Trojaner-Board - Windows 7 via BootCamp: Extrem langsam und öffnet unterschiedliche Pop-ups im Browser (Schädlingsbefall)

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Windows 7 via BootCamp: Extrem langsam und öffnet unterschiedliche Pop-ups im Browser (Schädlingsbefall) (https://www.trojaner-board.de/158809-windows-7-via-bootcamp-extrem-langsam-oeffnet-unterschiedliche-pop-ups-browser-schaedlingsbefall.html)

Windows 7 via BootCamp: Extrem langsam und öffnet unterschiedliche Pop-ups im Browser (Schädlingsbefall)

Hallo zusammen, habe noch ein Problemkind zuhause. Ich hatte auf dem Rechner mal einen Trojaner, der sich anfangs nicht löschen lies. Irgendwie habe ich den über mein Security Programm wegbekommen. Dennoch habe ich mehrere Infektionen via Malewarebytes gefunden. Vielleicht könnt ihr mir helfen.

ANbei die Logs

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-09-2014

Ran by D (administrator) on D-PC on 17-09-2014 12:28:26

Running from C:\Users\D\Downloads

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

() C:\Windows\System32\AppleOSSMgr.exe

(Apple Inc.) C:\Windows\System32\AppleTimeSrv.exe

(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\pg_ctl.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.3\bin\pg_ctl.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.3\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.3\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.3\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.3\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.3\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.3\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.3\bin\postgres.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe

(Apple Inc.) C:\Program Files\Boot Camp\Bootcamp.exe

(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe

(Akamai Technologies, Inc.) C:\Users\D\AppData\Local\Akamai\netsession_win.exe

(Akamai Technologies, Inc.) C:\Users\D\AppData\Local\Akamai\netsession_win.exe

(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe

(Spotify Ltd) C:\Users\D\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(Dropbox, Inc.) C:\Users\D\AppData\Roaming\Dropbox\bin\Dropbox.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [Apple_KbdMgr] => C:\Program Files\Boot Camp\Bootcamp.exe [743776 2013-01-16] (Apple Inc.)

HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [3100440 2014-05-19] (Logitech, Inc.)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)

Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)

HKU\.DEFAULT\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2013-11-08] (Microsoft Corporation)

HKU\S-1-5-21-1933391480-3615603964-130723930-1000\...\Run: [Akamai NetSession Interface] => C:\Users\D\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)

HKU\S-1-5-21-1933391480-3615603964-130723930-1000\...\Run: [Spotify Web Helper] => C:\Users\D\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1245752 2014-08-25] (Spotify Ltd)

HKU\S-1-5-21-1933391480-3615603964-130723930-1000\...\MountPoints2: {ecfb9016-415d-11e3-ae19-7cd1c3a28bda} - G:\setup_vmb_lite.exe /checkApplicationPresence

HKU\S-1-5-21-1933391480-3615603964-130723930-1000\...\MountPoints2: {ecfb90db-415d-11e3-ae19-7cd1c3a28bda} - G:\setup_vmb_lite.exe /checkApplicationPresence

Startup: C:\Users\D\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\D\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x4C4FC26FD1DACE01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)

BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)

BHO: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll (Logitech, Inc.)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)

BHO-x32: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)

BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)

BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)

BHO-x32: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll (Logitech, Inc.)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)

Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

Tcpip\..\Interfaces\{F337BAAB-BBCB-493B-8394-8409303C3176}: [NameServer] 139.7.30.125,139.7.30.126
 

FireFox:

========

FF ProfilePath: C:\Users\D\AppData\Roaming\Mozilla\Firefox\Profiles\pgcy5hwm.default

FF Homepage: hxxp://www.google.de/

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()

FF Plugin: @java.com/DTPlugin,version=10.17.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.17.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll (CANON INC.)

FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\ProgramData\Kaspersky Lab\SafeBrowser\S-1-5-21-1933391480-3615603964-130723930-1000\FireFox\searchplugins\trovi-search.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com

FF Extension: 卡巴斯基網址顧問 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2014-03-13]

FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com

FF Extension: 虛擬鍵盤 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-03-13]

FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com

FF Extension: 惡意網站攔截器 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2014-03-13]

FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com

FF Extension: Chặn quảng cáo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2014-03-13]

FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com

FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2014-03-13]

FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt

FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2014-08-17]
 

Chrome: 

=======

CHR HomePage: Default -> 8C54BCC20F1E8A824024F61377FC284FF433F0466B46D1EB22013CF4539CEE46

CHR DefaultSearchKeyword: Default -> search.conduit.com

CHR DefaultSearchProvider: Default -> Trovi search

CHR DefaultSearchURL: Default -> hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=MEC469C70-6769-4A41-9BB8-D7ADAEB0447A&SearchSource=58&CUI=&UM=5&UP=SPC31D573B-DBDC-4A83-9313-02744CEAAB63&q={searchTerms}&SSPV=

CHR DefaultSuggestURL: Default -> hxxp://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}

CHR Profile: C:\Users\D\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\D\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-04]

CHR Extension: (Modul zur Link-Untersuchung) - C:\Users\D\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj [2014-03-13]

CHR Extension: (Sicherer Zahlungsverkehr) - C:\Users\D\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh [2014-03-13]

CHR Extension: (Modul zum Sperren von gefährlichen Webseiten) - C:\Users\D\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail [2014-03-13]

CHR Extension: (Virtual Keyboard) - C:\Users\D\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh [2014-03-13]

CHR Extension: (Google Wallet) - C:\Users\D\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-06]

CHR Extension: (Anti-Banner) - C:\Users\D\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman [2014-03-13]

CHR HKLM-x32\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - https://chrome.google.com/webstore/detail/blbkdnmdcafmfhinpmnlhhddbepgkeaa []

CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2013-10-17]

CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2013-10-17]

CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2013-10-17]

CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2013-10-17]

CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2013-10-17]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AppleOSSMgr; C:\Windows\system32\AppleOSSMgr.exe [226144 2013-01-16] ()

R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2013-10-17] (Kaspersky Lab ZAO)

R2 postgresql-x64-9.0; C:/Program Files/PostgreSQL/9.0/bin/pg_ctl.exe runservice -N "postgresql-x64-9.0" -D "C:/Program Files/PostgreSQL/9.0/data" -w [X]

R2 postgresql-x64-9.3; C:/Program Files/PostgreSQL/9.3/bin/pg_ctl.exe runservice -N "postgresql-x64-9.3" -D "C:/Program Files/PostgreSQL/9.3/data" -w [X]
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R3 applebmt; C:\Windows\System32\DRIVERS\applebmt.sys [52736 2011-06-17] (Apple Inc.)

S3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [239104 2013-01-30] (Huawei Technologies Co., Ltd.)

R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-03-13] (Kaspersky Lab ZAO)

S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [115296 2014-03-20] (Kaspersky Lab ZAO)

R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [625248 2014-03-20] (Kaspersky Lab ZAO)

R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2013-10-17] (Kaspersky Lab ZAO)

R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2014-03-13] (Kaspersky Lab ZAO)

R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-10-17] (Kaspersky Lab ZAO)

R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)

R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2013-05-14] (Kaspersky Lab ZAO)

R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178272 2014-03-13] (Kaspersky Lab ZAO)
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-09-17 12:29 - 2014-09-17 12:29 - 00000000 ____D () C:\Users\D\Desktop\Neuer Ordner

2014-09-17 12:28 - 2014-09-17 12:29 - 00018743 _____ () C:\Users\D\Downloads\FRST.txt

2014-09-17 12:28 - 2014-09-17 12:28 - 00000000 ____D () C:\FRST

2014-09-17 12:27 - 2014-09-17 12:27 - 00000464 _____ () C:\Users\D\Downloads\defogger_disable.log

2014-09-17 12:27 - 2014-09-17 12:27 - 00000000 _____ () C:\Users\D\defogger_reenable

2014-09-17 12:25 - 2014-09-17 12:25 - 02105856 _____ (Farbar) C:\Users\D\Downloads\FRST64.exe

2014-09-17 12:25 - 2014-09-17 12:25 - 00380416 _____ () C:\Users\D\Downloads\Gmer-19357.exe

2014-09-17 12:25 - 2014-09-17 12:25 - 00050477 _____ () C:\Users\D\Downloads\Defogger.exe

2014-09-16 17:51 - 2014-09-16 17:51 - 02347384 _____ (ESET) C:\Users\D\Downloads\esetsmartinstaller_deu.exe

2014-09-16 17:44 - 2014-09-16 17:46 - 00000000 ____D () C:\AdwCleaner

2014-09-16 17:44 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll

2014-09-16 17:33 - 2014-09-16 17:33 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-09-16 17:32 - 2014-09-16 17:32 - 01373475 _____ () C:\Users\D\Downloads\AdwCleaner_3.310.exe

2014-09-16 17:32 - 2014-09-16 17:32 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-09-16 17:32 - 2014-09-16 17:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-09-16 17:32 - 2014-09-16 17:32 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-09-16 17:32 - 2014-09-16 17:32 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-09-16 17:32 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-09-16 17:32 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-09-16 17:32 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-09-16 17:31 - 2014-09-16 17:32 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\D\Downloads\mbam-setup-2.0.2.1012.exe

2014-09-15 18:24 - 2014-09-15 18:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-09-13 12:15 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2014-09-13 12:15 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

2014-09-12 19:37 - 2014-09-12 19:39 - 117931107 _____ () C:\Users\D\Desktop\Back_up_12.09.zip

2014-09-12 17:42 - 2014-09-12 17:43 - 00007595 _____ () C:\Users\D\AppData\Local\Resmon.ResmonCfg

2014-09-11 23:01 - 2014-08-19 20:05 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-09-11 23:01 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-09-11 23:01 - 2014-08-19 01:01 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-09-11 23:01 - 2014-08-19 00:29 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-09-11 23:01 - 2014-08-19 00:29 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-09-11 23:01 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-09-11 23:01 - 2014-08-19 00:20 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-09-11 23:01 - 2014-08-19 00:19 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-09-11 23:01 - 2014-08-19 00:15 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-09-11 23:01 - 2014-08-19 00:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-09-11 23:01 - 2014-08-19 00:14 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-09-11 23:01 - 2014-08-19 00:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-09-11 23:01 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-09-11 23:01 - 2014-08-19 00:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-09-11 23:01 - 2014-08-19 00:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-09-11 23:01 - 2014-08-19 00:05 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-09-11 23:01 - 2014-08-19 00:03 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-09-11 23:01 - 2014-08-19 00:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-09-11 23:01 - 2014-08-19 00:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-09-11 23:01 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-09-11 23:01 - 2014-08-18 23:56 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-09-11 23:01 - 2014-08-18 23:51 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-09-11 23:01 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-09-11 23:01 - 2014-08-18 23:45 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-09-11 23:01 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-09-11 23:01 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-09-11 23:01 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-09-11 23:01 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-09-11 23:01 - 2014-08-18 23:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-09-11 23:01 - 2014-08-18 23:39 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-09-11 23:01 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-09-11 23:01 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-09-11 23:01 - 2014-08-18 23:38 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-09-11 23:01 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-09-11 23:01 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-09-11 23:01 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-09-11 23:01 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-09-11 23:01 - 2014-08-18 23:25 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-09-11 23:01 - 2014-08-18 23:25 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-09-11 23:01 - 2014-08-18 23:23 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-09-11 23:01 - 2014-08-18 23:23 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-09-11 23:01 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-09-11 23:01 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-09-11 23:01 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-09-11 23:01 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-09-11 23:01 - 2014-08-18 23:16 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-09-11 23:01 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-09-11 23:01 - 2014-08-18 23:15 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-09-11 23:01 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-09-11 23:01 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-09-11 23:01 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-09-11 23:01 - 2014-08-18 22:55 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-09-11 23:01 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-09-11 23:01 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-09-11 23:01 - 2014-08-18 22:38 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-09-11 23:01 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-09-11 22:39 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll

2014-09-11 22:39 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll

2014-09-11 14:26 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-09-11 14:26 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-09-11 14:26 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll

2014-09-11 14:26 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll

2014-09-11 14:26 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2014-09-11 14:26 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2014-09-11 14:26 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2014-09-11 14:26 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2014-09-11 14:26 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2014-09-11 14:26 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll

2014-09-11 14:26 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll

2014-09-07 13:20 - 2014-09-07 13:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security Task Manager

2014-09-07 13:20 - 2014-09-07 13:20 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager

2014-09-07 13:19 - 2014-09-07 13:19 - 02365840 _____ () C:\Users\D\Downloads\SecurityTaskManager_Setup.exe

2014-08-28 14:23 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll

2014-08-28 14:23 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll

2014-08-28 14:23 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-08-26 13:06 - 2014-08-26 13:06 - 00001075 _____ () C:\Users\D\AppData\Roaming\Microsoft\Windows\Start Menu\PokerRanger.lnk

2014-08-26 13:06 - 2014-08-26 13:06 - 00001051 _____ () C:\Users\postgres\Desktop\PokerRanger.lnk

2014-08-26 13:06 - 2014-08-26 13:06 - 00001051 _____ () C:\Users\D\Desktop\PokerRanger.lnk

2014-08-26 13:06 - 2014-08-26 13:06 - 00000000 ____D () C:\Users\D\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PokerRanger

