E ...
Reg      HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                                                                                                                                                                   
Reg      HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                                                                                                                                                              0x44 0x36 0x9E 0xD2 ...
Reg      HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1                                                                                                                                                                   
Reg      HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12                                                                                                                                                              0x27 0x28 0x48 0x34 ...
Reg      HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2                                                                                                                                                                   
Reg      HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2@hdf12                                                                                                                                                              0x49 0x8B 0xAC 0xFB ...
Reg      HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                                                                                                                                                             
Reg      HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                                                                                                                                                                  C:\Program Files (x86)\DAEMON Tools Lite\
Reg      HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                                                                                                                                                                  0x00 0x00 0x00 0x00 ...
Reg      HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                                                                                                                                                  0
Reg      HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                                                                                                                                                0xBA 0xCC 0x94 0x5D ...
Reg      HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)                                                                                                                                                   
Reg      HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                                                                                                                                                                          0x20 0x01 0x00 0x00 ...
Reg      HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                                                                                                                                                                      0x5B 0x63 0xE0 0x7E ...
Reg      HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)                                                                                                                                               
Reg      HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                                                                                                                                                                  0x44 0x36 0x9E 0xD2 ...
Reg      HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1 (not active ControlSet)                                                                                                                                               
Reg      HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12                                                                                                                                                                  0x27 0x28 0x48 0x34 ...
Reg      HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2 (not active ControlSet)                                                                                                                                               
Reg      HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2@hdf12                                                                                                                                                                  0x49 0x8B 0xAC 0xFB ...
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A7683762-250E-1153-8024-4B2E4BD01261}                                                                                                                                                 
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A7683762-250E-1153-8024-4B2E4BD01261}@oadgidkllokdlihcbncfkifajgffgm                                                                                                                    0x69 0x61 0x62 0x61 ...
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A7683762-250E-1153-8024-4B2E4BD01261}@nafggahdoojdcjickaifmfoaianf                                                                                                                      0x6A 0x61 0x70 0x63 ...
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A7683762-250E-1153-8024-4B2E4BD01261}@oapiaamakhgeobpljakhoedhflkggc                                                                                                                    0x64 0x61 0x69 0x70 ...

---- Disk sectors - GMER 2.1 ----

Disk    \Device\Harddisk0\DR0                                                                                                                                                                                                                                            unknown MBR code

---- EOF - GMER 2.1 ----

Ich hoffe, bis auf das FRST ist das soweit okay wie ich es gepostet habe - bin dann spätestens morgen Abend wieder online zur weiteren Bearbeitung (falls sich also vorher ein freundlicher Helfer findet, keine Hektik und schon mal Danke!). Sollte was fehlen oder sich was Verbotenes finden (nicht bewußt), bitte kurzen Hinweis - dann werde ich das soweit ich kann nachreichen/ergänzen bzw. entfernen. Danke!

cosinus 29.04.2014 11:09
Hi,

Zitat:
2. Ich kann das FRST nicht starten (64bit System), der PC sagt mir das sei keine gültige Win32-Anwendung...?
64-Bit-Systeme benötigen die FRST64.exe, 32-Bit-System die FRST.exe

Sicher, dass du da nicht etwas verwechselt hast?

Du hast ein 64-Bit-System, lade FRST64 nochmal neu runter auf den Desktop und versuch es nochmal.

littlesheep 29.04.2014 19:53
Hi,

ja ich bin sicher, hatte gestern sogar erst beide runtergeladen obwohl ich relativ sicher war, daß es ein 64bit-System ist und dann erst nachgeguckt und dann die FRST64 versucht. Heute nochmal beide gelöscht, die 64er neu runtergeladen, gleiches Problem...

http://img.photobucket.com/albums/v5...psdef34461.jpg


http://img.photobucket.com/albums/v5...psd410d9ad.jpg

(Die andere ging aber auch nicht, hatte ich gestern dann alternativ versucht, gleiche Meldung)

cosinus 29.04.2014 21:48
Dann bitte jetzt Combofix ausführen:

Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

littlesheep 29.04.2014 22:29
Ich bin auf jeden Fall schon mal beeindruckt... :crazy:

Das hat jetzt funktioniert, hat auch nicht gemeckert (apropos gemeckert, meine Virensoftware hat heute beim Starten - weiß nicht genau, ob er den gestern und die Tage vorher auch schon namentlich erwähnt hatte - die Datei Genesis.exe zwei oder drei Mal als "im Arbeitsspeicher..." benannt und gelöscht) - hier das Log:

Code:
ComboFix 14-04-29.01 - Claudia 29.04.2014  23:09:48.1.6 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.8191.5814 [GMT 2:00]
ausgeführt von:: c:\users\Claudia\Desktop\ComboFix.exe
AV: ESET Smart Security 4.2 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
FW: ESET Personal Firewall *Disabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}
SP: ESET Smart Security 4.2 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\END
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\smartbar_3312014.exe.lnk
c:\users\Claudia\AppData\Local\AnyProtectScannerSetup.exe
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome.manifest
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\api.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\api\asyncDB.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\api\background.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\api\browserAction.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\api\contextMenu.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\api\dbManager.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\api\dom_bg.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\api\fileManager.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\api\firefox.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\api\firefoxNotifications.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\api\firefoxOmnibox.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\api\message.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\api\pageAction.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\api\request.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\api\tabs.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\api\webRequest.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\api\windowsMessagingHandler.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\background.html
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\baseObject.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\browser.xul
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core\addressBarChangeObserver.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core\console.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core\consts.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core\delegate.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core\extensionDataStore.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core\folderIOWrapper.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core\httpObserver.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core\IDBWrapper.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core\installer.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core\logFile.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core\prefs.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core\progressListenerObserver.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core\registry.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core\reloadObserver.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core\reports.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core\requestObject.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core\searchSettings.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core\uninstallObserver.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core\updateManager.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core\utils.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core\xhr.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\dialog.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\ffCoreFilesIndex.txt
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\main.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\options.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\options.xul
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\platformVersion.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\search_dialog.xul
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\defaults\preferences\prefs.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\manifest.xml
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins.json
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\1.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\102.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\103.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\104.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\13.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\14.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\155.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\16.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\17.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\177.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\182.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\183.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\184.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\190.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\191.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\195.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\207.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\21.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\211.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\22.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\220.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\226.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\233.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\242.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\244.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\246.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\28.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\4.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\47.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\64.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\7.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\72.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\78.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\9.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\91.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\93.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\98.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\userCode\background.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\userCode\extension.js
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\install.rdf
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\locale\en-US\translations.dtd
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\skin\button1.png
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\skin\button2.png
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\skin\button3.png
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\skin\button4.png
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\skin\button5.png
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\skin\crossrider_statusbar.png
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\skin\icon128.png
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\skin\icon16.png
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\skin\icon24.png
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\skin\icon48.png
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\skin\panelarrow-up.png
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\skin\popup.html
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\skin\skin.css
c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\skin\update.css
c:\windows\SysWow64\AVSredirect.dll
.
.
(((((((((((((((((((((((  Dateien erstellt von 2014-03-28 bis 2014-04-29  ))))))))))))))))))))))))))))))
.
.
2014-04-29 21:18 . 2014-04-29 21:18        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp
2014-04-29 21:18 . 2014-04-29 21:18        --------        d-----w-        c:\users\Default\AppData\Local\temp
2014-04-29 19:27 . 2014-04-29 19:27        75888        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{3DF22FEA-40D0-460F-81D0-132D380CF371}\offreg.dll
2014-04-29 18:31 . 2014-04-17 03:31        10651704        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{3DF22FEA-40D0-460F-81D0-132D380CF371}\mpengine.dll
2014-04-28 21:22 . 2014-04-28 21:22        --------        d-s---w-        c:\windows\system32\CompatTel
2014-04-28 21:21 . 2014-04-14 02:24        465408        ----a-w-        c:\windows\system32\aepdu.dll
2014-04-28 21:21 . 2014-04-14 02:19        424448        ----a-w-        c:\windows\system32\aeinv.dll
2014-04-28 21:04 . 2014-04-28 21:05        119512        ----a-w-        c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-04-28 21:03 . 2014-04-28 21:03        --------        d-----w-        c:\program files (x86)\Malwarebytes Anti-Malware
2014-04-28 21:03 . 2014-04-28 21:03        --------        d-----w-        c:\programdata\Malwarebytes
2014-04-28 21:03 . 2014-04-03 07:51        63192        ----a-w-        c:\windows\system32\drivers\mwac.sys
2014-04-28 21:03 . 2014-04-03 07:51        88280        ----a-w-        c:\windows\system32\drivers\mbamchameleon.sys
2014-04-28 21:03 . 2014-04-03 07:50        25816        ----a-w-        c:\windows\system32\drivers\mbam.sys
2014-04-28 20:54 . 2014-04-28 20:54        --------        d-----w-        c:\program files (x86)\Uninstaller
2014-04-28 20:52 . 2014-04-28 20:52        --------        d-----w-        c:\users\Claudia\AppData\Local\com
2014-04-28 20:50 . 2014-04-29 18:27        --------        d-----w-        c:\program files (x86)\MyPC Backup
2014-04-28 20:49 . 2014-04-28 20:53        --------        d-----w-        c:\program files (x86)\MediaPlayerplus
2014-04-28 20:49 . 2014-04-28 20:49        --------        d-----w-        c:\users\Claudia\AppData\Roaming\VOPackage
2014-04-28 20:49 . 2014-04-28 20:52        --------        d-----w-        c:\program files (x86)\Freeven pro 1.2
2014-04-28 20:49 . 2014-04-29 21:06        --------        d-----w-        c:\users\Claudia\AppData\Local\Genesis
2014-04-28 20:48 . 2014-04-28 20:48        --------        d-----w-        c:\users\Claudia\AppData\Local\SearchProtect
2014-04-28 20:39 . 2014-04-28 20:39        --------        d-----w-        c:\program files\V-bates
2014-04-28 20:39 . 2014-04-28 20:39        --------        d-----w-        c:\users\Claudia\AppData\Local\LPT
2014-04-28 20:39 . 2014-04-28 20:39        --------        d-----w-        c:\users\Claudia\AppData\Local\Smartbar
2014-04-19 00:08 . 2014-04-19 00:08        --------        d-----w-        c:\users\Claudia\AppData\Roaming\Bigasoft Total Video Converter 4
2014-04-19 00:07 . 2014-04-19 00:07        --------        d-----w-        c:\program files (x86)\Bigasoft
2014-04-18 22:31 . 2014-04-19 00:29        --------        d-----w-        c:\program files\rrsavings
2014-04-18 22:30 . 2014-04-18 22:30        --------        d-----w-        c:\program files\002
2014-04-18 22:10 . 2014-04-18 22:10        --------        d-----w-        c:\users\Claudia\AppData\Roaming\DivX
2014-04-18 22:10 . 2014-04-18 22:31        --------        d-----w-        c:\program files\DivX
2014-04-18 22:10 . 2014-04-18 22:31        --------        d-----w-        c:\program files (x86)\Common Files\DivX Shared
2014-04-18 22:08 . 2014-04-18 22:31        --------        d-----w-        c:\programdata\DivX
2014-04-18 22:06 . 2014-04-18 22:06        --------        d-----w-        c:\users\Claudia\.drdivx2
2014-04-18 20:55 . 2014-04-18 20:55        --------        d-----w-        c:\users\Claudia\AppData\Roaming\SupTab
2014-04-18 20:55 . 2014-04-18 20:59        --------        d-----w-        c:\program files (x86)\SupTab
2014-04-18 20:55 . 2014-04-18 20:55        --------        d-----w-        c:\programdata\IePluginService
2014-04-18 20:55 . 2014-04-18 21:04        --------        d-----w-        c:\programdata\WPM
2014-04-18 20:55 . 2014-04-18 20:55        --------        d-----w-        c:\users\Claudia\AppData\Local\WinRST
2014-04-18 20:55 . 2014-04-18 20:55        --------        d-----w-        c:\program files (x86)\WinRST
2014-04-18 20:55 . 2014-04-18 20:55        --------        d-----w-        c:\users\Claudia\AppData\Local\PirritSuggestor
2014-04-18 20:55 . 2014-04-18 20:55        --------        d-----w-        c:\users\Claudia\AppData\Roaming\Pirrit
2014-04-18 20:55 . 2014-04-18 20:55        --------        d-----w-        c:\program files (x86)\Pirrit
2014-04-18 20:54 . 2014-04-18 20:59        --------        d-----w-        c:\users\Claudia\AppData\Roaming\sweet-page
2014-04-18 20:42 . 2014-03-06 08:11        5784064        ----a-w-        c:\windows\system32\jscript9.dll
2014-04-18 20:42 . 2014-03-06 07:46        4254720        ----a-w-        c:\windows\SysWow64\jscript9.dll
2014-04-18 20:34 . 2014-01-24 02:37        1684928        ----a-w-        c:\windows\system32\drivers\ntfs.sys
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-04-28 21:59 . 2012-03-29 17:10        692400        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2014-04-28 21:59 . 2011-05-15 17:53        70832        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-04-18 20:38 . 2010-12-16 13:08        90655440        ----a-w-        c:\windows\system32\MRT.exe
2014-03-31 07:35 . 2010-12-10 10:11        270496        ------w-        c:\windows\system32\MpSigStub.exe
2014-03-20 21:03 . 2013-10-27 08:12        15783992        ----a-w-        c:\windows\SysWow64\nvwgf2um.dll
2014-03-20 21:03 . 2013-02-25 22:32        18302384        ----a-w-        c:\windows\system32\nvwgf2umx.dll
2014-03-20 21:03 . 2014-03-20 21:03        832936        ----a-w-        c:\windows\SysWow64\nvumdshim.dll
2014-03-20 21:03 . 2013-02-25 22:32        947808        ----a-w-        c:\windows\system32\nvumdshimx.dll
2014-03-20 21:03 . 2014-03-20 21:03        9690424        ----a-w-        c:\windows\SysWow64\nvopencl.dll
2014-03-20 21:03 . 2014-03-20 21:03        11589272        ----a-w-        c:\windows\system32\nvopencl.dll
2014-03-20 21:02 . 2014-03-20 21:02        31474976        ----a-w-        c:\windows\system32\nvoglv64.dll
2014-03-20 21:02 . 2014-03-20 21:02        353504        ----a-w-        c:\windows\system32\nvoglshim64.dll
2014-03-20 21:02 . 2014-03-20 21:02        305600        ----a-w-        c:\windows\SysWow64\nvoglshim32.dll
2014-03-20 21:02 . 2014-03-20 21:02        23716640        ----a-w-        c:\windows\SysWow64\nvoglv32.dll
2014-03-20 21:02 . 2014-03-20 21:02        12708128        ----a-w-        c:\windows\system32\drivers\nvlddmkm.sys
2014-03-20 21:02 . 2014-03-20 21:02        892704        ----a-w-        c:\windows\system32\NvIFR64.dll
2014-03-20 21:02 . 2014-03-20 21:02        863064        ----a-w-        c:\windows\SysWow64\NvIFR.dll
2014-03-20 21:02 . 2014-03-20 21:02        174296        ----a-w-        c:\windows\system32\nvinitx.dll
2014-03-20 21:02 . 2014-03-20 21:02        148016        ----a-w-        c:\windows\SysWow64\nvinit.dll
2014-03-20 21:02 . 2014-03-20 21:02        877856        ----a-w-        c:\windows\system32\NvFBC64.dll
2014-03-20 21:02 . 2014-03-20 21:02        846168        ----a-w-        c:\windows\SysWow64\NvFBC.dll
2014-03-20 21:02 . 2014-03-20 21:02        1885472        ----a-w-        c:\windows\system32\nvdispco6433523.dll
2014-03-20 21:02 . 2014-03-20 21:02        1516488        ----a-w-        c:\windows\system32\nvdispgenco6433523.dll
2014-03-20 21:02 . 2014-03-20 21:02        3143456        ----a-w-        c:\windows\system32\nvcuvid.dll
2014-03-20 21:02 . 2014-03-20 21:02        17755424        ----a-w-        c:\windows\system32\nvd3dumx.dll
2014-03-20 21:02 . 2013-09-17 20:22        14709720        ----a-w-        c:\windows\SysWow64\nvd3dum.dll
2014-03-20 21:02 . 2014-03-20 21:02        9728064        ----a-w-        c:\windows\SysWow64\nvcuda.dll
2014-03-20 21:02 . 2014-03-20 21:02        2958792        ----a-w-        c:\windows\SysWow64\nvcuvid.dll
2014-03-20 21:02 . 2014-03-20 21:02        2783008        ----a-w-        c:\windows\system32\nvcuvenc.dll
2014-03-20 21:02 . 2014-03-20 21:02        2411976        ----a-w-        c:\windows\SysWow64\nvcuvenc.dll
2014-03-20 21:02 . 2014-03-20 21:02        11636176        ----a-w-        c:\windows\system32\nvcuda.dll
2014-03-20 21:02 . 2014-03-20 21:02        17561544        ----a-w-        c:\windows\SysWow64\nvcompiler.dll
2014-03-20 21:02 . 2014-03-20 21:02        25255256        ----a-w-        c:\windows\system32\nvcompiler.dll
2014-03-20 21:02 . 2013-02-25 22:32        3093280        ----a-w-        c:\windows\system32\nvapi64.dll
2014-03-20 21:02 . 2013-02-25 22:32        2715264        ----a-w-        c:\windows\SysWow64\nvapi.dll
2014-03-19 13:27 . 2014-03-19 13:27        76496        ----a-w-        c:\windows\system32\drivers\dc3d.sys
2014-03-19 13:23 . 2014-03-19 13:23        862664        ----a-w-        c:\windows\SysWow64\msvcr110.dll
2014-03-19 13:23 . 2014-03-19 13:23        828872        ----a-w-        c:\windows\system32\msvcr110.dll