2014-08-26 13:06 - 2014-08-26 13:06 - 00000000 ____D () C:\Users\D\AppData\Local\PokerRanger

2014-08-26 13:06 - 2014-08-26 13:06 - 00000000 ____D () C:\Users\D\AppData\Local\CrashRpt

2014-08-26 13:06 - 2014-08-26 13:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PokerRanger

2014-08-26 13:06 - 2014-08-26 13:06 - 00000000 ____D () C:\Program Files (x86)\PokerRanger

2014-08-26 11:27 - 2014-08-26 11:27 - 28936542 _____ () C:\Users\D\Downloads\PokerRangerSetup.exe

2014-08-26 11:06 - 2014-09-07 13:30 - 09121002 _____ () C:\Windows\SysWOW64\console.log

2014-08-25 18:09 - 2014-09-16 17:29 - 00000093 _____ () C:\Users\D\AppData\Roaming\WB.CFG

2014-08-25 17:18 - 2014-08-25 17:19 - 25781712 _____ (DVDVideoSoft Ltd. ) C:\Users\D\Downloads\FreeVideoCallRecorder(1).exe

2014-08-25 17:06 - 2014-08-25 17:06 - 01040024 _____ () C:\Users\D\Downloads\Free-Video-Call-Recorder-for-Skype-lnstall.exe

2014-08-25 16:46 - 2014-08-25 16:49 - 00000000 ____D () C:\Users\D\Desktop\Playersvk

2014-08-25 14:26 - 2014-08-26 11:07 - 00000000 ____D () C:\Users\D\AppData\Local\Spotify

2014-08-25 14:26 - 2014-08-25 14:26 - 00001789 _____ () C:\Users\D\Desktop\Spotify.lnk

2014-08-25 14:26 - 2014-08-25 14:26 - 00001775 _____ () C:\Users\D\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk

2014-08-25 14:23 - 2014-09-03 19:40 - 00000000 ____D () C:\Users\D\AppData\Roaming\Spotify

2014-08-25 14:22 - 2014-08-25 14:22 - 00136352 _____ (Spotify Ltd) C:\Users\D\Downloads\SpotifySetup.exe

2014-08-19 13:21 - 2014-08-19 13:21 - 00002031 _____ () C:\Users\D\Downloads\fold_resteal_to_4-bet.pt4stat

2014-08-18 18:02 - 2014-08-18 18:02 - 00026592 _____ () C:\Users\D\Desktop\statyDefalut.ods

2014-08-18 15:30 - 2014-08-18 15:30 - 00002373 _____ () C:\Users\D\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ICMIZER.lnk

2014-08-18 15:30 - 2014-08-18 15:30 - 00002343 _____ () C:\Users\D\Desktop\ICMIZER.lnk

2014-08-18 15:27 - 2014-08-18 15:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

2014-08-18 15:27 - 2014-08-18 15:27 - 00000000 ____D () C:\Program Files\Microsoft Silverlight

2014-08-18 15:27 - 2014-08-18 15:27 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight

2014-08-18 15:26 - 2014-08-18 15:27 - 13087456 _____ (Microsoft Corporation) C:\Users\D\Downloads\Silverlight_x64.exe

2014-08-18 15:17 - 2014-08-18 15:17 - 00105442 _____ () C:\Users\D\Desktop\955019283.txt

2014-08-18 15:16 - 2014-08-18 15:16 - 00128581 _____ () C:\Users\D\Desktop\955019178.txt

2014-08-18 15:15 - 2014-08-18 15:15 - 00123720 _____ () C:\Users\D\Desktop\955003937.txt

2014-08-18 15:14 - 2014-08-18 15:14 - 00090883 _____ () C:\Users\D\Desktop\954997739.txt
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-09-17 12:29 - 2014-09-17 12:29 - 00000000 ____D () C:\Users\D\Desktop\Neuer Ordner

2014-09-17 12:29 - 2014-09-17 12:28 - 00018743 _____ () C:\Users\D\Downloads\FRST.txt

2014-09-17 12:28 - 2014-09-17 12:28 - 00000000 ____D () C:\FRST

2014-09-17 12:28 - 2009-07-14 06:45 - 00022576 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-09-17 12:28 - 2009-07-14 06:45 - 00022576 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-09-17 12:27 - 2014-09-17 12:27 - 00000464 _____ () C:\Users\D\Downloads\defogger_disable.log

2014-09-17 12:27 - 2014-09-17 12:27 - 00000000 _____ () C:\Users\D\defogger_reenable

2014-09-17 12:27 - 2013-10-27 10:53 - 00000000 ____D () C:\Users\D

2014-09-17 12:25 - 2014-09-17 12:25 - 02105856 _____ (Farbar) C:\Users\D\Downloads\FRST64.exe

2014-09-17 12:25 - 2014-09-17 12:25 - 00380416 _____ () C:\Users\D\Downloads\Gmer-19357.exe

2014-09-17 12:25 - 2014-09-17 12:25 - 00050477 _____ () C:\Users\D\Downloads\Defogger.exe

2014-09-17 12:25 - 2013-10-27 10:47 - 01442736 _____ () C:\Windows\WindowsUpdate.log

2014-09-17 12:22 - 2014-02-24 10:39 - 00000000 ___RD () C:\Users\D\Dropbox

2014-09-17 12:22 - 2014-02-24 10:37 - 00000000 ____D () C:\Users\D\AppData\Roaming\Dropbox

2014-09-17 12:21 - 2014-03-13 09:14 - 00000000 ____D () C:\ProgramData\Kaspersky Lab

2014-09-17 12:21 - 2014-02-20 09:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-09-17 12:21 - 2013-11-06 19:39 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-09-17 12:21 - 2013-10-28 19:10 - 00362716 _____ () C:\Windows\PFRO.log

2014-09-17 12:21 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-09-17 12:21 - 2009-07-14 06:51 - 00036984 _____ () C:\Windows\setupact.log

2014-09-16 20:18 - 2013-11-06 19:39 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-09-16 17:51 - 2014-09-16 17:51 - 02347384 _____ (ESET) C:\Users\D\Downloads\esetsmartinstaller_deu.exe

2014-09-16 17:46 - 2014-09-16 17:44 - 00000000 ____D () C:\AdwCleaner

2014-09-16 17:33 - 2014-09-16 17:33 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-09-16 17:32 - 2014-09-16 17:32 - 01373475 _____ () C:\Users\D\Downloads\AdwCleaner_3.310.exe

2014-09-16 17:32 - 2014-09-16 17:32 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-09-16 17:32 - 2014-09-16 17:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-09-16 17:32 - 2014-09-16 17:32 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-09-16 17:32 - 2014-09-16 17:32 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-09-16 17:32 - 2014-09-16 17:31 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\D\Downloads\mbam-setup-2.0.2.1012.exe

2014-09-16 17:29 - 2014-08-25 18:09 - 00000093 _____ () C:\Users\D\AppData\Roaming\WB.CFG

2014-09-15 18:50 - 2013-11-11 10:56 - 00000000 ____D () C:\Users\D\AppData\Roaming\Skype

2014-09-15 18:24 - 2014-09-15 18:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-09-15 17:02 - 2013-10-28 18:28 - 00000000 ____D () C:\Users\D\AppData\Local\PokerStars.EU

2014-09-13 12:14 - 2013-10-31 20:13 - 00000000 ____D () C:\Users\D\AppData\Roaming\TableNinja.v2

2014-09-12 19:39 - 2014-09-12 19:37 - 117931107 _____ () C:\Users\D\Desktop\Back_up_12.09.zip

2014-09-12 18:25 - 2013-10-29 19:25 - 00247722 _____ () C:\Users\D\Desktop\notes.o_S7ven_o.xml

2014-09-12 17:56 - 2013-10-28 18:29 - 00000000 ____D () C:\Program Files (x86)\PokerTracker 4

2014-09-12 17:47 - 2014-05-08 09:00 - 00000000 ____D () C:\Users\D\AppData\Roaming\DVDVideoSoft

2014-09-12 17:43 - 2014-09-12 17:42 - 00007595 _____ () C:\Users\D\AppData\Local\Resmon.ResmonCfg

2014-09-12 17:23 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-09-12 17:06 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-09-12 16:28 - 2013-10-28 19:34 - 00000000 ____D () C:\Users\postgres

2014-09-11 22:59 - 2013-10-28 19:20 - 01593956 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI

2014-09-11 22:59 - 2009-07-14 19:58 - 00699416 _____ () C:\Windows\system32\perfh007.dat

2014-09-11 22:59 - 2009-07-14 19:58 - 00149556 _____ () C:\Windows\system32\perfc007.dat

2014-09-11 22:59 - 2009-07-14 07:13 - 01593956 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-09-11 22:58 - 2013-10-28 19:49 - 00000000 ____D () C:\Windows\system32\MRT

2014-09-11 22:40 - 2013-10-28 19:49 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-09-11 22:39 - 2014-05-07 03:01 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-09-07 13:30 - 2014-08-26 11:06 - 09121002 _____ () C:\Windows\SysWOW64\console.log

2014-09-07 13:20 - 2014-09-07 13:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security Task Manager

2014-09-07 13:20 - 2014-09-07 13:20 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager

2014-09-07 13:19 - 2014-09-07 13:19 - 02365840 _____ () C:\Users\D\Downloads\SecurityTaskManager_Setup.exe

2014-09-05 04:10 - 2014-09-11 14:26 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-09-05 04:05 - 2014-09-11 14:26 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-09-04 17:20 - 2014-01-23 18:01 - 00000000 ____D () C:\Users\D\AppData\Local\Equilab

2014-09-03 19:40 - 2014-08-25 14:23 - 00000000 ____D () C:\Users\D\AppData\Roaming\Spotify

2014-08-30 09:06 - 2013-10-28 18:28 - 00000000 ____D () C:\Program Files (x86)\PokerStars.EU

2014-08-29 11:21 - 2009-07-14 06:45 - 00298320 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-08-26 13:06 - 2014-08-26 13:06 - 00001075 _____ () C:\Users\D\AppData\Roaming\Microsoft\Windows\Start Menu\PokerRanger.lnk

2014-08-26 13:06 - 2014-08-26 13:06 - 00001051 _____ () C:\Users\postgres\Desktop\PokerRanger.lnk

2014-08-26 13:06 - 2014-08-26 13:06 - 00001051 _____ () C:\Users\D\Desktop\PokerRanger.lnk

2014-08-26 13:06 - 2014-08-26 13:06 - 00000000 ____D () C:\Users\D\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PokerRanger

2014-08-26 13:06 - 2014-08-26 13:06 - 00000000 ____D () C:\Users\D\AppData\Local\PokerRanger

2014-08-26 13:06 - 2014-08-26 13:06 - 00000000 ____D () C:\Users\D\AppData\Local\CrashRpt

2014-08-26 13:06 - 2014-08-26 13:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PokerRanger

2014-08-26 13:06 - 2014-08-26 13:06 - 00000000 ____D () C:\Program Files (x86)\PokerRanger

2014-08-26 11:27 - 2014-08-26 11:27 - 28936542 _____ () C:\Users\D\Downloads\PokerRangerSetup.exe

2014-08-26 11:07 - 2014-08-25 14:26 - 00000000 ____D () C:\Users\D\AppData\Local\Spotify

2014-08-25 17:19 - 2014-08-25 17:18 - 25781712 _____ (DVDVideoSoft Ltd. ) C:\Users\D\Downloads\FreeVideoCallRecorder(1).exe

2014-08-25 17:06 - 2014-08-25 17:06 - 01040024 _____ () C:\Users\D\Downloads\Free-Video-Call-Recorder-for-Skype-lnstall.exe

2014-08-25 16:49 - 2014-08-25 16:46 - 00000000 ____D () C:\Users\D\Desktop\Playersvk

2014-08-25 16:49 - 2014-01-27 14:47 - 00002217 _____ () C:\Users\D\URPreferences.xml

2014-08-25 14:26 - 2014-08-25 14:26 - 00001789 _____ () C:\Users\D\Desktop\Spotify.lnk

2014-08-25 14:26 - 2014-08-25 14:26 - 00001775 _____ () C:\Users\D\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk

2014-08-25 14:22 - 2014-08-25 14:22 - 00136352 _____ (Spotify Ltd) C:\Users\D\Downloads\SpotifySetup.exe

2014-08-23 11:51 - 2013-10-28 18:35 - 00000000 ____D () C:\Users\D\AppData\Local\In The Money

2014-08-23 04:07 - 2014-08-28 14:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll

2014-08-23 03:45 - 2014-08-28 14:23 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll

2014-08-23 02:59 - 2014-08-28 14:23 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-08-22 12:43 - 2013-11-11 10:56 - 00000000 ____D () C:\ProgramData\Skype

2014-08-19 20:05 - 2014-09-11 23:01 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-08-19 19:39 - 2014-09-11 23:01 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-08-19 13:21 - 2014-08-19 13:21 - 00002031 _____ () C:\Users\D\Downloads\fold_resteal_to_4-bet.pt4stat