2014-03-19 13:23 . 2014-03-19 13:23        661448        ----a-w-        c:\windows\system32\msvcp110.dll
2014-03-19 13:23 . 2014-03-19 13:23        534480        ----a-w-        c:\windows\SysWow64\msvcp110.dll
2014-03-19 13:23 . 2014-03-19 13:23        50896        ----a-w-        c:\windows\system32\drivers\point64.sys
2014-03-19 13:23 . 2014-03-19 13:23        354264        ----a-w-        c:\windows\system32\vccorlib110.dll
2014-03-19 13:23 . 2014-03-19 13:23        251864        ----a-w-        c:\windows\SysWow64\vccorlib110.dll
2014-03-11 20:07 . 2014-03-11 20:07        4550656        ----a-w-        c:\windows\SysWow64\GPhotos.scr
2014-03-04 13:06 . 2010-08-08 22:12        6714312        ----a-w-        c:\windows\system32\nvcpl.dll
2014-03-04 13:06 . 2010-08-08 22:12        3497816        ----a-w-        c:\windows\system32\nvsvc64.dll
2014-03-04 13:05 . 2010-08-08 22:12        922968        ----a-w-        c:\windows\system32\nvvsvc.exe
2014-03-04 13:05 . 2010-08-08 22:12        64968        ----a-w-        c:\windows\system32\nvshext.dll
2014-03-04 13:05 . 2010-08-08 22:12        2558808        ----a-w-        c:\windows\system32\nvsvcr.dll
2014-03-04 13:05 . 2010-08-08 22:12        386336        ----a-w-        c:\windows\system32\nvmctray.dll
2014-03-04 13:05 . 2012-11-15 21:11        3649185        ----a-w-        c:\windows\system32\nvcoproc.bin
2014-03-04 11:32 . 2014-03-30 11:42        599840        ----a-w-        c:\windows\SysWow64\nvStreaming.exe
2014-03-04 09:17 . 2014-04-18 20:35        44032        ----a-w-        c:\windows\apppatch\acwow64.dll
2014-02-07 01:23 . 2014-03-30 11:32        3156480        ----a-w-        c:\windows\system32\win32k.sys
2014-02-04 02:32 . 2014-03-30 11:31        1424384        ----a-w-        c:\windows\system32\WindowsCodecs.dll
2014-02-04 02:32 . 2014-03-30 11:31        624128        ----a-w-        c:\windows\system32\qedit.dll
2014-02-04 02:04 . 2014-03-30 11:31        1230336        ----a-w-        c:\windows\SysWow64\WindowsCodecs.dll
2014-02-04 02:04 . 2014-03-30 11:31        509440        ----a-w-        c:\windows\SysWow64\qedit.dll
2010-12-11 21:21 . 2010-02-14 14:35        4411392        ----a-w-        c:\program files (x86)\mplayerc.exe
2010-12-11 19:01 . 2004-02-18 18:36        245760        ----a-w-        c:\program files (x86)\PvrDiskUtil.exe
2006-05-02 23:00        163328        --sh--r-        c:\windows\SysWOW64\flvDX.dll
2007-02-20 23:00        31232        --sh--r-        c:\windows\SysWOW64\msfDX.dll
2008-03-15 23:00        216064        --sh--r-        c:\windows\SysWOW64\nbDX.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{11111111-1111-1111-1111-110511421146}]
2014-04-28 20:52        500072        ----a-w-        c:\program files (x86)\MediaPlayerplus\MediaPlayerplus-bho.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{11111111-1111-1111-1111-110511421153}]
2014-04-28 20:51        500072        ----a-w-        c:\program files (x86)\Freeven pro 1.2\Freeven pro 1.2-bho.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}]
2014-04-07 13:38        195872        ----a-w-        c:\program files\V-bates\Extension32.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{31ad400d-1b06-4e33-a59a-90c2c140cba0}]
2010-11-05 01:58        297808        ----a-w-        c:\windows\System32\mscoree.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-09-28 21:44        1400712        ----a-w-        c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{d40c654d-7c51-4eb3-95b2-1e23905c2a2d}]
2010-11-05 01:58        297808        ----a-w-        c:\windows\System32\mscoree.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShareOverlay]
@="{594D4122-1F87-41E2-96C7-825FB4796516}"
[HKEY_CLASSES_ROOT\CLSID\{594D4122-1F87-41E2-96C7-825FB4796516}]
2010-10-30 11:09        478208        ----a-w-        c:\program files\Classic Shell\ClassicExplorer32.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TBPanel"="c:\program files (x86)\Vtune\TBPanel.exe" [2010-09-02 2158592]
"GMX SMS-Manager"="c:\program files (x86)\GMX\GMX SMS-Manager\SMSMngr.exe" [2007-07-19 3539968]
"CTSyncU.exe"="c:\program files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 868352]
"TomTomHOME.exe"="c:\program files (x86)\TomTom HOME 2\TomTomHOMERunner.exe" [2013-03-22 248208]
"iCloudServices"="c:\program files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe" [2012-12-17 59872]
"ApplePhotoStreams"="c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2012-12-17 59872]
"com.apple.dav.bookmarks.daemon"="c:\program files (x86)\Common Files\Apple\Internet Services\BookmarkDAV_client.exe" [2012-12-17 59872]
"KiesPreload"="c:\program files (x86)\Samsung\Kies\Kies.exe" [2013-09-04 1564528]
"Browser Infrastructure Helper"="c:\users\Claudia\AppData\Local\Smartbar\Application\Smartbar.exe" [2014-03-25 26904]
"genesis"="c:\users\claudia\appdata\local\genesis\genesis.exe" [2014-04-28 2887680]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"TrueImageMonitor.exe"="c:\program files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe" [2010-03-27 5141512]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS6ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-05-07 1073312]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-12-12 152544]
"KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2013-09-04 311152]
"BingDesktop"="c:\program files (x86)\Microsoft\BingDesktop\BingDesktop.exe" [2013-06-20 2249352]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
.
c:\users\Claudia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
MyPC Backup.lnk - c:\program files (x86)\MyPC Backup\MyPC Backup.exe [2014-3-14 2901032]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer9"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute        REG_MULTI_SZ          autocheck autochk *\0auto_reactivate \\?\Volume{a12df864-0442-11e0-8560-806e6f6e6963}\bootwiz\asrm.bin
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 IePluginService;IePlugin Service;c:\programdata\IePluginService\PluginService.exe;c:\programdata\IePluginService\PluginService.exe [x]
R2 PirritDesktop;PirritDesktop;c:\users\Claudia\AppData\Local\PirritSuggestor\PirritService.exe;c:\users\Claudia\AppData\Local\PirritSuggestor\PirritService.exe [x]
R2 PirritUpdater;PirritUpdater;c:\program files (x86)\Pirrit\AutoUpdater.exe;c:\program files (x86)\Pirrit\AutoUpdater.exe [x]
R2 WinRST;WinRST;c:\program files (x86)\WinRST\WinRST.exe;c:\program files (x86)\WinRST\WinRST.exe [x]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\SysWOW64\FsUsbExDisk.SYS;c:\windows\SysWOW64\FsUsbExDisk.SYS [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys;c:\windows\SYSNATIVE\Drivers\sptd.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 tdrpman258;Acronis Try&Decide and Restore Points filter (build 258);c:\windows\system32\DRIVERS\tdrpm258.sys;c:\windows\SYSNATIVE\DRIVERS\tdrpm258.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys;c:\windows\SYSNATIVE\DRIVERS\ehdrv.sys [x]
S2 afcdpsrv;Acronis Nonstop Backup service;c:\program files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe;c:\program files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [x]
S2 BackupStack;Computer Backup (MyPC Backup);c:\program files (x86)\MyPC Backup\BackupStack.exe;c:\program files (x86)\MyPC Backup\BackupStack.exe [x]
S2 BingDesktopUpdate;Bing Desktop Update service;c:\program files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe;c:\program files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [x]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys;c:\windows\SYSNATIVE\DRIVERS\eamonm.sys [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [x]
S2 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys;c:\windows\SYSNATIVE\DRIVERS\epfwwfp.sys [x]
S2 Mext Guard;Mext Guard;c:\program files\V-bates\guardsvc.exe;c:\program files\V-bates\guardsvc.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe [x]
S2 V-bates Updater;V-bates Updater;c:\program files\V-bates\ExtensionUpdaterService.exe;c:\program files\V-bates\ExtensionUpdaterService.exe [x]
S3 afcdp;afcdp;c:\windows\system32\DRIVERS\afcdp.sys;c:\windows\SYSNATIVE\DRIVERS\afcdp.sys [x]
S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys;c:\windows\SYSNATIVE\DRIVERS\dc3d.sys [x]
S3 Point64;Microsoft Mouse and Keyboard Center Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2014-04-29 c:\windows\Tasks\14ecb001-f416-4a5e-b100-cc6e315349af-1.job
- c:\program files (x86)\Freeven pro 1.2\Freeven pro 1.2-codedownloader.exe [2014-04-28 20:50]
.
2014-04-29 c:\windows\Tasks\14ecb001-f416-4a5e-b100-cc6e315349af-2.job
- c:\program files (x86)\Freeven pro 1.2\14ecb001-f416-4a5e-b100-cc6e315349af-2.exe [2014-04-28 20:51]
.
2014-04-29 c:\windows\Tasks\14ecb001-f416-4a5e-b100-cc6e315349af-3.job
- c:\program files (x86)\Freeven pro 1.2\14ecb001-f416-4a5e-b100-cc6e315349af-3.exe [2014-04-28 20:49]
.
2014-04-29 c:\windows\Tasks\14ecb001-f416-4a5e-b100-cc6e315349af-4.job
- c:\program files (x86)\Freeven pro 1.2\14ecb001-f416-4a5e-b100-cc6e315349af-4.exe [2014-04-28 20:49]
.
2014-04-29 c:\windows\Tasks\14ecb001-f416-4a5e-b100-cc6e315349af-5.job
- c:\program files (x86)\Freeven pro 1.2\14ecb001-f416-4a5e-b100-cc6e315349af-5.exe [2014-04-28 20:52]
.
2014-04-29 c:\windows\Tasks\923e656c-7931-4c44-9b19-6d3c00ebfbd9-1.job
- c:\program files (x86)\MediaPlayerplus\MediaPlayerplus-codedownloader.exe [2014-04-28 20:51]
.
2014-04-29 c:\windows\Tasks\923e656c-7931-4c44-9b19-6d3c00ebfbd9-2.job
- c:\program files (x86)\MediaPlayerplus\923e656c-7931-4c44-9b19-6d3c00ebfbd9-2.exe [2014-04-28 20:52]
.
2014-04-29 c:\windows\Tasks\923e656c-7931-4c44-9b19-6d3c00ebfbd9-3.job
- c:\program files (x86)\MediaPlayerplus\923e656c-7931-4c44-9b19-6d3c00ebfbd9-3.exe [2014-04-28 20:50]
.
2014-04-29 c:\windows\Tasks\923e656c-7931-4c44-9b19-6d3c00ebfbd9-4.job
- c:\program files (x86)\MediaPlayerplus\923e656c-7931-4c44-9b19-6d3c00ebfbd9-4.exe [2014-04-28 20:50]
.
2014-04-29 c:\windows\Tasks\923e656c-7931-4c44-9b19-6d3c00ebfbd9-5.job
- c:\program files (x86)\MediaPlayerplus\923e656c-7931-4c44-9b19-6d3c00ebfbd9-5.exe [2014-04-28 20:53]
.
2014-04-29 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-29 21:59]
.
2014-04-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-04 17:06]
.
2014-04-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-04 17:06]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShareOverlay]
@="{594D4122-1F87-41E2-96C7-825FB4796516}"
[HKEY_CLASSES_ROOT\CLSID\{594D4122-1F87-41E2-96C7-825FB4796516}]
2010-10-30 11:09        594432        ----a-w-        c:\program files\Classic Shell\ClassicExplorer64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CmPCIaudio"="c:\windows\Syswow64\CMICNFG3.dll" [2009-05-11 8126464]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2010-11-04 2919168]
"CTCheck"="c:\program files\Creative\ZEN Media Explorer\CTCheck.exe" [2007-11-06 397312]
"Acronis Scheduler2 Service"="c:\program files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe" [2010-03-27 362952]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-09-20 444904]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-03-20 1797064]
"V-bates"="c:\program files\V-bates\notifier.exe" [2014-04-07 375584]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK2q0U14moCf-ET1EM4uw4GigvFB13oDfsPU-0fo0C6mk4NKg1XjLo_bCzP1bfvbysSYTBYA_U1YbhW2x6q0gXxM7tERQ8Gdx2kZO8xvaIbTYAWEkOd-HzZ7JuY961T4qLXebIQcdfkMCWrpg7jUY5xm3hpwWAsuY4AU9-YMrgx8ShU87ZCsvC6AaVDgG-BjeFZfQoPi1TwU31A,,
mDefault_Search_URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1397854450&from=cor&uid=395049983_1052576_AC757C6F&q={searchTerms}
mDefault_Page_URL = hxxp://www.sweet-page.com/?type=hp&ts=1397854450&from=cor&uid=395049983_1052576_AC757C6F
mStart Page = hxxp://www.sweet-page.com/?type=hp&ts=1397854450&from=cor&uid=395049983_1052576_AC757C6F
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = hxxp://www.sweet-page.com/web/?type=ds&ts=1397854450&from=cor&uid=395049983_1052576_AC757C6F&q={searchTerms}
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=hxxp://127.0.0.1:9880
uSearchAssistant = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK2q0U14moCf-ET1EM4uw4GigvFB13oDfsPU-0fo0C6mk4NKg1XjLo_bCzP1bfvbysSYTBYA_U1YbhW2x6q0gXxM7tERQ8Gdx2kZO8xvaIbTYDZSU_pU1Qp4xx5ARpaXJhwu6BFFYCb7JyQI0Rz9vgpMRIbm9ocagIUeGDcQaXEQ8CREucr5wX27GOoIo2gWHHOYNdqcUJfEtBQ,,&q={searchTerms}
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\
FF - prefs.js: browser.search.selectedEngine - Web Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - prefs.js: keyword.URL - hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK2q0U14moCf-ET1EM4uw4GigvFB13oDfsPU-0fo0C6mk4NKg1XjLo_bCzP1bfvbysSYTBYA_U1YbhW2x6q0gXxM7tERQ8Gdx2kZO8xvaIbTYDZSU_pU1Qp4xx5ARpaXJhwu6BFFYCb7JyQI0Rz9vgpMRIbm9ocagIUeGDcQaXEQ8CREucr5wX27GOoIo2gWHHOYNdqcUJfEtBQ,,&q=
FF - user.js: extensions.autoDisableScopes - 0
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-AdobeBridge - (no file)
Wow6432Node-HKCU-Run-KiesAirMessage - c:\program files (x86)\Samsung\Kies\KiesAirMessage.exe
Wow6432Node-HKLM-Run-mobilegeni daemon - c:\program files (x86)\Mobogenie\DaemonProcess.exe
Wow6432Node-HKLM-Run-DivXMediaServer - c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
AddRemove-dBpoweramp Dalet Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp DirectShow Decoder - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp DSP Effects - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp FLAC Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp Monkeys Audio Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp Mp2 and BwfMp2 codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp mp3 (Fraunhofer IIS) Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp Music Converter - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp Ogg Vorbis Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp Real Audio (Helix) Encoder - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBPoweramp tooLame MP2 codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp Wave64 Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp WavPack Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp [Calculate Audio CRC] Codec - c:\windows\system32\SpoonUninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-1277317880-2460927560-2137772949-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\pspimage*ÿÿÿE¥cuE¥cu¾Z«e¸´T]
"0"=hex:14,00,1f,44,47,1a,03,59,72,3f,a7,44,89,c5,55,95,fe,6b,30,ee,20,00,00,
  00,1a,00,ee,bb,fe,23,00,00,10,00,30,81,e2,33,1e,4e,76,46,83,5a,98,39,5c,3b,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-1277317880-2460927560-2137772949-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*pspimage*ÿÿÿE¥cuE¥cu¾Z«e¸´T]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1277317880-2460927560-2137772949-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*pspimage*ÿÿÿE¥cuE¥cu¾Z«e¸´T\OpenWithList]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1277317880-2460927560-2137772949-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*pspimage*ÿÿÿE¥cuE¥cu¾Z«e¸´T]
"0"=hex:51,00,75,00,69,00,6e,00,63,00,79,00,2e,00,70,73,70,69,6d,61,67,65,00,
  ff,ff,ff,45,a5,63,75,45,a5,63,75,be,5a,ab,65,01,b8,b4,54,10,01,00,00,a6,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-1277317880-2460927560-2137772949-1001\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A7683762-250E-1153-8024-4B2E4BD01261}*]
"oadgidkllokdlihcbncfkifajgffgm"=hex:69,61,62,61,6c,6c,61,70,62,6b,70,65,6f,6b,
  63,61,61,61,00,00
"nafggahdoojdcjickaifmfoaianf"=hex:6a,61,70,63,68,6f,6a,63,70,68,63,61,65,66,
  6a,6f,66,69,61,6a,00,ff
"oapiaamakhgeobpljakhoedhflkggc"=hex:64,61,69,70,66,6f,61,65,00,fc
.
[HKEY_USERS\S-1-5-21-1277317880-2460927560-2137772949-1001_Classes\Wow6432Node\CLSID\{22ffb237-803b-4efd-bc84-2d3a41480e10}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:0000002a
"Therad"=dword:0000001f
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
  38,95,44,c3,4d,9e,47,61,a7,8f,c3,5d,5c,e7,10,32,dc,92,66,f1,78,db,23,e0,fc,\
.
[HKEY_USERS\S-1-5-21-1277317880-2460927560-2137772949-1001_Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"scansk"=hex(0):56,36,7c,21,a5,29,13,2c,4b,95,2b,36,9a,43,ed,57,fe,4c,65,4d,cf,
  b7,69,c0,d7,42,9f,f0,09,91,14,08,75,0f,10,c1,7f,d0,80,46,00,00,00,00,00,00,\
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_206_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_206_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_206_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_206_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_206.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.13"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_206.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_206.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_206.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-04-29  23:21:05
ComboFix-quarantined-files.txt  2014-04-29 21:21
.
Vor Suchlauf: 9 Verzeichnis(se), 398.623.420.416 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 431.000.928.256 Bytes frei
.
- - End Of File - - BBBF9DFBE60FAED714D90212181EBF93
10FA4DEA160749C165DB2CD2762E9FEE

cosinus 30.04.2014 10:06
Adware/Junkware/Toolbars entfernen


1. Schritt: adwCleaner

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).




2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.




3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


littlesheep 30.04.2014 13:24
Soweit alles gut funktioniert, Symbol ist auch wieder normal - hier die geforderten Logs:

1. adwCleaner:

Code:
# AdwCleaner v3.205 - Bericht erstellt am 30/04/2014 um 13:37:16
# Aktualisiert 28/04/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Claudia - LITTLESHEEP
# Gestartet von : C:\Users\Claudia\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****

Dienst Gelöscht : BackupStack
Dienst Gelöscht : IePluginService
[#] Dienst Gelöscht : PirritDesktop
[#] Dienst Gelöscht : PirritUpdater
Dienst Gelöscht : V-bates Updater

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Program Files (x86)\Ask.com
Ordner Gelöscht : C:\Program Files (x86)\Freeven pro 1.2
Ordner Gelöscht : C:\Program Files (x86)\MediaPlayerplus
Ordner Gelöscht : C:\Program Files (x86)\MyPC Backup
Ordner Gelöscht : C:\Program Files (x86)\Pirrit
Ordner Gelöscht : C:\Program Files (x86)\SupTab
Ordner Gelöscht : C:\Program Files (x86)\Uninstaller
Ordner Gelöscht : C:\Program Files (x86)\WinRST
Ordner Gelöscht : C:\Windows\installer\{86d4b82a-abed-442a-be86-96357b70f4fe}
Ordner Gelöscht : C:\Program Files\v-bates
Ordner Gelöscht : C:\Users\Claudia\.android
Ordner Gelöscht : C:\Users\Claudia\AppData\Local\Genesis
Ordner Gelöscht : C:\Users\Claudia\AppData\Local\LPT
Ordner Gelöscht : C:\Users\Claudia\AppData\Local\Mobogenie
Ordner Gelöscht : C:\Users\Claudia\AppData\Local\PirritSuggestor
Ordner Gelöscht : C:\Users\Claudia\AppData\Local\SearchProtect
Ordner Gelöscht : C:\Users\Claudia\AppData\Local\Smartbar
Ordner Gelöscht : C:\Users\Claudia\AppData\Local\WinRST
Ordner Gelöscht : C:\Users\Claudia\AppData\LocalLow\AskToolbar
Ordner Gelöscht : C:\Users\Claudia\AppData\Roaming\Pirrit
Ordner Gelöscht : C:\Users\Claudia\AppData\Roaming\SupTab
Ordner Gelöscht : C:\Users\Claudia\AppData\Roaming\sweet-page
Ordner Gelöscht : C:\Users\Claudia\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\Claudia\AppData\Roaming\VOPackage
Ordner Gelöscht : C:\Users\Claudia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup
Ordner Gelöscht : C:\Users\Claudia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage
Ordner Gelöscht : C:\Users\Claudia\Documents\Mobogenie
Ordner Gelöscht : C:\Users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\Extensions\quick_start@gmail.com
Ordner Gelöscht : C:\Users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\Extensions\2ab9302c-551a-4804-9971-9932d6d5b0f9@2bfa4cf8-298a-4792-80d5-75352ee81de1.com
Ordner Gelöscht : C:\Users\Claudia\AppData\Local\Google\Chrome\User Data\Default\Extensions\dmgpbjjcdccinnndjdgmegndbmhbgglb
Ordner Gelöscht : C:\Users\Claudia\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd
Datei Gelöscht : C:\Users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\Extensions\suggestor@suggestor.pirrit.com.xpi
Datei Gelöscht : C:\Windows\System32\roboot64.exe
Datei Gelöscht : C:\Users\Claudia\daemonprocess.txt
Datei Gelöscht : C:\Users\Claudia\AppData\Roaming\aps.uninstall.scan.results
Datei Gelöscht : C:\Users\Claudia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\sweet-page.xml
Datei Gelöscht : C:\Users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\user.js
Datei Gelöscht : C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar
Datei Gelöscht : C:\Windows\Tasks\14ecb001-f416-4a5e-b100-cc6e315349af-1.job
Datei Gelöscht : C:\Windows\System32\Tasks\14ecb001-f416-4a5e-b100-cc6e315349af-1
Datei Gelöscht : C:\Windows\Tasks\14ecb001-f416-4a5e-b100-cc6e315349af-2.job
Datei Gelöscht : C:\Windows\System32\Tasks\14ecb001-f416-4a5e-b100-cc6e315349af-2
Datei Gelöscht : C:\Windows\Tasks\14ecb001-f416-4a5e-b100-cc6e315349af-3.job
Datei Gelöscht : C:\Windows\System32\Tasks\14ecb001-f416-4a5e-b100-cc6e315349af-3
Datei Gelöscht : C:\Windows\Tasks\14ecb001-f416-4a5e-b100-cc6e315349af-4.job
Datei Gelöscht : C:\Windows\System32\Tasks\14ecb001-f416-4a5e-b100-cc6e315349af-4
Datei Gelöscht : C:\Windows\Tasks\14ecb001-f416-4a5e-b100-cc6e315349af-5.job
Datei Gelöscht : C:\Windows\System32\Tasks\14ecb001-f416-4a5e-b100-cc6e315349af-5
Datei Gelöscht : C:\Windows\Tasks\923e656c-7931-4c44-9b19-6d3c00ebfbd9-1.job
Datei Gelöscht : C:\Windows\System32\Tasks\923e656c-7931-4c44-9b19-6d3c00ebfbd9-1
Datei Gelöscht : C:\Windows\Tasks\923e656c-7931-4c44-9b19-6d3c00ebfbd9-2.job
Datei Gelöscht : C:\Windows\System32\Tasks\923e656c-7931-4c44-9b19-6d3c00ebfbd9-2
Datei Gelöscht : C:\Windows\Tasks\923e656c-7931-4c44-9b19-6d3c00ebfbd9-3.job
Datei Gelöscht : C:\Windows\System32\Tasks\923e656c-7931-4c44-9b19-6d3c00ebfbd9-3
Datei Gelöscht : C:\Windows\Tasks\923e656c-7931-4c44-9b19-6d3c00ebfbd9-4.job
Datei Gelöscht : C:\Windows\System32\Tasks\923e656c-7931-4c44-9b19-6d3c00ebfbd9-4
Datei Gelöscht : C:\Windows\Tasks\923e656c-7931-4c44-9b19-6d3c00ebfbd9-5.job
Datei Gelöscht : C:\Windows\System32\Tasks\923e656c-7931-4c44-9b19-6d3c00ebfbd9-5