2014-08-19 01:01 - 2014-09-11 23:01 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-08-19 00:29 - 2014-09-11 23:01 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-08-19 00:29 - 2014-09-11 23:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-08-19 00:26 - 2014-09-11 23:01 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-08-19 00:20 - 2014-09-11 23:01 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-08-19 00:19 - 2014-09-11 23:01 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-08-19 00:15 - 2014-09-11 23:01 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-08-19 00:15 - 2014-09-11 23:01 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-08-19 00:14 - 2014-09-11 23:01 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-08-19 00:14 - 2014-09-11 23:01 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-08-19 00:08 - 2014-09-11 23:01 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-08-19 00:08 - 2014-09-11 23:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-08-19 00:08 - 2014-09-11 23:01 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-08-19 00:05 - 2014-09-11 23:01 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-08-19 00:03 - 2014-09-11 23:01 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-08-19 00:03 - 2014-09-11 23:01 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-08-19 00:03 - 2014-09-11 23:01 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-08-18 23:57 - 2014-09-11 23:01 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-08-18 23:56 - 2014-09-11 23:01 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-08-18 23:51 - 2014-09-11 23:01 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-08-18 23:46 - 2014-09-11 23:01 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-08-18 23:45 - 2014-09-11 23:01 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-08-18 23:45 - 2014-09-11 23:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-08-18 23:44 - 2014-09-11 23:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-08-18 23:44 - 2014-09-11 23:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-08-18 23:42 - 2014-09-11 23:01 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-08-18 23:40 - 2014-09-11 23:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-08-18 23:39 - 2014-09-11 23:01 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-08-18 23:39 - 2014-09-11 23:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-08-18 23:39 - 2014-09-11 23:01 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-08-18 23:38 - 2014-09-11 23:01 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-08-18 23:37 - 2014-09-11 23:01 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-08-18 23:36 - 2014-09-11 23:01 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-08-18 23:35 - 2014-09-11 23:01 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-08-18 23:27 - 2014-09-11 23:01 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-08-18 23:25 - 2014-09-11 23:01 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-08-18 23:25 - 2014-09-11 23:01 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-08-18 23:23 - 2014-09-11 23:01 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-08-18 23:23 - 2014-09-11 23:01 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-08-18 23:22 - 2014-09-11 23:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-08-18 23:19 - 2014-09-11 23:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-08-18 23:17 - 2014-09-11 23:01 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-08-18 23:17 - 2014-09-11 23:01 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-08-18 23:16 - 2014-09-11 23:01 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-08-18 23:15 - 2014-09-11 23:01 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-08-18 23:15 - 2014-09-11 23:01 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-08-18 23:09 - 2014-09-11 23:01 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-08-18 23:08 - 2014-09-11 23:01 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-08-18 23:07 - 2014-09-11 23:01 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-08-18 22:55 - 2014-09-11 23:01 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-08-18 22:46 - 2014-09-11 23:01 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-08-18 22:38 - 2014-09-11 23:01 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-08-18 22:38 - 2014-09-11 23:01 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-08-18 22:36 - 2014-09-11 23:01 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-08-18 18:02 - 2014-08-18 18:02 - 00026592 _____ () C:\Users\D\Desktop\statyDefalut.ods

2014-08-18 15:30 - 2014-08-18 15:30 - 00002373 _____ () C:\Users\D\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ICMIZER.lnk

2014-08-18 15:30 - 2014-08-18 15:30 - 00002343 _____ () C:\Users\D\Desktop\ICMIZER.lnk

2014-08-18 15:27 - 2014-08-18 15:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

2014-08-18 15:27 - 2014-08-18 15:27 - 00000000 ____D () C:\Program Files\Microsoft Silverlight

2014-08-18 15:27 - 2014-08-18 15:27 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight

2014-08-18 15:27 - 2014-08-18 15:26 - 13087456 _____ (Microsoft Corporation) C:\Users\D\Downloads\Silverlight_x64.exe

2014-08-18 15:17 - 2014-08-18 15:17 - 00105442 _____ () C:\Users\D\Desktop\955019283.txt

2014-08-18 15:16 - 2014-08-18 15:16 - 00128581 _____ () C:\Users\D\Desktop\955019178.txt

2014-08-18 15:15 - 2014-08-18 15:15 - 00123720 _____ () C:\Users\D\Desktop\955003937.txt

2014-08-18 15:14 - 2014-08-18 15:14 - 00090883 _____ () C:\Users\D\Desktop\954997739.txt
 

Some content of TEMP:

====================

C:\Users\D\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmposigdi.dll

C:\Users\D\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-09-11 17:35
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-09-2014

Ran by D at 2014-09-17 12:29:22

Running from C:\Users\D\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}

AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.44 - Adobe Systems Incorporated)

Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.08) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)

Akamai NetSession Interface (HKCU\...\Akamai) (Version:  - Akamai Technologies, Inc)

AMD Accelerated Video Transcoding (Version: 13.30.100.40417 - Advanced Micro Devices, Inc.) Hidden

AMD Catalyst Control Center (x32 Version: 2014.0417.2226.38446 - Ihr Firmenname) Hidden

AMD Catalyst Install Manager (HKLM\...\{6119B3A6-3603-9695-0398-CDF2AF0A13F8}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)

AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden

AMD Wireless Display v3.0 (Version: 1.0.0.15 - Advanced Micro Devices, Inc.) Hidden

Apple Application Support (HKLM-x32\...\{21FC2093-6E43-460B-B9B0-5F5AA35BBB0F}) (Version: 3.0 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{FE86CB0C-FCB3-4358-B4B0-B0A41E33B3DD}) (Version: 7.1.0.32 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

AVM FRITZ!fax für FRITZ!Box (HKLM-x32\...\FRITZ! 2.0) (Version:  - AVM Berlin)

Boot Camp-Dienste (HKLM\...\{FA2B2C2A-EA41-495A-9308-60726125D562}) (Version: 5.0.5033 - Apple Inc.)

Canon Easy-WebPrint EX (HKLM-x32\...\Easy-WebPrint EX) (Version: 1.3.5.0 - Canon Inc.)

Canon IJ Network Scanner Selector EX (HKLM-x32\...\Canon_IJ_Network_Scanner_Selector_EX) (Version:  - ‪Canon Inc.‬)

Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version: 3.1.0 - Canon Inc.)

Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version:  - ‪Canon Inc.‬)

Canon MG5400 series Benutzerregistrierung (HKLM-x32\...\Canon MG5400 series Benutzerregistrierung) (Version:  - Canon Inc.‎)

Canon MG5400 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5400_series) (Version: 1.00 - Canon Inc.)

Canon MG5400 series On-screen Manual (HKLM-x32\...\Canon MG5400 series On-screen Manual) (Version: 7.5.0 - Canon Inc.)

Canon My Image Garden (HKLM-x32\...\Canon My Image Garden) (Version: 1.0.0 - Canon Inc.)

Canon My Image Garden Design Files (HKLM-x32\...\Canon My Image Garden Design Files) (Version: 1.0.0 - Canon Inc.)

Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: 3.0.0 - Canon Inc.)

Canon Quick Menu (HKLM-x32\...\CanonQuickMenu) (Version: 2.0.0 - Canon Inc.)

Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center Graphics Previews Common (x32 Version: 2014.0417.2226.38446 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center InstallProxy (x32 Version: 2014.0417.2226.38446 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center Localization All (x32 Version: 2014.0417.2226.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Chinese Standard (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Chinese Traditional (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Czech (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Danish (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Dutch (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help English (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Finnish (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help French (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help German (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Greek (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Hungarian (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Italian (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Japanese (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Korean (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Norwegian (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Polish (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Portuguese (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Russian (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Spanish (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Swedish (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Thai (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Turkish (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

ccc-utility64 (Version: 2014.0417.2226.38446 - Advanced Micro Devices, Inc.) Hidden

Dropbox (HKCU\...\Dropbox) (Version: 2.10.27 - Dropbox, Inc.)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 37.0.2062.120 - Google Inc.)

Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden

HoldemResources Calculator (HKLM-x32\...\HoldemResources Calculator) (Version: release - HoldemResources)

ICMIZER (HKCU\...\1396580509.www.icmpoker.com) (Version:  - www.icmpoker.com)

Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.0.1351 - Intel Corporation)

iTunes (HKLM\...\{96B53CA8-5ABB-49D8-96F1-F6C0D73A76C6}) (Version: 11.1.4.62 - Apple Inc.)

Java 7 Update 17 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417017FF}) (Version: 7.0.170 - Oracle)

Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.670 - Oracle)

Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) Hidden

Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{6F6873E3-5C92-4049-B511-231A138DD090}) (Version: 14.0.0.4651 - Kaspersky Lab)

Kaspersky Internet Security (x32 Version: 14.0.0.4651 - Kaspersky Lab) Hidden

Logitech SetPoint 6.65 (HKLM\...\sp6) (Version: 6.65.62 - Logitech)

Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)

Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden

Mozilla Firefox 32.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.1 (x86 de)) (Version: 32.0.1 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)

OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)

PokerRanger  (HKLM-x32\...\PokerRanger) (Version:  - Michael A. Voelkel)

PokerStars.eu (HKLM-x32\...\PokerStars.eu) (Version:  - PokerStars.eu)

PokerStrategy.com Equilab (HKLM-x32\...\{86D09F48-CDAB-4B4C-8806-F6C16F17935A}) (Version: 1.2.8.0 - PokerStrategy.com)

PokerTracker 4 (remove only) (HKLM-x32\...\PokerTracker4) (Version:  - )

PostgreSQL 9.0  (HKLM\...\PostgreSQL 9.0) (Version: 9.0 - PostgreSQL Global Development Group)

PostgreSQL 9.3  (HKLM\...\PostgreSQL 9.3) (Version: 9.3 - PostgreSQL Global Development Group)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5936 - Realtek Semiconductor Corp.)

Security Task Manager 1.8g (HKLM-x32\...\Security Task Manager) (Version: 1.8g - Neuber Software)

SitNGo Wizard (HKLM-x32\...\SitNGoWizard) (Version:  - In The Money LLC)

SitNGo Wizard 2 (HKLM-x32\...\SitNGoWizard2) (Version:  - )

Skype™ 6.18 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.)

Spotify (HKCU\...\Spotify) (Version: 0.9.12.10.g89b2a4fc - Spotify AB)

TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.28223 - TeamViewer)

TN2 (HKLM-x32\...\{6B636FF5-14E8-48DD-A251-6C6FF0C761A7}) (Version: 2.3.93 - PASG)

Windows-Treiberpaket - Apple Inc. (AppleUSBEthernet) Net  (02/01/2008 3.10.3.10) (HKLM\...\D53CBF2C12DF51DA5E9C1A9DA97FF0DCA0C524C5) (Version: 02/01/2008 3.10.3.10 - Apple Inc.)

Windows-Treiberpaket - Apple Inc. Apple Bluetooth (03/01/2010 3.0.0.5) (HKLM\...\EA3C044F6FD39CEC8F4F596836BF4197E97E1D39) (Version: 03/01/2010 3.0.0.5 - Apple Inc.)

Windows-Treiberpaket - Apple Inc. Apple Broadcom Bluetooth (10/29/2012 5.0.1.0) (HKLM\...\790D7FBB22FD6EA6B526D13ABE02EA921C86BB4A) (Version: 10/29/2012 5.0.1.0 - Apple Inc.)

Windows-Treiberpaket - Apple Inc. Apple Display (01/23/2009 3.0.0.0) (HKLM\...\E0EAD0CEA9119B77350ED4DE28D9A82E57014D94) (Version: 01/23/2009 3.0.0.0 - Apple Inc.)

Windows-Treiberpaket - Apple Inc. Apple IR Receiver (02/21/2008 2.0.4.0) (HKLM\...\D5BB697E7D0C75712F3AD00AB1B85412CB5C0FD3) (Version: 02/21/2008 2.0.4.0 - Apple Inc.)

Windows-Treiberpaket - Apple Inc. Apple Keyboard (10/29/2012 5.0.3.0) (HKLM\...\59357B4067FCABD09BD751BD9A00336CF05B2E22) (Version: 10/29/2012 5.0.3.0 - Apple Inc.)

Windows-Treiberpaket - Apple Inc. Apple Multitouch (09/11/2012 4.0.3.0) (HKLM\...\B374E899604BD9007FF7564A07F627CCDA58763C) (Version: 09/11/2012 4.0.3.0 - Apple Inc.)

Windows-Treiberpaket - Apple Inc. Apple Multitouch Mouse (09/11/2012 4.0.3.0) (HKLM\...\742CB1BDA52EA9F1BBE482DA6DAA17944652B476) (Version: 09/11/2012 4.0.3.0 - Apple Inc.)

Windows-Treiberpaket - Apple Inc. Apple ODD (05/17/2010 3.1.0.0) (HKLM\...\D6B4CB6AD2F81752C2EF8DCF6AD5EBC567ADD45C) (Version: 05/17/2010 3.1.0.0 - Apple Inc.)

Windows-Treiberpaket - Apple Inc. Apple System Device (08/28/2012 5.0.0.0) (HKLM\...\051EC488BEF1D02E9051B188C43B026A88E197E5) (Version: 08/28/2012 5.0.0.0 - Apple Inc.)

Windows-Treiberpaket - Apple Inc. Apple Wireless Mouse (06/01/2011 4.0.0.1) (HKLM\...\D088EE4BD2819FBA2B349EF9D55176F223419BE6) (Version: 06/01/2011 4.0.0.1 - Apple Inc.)