***** [ Verknüpfungen ] *****

Verknüpfung Desinfiziert : C:\Users\Claudia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk

***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}]
Wert Gelöscht : [x64] HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}]
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [quick_start@gmail.com]
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Browser Infrastructure Helper]
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [genesis]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\Extension.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bandobjectattribute
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.dockingpanel
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbarbandobject
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbardisplaystate
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbarmenuform
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\speedupmypc
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BrowseMark_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BrowseMark_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\updateBrowseMark_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\updateBrowseMark_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\mypc backup
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CrossriderApp0054246.BHO
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CrossriderApp0054246.Sandbox
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CrossriderApp0054246.Sandbox.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CrossriderApp0054253.BHO
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CrossriderApp0054253.Sandbox
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CrossriderApp0054253.Sandbox.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_gimp_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_gimp_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{21EAF666-26B3-4A3C-ABD0-CA2F5A326744}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D40C654D-7C51-4EB3-95B2-1E23905C2A2D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110511421146}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110511421153}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220522422246}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220522422253}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550555425546}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550555425553}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660566426646}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660566426653}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{21EAF666-26B3-4A3C-ABD0-CA2F5A326744}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D40C654D-7C51-4EB3-95B2-1E23905C2A2D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110511421146}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110511421153}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220522422246}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220522422253}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550555425546}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550555425553}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660566426646}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660566426653}
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : HKCU\Software\AnyProtect
Schlüssel Gelöscht : HKCU\Software\Ask.com
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\genesis
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\installedbrowserextensions
Schlüssel Gelöscht : HKCU\Software\SearchProtectINT
Schlüssel Gelöscht : HKCU\Software\SearchProtectInt2
Schlüssel Gelöscht : HKCU\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\smartbarbackup
Schlüssel Gelöscht : HKCU\Software\smartbarlog
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\systweak
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\AskToolbarInfo
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\AskToolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\MediaPlayerplus
Schlüssel Gelöscht : HKLM\Software\dt soft\daemon tools toolbar
Schlüssel Gelöscht : HKLM\Software\installedbrowserextensions
Schlüssel Gelöscht : HKLM\Software\MediaPlayerplus
Schlüssel Gelöscht : HKLM\Software\Pirrit
Schlüssel Gelöscht : HKLM\Software\supTab
Schlüssel Gelöscht : HKLM\Software\supWPM
Schlüssel Gelöscht : HKLM\Software\sweet-pageSoftware
Schlüssel Gelöscht : HKLM\Software\systweak
Schlüssel Gelöscht : HKLM\Software\Uniblue
Schlüssel Gelöscht : HKLM\Software\V-bates
Schlüssel Gelöscht : HKLM\Software\Wpm
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\genesis
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DMUninstaller
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MediaPlayerplus
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VOPackage
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\installedbrowserextensions
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Pirrit
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\V-bates
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17041

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [SearchAssistant]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]

-\\ Mozilla Firefox v28.0 (de)

[ Datei : C:\Users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\prefs.js ]

Zeile gelöscht : user_pref("browser.search.defaultenginename", "Web Search");
Zeile gelöscht : user_pref("browser.search.selectedEngine", "Web Search");
Zeile gelöscht : user_pref("extensions.crossrider.bic", "145aa1d3a90368f448fa0e54ff7baf5f");
Zeile gelöscht : user_pref("extensions.helperbar.BackPageActive", true);
Zeile gelöscht : user_pref("extensions.helperbar.DockingPositionDown", false);
Zeile gelöscht : user_pref("extensions.helperbar.SmartbarDisabled", false);
Zeile gelöscht : user_pref("extensions.helperbar.SmartbarStateMinimaized", false);
Zeile gelöscht : user_pref("extensions.helperbar.Visibility", true);
Zeile gelöscht : user_pref("extensions.helperbar.backPageCapacity", 3);
Zeile gelöscht : user_pref("extensions.helperbar.backPageCounter", 0);
Zeile gelöscht : user_pref("extensions.helperbar.backPageDay", 28);
Zeile gelöscht : user_pref("extensions.helperbar.backPageLastEvent", "1398544788334");
Zeile gelöscht : user_pref("extensions.helperbar.backPageMinInterval", 15);
Zeile gelöscht : user_pref("extensions.helperbar.barcodeid", "132921");
Zeile gelöscht : user_pref("extensions.helperbar.countryiso", "de");
Zeile gelöscht : user_pref("extensions.helperbar.downloadprovider", "yahootr_pkr");
Zeile gelöscht : user_pref("extensions.helperbar.externalJsFiles", "{\"d\":\"[{\\\"ExcludeDomains\\\":[\\\"snap.do\\\",\\\"snapdo.com\\\"],\\\"hxxpInjection\\\":\\\"hxxp:\\\\\\/\\\\\\/i.linkuryjs.info\\\\\\/kury\\\\\\[...]
Zeile gelöscht : user_pref("extensions.helperbar.fromautoupdate", "false");
Zeile gelöscht : user_pref("extensions.helperbar.installationid", "f5d0e961-d27d-4677-9e12-d531a9c7acb1");
Zeile gelöscht : user_pref("extensions.helperbar.installdate", "28/04/2014");
Zeile gelöscht : user_pref("extensions.helperbar.keepAliveLastevent", "1398717588");
Zeile gelöscht : user_pref("extensions.helperbar.lastExternalJsUpdate", "1398717595105");
Zeile gelöscht : user_pref("extensions.helperbar.publisher", "yahootr");
Zeile gelöscht : user_pref("keyword.URL", "hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK2q0U14moCf-ET1EM4uw4GigvFB13oDfsPU-0fo0C6mk4NKg1XjLo_bCzP1bfvbysSYTBYA_U1YbhW2x6q0gXxM7tERQ8Gdx2kZO8xvaIbTYDZSU_pU1Qp4xx5ARp[...]
Zeile gelöscht : user_pref("{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}.ScriptData_whiteListSearch", "{\"isearch.babylon.com\":\"q\",\"search.imesh.net\":\"q\",\"www.search-results.com\":\"q\",\"home.mywebsearch.com\":\"se[...]

-\\ Google Chrome v

[ Datei : C:\Users\Claudia\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Gelöscht [Search Provider] : hxxp://de.ask.com/web?q={searchTerms}
Gelöscht [Extension] : dmgpbjjcdccinnndjdgmegndbmhbgglb
Gelöscht [Extension] : majjphhgppkndjjkmhhnbgafooenebhd

*************************

AdwCleaner[R0].txt - [24703 octets] - [30/04/2014 13:36:00]
AdwCleaner[S0].txt - [21206 octets] - [30/04/2014 13:37:16]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [21267 octets] ##########

2. JRT:

Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x64
Ran by Claudia on 30.04.2014 at 13:54:39,60
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Myfree Codec
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Myfree Codec
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9
Successfully deleted: [Registry Key] "hkey_current_user\software\microsoft\internet explorer\low rights\elevationpolicy\{a5aa24ea-11b8-4113-95ae-9ed71deaf12a}"