Windows-Treiberpaket - Apple Inc. Apple Wireless Trackpad (10/29/2011 5.0.0.0) (HKLM\...\551732BB0872DA97E26385C221B172A5BD4DE93C) (Version: 10/29/2011 5.0.0.0 - Apple Inc.)

Windows-Treiberpaket - Atheros Communications Inc. (athr) Net  (11/13/2010 9.2.0.113) (HKLM\...\F0A3F8394866FA91E82C8D5AB92C918FE40FE1DF) (Version: 11/13/2010 9.2.0.113 - Atheros Communications Inc.)

Windows-Treiberpaket - Broadcom (b57nd60a) Net  (09/04/2012 15.4.0.17) (HKLM\...\75E64992A03EC5E73D33586790CC506561DCC5DB) (Version: 09/04/2012 15.4.0.17 - Broadcom)

Windows-Treiberpaket - Broadcom (B57ports) Net  (06/16/2009 1.0.0.1) (HKLM\...\FC2077892425ED71A137B1CB6D99A9CA7475435D) (Version: 06/16/2009 1.0.0.1 - Broadcom)

Windows-Treiberpaket - Broadcom (BCM43XX) Net  (11/13/2012 5.106.199.1) (HKLM\...\3D6DDDCF8961C8C866F6660579A59B5B6CFA281F) (Version: 11/13/2012 5.106.199.1 - Broadcom)

Windows-Treiberpaket - Broadcom Corporation (bScsiSDa) SDHost  (08/14/2012 1.0.0.243) (HKLM\...\ADF3AD5C5705E56E7DEA1447D58EFF216BA1223D) (Version: 08/14/2012 1.0.0.243 - Broadcom Corporation)

Windows-Treiberpaket - Cirrus Logic, Inc. (CirrusFilter) MEDIA  (11/09/2012 6.6001.1.38) (HKLM\...\907F370097451D1FE9BF31A43BF04CDAF69407D4) (Version: 11/09/2012 6.6001.1.38 - Cirrus Logic, Inc.)

Windows-Treiberpaket - Intel (e1express) Net  (03/26/2010 9.13.41.0) (HKLM\...\159439476E3A00F9FAE49DD6C1A78F2F6288A5B9) (Version: 03/26/2010 9.13.41.0 - Intel)

Windows-Treiberpaket - Intel (e1kexpress) Net  (04/12/2010 11.6.92.0) (HKLM\...\5BEF08C10896D86DC13394FFA75874564B700368) (Version: 04/12/2010 11.6.92.0 - Intel)

Windows-Treiberpaket - Intel (e1qexpress) Net  (12/04/2009 11.4.7.0) (HKLM\...\57AFA39B22ADEC4E383572E9331167546EB3C9C7) (Version: 12/04/2009 11.4.7.0 - Intel)

Windows-Treiberpaket - Intel (e1rexpress) Net  (01/07/2010 11.4.16.0) (HKLM\...\F71DB41300D30088C8D3716343D1429488E605C1) (Version: 01/07/2010 11.4.16.0 - Intel)

Windows-Treiberpaket - Intel (e1yexpress) Net  (04/07/2010 10.1.9.0) (HKLM\...\CB599752301BCA080D135697FDD05900F5A5CF4C) (Version: 04/07/2010 10.1.9.0 - Intel)

Windows-Treiberpaket - Intel System  (07/20/2007 1.2.76.0) (HKLM\...\E2708073906571A0B56F17FD825EF19281ECE29B) (Version: 07/20/2007 1.2.76.0 - Intel)

Windows-Treiberpaket - Marvell (yukonx64) Net  (12/06/2007 10.51.1.3) (HKLM\...\CDD703ED0B390A5643DB748EBFA5BD55FEEC0D8A) (Version: 12/06/2007 10.51.1.3 - Marvell)

Windows-Treiberpaket - NVIDIA Corporation (NVHDA) MEDIA  (07/03/2012 1.3.18.0) (HKLM\...\B46A8C1640335CA36A800E2C6D832964F6F58B54) (Version: 07/03/2012 1.3.18.0 - NVIDIA Corporation)
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 

CustomCLSID: HKU\S-1-5-21-1933391480-3615603964-130723930-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\D\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-1933391480-3615603964-130723930-1000_Classes\CLSID\{087B3AE3-E237-4467-B8DB-5A38AB959AC9}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)

CustomCLSID: HKU\S-1-5-21-1933391480-3615603964-130723930-1000_Classes\CLSID\{3B092F0C-7696-40E3-A80F-68D74DA84210}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)

CustomCLSID: HKU\S-1-5-21-1933391480-3615603964-130723930-1000_Classes\CLSID\{63542C48-9552-494A-84F7-73AA6A7C99C1}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)

CustomCLSID: HKU\S-1-5-21-1933391480-3615603964-130723930-1000_Classes\CLSID\{7BC0E710-5703-45BE-A29D-5D46D8B39262}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\ooofilt_x64.dll (Apache Software Foundation)

CustomCLSID: HKU\S-1-5-21-1933391480-3615603964-130723930-1000_Classes\CLSID\{AE424E85-F6DF-4910-A6A9-438797986431}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\propertyhdl_x64.dll (Apache Software Foundation)

CustomCLSID: HKU\S-1-5-21-1933391480-3615603964-130723930-1000_Classes\CLSID\{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)

CustomCLSID: HKU\S-1-5-21-1933391480-3615603964-130723930-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\D\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-1933391480-3615603964-130723930-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\D\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-1933391480-3615603964-130723930-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\D\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-1933391480-3615603964-130723930-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\D\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-1933391480-3615603964-130723930-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\D\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-1933391480-3615603964-130723930-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\D\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-1933391480-3615603964-130723930-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\D\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-1933391480-3615603964-130723930-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\D\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
 

==================== Restore Points  =========================
 

11-09-2014 20:38:45 Windows Update

12-09-2014 15:47:20 ICM Trainer wird entfernt

14-09-2014 01:00:24 Windows Update
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {19DA5194-A310-41F9-8CE9-4E7263BC4238} - System32\Tasks\{2CB3B094-EDB0-4CA1-8C2A-D3146497C653} => C:\Program Files (x86)\REFLEX\RMK.exe

Task: {3C2D41BB-CFB6-4C7F-BE3D-1E9492A6B63A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-11-06] (Google Inc.)

Task: {3D659369-7E16-4F36-A6A1-8F844A2B88D5} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-11-06] (Google Inc.)

Task: {405C3F39-21B3-4B1A-ACB1-692C2811704A} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {C2576898-861C-4E6E-9683-98D9F2EFD306} - System32\Tasks\{75E4B347-B7CB-4DEB-BEAE-F67FC6F3D9D4} => C:\Program Files (x86)\REFLEX\REFLEX.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 

==================== Loaded Modules (whitelisted) =============
 

2013-12-19 15:27 - 2006-02-23 12:35 - 00020480 _____ () C:\Windows\System32\FritzColorPort64.dll

2013-12-19 15:27 - 2006-02-22 10:39 - 00020480 _____ () C:\Windows\System32\FritzPort64.dll

2013-01-16 18:55 - 2013-01-16 18:55 - 00226144 _____ () C:\Windows\system32\AppleOSSMgr.exe

2013-10-28 19:33 - 2013-10-08 11:21 - 00218624 _____ () C:\Program Files\PostgreSQL\9.0\bin\LIBPQ.dll

2013-10-28 18:51 - 2013-10-08 09:23 - 00177664 _____ () C:\Program Files\PostgreSQL\9.3\bin\LIBPQ.dll

2013-10-28 19:33 - 2012-08-14 14:02 - 02258432 _____ () C:\Program Files\PostgreSQL\9.0\bin\libxml2.dll

2013-10-28 18:51 - 2012-08-14 15:31 - 01328128 _____ () C:\Program Files\PostgreSQL\9.3\bin\libxml2.dll

2014-02-06 01:52 - 2014-02-06 01:52 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2014-02-06 01:52 - 2014-02-06 01:52 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2013-06-17 13:35 - 2013-06-17 13:35 - 00478400 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\dblite.dll

2013-05-08 15:52 - 2013-05-08 15:52 - 01270464 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\kpcengine.2.3.dll

2014-09-17 12:21 - 2014-09-17 12:21 - 00043008 _____ () c:\users\d\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmposigdi.dll

2013-08-23 21:01 - 2013-08-23 21:01 - 25100288 _____ () C:\Users\D\AppData\Roaming\Dropbox\bin\libcef.dll

2014-09-15 18:24 - 2014-09-15 18:24 - 03716720 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

2013-10-27 10:59 - 2013-01-02 13:23 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 

MSCONFIG\startupfolder: C:^Users^D^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk => C:\Windows\pss\Dropbox.lnk.Startup

MSCONFIG\startupreg: CanonQuickMenu => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE /logon

MSCONFIG\startupreg: DVSSkypeRecorder => "C:\Program Files (x86)\DVDVideoSoft\Free Video Call Recorder for Skype\skyui.exe" /minimized

MSCONFIG\startupreg: IJNetworkScannerSelectorEX => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe /FORCE

MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

MSCONFIG\startupreg: Spotify => "C:\Users\D\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart

MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\D\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"

MSCONFIG\startupreg: StartCCC => "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (09/17/2014 00:27:10 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (09/16/2014 05:51:39 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (09/14/2014 03:13:12 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: GoogleUpdate.exe, Version: 1.3.21.103, Zeitstempel: 0x4f3c6d6c

Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7

Ausnahmecode: 0xc0000005

Fehleroffset: 0x000223e0

ID des fehlerhaften Prozesses: 0x1524

Startzeit der fehlerhaften Anwendung: 0xGoogleUpdate.exe0

Pfad der fehlerhaften Anwendung: GoogleUpdate.exe1

Pfad des fehlerhaften Moduls: GoogleUpdate.exe2

Berichtskennung: GoogleUpdate.exe3
 

Error: (09/13/2014 02:05:07 AM) (Source: Application Hang) (EventID: 1002) (User: )

Description: Programm TN2Profiling.exe, Version 2.3.93.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 8fe24
 

Startzeit: 01cfcea7c82d45a2
 

Endzeit: 16
 

Anwendungspfad: C:\Users\D\AppData\Roaming\TableNinja.v2\prof\TN2Profiling.exe
 

Berichts-ID:
 

Error: (08/26/2014 10:35:46 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: Programm soffice.bin, Version 4.0.9714.500 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 34d4
 

Startzeit: 01cfc1308b24a6d8
 

Endzeit: 3914
 

Anwendungspfad: C:\Program Files (x86)\OpenOffice 4\program\soffice.bin
 

Berichts-ID: 74648a32-2d60-11e4-a019-7cd1c3a28bda
 

Error: (08/25/2014 05:10:11 PM) (Source: MsiInstaller) (EventID: 11316) (User: D-PC)

Description: Product: Google Update Helper -- Error 1316. Das angegebene Konto ist bereits vorhanden.
 

Error: (08/25/2014 05:10:09 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: Skype.exe, Version: 6.18.0.106, Zeitstempel: 0x53d13f6d

Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000

Ausnahmecode: 0xc0000005

Fehleroffset: 0x04a817b8

ID des fehlerhaften Prozesses: 0x1d80

Startzeit der fehlerhaften Anwendung: 0xSkype.exe0

Pfad der fehlerhaften Anwendung: Skype.exe1

Pfad des fehlerhaften Moduls: Skype.exe2

Berichtskennung: Skype.exe3
 

Error: (08/22/2014 08:31:00 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: raptr_im.exe, Version: 4.1.0.0, Zeitstempel: 0x4bbd3163

Name des fehlerhaften Moduls: libpurple.dll, Version: 2.7.10.0, Zeitstempel: 0x5182ec74

Ausnahmecode: 0xc0000005

Fehleroffset: 0x000220cd

ID des fehlerhaften Prozesses: 0x810

Startzeit der fehlerhaften Anwendung: 0xraptr_im.exe0

Pfad der fehlerhaften Anwendung: raptr_im.exe1

Pfad des fehlerhaften Moduls: raptr_im.exe2

Berichtskennung: raptr_im.exe3
 

Error: (08/11/2014 03:28:41 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: GoogleUpdate.exe, Version: 1.3.21.103, Zeitstempel: 0x4f3c6d6c

Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7

Ausnahmecode: 0xc0000005

Fehleroffset: 0x000223e0

ID des fehlerhaften Prozesses: 0x2b20

Startzeit der fehlerhaften Anwendung: 0xGoogleUpdate.exe0

Pfad der fehlerhaften Anwendung: GoogleUpdate.exe1

Pfad des fehlerhaften Moduls: GoogleUpdate.exe2

Berichtskennung: GoogleUpdate.exe3
 

Error: (08/05/2014 06:46:41 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: PokerTracker4.exe, Version: 4.11.10.0, Zeitstempel: 0x53cd30a1

Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7

Ausnahmecode: 0xc0000005

Fehleroffset: 0x00038e19

ID des fehlerhaften Prozesses: 0x14d0

Startzeit der fehlerhaften Anwendung: 0xPokerTracker4.exe0

Pfad der fehlerhaften Anwendung: PokerTracker4.exe1

Pfad des fehlerhaften Moduls: PokerTracker4.exe2

Berichtskennung: PokerTracker4.exe3
 
 