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Users\Claudia\AppData\Roaming\getrighttogo"
Successfully deleted: [Folder] "C:\Program Files (x86)\myfree codec"
Successfully deleted: [Folder] "C:\ProgramData\ask"



~~~ FireFox

Emptied folder: C:\Users\Claudia\AppData\Roaming\mozilla\firefox\profiles\ift3z7in.default\minidumps [81 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 30.04.2014 at 14:00:03,58
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

3. FRST (jetzt hat's geklappt):


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-04-2014 01
Ran by Claudia (administrator) on LITTLESHEEP on 30-04-2014 14:03:34
Running from C:\Users\Claudia\Desktop
Windows 7 Ultimate (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(Creative Technology Ltd) C:\Program Files\Creative\ZEN Media Explorer\CTCheck.exe
() C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
() C:\Program Files (x86)\Vtune\TBPANEL.exe
(1&1 Internet AG) C:\Program Files (x86)\GMX\GMX SMS-Manager\SMSMngr.exe
() C:\Program Files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\BookmarkDAV_client.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\Kies.exe
() C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [CmPCIaudio] => C:\Windows\Syswow64\CMICNFG3.dll [8126464 2009-05-11] (C-Media Corporation)
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [2919168 2010-11-04] (ESET)
HKLM\...\Run: [CTCheck] => C:\Program Files\Creative\ZEN Media Explorer\CTCheck.exe [397312 2007-11-06] (Creative Technology Ltd)
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [362952 2010-03-27] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [444904 2012-09-20] (Adobe Systems Incorporated)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [1797064 2014-03-20] (NVIDIA Corporation)
HKLM\...\Run: [V-bates] => C:\Program Files\V-bates\notifier.exe
HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [5141512 2010-03-27] ()
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-11-28] (Apple Inc.)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-05-07] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-10-25] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152544 2012-12-12] (Apple Inc.)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-09-04] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [BingDesktop] => C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe [2249352 2013-06-20] (Microsoft Corp.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKU\S-1-5-21-1277317880-2460927560-2137772949-1001\...\Run: [TBPanel] => C:\Program Files (x86)\Vtune\TBPanel.exe [2158592 2010-09-02] ()
HKU\S-1-5-21-1277317880-2460927560-2137772949-1001\...\Run: [GMX SMS-Manager] => C:\Program Files (x86)\GMX\GMX SMS-Manager\SMSMngr.exe [3539968 2007-07-19] (1&1 Internet AG)
HKU\S-1-5-21-1277317880-2460927560-2137772949-1001\...\Run: [CTSyncU.exe] => C:\Program Files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe [868352 2007-07-17] ()
HKU\S-1-5-21-1277317880-2460927560-2137772949-1001\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-03-22] (TomTom)
HKU\S-1-5-21-1277317880-2460927560-2137772949-1001\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59872 2012-12-17] (Apple Inc.)
HKU\S-1-5-21-1277317880-2460927560-2137772949-1001\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59872 2012-12-17] (Apple Inc.)
HKU\S-1-5-21-1277317880-2460927560-2137772949-1001\...\Run: [com.apple.dav.bookmarks.daemon] => C:\Program Files (x86)\Common Files\Apple\Internet Services\BookmarkDAV_client.exe [59872 2012-12-17] (Apple Inc.)
HKU\S-1-5-21-1277317880-2460927560-2137772949-1001\...\Run: [KiesPreload] => C:\Program Files (x86)\Samsung\Kies\Kies.exe [1564528 2013-09-04] (Samsung)

==================== Internet (Whitelisted) ====================

ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=hxxp://127.0.0.1:9881
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xC04F32105298CB01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default
FF NewTab: chrome://quick_start/content/index.html
FF Homepage: hxxp://www.google.de/
FF NetworkProxy: "type", 4
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Add to Amazon Wish List Button - C:\Users\Claudia\AppData\Roaming\Mozilla\Firefox\Profiles\ift3z7in.default\Extensions\amznUWL2@amazon.com.xpi [2013-09-15]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-03-30]
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2010-12-10]
FF HKCU\...\SeaMonkey\Extensions: [mozilla_cc@internetdownloadmanager.com] - C:\Users\Claudia\AppData\Roaming\IDM\idmmzcc3

Chrome:
=======
CHR HomePage:
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\pdf.dll No File
CHR Plugin: (2007 Microsoft Office system) - C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (AdobeAAMDetect) - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
CHR Plugin: (Foxit Reader Plugin for Mozilla) - C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U37) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.370.6) - C:\Windows\SysWOW64\npdeployJava1.dll No File
CHR Extension: (Docs) - C:\Users\Claudia\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-03-18]
CHR Extension: (Google Drive) - C:\Users\Claudia\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-03-18]
CHR Extension: (YouTube) - C:\Users\Claudia\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-03-18]
CHR Extension: (Google-Suche) - C:\Users\Claudia\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-03-18]
CHR Extension: (No Name) - C:\Users\Claudia\AppData\Local\Google\Chrome\User Data\Default\Extensions\dmgpbjjcdccinnndjdgmegndbmhbgglb [2014-04-28]
CHR Extension: (No Name) - C:\Users\Claudia\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd [2014-04-28]
CHR Extension: (Google Mail) - C:\Users\Claudia\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-03-18]

==================== Services (Whitelisted) =================

R2 AcrSch2Svc; C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe [1055288 2010-03-27] ()
R2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173192 2013-06-20] (Microsoft Corp.)
S3 EhttpSrv; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [42360 2010-11-04] (ESET)
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [810144 2010-11-04] (ESET)
S2 Mext Guard; "C:\Program Files\V-bates\guardsvc.exe" [X]
S2 WinRST; C:\Program Files (x86)\WinRST\WinRST.exe [X]

==================== Drivers (Whitelisted) ====================

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R3 cmuda3; C:\Windows\System32\drivers\cmudax3.sys [1154560 2009-05-19] (C-Media Inc)
R2 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [170104 2010-09-03] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [141264 2010-07-29] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [171152 2010-07-29] (ESET)
R3 Epfwndis; C:\Windows\System32\DRIVERS\Epfwndis.sys [33632 2010-07-29] (ESET)
R2 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [50624 2010-07-29] (ESET)
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-02-05] ()
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2010-12-25] (Duplex Secure Ltd.)
S3 TBPanel; No ImagePath
R0 tdrpman258; C:\Windows\System32\DRIVERS\tdrpm258.sys [1477728 2010-12-12] (Acronis)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-30 14:03 - 2014-04-30 14:04 - 00020320 _____ () C:\Users\Claudia\Desktop\FRST.txt
2014-04-30 14:03 - 2014-04-30 14:03 - 00000000 ____D () C:\FRST
2014-04-30 14:02 - 2014-04-30 14:03 - 02060800 _____ (Farbar) C:\Users\Claudia\Desktop\FRST64.exe
2014-04-30 13:54 - 2014-04-30 13:54 - 01016261 _____ (Thisisu) C:\Users\Claudia\Desktop\JRT.exe
2014-04-30 13:54 - 2014-04-30 13:54 - 00000000 ____D () C:\Windows\ERUNT
2014-04-30 13:36 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-04-30 13:35 - 2014-04-30 13:38 - 00000000 ____D () C:\AdwCleaner
2014-04-29 23:21 - 2014-04-29 23:21 - 00056121 _____ () C:\ComboFix.txt
2014-04-29 23:08 - 2014-04-29 23:21 - 00000000 ____D () C:\Qoobox
2014-04-29 23:08 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-04-29 23:08 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-04-29 23:08 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-04-29 23:08 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-04-29 23:08 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-04-29 23:08 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-04-29 23:08 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-04-29 23:08 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-04-29 23:07 - 2014-04-29 23:19 - 00000000 ____D () C:\Windows\erdnt
2014-04-28 23:47 - 2014-04-28 23:47 - 00000188 _____ () C:\Users\Claudia\defogger_reenable
2014-04-28 23:22 - 2014-04-28 23:22 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-04-28 23:21 - 2014-04-14 04:24 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-04-28 23:21 - 2014-04-14 04:19 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-04-28 23:07 - 2014-04-30 13:35 - 01310621 _____ () C:\Users\Claudia\Desktop\adwcleaner.exe
2014-04-28 23:04 - 2014-04-28 23:05 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-28 23:03 - 2014-04-28 23:03 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-28 23:03 - 2014-04-28 23:03 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-04-28 23:03 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-28 23:03 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-28 23:03 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-28 23:02 - 2014-04-30 13:33 - 00000000 ____D () C:\Users\Claudia\Desktop\PC-Reinigung
2014-04-28 22:52 - 2014-04-28 22:52 - 00000000 ____D () C:\Users\Claudia\AppData\Local\com
2014-04-28 22:47 - 2014-04-28 22:48 - 00503400 _____ () C:\Users\Claudia\Downloads\Player.exe
2014-04-28 22:47 - 2014-04-28 22:47 - 00357736 _____ () C:\Users\Claudia\Downloads\FlashPlayersetup__4651_i611033000_il7.exe
2014-04-28 22:40 - 2014-04-28 22:40 - 00003626 _____ () C:\Windows\System32\Tasks\Mext Guard FBE8818C-5B13-48C2-A93E-AD731167DBF2
2014-04-28 22:39 - 2014-04-30 13:38 - 00001088 _____ () C:\Users\Claudia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-04-28 22:39 - 2014-04-28 22:40 - 20914176 _____ () C:\Users\Claudia\Downloads\uPlayer.msi
2014-04-28 22:37 - 2014-04-28 22:37 - 00623696 _____ () C:\Users\Claudia\Downloads\uplayermediaplayer-setup.exe
2014-04-23 14:40 - 2014-04-23 14:40 - 00695040 _____ ( ) C:\Users\Claudia\Downloads\FlvPlayerSetup.exe
2014-04-19 02:09 - 2014-04-19 02:09 - 00001817 _____ () C:\Users\Claudia\Desktop\Total Videoconverter.lnk
2014-04-19 02:08 - 2014-04-19 02:08 - 00000000 ____D () C:\Users\Claudia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bigasoft
2014-04-19 02:08 - 2014-04-19 02:08 - 00000000 ____D () C:\Users\Claudia\AppData\Roaming\Bigasoft Total Video Converter 4
2014-04-19 02:07 - 2014-04-19 02:07 - 00000000 ____D () C:\Program Files (x86)\Bigasoft
2014-04-19 01:48 - 2014-04-19 01:48 - 00005081 _____ () C:\ProgramData\hnbdehzc.pfe
2014-04-19 01:46 - 2014-04-19 01:46 - 36769328 _____ () C:\Users\Claudia\Downloads\VideoConverterSetup.exe
2014-04-19 00:31 - 2014-04-19 02:29 - 00000000 ____D () C:\Program Files\rrsavings
2014-04-19 00:30 - 2014-04-19 00:30 - 00000000 ____D () C:\Program Files\002
2014-04-19 00:28 - 2014-04-19 00:28 - 00929416 _____ (CNET Download.com) C:\Users\Claudia\Downloads\WMV_to_MP4_Converter-ORG-75903117.exe
2014-04-19 00:10 - 2014-04-19 00:31 - 00000000 ____D () C:\Program Files\DivX
2014-04-19 00:10 - 2014-04-19 00:10 - 00000000 ____D () C:\Users\Claudia\AppData\Roaming\DivX
2014-04-19 00:08 - 2014-04-19 00:31 - 00000000 ____D () C:\ProgramData\DivX
2014-04-19 00:06 - 2014-04-19 00:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DivX
2014-04-19 00:06 - 2014-04-19 00:14 - 00000000 ____D () C:\Users\Claudia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DivX
2014-04-19 00:06 - 2014-04-19 00:06 - 00000000 ____D () C:\Users\Claudia\.drdivx2
2014-04-18 22:55 - 2014-04-18 23:04 - 00000000 ____D () C:\ProgramData\WPM
2014-04-18 22:55 - 2014-04-18 22:55 - 00000000 ____D () C:\ProgramData\IePluginService
2014-04-18 22:44 - 2014-04-18 22:44 - 00003060 _____ () C:\Windows\System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe
2014-04-18 22:44 - 2014-04-18 22:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft-Maus- und Tastatur-Center
2014-04-18 22:43 - 2014-04-18 22:43 - 00000000 ____D () C:\Program Files\Microsoft Mouse and Keyboard Center
2014-04-18 22:43 - 2014-03-06 12:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-18 22:43 - 2014-03-06 11:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-18 22:43 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-18 22:43 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-18 22:43 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-18 22:43 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-18 22:43 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-18 22:43 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-18 22:43 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-18 22:43 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-18 22:43 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-18 22:43 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-18 22:43 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-18 22:43 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-18 22:43 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-18 22:43 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-18 22:43 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-18 22:43 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-18 22:43 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-18 22:43 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-18 22:43 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-18 22:43 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-18 22:43 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-18 22:43 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-18 22:43 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-18 22:43 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-18 22:43 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-18 22:43 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-18 22:43 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-18 22:43 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-18 22:43 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-18 22:43 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-18 22:43 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-18 22:43 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-18 22:43 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-18 22:43 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-18 22:43 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-18 22:43 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-18 22:43 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-18 22:43 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-18 22:43 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-18 22:43 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-18 22:43 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-18 22:43 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-18 22:42 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-18 22:42 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-18 22:42 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-18 22:42 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-18 22:35 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-18 22:35 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-18 22:35 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-18 22:35 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-18 22:35 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-18 22:35 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-18 22:35 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-18 22:35 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-18 22:35 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-18 22:35 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-18 22:35 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-18 22:35 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-18 22:35 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-18 22:35 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-18 22:35 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-18 22:35 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-18 22:34 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-07 14:36 - 2014-04-07 14:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation

==================== One Month Modified Files and Folders =======

2014-04-30 14:04 - 2014-04-30 14:03 - 00020320 _____ () C:\Users\Claudia\Desktop\FRST.txt
2014-04-30 14:03 - 2014-04-30 14:03 - 00000000 ____D () C:\FRST
2014-04-30 14:03 - 2014-04-30 14:02 - 02060800 _____ (Farbar) C:\Users\Claudia\Desktop\FRST64.exe
2014-04-30 13:59 - 2012-03-29 19:10 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-30 13:56 - 2009-07-14 06:45 - 00014608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-30 13:56 - 2009-07-14 06:45 - 00014608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-30 13:54 - 2014-04-30 13:54 - 01016261 _____ (Thisisu) C:\Users\Claudia\Desktop\JRT.exe
2014-04-30 13:54 - 2014-04-30 13:54 - 00000000 ____D () C:\Windows\ERUNT
2014-04-30 13:49 - 2011-09-04 19:06 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-30 13:49 - 2010-12-10 12:19 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-04-30 13:49 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-30 13:49 - 2009-07-14 06:51 - 00089375 _____ () C:\Windows\setupact.log
2014-04-30 13:47 - 2010-12-10 11:51 - 01708560 _____ () C:\Windows\WindowsUpdate.log
2014-04-30 13:46 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-30 13:40 - 2010-12-10 12:23 - 00095366 _____ () C:\Windows\PFRO.log
2014-04-30 13:38 - 2014-04-30 13:35 - 00000000 ____D () C:\AdwCleaner
2014-04-30 13:38 - 2014-04-28 22:39 - 00001088 _____ () C:\Users\Claudia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-04-30 13:38 - 2010-12-10 11:57 - 00000000 ___RD () C:\Users\Claudia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-30 13:38 - 2010-12-10 11:56 - 00000000 ____D () C:\Users\Claudia
2014-04-30 13:35 - 2014-04-28 23:07 - 01310621 _____ () C:\Users\Claudia\Desktop\adwcleaner.exe
2014-04-30 13:33 - 2014-04-28 23:02 - 00000000 ____D () C:\Users\Claudia\Desktop\PC-Reinigung
2014-04-29 23:21 - 2014-04-29 23:21 - 00056121 _____ () C:\ComboFix.txt
2014-04-29 23:21 - 2014-04-29 23:08 - 00000000 ____D () C:\Qoobox
2014-04-29 23:19 - 2014-04-29 23:07 - 00000000 ____D () C:\Windows\erdnt
2014-04-29 23:19 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-04-29 23:17 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-29 22:49 - 2011-09-04 19:06 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-29 21:40 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-29 20:37 - 2012-06-21 21:14 - 00000000 ____D () C:\Users\Claudia\AppData\Local\CrashDumps
2014-04-28 23:59 - 2012-03-29 19:10 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-28 23:59 - 2012-03-29 19:10 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-28 23:59 - 2011-05-15 19:53 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-28 23:47 - 2014-04-28 23:47 - 00000188 _____ () C:\Users\Claudia\defogger_reenable
2014-04-28 23:22 - 2014-04-28 23:22 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-04-28 23:05 - 2014-04-28 23:04 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-28 23:03 - 2014-04-28 23:03 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-28 23:03 - 2014-04-28 23:03 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-04-28 22:52 - 2014-04-28 22:52 - 00000000 ____D () C:\Users\Claudia\AppData\Local\com
2014-04-28 22:48 - 2014-04-28 22:47 - 00503400 _____ () C:\Users\Claudia\Downloads\Player.exe
2014-04-28 22:47 - 2014-04-28 22:47 - 00357736 _____ () C:\Users\Claudia\Downloads\FlashPlayersetup__4651_i611033000_il7.exe
2014-04-28 22:40 - 2014-04-28 22:40 - 00003626 _____ () C:\Windows\System32\Tasks\Mext Guard FBE8818C-5B13-48C2-A93E-AD731167DBF2
2014-04-28 22:40 - 2014-04-28 22:39 - 20914176 _____ () C:\Users\Claudia\Downloads\uPlayer.msi
2014-04-28 22:37 - 2014-04-28 22:37 - 00623696 _____ () C:\Users\Claudia\Downloads\uplayermediaplayer-setup.exe
2014-04-28 22:37 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Resources
2014-04-23 14:40 - 2014-04-23 14:40 - 00695040 _____ ( ) C:\Users\Claudia\Downloads\FlvPlayerSetup.exe
2014-04-19 02:39 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-19 02:33 - 2012-03-29 21:26 - 00000000 ____D () C:\Users\Claudia\AppData\Local\Adobe
2014-04-19 02:29 - 2014-04-19 00:31 - 00000000 ____D () C:\Program Files\rrsavings
2014-04-19 02:09 - 2014-04-19 02:09 - 00001817 _____ () C:\Users\Claudia\Desktop\Total Videoconverter.lnk
2014-04-19 02:08 - 2014-04-19 02:08 - 00000000 ____D () C:\Users\Claudia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bigasoft
2014-04-19 02:08 - 2014-04-19 02:08 - 00000000 ____D () C:\Users\Claudia\AppData\Roaming\Bigasoft Total Video Converter 4
2014-04-19 02:07 - 2014-04-19 02:07 - 00000000 ____D () C:\Program Files (x86)\Bigasoft
2014-04-19 01:58 - 2010-12-11 20:48 - 00000000 ____D () C:\Program Files (x86)\JDownloader
2014-04-19 01:48 - 2014-04-19 01:48 - 00005081 _____ () C:\ProgramData\hnbdehzc.pfe
2014-04-19 01:46 - 2014-04-19 01:46 - 36769328 _____ () C:\Users\Claudia\Downloads\VideoConverterSetup.exe
2014-04-19 00:31 - 2014-04-19 00:10 - 00000000 ____D () C:\Program Files\DivX
2014-04-19 00:31 - 2014-04-19 00:08 - 00000000 ____D () C:\ProgramData\DivX
2014-04-19 00:31 - 2014-04-19 00:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DivX
2014-04-19 00:30 - 2014-04-19 00:30 - 00000000 ____D () C:\Program Files\002
2014-04-19 00:28 - 2014-04-19 00:28 - 00929416 _____ (CNET Download.com) C:\Users\Claudia\Downloads\WMV_to_MP4_Converter-ORG-75903117.exe
2014-04-19 00:20 - 2010-12-12 14:22 - 00000000 ____D () C:\Users\Claudia\AppData\Roaming\vlc
2014-04-19 00:14 - 2014-04-19 00:06 - 00000000 ____D () C:\Users\Claudia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DivX
2014-04-19 00:11 - 2014-03-30 14:51 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-04-19 00:10 - 2014-04-19 00:10 - 00000000 ____D () C:\Users\Claudia\AppData\Roaming\DivX
2014-04-19 00:06 - 2014-04-19 00:06 - 00000000 ____D () C:\Users\Claudia\.drdivx2
2014-04-18 23:04 - 2014-04-18 22:55 - 00000000 ____D () C:\ProgramData\WPM
2014-04-18 22:55 - 2014-04-18 22:55 - 00000000 ____D () C:\ProgramData\IePluginService
2014-04-18 22:44 - 2014-04-18 22:44 - 00003060 _____ () C:\Windows\System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe
2014-04-18 22:44 - 2014-04-18 22:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft-Maus- und Tastatur-Center
2014-04-18 22:44 - 2013-07-11 19:58 - 00003062 _____ () C:\Windows\System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe
2014-04-18 22:44 - 2012-12-24 21:16 - 00003118 _____ () C:\Windows\System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe
2014-04-18 22:44 - 2010-12-16 15:42 - 00003090 _____ () C:\Windows\System32\Tasks\Microsoft_Hardware_Launch_itype_exe
2014-04-18 22:44 - 2010-12-16 15:32 - 00003092 _____ () C:\Windows\System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe
2014-04-18 22:43 - 2014-04-18 22:43 - 00000000 ____D () C:\Program Files\Microsoft Mouse and Keyboard Center
2014-04-18 22:42 - 2010-12-12 15:50 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-18 22:40 - 2013-08-18 21:13 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-18 22:38 - 2010-12-16 15:08 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-18 22:27 - 2009-07-14 19:58 - 00699432 _____ () C:\Windows\system32\perfh007.dat
2014-04-18 22:27 - 2009-07-14 19:58 - 00149572 _____ () C:\Windows\system32\perfc007.dat
2014-04-18 22:27 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-18 22:22 - 2012-05-19 13:21 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-04-14 04:24 - 2014-04-28 23:21 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-04-14 04:19 - 2014-04-28 23:21 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-04-07 14:44 - 2011-09-04 19:06 - 00004108 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-07 14:44 - 2011-09-04 19:06 - 00003856 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-04-07 14:36 - 2014-04-07 14:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2014-04-07 14:34 - 2009-07-14 06:45 - 04939000 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-04-07 14:33 - 2012-05-13 21:02 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-04-07 14:33 - 2012-05-13 21:02 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-04-03 09:51 - 2014-04-28 23:03 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-04-28 23:03 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-04-28 23:03 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-03-31 09:35 - 2010-12-10 12:11 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

Some content of TEMP:
====================
C:\Users\Claudia\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-29 21:32

==================== End Of Log ============================
--- --- ---



und die Additions:

Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 30-04-2014 01
Ran by Claudia at 2014-04-30 14:09:38
Running from C:\Users\Claudia\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: ESET Smart Security 4.2 (Disabled - Up to date) {77DEAFED-8149-104B-25A1-21771CA47CD1}
AS: ESET Smart Security 4.2 (Disabled - Up to date) {CCBF4E09-A773-1FC5-1F11-1A056723366C}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: ESET Personal Firewall (Disabled) {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}

==================== Installed Programs ======================

 Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version:  - Microsoft)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Acronis*True*Image*Home (HKLM-x32\...\{67ED38A3-4882-448B-B44D-3428AB00D7D5}) (Version: 13.0.7046 - Acronis)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 4.0.0.1390 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 4.0.0.1390 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.206 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.206 - Adobe Systems Incorporated)
Adobe Photoshop CS6 (HKLM-x32\...\{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}) (Version: 13.0 - Adobe Systems Incorporated)
Adobe Photoshop Lightroom 4.1 64-bit (HKLM\...\{F7ADB493-B913-4D61-9A63-DA736C20C3F2}) (Version: 4.1.2 - Adobe)
Apple Application Support (HKLM-x32\...\{CCE825DB-347A-4004-A186-5F4A6FDD8547}) (Version: 2.3.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{D70884EA-E2CE-4539-91DB-4766CC1E5F5F}) (Version: 6.0.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Audacity 1.3.12 (Unicode) (HKLM-x32\...\Audacity 1.3 Beta (Unicode)_is1) (Version:  - Audacity Team)
AudibleManager (HKLM-x32\...\AudibleManager) (Version: 2001678000.48.56.9243882 - Audible, Inc.)
Bigasoft Total Video Converter 4.2.1.5186 (HKLM-x32\...\{A72CE741-1F32-4D79-BFFB-A714375C678D}_is1) (Version:  - Bigasoft Corporation)
Bing Bar (HKLM-x32\...\{77F8A71E-3515-4832-B8B2-2F1EDBD2E0F1}) (Version: 7.0.609.0 - Microsoft Corporation)
Bing-Desktop (HKLM-x32\...\{7D095455-D971-4D4C-9EFD-9AF6A6584F3A}) (Version: 1.3.171.0 - Microsoft Corporation)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
BurnAware Free 6.9.2 (HKLM-x32\...\BurnAware Free_is1) (Version:  - Burnaware)
calibre (HKLM-x32\...\{4105BF5B-1DC2-4EEF-88AF-3C9EAF69827F}) (Version: 0.8.39 - Kovid Goyal)
CDex - Open Source Digital Audio CD Extractor (HKLM-x32\...\CDex) (Version: 1.70.4.2009 - Georgy Berdyshev)
Classic Shell (HKLM\...\{82083946-B6A5-4027-BA4D-0A15963F26EB}) (Version: 2.9.0 - IvoSoft)
C-Media PCI Audio Device (HKLM\...\C-Media PCI Audio Driver) (Version:  - )
Corel PaintShop Pro X4 (HKLM-x32\...\_{00580795-581C-4587-B9F2-37320D7AB37F}) (Version: 14.0.0.332 - Corel Corporation)
Corel PaintShop Pro X4 (x32 Version: 14.0.0.332 - Corel Corporation) Hidden
CutePDF Writer 2.8 (HKLM\...\CutePDF Writer Installation) (Version:  - )
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
dBpoweramp [Calculate Audio CRC] Codec (HKLM-x32\...\dBpoweramp [Calculate Audio CRC] Codec) (Version:  - )
dBpoweramp Dalet Codec (HKLM-x32\...\dBpoweramp Dalet Codec) (Version:  - )
dBpoweramp DirectShow Decoder (HKLM-x32\...\dBpoweramp DirectShow Decoder) (Version: Release 2 - Illustrate)
dBpoweramp DSP Effects (HKLM-x32\...\dBpoweramp DSP Effects) (Version: Release 6 - Illustrate)
dBpoweramp FLAC Codec (HKLM-x32\...\dBpoweramp FLAC Codec) (Version: Release 12 (FLAC 1.2.1) - Illustrate)
dBpoweramp Monkeys Audio Codec (HKLM-x32\...\dBpoweramp Monkeys Audio Codec) (Version:  - )
dBpoweramp Mp2 and BwfMp2 codec (HKLM-x32\...\dBpoweramp Mp2 and BwfMp2 codec) (Version:  - )
dBpoweramp mp3 (Fraunhofer IIS) Codec (HKLM-x32\...\dBpoweramp mp3 (Fraunhofer IIS) Codec) (Version: Release 2a (v4.0.3) - Illustrate)
dBpoweramp Music Converter (HKLM-x32\...\dBpoweramp Music Converter) (Version: Release 13.5 - Illustrate)
dBpoweramp Ogg Vorbis Codec (HKLM-x32\...\dBpoweramp Ogg Vorbis Codec) (Version: Release 19 (Vorbis v1.2.0) - Illustrate)
dBpoweramp Real Audio (Helix) Encoder (HKLM-x32\...\dBpoweramp Real Audio (Helix) Encoder) (Version:  - )
dBPoweramp tooLame MP2 codec (HKLM-x32\...\dBPoweramp tooLame MP2 codec) (Version:  - )
dBpoweramp Wave64 Codec (HKLM-x32\...\dBpoweramp Wave64 Codec) (Version:  - )
dBpoweramp WavPack Codec (HKLM-x32\...\dBpoweramp WavPack Codec) (Version:  - )
Direct MP3 Joiner version 3.0.2.9 (HKLM-x32\...\Direct MP3 Joiner_is1) (Version: 3.0.2.9 - Piston Software)
ESET Smart Security (HKLM\...\{9D34D4CB-AF07-47AC-8A26-0AC085A4D8B5}) (Version: 4.2.67.10 - ESET, spol. s r.o.)
Exif-Viewer 2.51  (HKLM-x32\...\Exif-Viewer) (Version: 2.51 - Ralf Bibinger)
File Renamer - Basic (HKLM-x32\...\File Renamer - Basic) (Version: 6.3 - Sherrod Computers)
foobar2000 v1.1.1 (HKLM-x32\...\foobar2000) (Version: 1.1.1 - Peter Pawlowski)
Foxit PDF Editor (HKLM-x32\...\Foxit PDF Editor) (Version: 2.2.1.1102 - Foxit Corporation)
Foxit Reader (HKLM-x32\...\Foxit Reader) (Version: 4.3.0.1110 - Foxit Corporation)
Freeven pro 1.2 (HKLM-x32\...\Freeven pro 1.2) (Version: 1.34.4.10 - Freeven) <==== ATTENTION
GIMP 2.8.0 (HKLM\...\GIMP-2_is1) (Version: 2.8.0 - The GIMP Team)
GMX ProfiFax (HKLM-x32\...\GMX ProfiFax) (Version: 2.00.222 - GMX GmbH)
GMX SMS-Manager (HKLM-x32\...\com.unitedinternet.ums.sms-mms-manager) (Version: 2.1 - 1 und 1 Internet AG)
GMX SMS-Manager (HKLM-x32\...\GMX SMS-Manager) (Version:  - )
GMX SMS-Manager (x32 Version: 2.1 - 1 und 1 Internet AG) Hidden
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.23.9 - Google Inc.) Hidden
ICA (x32 Version: 14.0.0.332 - Corel Corporation) Hidden
iCloud (HKLM\...\{D0CB24F4-084F-40DE-B6B9-A03626E682F0}) (Version: 2.1.1.3 - Apple Inc.)
IPM_PSP_COM (x32 Version: 14.0.0.332 - Corel Corporation) Hidden
iTunes (HKLM\...\{0E5D76AD-A3FB-48D5-8400-8903B10317D3}) (Version: 11.0.1.12 - Apple Inc.)
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
JDownloader (HKLM-x32\...\JDownloader) (Version:  - AppWork UG (haftungsbeschränkt))
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LingoPad 2.6 (Build 360) (HKLM-x32\...\LingoPad_is1) (Version: 2.6 - Lingo4you)
Magic DVD Copier V6.0.0 (HKLM-x32\...\Magic DVD Copier_is1) (Version:  - Magic DVD Software, Inc.)
Magic DVD Ripper V6.0.0 (HKLM-x32\...\Magic DVD Ripper_is1) (Version:  - Magic DVD Software, Inc.)
Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (Version: 2.3.188.0 - Microsoft Corporation) Hidden
Mozilla Firefox 28.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 24.4.0 - Mozilla)
Mozilla Thunderbird 24.4.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.4.0 (x86 de)) (Version: 24.4.0 - Mozilla)
Mp3 Merger V1.0 (HKLM-x32\...\Mp3 Merger_is1) (Version:  - Pickmp3.com, Inc.)
Mp3 Tag Assistant Pro v2.94 (HKLM-x32\...\Mp3 Tag Assistant Pro_is1) (Version: 2.94 - AssistantTools.com)
Mp3tag v2.58 (HKLM-x32\...\Mp3tag) (Version: v2.58 - Florian Heidenreich)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MyFreeCodec (HKCU\...\MyFreeCodec) (Version:  - )
MyMicroBalance (HKLM-x32\...\{E0AF0831-F950-4805-A7D3-2FE85C9F5E84}) (Version: 2.1.2 - Trusted Bytes)
Napster 5 Beta (HKLM-x32\...\com.Rhapsody.Napster5) (Version: 1.0.65 - Rhapsody International, Inc)
Napster 5 Beta (x32 Version: 1.0.65 - Rhapsody International, Inc) Hidden
Napster Rienf Repair (HKLM-x32\...\{7FF8A00B-5FA7-4BD4-A6B9-131CE0D1FC11}) (Version: 1.1.9 - NA)
NVIDIA 3D Vision Treiber 335.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 335.23 - NVIDIA Corporation)
NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 6.14.12.5936 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.62.40 - NVIDIA Corporation)
NVIDIA Grafiktreiber 335.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 335.23 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.145.1024 - NVIDIA Corporation) Hidden
NVIDIA PhysX (HKLM-x32\...\{8A809006-C25A-4A3A-9DAB-94659BCDB107}) (Version: 9.10.0224 - NVIDIA Corporation)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3523 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 335.23 (Version: 335.23 - NVIDIA Corporation) Hidden
NVIDIA Update 10.4.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 10.4.0 - NVIDIA Corporation)
NVIDIA Update Components (Version: 1.15.2 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 10.4.0 - NVIDIA Corporation) Hidden
OverDrive Media Console (HKLM-x32\...\{D4AFC7AD-F637-4EDD-BC76-767E4AF78CE1}) (Version: 3.2.5 - OverDrive, Inc.)
PDF Settings CS6 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
PSPPContent (x32 Version: 14.0.0.332 - Corel Corporation) Hidden
PSPPHelp (x32 Version: 14.0.0.332 - Corel Corporation) Hidden
PSPPro64 (Version: 14.0.0.332 - Corel Corporation) Hidden
QuickTime (HKLM-x32\...\{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}) (Version: 7.73.80.64 - Apple Inc.)
RapidShare Manager (HKLM-x32\...\RapidShare Manager) (Version: 0.1 - RapidShare AG)
Rosetta Stone Version 3 (HKLM-x32\...\{99011A6E-5200-11DE-BDB8-7ACD56D89593}) (Version: 3.4.5.0 - Rosetta Stone Ltd.)
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.5.1.12123_2 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.5.1.12123_2 - Samsung Electronics Co., Ltd.) Hidden
Samsung Story Album Viewer (HKLM-x32\...\InstallShield_{698BBAD8-B116-495D-B879-0F07A533E57F}) (Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.)
Samsung Story Album Viewer (x32 Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.27.0 - SAMSUNG Electronics Co., Ltd.)
Setup (x32 Version: 14.0.0.332 - Ihr Firmenname) Hidden
Sleeptracker Pro 1.0.2 (HKLM-x32\...\Sleeptracker Pro 1.0.2_is1) (Version:  - Sleeptracker)
SUPER © Version 2010.bld.42 (Nov 7, 2010) (HKLM-x32\...\SUPER ©) (Version: Version 2010.bld.42 (Nov 7, 2010) - eRightSoft)
Tipard MTS Converter 6.1.22 (HKLM-x32\...\{AD64A17A-B824-4528-BEAE-EF724C738753}_is1) (Version:  - )
TomTom HOME (HKLM-x32\...\{EC5F4C1B-F838-4CB7-8561-8F809296428B}) (Version: 2.9.5 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6FAA03BD-2B51-4029-9AD9-64A3B8E3C84C}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
V-bates 2.0.0.440 (HKLM\...\{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}_is1) (Version: 2.0.0.440 - Wajamu) <==== ATTENTION
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VideoConverter (HKLM-x32\...\VideoConverter) (Version: ${VERSION} - )
VLC media player 1.1.5 (HKLM-x32\...\VLC media player) (Version: 1.1.5 - VideoLAN)
Vtune 7.13 (HKLM-x32\...\MySSID_is1) (Version:  - )
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger Companion Core (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WinRAR (HKLM\...\WinRAR archiver) (Version:  - )
Winsome File Renamer 7.1 (HKLM-x32\...\{FD9B68EA-2531-4056-BF98-93171264C85C}_is1) (Version:  - Winsome Technologies)
Wondershare Photo Collage Studio 4.2.9.2 (HKLM-x32\...\Wondershare Photo Collage Studio_is1) (Version: 4.2.9.2 - Wondershare Software Co.,Ltd.)
Yahoo Community Smartbar (HKLM-x32\...\{D96EBFC0-C680-4463-B4F0-299E48771819}) (Version: 11.38.66.16134 - Linkury Inc.) <==== ATTENTION
ZEN Media Explorer (HKLM-x32\...\ZEN (MTP) Media Explorer) (Version:  - )

==================== Restore Points  =========================

07-04-2014 12:42:00 Windows Update
18-04-2014 20:35:26 Windows Update
23-04-2014 11:35:38 Windows Update
26-04-2014 19:44:23 Windows Update
28-04-2014 20:49:46 Uniblue SpeedUpMyPC installation
28-04-2014 20:51:39 Removed uPlayer
28-04-2014 21:21:32 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:34 - 2014-04-29 23:19 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1      localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {001E5314-59B2-443A-937E-9B5709EFB3CB} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {0314821E-8E5E-4409-A2CB-BCCC4073B676} - \923e656c-7931-4c44-9b19-6d3c00ebfbd9-2 No Task File <==== ATTENTION