System errors:

=============

Error: (09/17/2014 00:22:36 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)

Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
 

Error: (09/16/2014 05:49:02 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)

Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
 

Error: (09/16/2014 05:01:52 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)

Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
 

Error: (09/15/2014 05:01:32 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)

Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
 

Error: (09/14/2014 03:19:32 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)

Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
 

Error: (09/13/2014 00:06:05 PM) (Source: DCOM) (EventID: 10010) (User: )

Description: {752073A1-23F2-4396-85F0-8FDB879ED0ED}
 

Error: (09/13/2014 00:04:17 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)

Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
 

Error: (09/13/2014 02:07:42 AM) (Source: DCOM) (EventID: 10010) (User: )

Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
 

Error: (09/12/2014 04:29:39 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)

Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
 

Error: (09/11/2014 02:19:01 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)

Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
 
 

Microsoft Office Sessions:

=========================

Error: (09/17/2014 00:27:10 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\D\Downloads\esetsmartinstaller_deu.exe
 

Error: (09/16/2014 05:51:39 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\D\Downloads\esetsmartinstaller_deu.exe
 

Error: (09/14/2014 03:13:12 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: GoogleUpdate.exe1.3.21.1034f3c6d6cntdll.dll6.1.7601.18247521ea8e7c0000005000223e0152401cfcfb7401abacfC:\Program Files (x86)\Google\Update\GoogleUpdate.exeC:\Windows\SysWOW64\ntdll.dll4bad9094-3bac-11e4-b175-7cd1c3a28bda
 

Error: (09/13/2014 02:05:07 AM) (Source: Application Hang) (EventID: 1002) (User: )

Description: TN2Profiling.exe2.3.93.08fe2401cfcea7c82d45a216C:\Users\D\AppData\Roaming\TableNinja.v2\prof\TN2Profiling.exe
 

Error: (08/26/2014 10:35:46 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: soffice.bin4.0.9714.50034d401cfc1308b24a6d83914C:\Program Files (x86)\OpenOffice 4\program\soffice.bin74648a32-2d60-11e4-a019-7cd1c3a28bda
 

Error: (08/25/2014 05:10:11 PM) (Source: MsiInstaller) (EventID: 11316) (User: D-PC)

Description: Product: Google Update Helper -- Error 1316. Das angegebene Konto ist bereits vorhanden.

(NULL)(NULL)(NULL)(NULL)(NULL)
 

Error: (08/25/2014 05:10:09 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Skype.exe6.18.0.10653d13f6dunknown0.0.0.000000000c000000504a817b81d8001cfc07696a74e59C:\Program Files (x86)\Skype\Phone\Skype.exeunknowne6d98b5f-2c69-11e4-bcae-7cd1c3a28bda
 

Error: (08/22/2014 08:31:00 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: raptr_im.exe4.1.0.04bbd3163libpurple.dll2.7.10.05182ec74c0000005000220cd81001cfbdd293d549e3C:\PROGRA~2\Raptr\raptr_im.exeC:\PROGRA~2\Raptr\libpurple.dlle1a633e6-29c5-11e4-a401-7cd1c3a28bda
 

Error: (08/11/2014 03:28:41 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: GoogleUpdate.exe1.3.21.1034f3c6d6cntdll.dll6.1.7601.18247521ea8e7c0000005000223e02b2001cfb566ac78e9f3C:\Program Files (x86)\Google\Update\GoogleUpdate.exeC:\Windows\SysWOW64\ntdll.dll68624078-215b-11e4-a3f1-7cd1c3a28bda
 

Error: (08/05/2014 06:46:41 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: PokerTracker4.exe4.11.10.053cd30a1ntdll.dll6.1.7601.18247521ea8e7c000000500038e1914d001cfb07942cbe23eC:\Program Files (x86)\PokerTracker 4\PokerTracker4.exeC:\Windows\SysWOW64\ntdll.dll12ae9a4f-1cc0-11e4-ab81-7cd1c3a28bda
 
 

CodeIntegrity Errors:

===================================

  Date: 2014-09-14 03:49:27.745

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-09-14 03:49:27.729

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-09-14 03:49:27.729

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-09-14 03:49:27.714

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-09-14 03:49:27.714

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-09-14 03:49:27.698

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-09-13 00:09:52.035

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-09-13 00:09:52.033

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-09-13 00:09:52.030

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-09-13 00:09:51.994

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 
 

==================== Memory info =========================== 
 

Processor: Intel(R) Core(TM) i5-2400S CPU @ 2.50GHz

Percentage of memory in use: 41%

Total physical RAM: 4071.73 MB

Available physical RAM: 2399.78 MB

Total Pagefile: 8141.65 MB

Available Pagefile: 5379.76 MB

Total Virtual: 8192 MB

Available Virtual: 8191.83 MB
 

==================== Drives ================================
 

Drive c: (BOOTCAMP) (Fixed) (Total:139.7 GB) (Free:69.3 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

Drive e: (Macintosh HD) (Fixed) (Total:325.26 GB) (Free:256.78 GB) HFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 00005260)
 

Partition: GPT Partition Type.

Partition 2: (Not Active) - (Size=325.3 GB) - (Type=AF)

Partition 3: (Not Active) - (Size=620 MB) - (Type=AB)

Partition 4: (Active) - (Size=139.7 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 

Suchlauf Datum: 16.09.2014

Suchlauf-Zeit: 17:33:32

Logdatei: MW.txt

Administrator: Ja
 

Version: 2.00.2.1012

Malware Datenbank: v2014.09.16.05

Rootkit Datenbank: v2014.09.15.01

Lizenz: Kostenlos

Malware Schutz: Deaktiviert

Bösartiger Webseiten Schutz: Deaktiviert

Self-protection: Deaktiviert
 

Betriebssystem: Windows 7 Service Pack 1

CPU: x64

Dateisystem: NTFS

Benutzer: D
 

Suchlauf-Art: Bedrohungs-Suchlauf

Ergebnis: Abgeschlossen

Durchsuchte Objekte: 346438

Verstrichene Zeit: 9 Min, 54 Sek
 

Speicher: Aktiviert

Autostart: Aktiviert

Dateisystem: Aktiviert

Archive: Aktiviert

Rootkits: Deaktiviert

Heuristics: Aktiviert

PUP: Aktiviert

PUM: Aktiviert
 

Prozesse: 2

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe, 3544, Löschen bei Neustart, [88cd5e9080fb82b4b3d6891351b01ce4]

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe, 1084, Löschen bei Neustart, [66ef9658bac1d0667217b0ecfc053cc4]
 

Module: 0

(No malicious items detected)
 

Registrierungsschlüssel: 20

PUP.Optional.SearchProtect.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\CltMngSvc, In Quarantäne, [cb8a3faf215a9a9c5c2db4e8847d18e8], 

PUP.Optional.BatBrowse.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{a7262c86-7809-4d76-a726-5a379f1a3158}, In Quarantäne, [e66f04ea93e8f343cd881e6a26dc4ab6], 

PUP.Optional.BatBrowse.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{5f3fedef-b096-4123-97d7-f51b6a819ced}, In Quarantäne, [e66f04ea93e8f343cd881e6a26dc4ab6], 

PUP.Optional.BatBrowse.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{76FB2057-6D95-4642-B6C2-1E554CEA7EF7}, In Quarantäne, [e66f04ea93e8f343cd881e6a26dc4ab6], 

PUP.Optional.BatBrowse.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{76FB2057-6D95-4642-B6C2-1E554CEA7EF7}, In Quarantäne, [e66f04ea93e8f343cd881e6a26dc4ab6], 

PUP.Optional.BatBrowse.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{5f3fedef-b096-4123-97d7-f51b6a819ced}, In Quarantäne, [e66f04ea93e8f343cd881e6a26dc4ab6], 

PUP.Optional.BatBrowse.A, HKU\S-1-5-21-1933391480-3615603964-130723930-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{A7262C86-7809-4D76-A726-5A379F1A3158}, In Quarantäne, [e66f04ea93e8f343cd881e6a26dc4ab6], 

PUP.Optional.BatBrowse.A, HKU\S-1-5-21-1933391480-3615603964-130723930-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{A7262C86-7809-4D76-A726-5A379F1A3158}, In Quarantäne, [e66f04ea93e8f343cd881e6a26dc4ab6], 

PUP.Optional.SearchProtect.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\SearchProtect, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, In Quarantäne, [ada8f2fcbbc067cf1ed3aca95aaa3cc4], 

PUP.Optional.SearchProtect, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\INSTALLEDSDB\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}, In Quarantäne, [d67ffcf2205ba096e3d5f67812f2837d], 

PUP.Optional.SearchProtect, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\INSTALLEDSDB\{cf2797aa-b7ec-e311-8ed9-005056c00008}, In Quarantäne, [bd989b5380fb8ea8298e29459e6638c8], 

PUP.Optional.DoSearches.A, HKLM\SOFTWARE\WOW6432NODE\dosearchesSoftware, In Quarantäne, [a6afb638f98257df50cfe06ec73d728e], 

PUP.Optional.BatBrowse.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\pbpjplgmaeigbnpadeajipebdlihpcfn, In Quarantäne, [afa632bcdd9e2412bbbdee277f8454ac], 

PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, In Quarantäne, [272e2dc12c4f62d4529f0451986c926e], 

PUP.Optional.SearchProtect.A, HKLM\SOFTWARE\WOW6432NODE\SEARCHPROTECT, In Quarantäne, [01544f9f86f5aa8c415e3ed25da61ee2], 

PUP.Optional.SearchProtect, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SPPD, In Quarantäne, [5df814da3645f343de05ec1d1ee5857b], 

PUP.Optional.InstallCore.A, HKU\S-1-5-21-1933391480-3615603964-130723930-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, In Quarantäne, [d18446a8ccaf3600db1f76bd3cc7d22e], 

PUP.Optional.InstallCore.A, HKU\S-1-5-21-1933391480-3615603964-130723930-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, In Quarantäne, [b2a3e7072b5056e07fd6d377b54f46ba], 

PUP.Optional.SuperFish.A, HKU\S-1-5-21-1933391480-3615603964-130723930-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DOMSTORAGE\superfish.com, In Quarantäne, [6ee7539bcab12214d289c24e8f74936d], 
 

Registrierungswerte: 3

PUP.Optional.SearchProtect.A, HKLM\SOFTWARE\WOW6432NODE\SEARCHPROTECT|InstallDir, C:\PROGRA~2\SearchProtect, In Quarantäne, [01544f9f86f5aa8c415e3ed25da61ee2]

PUP.Optional.SearchProtect, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SPPD|ImagePath, \??\C:\Windows\system32\drivers\SPPD.sys, In Quarantäne, [5df814da3645f343de05ec1d1ee5857b]

PUP.Optional.InstallCore.A, HKU\S-1-5-21-1933391480-3615603964-130723930-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 0X2O1C0R2R1R, In Quarantäne, [b2a3e7072b5056e07fd6d377b54f46ba]
 

Registrierungsdaten: 5

PUP.Optional.SearchProtect.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS|AppInit_DLLs, C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll, Gut: (), Schlecht: (C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll),Ersetzt,[8fc6c727bfbc0d29f099faa27d848779]

PUP.Optional.SearchProtect.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS|AppInit_DLLs, C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll, Gut: (), Schlecht: (C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll),Ersetzt,[a1b43cb2700bad893554fba15da414ec]

PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[2233ffeff6855ed88eba8f71e4215ca4]

PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[292c5d910279c76f15332fd15aabef11]

PUP.Optional.Conduit.A, HKU\S-1-5-21-1933391480-3615603964-130723930-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://search.conduit.com/?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=MEC469C70-6769-4A41-9BB8-D7ADAEB0447A&SearchSource=55&CUI=&UM=5&UP=SPC31D573B-DBDC-4A83-9313-02744CEAAB63&SSPV=, Gut: (www.google.com), Schlecht: (hxxp://search.conduit.com/?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=MEC469C70-6769-4A41-9BB8-D7ADAEB0447A&SearchSource=55&CUI=&UM=5&UP=SPC31D573B-DBDC-4A83-9313-02744CEAAB63&SSPV=),Ersetzt,[a7aebb3386f50a2cd7de1bdb9a6a37c9]
 

Ordner: 34

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect, Löschen bei Neustart, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main, Löschen bei Neustart, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\bin, Löschen bei Neustart, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\rep, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect, Löschen bei Neustart, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin, Löschen bei Neustart, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\rep, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI, Löschen bei Neustart, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\bin, Löschen bei Neustart, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Consent, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\rep, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.OpenCandy, C:\Users\D\AppData\Roaming\OpenCandy, In Quarantäne, [57fe10dec6b562d48df5c111d230d42c], 

PUP.Optional.OpenCandy, C:\Users\D\AppData\Roaming\OpenCandy\077B960C12FD467DAFCA969B57495C60, In Quarantäne, [57fe10dec6b562d48df5c111d230d42c], 

PUP.Optional.OpenCandy, C:\Users\D\AppData\Roaming\OpenCandy\AC7469DF65E0458DAB595A424CCBC7F3, In Quarantäne, [57fe10dec6b562d48df5c111d230d42c], 

PUP.Optional.OpenCandy, C:\Users\D\AppData\Roaming\OpenCandy\FAD5E8B0708542238F250CB1C1EB835C, In Quarantäne, [57fe10dec6b562d48df5c111d230d42c], 