Task: {07DE25F2-7E4D-4FA4-BA6C-911FA1E246DC} - System32\Tasks\Mext Guard FBE8818C-5B13-48C2-A93E-AD731167DBF2 => C:\Program Files\V-bates\startsc.bat
Task: {08EC88C4-0FE6-47A1-9268-1D2F3BC113D7} - \923e656c-7931-4c44-9b19-6d3c00ebfbd9-3 No Task File <==== ATTENTION
Task: {0B58C212-AE1E-4A17-92B5-DDE10A469E46} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {18FFAEFB-9955-4965-BEB2-3A1910B11B41} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {1C56263B-5089-4E70-A25E-1D9B5155480B} - \14ecb001-f416-4a5e-b100-cc6e315349af-3 No Task File <==== ATTENTION
Task: {20EF1A63-AC11-428B-85C6-34F3F9094508} - \14ecb001-f416-4a5e-b100-cc6e315349af-2 No Task File <==== ATTENTION
Task: {2C155A01-639A-4494-81DD-74A65959B838} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {466B89A4-56FA-4E89-9D3E-E0368985B925} - System32\Tasks\Microsoft_Hardware_Launch_devicecenter_exe => C:\Program Files\Microsoft Device Center\devicecenter.exe
Task: {54E5FEA7-105F-46CB-93ED-FF4E8194ABE6} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {6FF2B5D6-5FBE-480D-A836-A3822A547C89} - \14ecb001-f416-4a5e-b100-cc6e315349af-1 No Task File <==== ATTENTION
Task: {703617EF-0F4F-4D43-8E3F-4323A89FA5B0} - \14ecb001-f416-4a5e-b100-cc6e315349af-4 No Task File <==== ATTENTION
Task: {717387C9-19EC-4302-891B-3EAC188C5A0A} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {86A6AC0B-FF59-416C-9D12-EB9ECC212276} - \923e656c-7931-4c44-9b19-6d3c00ebfbd9-5 No Task File <==== ATTENTION
Task: {8973D0D8-320E-4778-B510-9AE108F449D8} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-09-04] (Google Inc.)
Task: {938A57A4-BB70-4AE7-83F9-C02EBD615EB5} - \14ecb001-f416-4a5e-b100-cc6e315349af-5 No Task File <==== ATTENTION
Task: {9B8DD772-700E-4020-886C-5A7FC3AE8B1D} - \Scheduled Update for Ask Toolbar No Task File <==== ATTENTION
Task: {AAA58B2A-044F-49A1-B1E0-562BC64260E2} - \923e656c-7931-4c44-9b19-6d3c00ebfbd9-4 No Task File <==== ATTENTION
Task: {AD5C6214-E148-4BE7-B540-35FC103A2420} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2014-03-19] (Microsoft)
Task: {BB5D9224-2BAF-4B2A-B974-F918EF613A48} - \923e656c-7931-4c44-9b19-6d3c00ebfbd9-1 No Task File <==== ATTENTION
Task: {CBB510B6-01DD-41D3-A29C-2837C7F6D10C} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-28] (Adobe Systems Incorporated)
Task: {DDCADAAB-24A5-432F-A997-CD6B596FCDAC} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-09-04] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2012-11-15 23:11 - 2014-03-04 15:05 - 00116056 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2010-12-10 22:30 - 2009-11-05 08:40 - 00085504 _____ () C:\Windows\System32\cpwmon64.dll
2010-03-27 19:39 - 2010-03-27 19:39 - 01055288 _____ () C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
2010-03-27 19:39 - 2010-03-27 19:39 - 00362952 _____ () C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
2010-12-10 12:14 - 2010-09-02 11:59 - 02158592 _____ () C:\Program Files (x86)\Vtune\TBPANEL.exe
2010-12-11 21:12 - 2007-07-17 12:03 - 00868352 ____N () C:\Program Files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe
2010-03-27 19:38 - 2010-03-27 19:38 - 05141512 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
2010-03-27 19:40 - 2010-03-27 19:40 - 01211120 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll
2011-02-18 18:08 - 2010-03-15 12:28 - 00166400 _____ () C:\Program Files\WinRAR\rarext.dll
2012-12-17 18:14 - 2012-12-17 18:14 - 00954848 _____ () C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll
2011-06-24 22:56 - 2011-06-24 22:56 - 00087328 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2011-06-24 22:56 - 2011-06-24 22:56 - 01241888 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2010-12-10 12:14 - 1998-10-31 05:55 - 00005120 _____ () C:\Program Files (x86)\Vtune\TBManage.dll
2010-12-11 21:12 - 2007-03-29 11:49 - 00192512 ____N () C:\Program Files (x86)\Creative\Sync Manager Unicode\CTSyncRs.crl
2010-03-27 17:30 - 2010-03-27 17:30 - 00279904 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\Common\resource.dll
2010-03-27 16:13 - 2010-03-27 16:13 - 00019808 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\Common\thread_pool.dll
2010-03-27 16:14 - 2010-03-27 16:14 - 00028512 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\Common\rpc_client.dll
2014-03-30 14:21 - 2014-03-30 14:21 - 03642480 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-04-29 23:17:52.068
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-04-29 23:17:51.761
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-02-15 23:08:32.354
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-02-15 23:08:32.232
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-02-15 23:08:29.698
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-02-15 23:08:29.569
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-02-15 23:08:27.210
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-02-15 23:08:27.083
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-02-15 23:08:24.678
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-02-15 23:08:24.551
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info ===========================

Percentage of memory in use: 25%
Total physical RAM: 8191.23 MB
Available physical RAM: 6115.63 MB
Total Pagefile: 16380.63 MB
Available Pagefile: 14261.04 MB
Total Virtual: 8192 MB
Available Virtual: 8191.77 MB

==================== Drives ================================

Drive c: (Win 7) (Fixed) (Total:537.11 GB) (Free:401.35 GB) NTFS
Drive d: (XP) (Fixed) (Total:225.39 GB) (Free:220.26 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (Daten) (Fixed) (Total:634.76 GB) (Free:634.16 GB) NTFS
Drive g: (Western Digital) (Fixed) (Total:465.75 GB) (Free:227.77 GB) NTFS
Drive h: (RANGER) (Fixed) (Total:931.28 GB) (Free:89.26 GB) FAT32
Drive i: (Elements) (Fixed) (Total:931.28 GB) (Free:333.08 GB) FAT32
Drive j: (Final Destination) (Fixed) (Total:1863.02 GB) (Free:890.17 GB) NTFS
Drive m: (Backup) (Fixed) (Total:298.09 GB) (Free:144.86 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 1397 GB) (Disk ID: 00000001)
Partition 1: (Active) - (Size=225 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=537 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=635 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 1863 GB) (Disk ID: 0017374A)
Partition 1: (Not Active) - (Size=-198625370112) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows XP) (Size: 298 GB) (Disk ID: FF85D174)
Partition 1: (Not Active) - (Size=298 GB) - (Type=07 NTFS)

========================================================
Disk: 3 (Size: 466 GB) (Disk ID: 8D399BC0)
Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)

========================================================
Disk: 4 (Size: 932 GB) (Disk ID: E8900690)
Partition 1: (Not Active) - (Size=932 GB) - (Type=0C)

========================================================
Disk: 5 (Size: 932 GB) (Disk ID: 469D60DF)
Partition 1: (Not Active) - (Size=932 GB) - (Type=0C)

==================== End Of Log ============================

cosinus 30.04.2014 13:50
Code:
ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=http://127.0.0.1:9881
S2 Mext Guard; "C:\Program Files\V-bates\guardsvc.exe" [X]
C:\Program Files\V-bates
S2 WinRST; C:\Program Files (x86)\WinRST\WinRST.exe [X]
C:\Program Files (x86)\WinRST
S3 TBPanel; No ImagePath
C:\ProgramData\hnbdehzc.pfe
C:\Users\Claudia\Downloads\VideoConverterSetup.exe
C:\Program Files\rrsavings
C:\Program Files\002
Task: {0314821E-8E5E-4409-A2CB-BCCC4073B676} - \923e656c-7931-4c44-9b19-6d3c00ebfbd9-2 No Task File <==== ATTENTION
Task: {08EC88C4-0FE6-47A1-9268-1D2F3BC113D7} - \923e656c-7931-4c44-9b19-6d3c00ebfbd9-3 No Task File <==== ATTENTION
Task: {1C56263B-5089-4E70-A25E-1D9B5155480B} - \14ecb001-f416-4a5e-b100-cc6e315349af-3 No Task File <==== ATTENTION
Task: {20EF1A63-AC11-428B-85C6-34F3F9094508} - \14ecb001-f416-4a5e-b100-cc6e315349af-2 No Task File <==== ATTENTION
Task: {6FF2B5D6-5FBE-480D-A836-A3822A547C89} - \14ecb001-f416-4a5e-b100-cc6e315349af-1 No Task File <==== ATTENTION
Task: {703617EF-0F4F-4D43-8E3F-4323A89FA5B0} - \14ecb001-f416-4a5e-b100-cc6e315349af-4 No Task File <==== ATTENTION
Task: {86A6AC0B-FF59-416C-9D12-EB9ECC212276} - \923e656c-7931-4c44-9b19-6d3c00ebfbd9-5 No Task File <==== ATTENTION
Task: {938A57A4-BB70-4AE7-83F9-C02EBD615EB5} - \14ecb001-f416-4a5e-b100-cc6e315349af-5 No Task File <==== ATTENTION
Task: {9B8DD772-700E-4020-886C-5A7FC3AE8B1D} - \Scheduled Update for Ask Toolbar No Task File <==== ATTENTION
Task: {AAA58B2A-044F-49A1-B1E0-562BC64260E2} - \923e656c-7931-4c44-9b19-6d3c00ebfbd9-4 No Task File <==== ATTENTION
Task: {BB5D9224-2BAF-4B2A-B974-F918EF613A48} - \923e656c-7931-4c44-9b19-6d3c00ebfbd9-1 No Task File <==== ATTENTION

littlesheep 01.05.2014 20:16
Was sagt mir das?

Dann lasse ich jetzt doch die anderen Programme nochmal laufen bzw. mach das Defogger "rückgängig" und das Deinstallieren von dem Combofix und installiere die anderen Programme, die in dem anderen Post von dem Kollegen empfohlen wurden zum regelmäßigen Checken, oder? Die anderen kleinen Problemchen, die jetzt durch die Aktionen auftreten, gucke ich mir dann später an (Internetverbindung wollte erst nicht mehr, deshalb hab ich mit dem Proxy "rumgespielt" und eine Einstellung geändert, Bilder in Mailprogramm werden nicht mehr angezeigt). Danke für die Hilfe!

cosinus 01.05.2014 23:16
Wollte eigentlich das hier posten

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=http://127.0.0.1:9881
S2 Mext Guard; "C:\Program Files\V-bates\guardsvc.exe" [X]
C:\Program Files\V-bates
S2 WinRST; C:\Program Files (x86)\WinRST\WinRST.exe [X]
C:\Program Files (x86)\WinRST
S3 TBPanel; No ImagePath
C:\ProgramData\hnbdehzc.pfe
C:\Users\Claudia\Downloads\VideoConverterSetup.exe
C:\Program Files\rrsavings
C:\Program Files\002
Task: {0314821E-8E5E-4409-A2CB-BCCC4073B676} - \923e656c-7931-4c44-9b19-6d3c00ebfbd9-2 No Task File <==== ATTENTION
Task: {08EC88C4-0FE6-47A1-9268-1D2F3BC113D7} - \923e656c-7931-4c44-9b19-6d3c00ebfbd9-3 No Task File <==== ATTENTION
Task: {1C56263B-5089-4E70-A25E-1D9B5155480B} - \14ecb001-f416-4a5e-b100-cc6e315349af-3 No Task File <==== ATTENTION
Task: {20EF1A63-AC11-428B-85C6-34F3F9094508} - \14ecb001-f416-4a5e-b100-cc6e315349af-2 No Task File <==== ATTENTION
Task: {6FF2B5D6-5FBE-480D-A836-A3822A547C89} - \14ecb001-f416-4a5e-b100-cc6e315349af-1 No Task File <==== ATTENTION
Task: {703617EF-0F4F-4D43-8E3F-4323A89FA5B0} - \14ecb001-f416-4a5e-b100-cc6e315349af-4 No Task File <==== ATTENTION
Task: {86A6AC0B-FF59-416C-9D12-EB9ECC212276} - \923e656c-7931-4c44-9b19-6d3c00ebfbd9-5 No Task File <==== ATTENTION
Task: {938A57A4-BB70-4AE7-83F9-C02EBD615EB5} - \14ecb001-f416-4a5e-b100-cc6e315349af-5 No Task File <==== ATTENTION
Task: {9B8DD772-700E-4020-886C-5A7FC3AE8B1D} - \Scheduled Update for Ask Toolbar No Task File <==== ATTENTION
Task: {AAA58B2A-044F-49A1-B1E0-562BC64260E2} - \923e656c-7931-4c44-9b19-6d3c00ebfbd9-4 No Task File <==== ATTENTION
Task: {BB5D9224-2BAF-4B2A-B974-F918EF613A48} - \923e656c-7931-4c44-9b19-6d3c00ebfbd9-1 No Task File <==== ATTENTION

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.


littlesheep 02.05.2014 21:08
Oops... bin jetzt davon ausgegangen, daß warum auch immer nichts mehr kommt und hab jetzt ein paar Sachen gemacht, die in dem anderen Post abschließend gemacht werden sollten und danach die empfohlenen Sicherheitsprogramme installiert (allerdings hab ich jetzt durch irgendwas noch einen "Knoten" beim Starten drin) - sorry :pfeiff:

Muß ich jetzt sicher noch wieder irgendwas zurückdrehen und irgendwas an neuen Logs posten? Folgendes hatte ich jetzt gemacht (hoffe ich krieg das noch zusammen):

Defogger gestartet und wieder auf reenable geklickt
Combofix deinstalliert

Installiert und gestartet (nach den Instruktionen): Anti-Malware, TFC, Spyware Blaster, WinPatrol, PSI (das wollte aber nicht, hab ich jetzt deinstalliert - stand die ganze Zeit auf "Loading", aber nichts ist passiert).

Problem jetzt beim Starten (Desktop erscheint schon): diverse Popup-Fenster, die alle was von Runtime Error, C++ etc. sagen, aber nicht genau was das Problem verursacht.

Brauchst Du jetzt erst ein neues Log von irgendwas oder trotzdem die letzten Anweisungen ausführen?

Sorry nochmal, wollte es nicht komplizierter machen als nötig... :balla:

littlesheep 05.05.2014 23:36
Wollte am Wochenende nicht nerven, magst du mir denn jetzt noch weiter helfen? Bin jetzt nicht sicher, ob ich die letzte Anweisung ausführen soll oder ob ich noch wieder wad zurück drehen muß vorher... Danke!

cosinus 06.05.2014 07:23
Einfach den Fix machen, der wurde nicht zur Deko gepostet :D

littlesheep 06.05.2014 21:33
Zu Befehl! (kein salutierendes Smiley vorhanden...)

Hier die Fixlog (da wo steht "nicht gefunden", das sind einige Sachen, die ich vorher schon gelöscht hatte bzw. die evtl. auch durch die Malware-Programme etc. schon rausgeflogen waren):

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 06-05-2014
Ran by Claudia at 2014-05-06 22:29:12 Run:1
Running from C:\Users\Claudia\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=hxxp://127.0.0.1:9881
S2 Mext Guard; "C:\Program Files\V-bates\guardsvc.exe" [X]
C:\Program Files\V-bates
S2 WinRST; C:\Program Files (x86)\WinRST\WinRST.exe [X]
C:\Program Files (x86)\WinRST
S3 TBPanel; No ImagePath
C:\ProgramData\hnbdehzc.pfe
C:\Users\Claudia\Downloads\VideoConverterSetup.exe
C:\Program Files\rrsavings
C:\Program Files\002
Task: {0314821E-8E5E-4409-A2CB-BCCC4073B676} - \923e656c-7931-4c44-9b19-6d3c00ebfbd9-2 No Task File <==== ATTENTION
Task: {08EC88C4-0FE6-47A1-9268-1D2F3BC113D7} - \923e656c-7931-4c44-9b19-6d3c00ebfbd9-3 No Task File <==== ATTENTION
Task: {1C56263B-5089-4E70-A25E-1D9B5155480B} - \14ecb001-f416-4a5e-b100-cc6e315349af-3 No Task File <==== ATTENTION
Task: {20EF1A63-AC11-428B-85C6-34F3F9094508} - \14ecb001-f416-4a5e-b100-cc6e315349af-2 No Task File <==== ATTENTION
Task: {6FF2B5D6-5FBE-480D-A836-A3822A547C89} - \14ecb001-f416-4a5e-b100-cc6e315349af-1 No Task File <==== ATTENTION
Task: {703617EF-0F4F-4D43-8E3F-4323A89FA5B0} - \14ecb001-f416-4a5e-b100-cc6e315349af-4 No Task File <==== ATTENTION
Task: {86A6AC0B-FF59-416C-9D12-EB9ECC212276} - \923e656c-7931-4c44-9b19-6d3c00ebfbd9-5 No Task File <==== ATTENTION
Task: {938A57A4-BB70-4AE7-83F9-C02EBD615EB5} - \14ecb001-f416-4a5e-b100-cc6e315349af-5 No Task File <==== ATTENTION
Task: {9B8DD772-700E-4020-886C-5A7FC3AE8B1D} - \Scheduled Update for Ask Toolbar No Task File <==== ATTENTION
Task: {AAA58B2A-044F-49A1-B1E0-562BC64260E2} - \923e656c-7931-4c44-9b19-6d3c00ebfbd9-4 No Task File <==== ATTENTION
Task: {BB5D9224-2BAF-4B2A-B974-F918EF613A48} - \923e656c-7931-4c44-9b19-6d3c00ebfbd9-1 No Task File <==== ATTENTION
       
*****************

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => Value deleted successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => Value deleted successfully.
Mext Guard => Service deleted successfully.
"C:\Program Files\V-bates" => File/Directory not found.
WinRST => Service not found.
"C:\Program Files (x86)\WinRST" => File/Directory not found.
TBPanel => Service deleted successfully.
C:\ProgramData\hnbdehzc.pfe => Moved successfully.
"C:\Users\Claudia\Downloads\VideoConverterSetup.exe" => File/Directory not found.
"C:\Program Files\rrsavings" => File/Directory not found.
"C:\Program Files\002" => File/Directory not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{0314821E-8E5E-4409-A2CB-BCCC4073B676} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0314821E-8E5E-4409-A2CB-BCCC4073B676} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\923e656c-7931-4c44-9b19-6d3c00ebfbd9-2 => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{08EC88C4-0FE6-47A1-9268-1D2F3BC113D7} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{08EC88C4-0FE6-47A1-9268-1D2F3BC113D7} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\923e656c-7931-4c44-9b19-6d3c00ebfbd9-3 => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{1C56263B-5089-4E70-A25E-1D9B5155480B} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1C56263B-5089-4E70-A25E-1D9B5155480B} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\14ecb001-f416-4a5e-b100-cc6e315349af-3 => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{20EF1A63-AC11-428B-85C6-34F3F9094508} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{20EF1A63-AC11-428B-85C6-34F3F9094508} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\14ecb001-f416-4a5e-b100-cc6e315349af-2 => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{6FF2B5D6-5FBE-480D-A836-A3822A547C89} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6FF2B5D6-5FBE-480D-A836-A3822A547C89} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\14ecb001-f416-4a5e-b100-cc6e315349af-1 => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{703617EF-0F4F-4D43-8E3F-4323A89FA5B0} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{703617EF-0F4F-4D43-8E3F-4323A89FA5B0} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\14ecb001-f416-4a5e-b100-cc6e315349af-4 => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{86A6AC0B-FF59-416C-9D12-EB9ECC212276} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{86A6AC0B-FF59-416C-9D12-EB9ECC212276} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\923e656c-7931-4c44-9b19-6d3c00ebfbd9-5 => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{938A57A4-BB70-4AE7-83F9-C02EBD615EB5} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{938A57A4-BB70-4AE7-83F9-C02EBD615EB5} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\14ecb001-f416-4a5e-b100-cc6e315349af-5 => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9B8DD772-700E-4020-886C-5A7FC3AE8B1D} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9B8DD772-700E-4020-886C-5A7FC3AE8B1D} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{AAA58B2A-044F-49A1-B1E0-562BC64260E2} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AAA58B2A-044F-49A1-B1E0-562BC64260E2} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\923e656c-7931-4c44-9b19-6d3c00ebfbd9-4 => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{BB5D9224-2BAF-4B2A-B974-F918EF613A48} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BB5D9224-2BAF-4B2A-B974-F918EF613A48} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\923e656c-7931-4c44-9b19-6d3c00ebfbd9-1 => Key deleted successfully.

==== End of Fixlog ====

cosinus 07.05.2014 08:58
Dann zeig mal frische FRST Logs. Haken setzen bei addition.txt dann auf Scan klicken

http://saved.im/mtg0mjy4yjlu/2014-04...ryscantool.png


Alle Zeitangaben in WEZ +1. Es ist jetzt 10:19 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131