PUP.Optional.PriceMeter.A, C:\Users\D\AppData\Roaming\PriceMeterUpdater, In Quarantäne, [b79e31bdbdbede588cc25b7e6c9658a8], 

PUP.Optional.PriceMeter.A, C:\Users\D\AppData\Roaming\PriceMeterUpdater\UpdateProc, In Quarantäne, [b79e31bdbdbede588cc25b7e6c9658a8], 

PUP.Optional.PriceMeter.A, C:\Program Files (x86)\PriceMeterLiveUpdate, In Quarantäne, [afa637b723585adce6695c7d020055ab], 

PUP.Optional.PriceMeter.A, C:\Program Files (x86)\PriceMeterLiveUpdate\CrashReports, In Quarantäne, [afa637b723585adce6695c7d020055ab], 

PUP.Optional.SearchProtect.A, C:\Users\D\AppData\Local\SearchProtect, Löschen bei Neustart, [6aeb8a64532888aeb6853aae33cf47b9], 

PUP.Optional.SearchProtect.A, C:\Users\D\AppData\Local\SearchProtect\SearchProtect, Löschen bei Neustart, [6aeb8a64532888aeb6853aae33cf47b9], 

PUP.Optional.SearchProtect.A, C:\Users\D\AppData\Local\SearchProtect\SearchProtect\rep, In Quarantäne, [6aeb8a64532888aeb6853aae33cf47b9], 

PUP.Optional.SearchProtect.A, C:\Users\D\AppData\Local\SearchProtect\SearchProtect\STG, In Quarantäne, [6aeb8a64532888aeb6853aae33cf47b9], 

PUP.Optional.SearchProtect.A, C:\Users\D\AppData\Local\SearchProtect\UI, In Quarantäne, [6aeb8a64532888aeb6853aae33cf47b9], 

PUP.Optional.SearchProtect.A, C:\Users\D\AppData\Local\SearchProtect\UI\rep, In Quarantäne, [6aeb8a64532888aeb6853aae33cf47b9], 

PUP.Optional.Extutil.A, C:\Users\D\AppData\Local\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B, In Quarantäne, [cd886589cead8caa1c7e8a60a85a768a], 

PUP.Optional.Managera.A, C:\Users\D\AppData\Local\Temp\38fdaae5-8e0e-493c-88ec-e05c3be06e42, In Quarantäne, [282d4ea0e6957fb77b2027c3986a817f], 
 

Dateien: 134

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe, Löschen bei Neustart, [cb8a3faf215a9a9c5c2db4e8847d18e8], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe, Löschen bei Neustart, [88cd5e9080fb82b4b3d6891351b01ce4], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe, Löschen bei Neustart, [66ef9658bac1d0667217b0ecfc053cc4], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32.dll, Löschen bei Neustart, [0e479856ccaf91a5c4c55e3e9071c937], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll, In Quarantäne, [8fc6c727bfbc0d29f099faa27d848779], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll, In Quarantäne, [a1b43cb2700bad893554fba15da414ec], 

PUP.Optional.PriceMeter.A, C:\ProgramData\SecTaskMan\pricemeter.exe.q_Quarantine_1449F614_q, In Quarantäne, [e273f1fd4b3032040921f38a996828d8], 

PUP.Optional.PriceMeter.A, C:\ProgramData\SecTaskMan\pricemeterw.exe.q_Quarantine_1449BA0C_q, In Quarantäne, [0b4a509edf9c280ef03aafcef011867a], 

PUP.Optional.PriceMeter.A, C:\Users\D\AppData\Roaming\OpenCandy\077B960C12FD467DAFCA969B57495C60\pm.exe, In Quarantäne, [6beaf2fcec8f85b152b3b4c551b018e8], 

PUP.Optional.Conduit.A, C:\Users\D\AppData\Roaming\OpenCandy\FAD5E8B0708542238F250CB1C1EB835C\sp-downloader.exe, In Quarantäne, [c98c8c62d5a60d292673d15bb44ddc24], 

PUP.Optional.Conduit.A, C:\Windows\Temp\nsa2DDE.exe, In Quarantäne, [4312737b4f2c290dd88b702219e805fb], 

PUP.Optional.Conduit.A, C:\Windows\Temp\nsbB1D0.exe, In Quarantäne, [66ef846a85f6c86eff649cf698696b95], 

PUP.Optional.Conduit.A, C:\Windows\Temp\nsbECE2.exe, In Quarantäne, [f85d5f8f8eedbc7a7be8e3af53ae17e9], 

PUP.Optional.Conduit.A, C:\Windows\Temp\nsdFE01.exe, In Quarantäne, [fa5b28c6fb8026105b080e84c23ff60a], 

PUP.Optional.Conduit.A, C:\Windows\Temp\nse6E57.exe, In Quarantäne, [9fb6bd3188f32016392a4b473ac7d42c], 

PUP.Optional.Conduit.A, C:\Windows\Temp\nsj3B93.exe, In Quarantäne, [ca8b6b830774e4521b486e24e02138c8], 

PUP.Optional.Conduit.A, C:\Windows\Temp\nsj633F.exe, In Quarantäne, [2e27af3f8eed2115580b0a884db41ae6], 

PUP.Optional.Conduit.A, C:\Windows\Temp\nsjACAE.exe, In Quarantäne, [13423cb2106bb185075c355d48b98a76], 

PUP.Optional.Conduit.A, C:\Windows\Temp\nslCAB1.exe, In Quarantäne, [8acbab430477cc6a6102c3cfaa57a957], 

PUP.Optional.Conduit.A, C:\Windows\Temp\nsn2F9A.exe, In Quarantäne, [80d5ffef314a280ee97a474ba85944bc], 

PUP.Optional.Conduit.A, C:\Windows\Temp\nsz6D5D.exe, In Quarantäne, [b4a185692f4c23138fd497fbf8096b95], 

PUP.Optional.Conduit.A, C:\Windows\Temp\nsz8438.exe, In Quarantäne, [bd98509e6615d165e77c791932cf51af], 

PUP.Optional.Conduit.A, C:\Windows\Temp\nsz9F08.exe, In Quarantäne, [79dc2fbfa8d3bd791d46474bb1500cf4], 

PUP.Optional.Conduit.A, C:\Windows\Temp\nszCF79.exe, In Quarantäne, [aaabcd218dee1d19aab91280728f24dc], 

PUP.Optional.Conduit.A, C:\Windows\Temp\nspF1F8.exe, In Quarantäne, [193cd21c29521f17ee7572208e732bd5], 

PUP.Optional.Conduit.A, C:\Windows\Temp\nss170D.exe, In Quarantäne, [dc79cd21f289a294bda64c4658a99c64], 

PUP.Optional.Conduit.A, C:\Windows\Temp\nss6D08.exe, In Quarantäne, [a8adcc229fdc280e61029af809f8c937], 

PUP.Optional.Conduit.A, C:\Windows\Temp\nss8A97.exe, In Quarantäne, [3f168965ef8c5bdba4bf3d558a77857b], 

PUP.Optional.Conduit.A, C:\Windows\Temp\nss9A6C.exe, In Quarantäne, [7cd98e60fa81cc6a2c37b6dc19e8ce32], 

PUP.Optional.Conduit.A, C:\Windows\Temp\nsu79BC.exe, In Quarantäne, [163f628cb4c783b3e97ab5dd4bb67f81], 

PUP.Optional.Conduit.A, C:\Windows\Temp\nsu974B.exe, In Quarantäne, [68ed47a7fc7f45f1d58efb97a061b34d], 

PUP.Optional.Conduit.A, C:\Windows\Temp\nsw8582.exe, In Quarantäne, [084d628cceadef47a9ba98fad52c38c8], 

PUP.Optional.Conduit.A, C:\Windows\Temp\nso6532.exe, In Quarantäne, [9abbeb03601b5adc9bc8365cb44db947], 

PUP.Optional.YourFileDownloader, C:\Users\D\Downloads\Schon_Wieder_Zu_FrÃ¼h_downloader.exe, In Quarantäne, [de77826cafcc42f409375ac4916faa56], 

PUP.Optional.SearchProtect.A, C:\Windows\AppPatch\AppPatch64\SPVCLdr64.dll, In Quarantäne, [0154c529bbc0f640ccbd9ffdd928ce32], 

PUP.Optional.PriceMeter.A, C:\Windows\System32\Tasks\PriceMeterUpdater, In Quarantäne, [5401e608cab12b0bde489c75cc37b14f], 

PUP.Optional.Trovi.A, C:\Users\D\AppData\Roaming\Mozilla\Firefox\Profiles\pgcy5hwm.default\searchplugins\trovi-search.xml, In Quarantäne, [2b2aa34bfd7eb68041c62fed40c3bd43], 

PUP.Optional.Superfish.A, C:\Users\D\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage, In Quarantäne, [e66f45a981fa44f201094cd02dd638c8], 

PUP.Optional.Superfish.A, C:\Users\D\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage-journal, In Quarantäne, [98bd26c8d2a94ee86e9c71ab29da10f0], 

PUP.Optional.PriceMeter.A, C:\Windows\Tasks\PriceMeterUpdater.job, In Quarantäne, [094c905ed0ab5fd731ecb2750ff458a8], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\EULA.txt, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\bin\SPTool.dll, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\bin\SPtool.dll_1409593694284, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\bin\uninstall.exe, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\rep\SystemRepository.dat, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPTool64.exe, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64.dll, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings.html, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\style.css, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Consent\consent.css, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Consent\consent.html, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Consent\consent.js, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Consent\defaults.js, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgUninstall.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\hez-def-grey.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Apply-default.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Apply-onclick.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Apply-Rollover.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bg-dia.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bg-uninstall.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bg-with-logo.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bg.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgNotif.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgSettings.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgSettingsDS.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\btnBlue.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\btnClose.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\btnSilver.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\button-bg.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\checkbox.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\checkbox_checked.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\checkbox_def.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\close-win-def.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\close-win-over-click.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\gray-bg.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\hez-def.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\hez-selected.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\hez.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\icon-win.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\info-icon.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\menu-rollover.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\menu-selected.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button-def.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button-selected.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button2.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Settings-icon.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\SP_DialogBG.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\text-field.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\v.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\x.png, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\defaults.js, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\dialogUtils.js, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\jquery.1.7.1.min.js, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\json2.min.js, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\main.js, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\SPDialogAPI.js, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\defaults.js, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\protection.css, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\protection.html, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\protection.js, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\defaults.js, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.css, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.html, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.js, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\defaults.js, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\settings.css, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\settings.html, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\settings.js, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\defaults.js, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.css, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.html, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.js, In Quarantäne, [e96cb03e83f884b2322ce272c63e6f91], 

PUP.Optional.SearchProtect, C:\Windows\AppPatch\Custom\Custom64\{cf2797aa-b7ec-e311-8ed9-005056c00008}.sdb, In Quarantäne, [a7ae648a0e6dad89942725492dd745bb], 

PUP.Optional.OpenCandy, C:\Users\D\AppData\Roaming\OpenCandy\AC7469DF65E0458DAB595A424CCBC7F3\PokkiPACK_Stp3v5.exe, In Quarantäne, [57fe10dec6b562d48df5c111d230d42c], 

PUP.Optional.PriceMeter.A, C:\Users\D\AppData\Roaming\PriceMeterUpdater\UpdateProc\config.dat, In Quarantäne, [b79e31bdbdbede588cc25b7e6c9658a8], 

PUP.Optional.PriceMeter.A, C:\Users\D\AppData\Roaming\PriceMeterUpdater\UpdateProc\info.dat, In Quarantäne, [b79e31bdbdbede588cc25b7e6c9658a8], 

PUP.Optional.PriceMeter.A, C:\Users\D\AppData\Roaming\PriceMeterUpdater\UpdateProc\STTL.DAT, In Quarantäne, [b79e31bdbdbede588cc25b7e6c9658a8], 

PUP.Optional.PriceMeter.A, C:\Users\D\AppData\Roaming\PriceMeterUpdater\UpdateProc\TTL.DAT, In Quarantäne, [b79e31bdbdbede588cc25b7e6c9658a8], 

PUP.Optional.PriceMeter.A, C:\Users\D\AppData\Roaming\PriceMeterUpdater\UpdateProc\UpdateTask.exe, In Quarantäne, [b79e31bdbdbede588cc25b7e6c9658a8], 

PUP.Optional.SearchProtect.A, C:\Users\D\AppData\Local\SearchProtect\SearchProtect\rep\Cvc.dat, In Quarantäne, [6aeb8a64532888aeb6853aae33cf47b9], 

PUP.Optional.SearchProtect.A, C:\Users\D\AppData\Local\SearchProtect\SearchProtect\rep\UserRepository.dat, In Quarantäne, [6aeb8a64532888aeb6853aae33cf47b9], 

PUP.Optional.SearchProtect.A, C:\Users\D\AppData\Local\SearchProtect\SearchProtect\rep\UserSettings.dat, In Quarantäne, [6aeb8a64532888aeb6853aae33cf47b9], 

PUP.Optional.SearchProtect.A, C:\Users\D\AppData\Local\SearchProtect\UI\rep\UIRepository.dat, In Quarantäne, [6aeb8a64532888aeb6853aae33cf47b9], 

PUP.Optional.Extutil.A, C:\Users\D\AppData\Local\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B\bk.js, In Quarantäne, [cd886589cead8caa1c7e8a60a85a768a], 

PUP.Optional.Extutil.A, C:\Users\D\AppData\Local\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B\cs.js, In Quarantäne, [cd886589cead8caa1c7e8a60a85a768a], 

PUP.Optional.Extutil.A, C:\Users\D\AppData\Local\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B\manifest.json, In Quarantäne, [cd886589cead8caa1c7e8a60a85a768a], 

PUP.Optional.Managera.A, C:\Users\D\AppData\Local\Temp\38fdaae5-8e0e-493c-88ec-e05c3be06e42\cs.js, In Quarantäne, [282d4ea0e6957fb77b2027c3986a817f], 

PUP.Optional.Managera.A, C:\Users\D\AppData\Local\Temp\38fdaae5-8e0e-493c-88ec-e05c3be06e42\manifest.json, In Quarantäne, [282d4ea0e6957fb77b2027c3986a817f], 

PUP.Optional.Conduit.A, C:\Users\D\AppData\Local\Google\Chrome\User Data\Default\Preferences, Gut: (), Schlecht: (   "homepage": "hxxp://search.conduit.com/?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=MEC469C70-6769-4A41-9BB8-D7ADAEB0447A&SearchSource=55&CUI=&UM=5&UP=SPC31D573B-DBDC-4A83-9313-02744CEAAB63&SSPV=",), Ersetzt,[64f11bd3c6b5b185deef1b1808fd7f81]

PUP.Optional.Conduit.A, C:\Users\D\AppData\Local\Google\Chrome\User Data\Default\Preferences, Gut: (), Schlecht: (      "startup_urls": [ "hxxp://search.conduit.com/?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=MEC469C70-6769-4A41-9BB8-D7ADAEB0447A&SearchSource=55&CUI=&UM=5&UP=SPC31D573B-DBDC-4A83-9313-02744CEAAB63&SSPV=" ],), Ersetzt,[540185696219de587c829c9764a17987]

PUP.Optional.Trovi, C:\Users\D\AppData\Roaming\Mozilla\Firefox\Profiles\pgcy5hwm.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.search.defaultenginename", "Trovi search");), Ersetzt,[ee6766885922043277d8d65c55b0b848]

PUP.Optional.Trovi, C:\Users\D\AppData\Roaming\Mozilla\Firefox\Profiles\pgcy5hwm.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.search.selectedEngine", "Trovi search");), Ersetzt,[53028767e398a0963f114ee42dd8bf41]

PUP.Optional.Conduit.A, C:\Users\D\AppData\Roaming\Mozilla\Firefox\Profiles\pgcy5hwm.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "hxxp://search.conduit.com/?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=MEC469C70-6769-4A41-9BB8-D7ADAEB0447A&SearchSource=69&CUI=&SSPV=&Lay=1&UM=5&UP=SPC31D573B-DBDC-4A83-9313-02744CEAAB63");), Ersetzt,[2f26846a5922b680e7b5a093a362d42c]
 

Physische Sektoren: 0

(No malicious items detected)
 
 

(end)

Hi und :hallo:

Adware/Junkware/Toolbars entfernen

(alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen aus den Desktop!)

1. Schritt: adwCleaner

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Danke das du dich der sache annimmst (y):

Code:

# AdwCleaner v3.310 - Bericht erstellt am 17/09/2014 um 13:00:11

# Aktualisiert 12/09/2014 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzername : D - D-PC

# Gestartet von : C:\Users\D\Downloads\AdwCleaner_3.310.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 
 

***** [ Tasks ] *****
 
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 
 

***** [ Browser ] *****
 

-\\ Internet Explorer v11.0.9600.17280
 
 

-\\ Mozilla Firefox v32.0.1 (x86 de)
 

[ Datei : C:\Users\D\AppData\Roaming\Mozilla\Firefox\Profiles\pgcy5hwm.default\prefs.js ]
 
 

-\\ Google Chrome v37.0.2062.120
 

[ Datei : C:\Users\D\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 
 

*************************
 

AdwCleaner[R0].txt - [5464 octets] - [16/09/2014 17:44:25]

AdwCleaner[R1].txt - [1070 octets] - [17/09/2014 12:59:37]

AdwCleaner[S0].txt - [5180 octets] - [16/09/2014 17:46:23]

AdwCleaner[S1].txt - [993 octets] - [17/09/2014 13:00:11]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1052 octets] ##########

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.5 (09.16.2014:1)

OS: Windows 7 Home Premium x64

Ran by D on 17.09.2014 at 13:03:50,98

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 
 
 

~~~ Files
 
 
 

~~~ Folders
 
 
 

~~~ FireFox
 

Emptied folder: C:\Users\D\AppData\Roaming\mozilla\firefox\profiles\pgcy5hwm.default\minidumps [31 files]
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 17.09.2014 at 13:10:03,65

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-09-2014

Ran by D (administrator) on D-PC on 17-09-2014 13:14:20

Running from C:\Users\D\Downloads

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

() C:\Windows\System32\AppleOSSMgr.exe

(Apple Inc.) C:\Windows\System32\AppleTimeSrv.exe

(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\pg_ctl.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.3\bin\pg_ctl.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.3\bin\postgres.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.3\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.3\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.3\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.3\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.3\bin\postgres.exe

(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.3\bin\postgres.exe

(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe

(Apple Inc.) C:\Program Files\Boot Camp\Bootcamp.exe

(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe

(Akamai Technologies, Inc.) C:\Users\D\AppData\Local\Akamai\netsession_win.exe

(Akamai Technologies, Inc.) C:\Users\D\AppData\Local\Akamai\netsession_win.exe

(Spotify Ltd) C:\Users\D\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(Dropbox, Inc.) C:\Users\D\AppData\Roaming\Dropbox\bin\Dropbox.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [Apple_KbdMgr] => C:\Program Files\Boot Camp\Bootcamp.exe [743776 2013-01-16] (Apple Inc.)

HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [3100440 2014-05-19] (Logitech, Inc.)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)

Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)

HKU\.DEFAULT\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2013-11-08] (Microsoft Corporation)

HKU\S-1-5-21-1933391480-3615603964-130723930-1000\...\Run: [Akamai NetSession Interface] => C:\Users\D\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)

HKU\S-1-5-21-1933391480-3615603964-130723930-1000\...\Run: [Spotify Web Helper] => C:\Users\D\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1245752 2014-08-25] (Spotify Ltd)

HKU\S-1-5-21-1933391480-3615603964-130723930-1000\...\MountPoints2: {ecfb9016-415d-11e3-ae19-7cd1c3a28bda} - G:\setup_vmb_lite.exe /checkApplicationPresence

HKU\S-1-5-21-1933391480-3615603964-130723930-1000\...\MountPoints2: {ecfb90db-415d-11e3-ae19-7cd1c3a28bda} - G:\setup_vmb_lite.exe /checkApplicationPresence

Startup: C:\Users\D\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\D\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x4C4FC26FD1DACE01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)

BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)

BHO: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll (Logitech, Inc.)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)

BHO-x32: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)

BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)

BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)

BHO-x32: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll (Logitech, Inc.)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)

Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

Tcpip\..\Interfaces\{F337BAAB-BBCB-493B-8394-8409303C3176}: [NameServer] 139.7.30.125,139.7.30.126
 

FireFox:

========

FF ProfilePath: C:\Users\D\AppData\Roaming\Mozilla\Firefox\Profiles\pgcy5hwm.default

FF Homepage: hxxp://www.google.de/

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()

FF Plugin: @java.com/DTPlugin,version=10.17.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.17.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll (CANON INC.)

FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\ProgramData\Kaspersky Lab\SafeBrowser\S-1-5-21-1933391480-3615603964-130723930-1000\FireFox\searchplugins\trovi-search.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com

FF Extension: 卡巴斯基網址顧問 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2014-03-13]

FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com

FF Extension: 虛擬鍵盤 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-03-13]

FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com

FF Extension: 惡意網站攔截器 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2014-03-13]

FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com

FF Extension: Chặn quảng cáo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2014-03-13]

FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com

FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2014-03-13]

FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt

FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2014-08-17]
 

Chrome: 

=======

CHR HomePage: Default -> 8C54BCC20F1E8A824024F61377FC284FF433F0466B46D1EB22013CF4539CEE46

CHR DefaultSearchKeyword: Default -> search.conduit.com

CHR DefaultSearchProvider: Default -> Trovi search

CHR DefaultSearchURL: Default -> hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=MEC469C70-6769-4A41-9BB8-D7ADAEB0447A&SearchSource=58&CUI=&UM=5&UP=SPC31D573B-DBDC-4A83-9313-02744CEAAB63&q={searchTerms}&SSPV=

CHR DefaultSuggestURL: Default -> hxxp://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}

CHR Profile: C:\Users\D\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\D\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-04]

CHR Extension: (Modul zur Link-Untersuchung) - C:\Users\D\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj [2014-03-13]

CHR Extension: (Sicherer Zahlungsverkehr) - C:\Users\D\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh [2014-03-13]

CHR Extension: (Modul zum Sperren von gefährlichen Webseiten) - C:\Users\D\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail [2014-03-13]

CHR Extension: (Virtual Keyboard) - C:\Users\D\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh [2014-03-13]

CHR Extension: (Google Wallet) - C:\Users\D\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-06]

CHR Extension: (Anti-Banner) - C:\Users\D\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman [2014-03-13]

CHR HKLM-x32\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - https://chrome.google.com/webstore/detail/blbkdnmdcafmfhinpmnlhhddbepgkeaa []

CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2013-10-17]

CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2013-10-17]

CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2013-10-17]

CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2013-10-17]

CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2013-10-17]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AppleOSSMgr; C:\Windows\system32\AppleOSSMgr.exe [226144 2013-01-16] ()

R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2013-10-17] (Kaspersky Lab ZAO)

R2 postgresql-x64-9.0; C:/Program Files/PostgreSQL/9.0/bin/pg_ctl.exe runservice -N "postgresql-x64-9.0" -D "C:/Program Files/PostgreSQL/9.0/data" -w [X]

R2 postgresql-x64-9.3; C:/Program Files/PostgreSQL/9.3/bin/pg_ctl.exe runservice -N "postgresql-x64-9.3" -D "C:/Program Files/PostgreSQL/9.3/data" -w [X]
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R3 applebmt; C:\Windows\System32\DRIVERS\applebmt.sys [52736 2011-06-17] (Apple Inc.)

S3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [239104 2013-01-30] (Huawei Technologies Co., Ltd.)

R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-03-13] (Kaspersky Lab ZAO)

S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [115296 2014-03-20] (Kaspersky Lab ZAO)

R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [625248 2014-03-20] (Kaspersky Lab ZAO)

R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2013-10-17] (Kaspersky Lab ZAO)

R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2014-03-13] (Kaspersky Lab ZAO)

R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-10-17] (Kaspersky Lab ZAO)

R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)

R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2013-05-14] (Kaspersky Lab ZAO)

R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178272 2014-03-13] (Kaspersky Lab ZAO)
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-09-17 13:13 - 2014-09-17 13:14 - 02105856 _____ (Farbar) C:\Users\D\Downloads\FRST64.exe

2014-09-17 13:10 - 2014-09-17 13:10 - 00000749 _____ () C:\Users\D\Desktop\JRT.txt

2014-09-17 13:03 - 2014-09-17 13:03 - 00000000 ____D () C:\Windows\ERUNT

2014-09-17 12:58 - 2014-09-17 12:58 - 01016035 _____ (Thisisu) C:\Users\D\Downloads\JRT.exe

2014-09-17 12:29 - 2014-09-17 12:31 - 00000000 ____D () C:\Users\D\Desktop\trojan

2014-09-17 12:29 - 2014-09-17 12:29 - 00040193 _____ () C:\Users\D\Downloads\Addition.txt

2014-09-17 12:28 - 2014-09-17 13:14 - 00018742 _____ () C:\Users\D\Downloads\FRST.txt

2014-09-17 12:28 - 2014-09-17 13:14 - 00000000 ____D () C:\FRST

2014-09-17 12:27 - 2014-09-17 12:27 - 00000464 _____ () C:\Users\D\Downloads\defogger_disable.log

2014-09-17 12:27 - 2014-09-17 12:27 - 00000000 _____ () C:\Users\D\defogger_reenable

2014-09-17 12:25 - 2014-09-17 12:25 - 00380416 _____ () C:\Users\D\Downloads\Gmer-19357.exe

2014-09-17 12:25 - 2014-09-17 12:25 - 00050477 _____ () C:\Users\D\Downloads\Defogger.exe

2014-09-16 17:51 - 2014-09-16 17:51 - 02347384 _____ (ESET) C:\Users\D\Downloads\esetsmartinstaller_deu.exe

2014-09-16 17:44 - 2014-09-17 13:00 - 00000000 ____D () C:\AdwCleaner

2014-09-16 17:44 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll

2014-09-16 17:33 - 2014-09-17 12:30 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-09-16 17:32 - 2014-09-16 17:32 - 01373475 _____ () C:\Users\D\Downloads\AdwCleaner_3.310.exe

2014-09-16 17:32 - 2014-09-16 17:32 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-09-16 17:32 - 2014-09-16 17:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-09-16 17:32 - 2014-09-16 17:32 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-09-16 17:32 - 2014-09-16 17:32 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-09-16 17:32 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-09-16 17:32 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-09-16 17:32 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-09-16 17:31 - 2014-09-16 17:32 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\D\Downloads\mbam-setup-2.0.2.1012.exe

2014-09-15 18:24 - 2014-09-15 18:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-09-13 12:15 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2014-09-13 12:15 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

2014-09-12 19:37 - 2014-09-12 19:39 - 117931107 _____ () C:\Users\D\Desktop\Back_up_12.09.zip

2014-09-12 17:42 - 2014-09-12 17:43 - 00007595 _____ () C:\Users\D\AppData\Local\Resmon.ResmonCfg

2014-09-11 23:01 - 2014-08-19 20:05 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-09-11 23:01 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-09-11 23:01 - 2014-08-19 01:01 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-09-11 23:01 - 2014-08-19 00:29 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-09-11 23:01 - 2014-08-19 00:29 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-09-11 23:01 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-09-11 23:01 - 2014-08-19 00:20 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-09-11 23:01 - 2014-08-19 00:19 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-09-11 23:01 - 2014-08-19 00:15 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-09-11 23:01 - 2014-08-19 00:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-09-11 23:01 - 2014-08-19 00:14 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-09-11 23:01 - 2014-08-19 00:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-09-11 23:01 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-09-11 23:01 - 2014-08-19 00:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-09-11 23:01 - 2014-08-19 00:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-09-11 23:01 - 2014-08-19 00:05 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-09-11 23:01 - 2014-08-19 00:03 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-09-11 23:01 - 2014-08-19 00:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-09-11 23:01 - 2014-08-19 00:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-09-11 23:01 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-09-11 23:01 - 2014-08-18 23:56 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-09-11 23:01 - 2014-08-18 23:51 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-09-11 23:01 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-09-11 23:01 - 2014-08-18 23:45 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-09-11 23:01 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-09-11 23:01 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-09-11 23:01 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-09-11 23:01 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-09-11 23:01 - 2014-08-18 23:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-09-11 23:01 - 2014-08-18 23:39 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-09-11 23:01 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-09-11 23:01 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-09-11 23:01 - 2014-08-18 23:38 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-09-11 23:01 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-09-11 23:01 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-09-11 23:01 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-09-11 23:01 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-09-11 23:01 - 2014-08-18 23:25 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-09-11 23:01 - 2014-08-18 23:25 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-09-11 23:01 - 2014-08-18 23:23 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-09-11 23:01 - 2014-08-18 23:23 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-09-11 23:01 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-09-11 23:01 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-09-11 23:01 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-09-11 23:01 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-09-11 23:01 - 2014-08-18 23:16 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-09-11 23:01 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-09-11 23:01 - 2014-08-18 23:15 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-09-11 23:01 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-09-11 23:01 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-09-11 23:01 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-09-11 23:01 - 2014-08-18 22:55 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-09-11 23:01 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-09-11 23:01 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-09-11 23:01 - 2014-08-18 22:38 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-09-11 23:01 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-09-11 22:39 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll

2014-09-11 22:39 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll

2014-09-11 14:26 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-09-11 14:26 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-09-11 14:26 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll

2014-09-11 14:26 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll

2014-09-11 14:26 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2014-09-11 14:26 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2014-09-11 14:26 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2014-09-11 14:26 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2014-09-11 14:26 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2014-09-11 14:26 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll

2014-09-11 14:26 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll

2014-09-07 13:20 - 2014-09-07 13:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security Task Manager

2014-09-07 13:20 - 2014-09-07 13:20 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager

2014-09-07 13:19 - 2014-09-07 13:19 - 02365840 _____ () C:\Users\D\Downloads\SecurityTaskManager_Setup.exe

2014-08-28 14:23 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll

2014-08-28 14:23 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll

2014-08-28 14:23 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-08-26 13:06 - 2014-08-26 13:06 - 00001075 _____ () C:\Users\D\AppData\Roaming\Microsoft\Windows\Start Menu\PokerRanger.lnk

2014-08-26 13:06 - 2014-08-26 13:06 - 00001051 _____ () C:\Users\postgres\Desktop\PokerRanger.lnk

2014-08-26 13:06 - 2014-08-26 13:06 - 00001051 _____ () C:\Users\D\Desktop\PokerRanger.lnk

2014-08-26 13:06 - 2014-08-26 13:06 - 00000000 ____D () C:\Users\D\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PokerRanger

2014-08-26 13:06 - 2014-08-26 13:06 - 00000000 ____D () C:\Users\D\AppData\Local\PokerRanger

2014-08-26 13:06 - 2014-08-26 13:06 - 00000000 ____D () C:\Users\D\AppData\Local\CrashRpt

2014-08-26 13:06 - 2014-08-26 13:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PokerRanger

2014-08-26 13:06 - 2014-08-26 13:06 - 00000000 ____D () C:\Program Files (x86)\PokerRanger

2014-08-26 11:27 - 2014-08-26 11:27 - 28936542 _____ () C:\Users\D\Downloads\PokerRangerSetup.exe

2014-08-26 11:06 - 2014-09-07 13:30 - 09121002 _____ () C:\Windows\SysWOW64\console.log

2014-08-25 18:09 - 2014-09-16 17:29 - 00000093 _____ () C:\Users\D\AppData\Roaming\WB.CFG

2014-08-25 17:18 - 2014-08-25 17:19 - 25781712 _____ (DVDVideoSoft Ltd. ) C:\Users\D\Downloads\FreeVideoCallRecorder(1).exe

2014-08-25 17:06 - 2014-08-25 17:06 - 01040024 _____ () C:\Users\D\Downloads\Free-Video-Call-Recorder-for-Skype-lnstall.exe

2014-08-25 16:46 - 2014-08-25 16:49 - 00000000 ____D () C:\Users\D\Desktop\Playersvk

2014-08-25 14:26 - 2014-08-26 11:07 - 00000000 ____D () C:\Users\D\AppData\Local\Spotify

2014-08-25 14:26 - 2014-08-25 14:26 - 00001789 _____ () C:\Users\D\Desktop\Spotify.lnk

2014-08-25 14:26 - 2014-08-25 14:26 - 00001775 _____ () C:\Users\D\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk

2014-08-25 14:23 - 2014-09-03 19:40 - 00000000 ____D () C:\Users\D\AppData\Roaming\Spotify

2014-08-25 14:22 - 2014-08-25 14:22 - 00136352 _____ (Spotify Ltd) C:\Users\D\Downloads\SpotifySetup.exe

2014-08-19 13:21 - 2014-08-19 13:21 - 00002031 _____ () C:\Users\D\Downloads\fold_resteal_to_4-bet.pt4stat

2014-08-18 18:02 - 2014-08-18 18:02 - 00026592 _____ () C:\Users\D\Desktop\statyDefalut.ods

2014-08-18 15:30 - 2014-08-18 15:30 - 00002373 _____ () C:\Users\D\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ICMIZER.lnk

2014-08-18 15:30 - 2014-08-18 15:30 - 00002343 _____ () C:\Users\D\Desktop\ICMIZER.lnk

2014-08-18 15:27 - 2014-08-18 15:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

2014-08-18 15:27 - 2014-08-18 15:27 - 00000000 ____D () C:\Program Files\Microsoft Silverlight

2014-08-18 15:27 - 2014-08-18 15:27 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight

2014-08-18 15:26 - 2014-08-18 15:27 - 13087456 _____ (Microsoft Corporation) C:\Users\D\Downloads\Silverlight_x64.exe

2014-08-18 15:17 - 2014-08-18 15:17 - 00105442 _____ () C:\Users\D\Desktop\955019283.txt

2014-08-18 15:16 - 2014-08-18 15:16 - 00128581 _____ () C:\Users\D\Desktop\955019178.txt

2014-08-18 15:15 - 2014-08-18 15:15 - 00123720 _____ () C:\Users\D\Desktop\955003937.txt

2014-08-18 15:14 - 2014-08-18 15:14 - 00090883 _____ () C:\Users\D\Desktop\954997739.txt
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-09-17 13:15 - 2014-09-17 12:28 - 00018742 _____ () C:\Users\D\Downloads\FRST.txt

2014-09-17 13:14 - 2014-09-17 13:13 - 02105856 _____ (Farbar) C:\Users\D\Downloads\FRST64.exe

2014-09-17 13:14 - 2014-09-17 12:28 - 00000000 ____D () C:\FRST

2014-09-17 13:10 - 2014-09-17 13:10 - 00000749 _____ () C:\Users\D\Desktop\JRT.txt

2014-09-17 13:08 - 2009-07-14 06:45 - 00022576 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-09-17 13:08 - 2009-07-14 06:45 - 00022576 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-09-17 13:03 - 2014-09-17 13:03 - 00000000 ____D () C:\Windows\ERUNT

2014-09-17 13:03 - 2014-03-13 09:14 - 00000000 ____D () C:\ProgramData\Kaspersky Lab

2014-09-17 13:01 - 2014-02-24 10:39 - 00000000 ___RD () C:\Users\D\Dropbox

2014-09-17 13:01 - 2014-02-24 10:37 - 00000000 ____D () C:\Users\D\AppData\Roaming\Dropbox

2014-09-17 13:01 - 2013-11-06 19:39 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-09-17 13:01 - 2013-10-28 19:10 - 00363022 _____ () C:\Windows\PFRO.log

2014-09-17 13:01 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-09-17 13:01 - 2009-07-14 06:51 - 00037040 _____ () C:\Windows\setupact.log

2014-09-17 13:00 - 2014-09-16 17:44 - 00000000 ____D () C:\AdwCleaner

2014-09-17 13:00 - 2013-10-27 10:47 - 01450433 _____ () C:\Windows\WindowsUpdate.log

2014-09-17 12:58 - 2014-09-17 12:58 - 01016035 _____ (Thisisu) C:\Users\D\Downloads\JRT.exe

2014-09-17 12:31 - 2014-09-17 12:29 - 00000000 ____D () C:\Users\D\Desktop\trojan

2014-09-17 12:30 - 2014-09-16 17:33 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-09-17 12:29 - 2014-09-17 12:29 - 00040193 _____ () C:\Users\D\Downloads\Addition.txt

2014-09-17 12:27 - 2014-09-17 12:27 - 00000464 _____ () C:\Users\D\Downloads\defogger_disable.log

2014-09-17 12:27 - 2014-09-17 12:27 - 00000000 _____ () C:\Users\D\defogger_reenable

2014-09-17 12:27 - 2013-10-27 10:53 - 00000000 ____D () C:\Users\D

2014-09-17 12:25 - 2014-09-17 12:25 - 00380416 _____ () C:\Users\D\Downloads\Gmer-19357.exe

2014-09-17 12:25 - 2014-09-17 12:25 - 00050477 _____ () C:\Users\D\Downloads\Defogger.exe

2014-09-17 12:21 - 2014-02-20 09:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-09-16 20:18 - 2013-11-06 19:39 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-09-16 17:51 - 2014-09-16 17:51 - 02347384 _____ (ESET) C:\Users\D\Downloads\esetsmartinstaller_deu.exe

2014-09-16 17:32 - 2014-09-16 17:32 - 01373475 _____ () C:\Users\D\Downloads\AdwCleaner_3.310.exe

2014-09-16 17:32 - 2014-09-16 17:32 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-09-16 17:32 - 2014-09-16 17:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-09-16 17:32 - 2014-09-16 17:32 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-09-16 17:32 - 2014-09-16 17:32 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-09-16 17:32 - 2014-09-16 17:31 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\D\Downloads\mbam-setup-2.0.2.1012.exe

2014-09-16 17:29 - 2014-08-25 18:09 - 00000093 _____ () C:\Users\D\AppData\Roaming\WB.CFG

2014-09-15 18:50 - 2013-11-11 10:56 - 00000000 ____D () C:\Users\D\AppData\Roaming\Skype

2014-09-15 18:24 - 2014-09-15 18:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-09-15 17:02 - 2013-10-28 18:28 - 00000000 ____D () C:\Users\D\AppData\Local\PokerStars.EU

2014-09-13 12:14 - 2013-10-31 20:13 - 00000000 ____D () C:\Users\D\AppData\Roaming\TableNinja.v2

2014-09-12 19:39 - 2014-09-12 19:37 - 117931107 _____ () C:\Users\D\Desktop\Back_up_12.09.zip

2014-09-12 18:25 - 2013-10-29 19:25 - 00247722 _____ () C:\Users\D\Desktop\notes.o_S7ven_o.xml

2014-09-12 17:56 - 2013-10-28 18:29 - 00000000 ____D () C:\Program Files (x86)\PokerTracker 4

2014-09-12 17:47 - 2014-05-08 09:00 - 00000000 ____D () C:\Users\D\AppData\Roaming\DVDVideoSoft

2014-09-12 17:43 - 2014-09-12 17:42 - 00007595 _____ () C:\Users\D\AppData\Local\Resmon.ResmonCfg

2014-09-12 17:23 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-09-12 17:06 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-09-12 16:28 - 2013-10-28 19:34 - 00000000 ____D () C:\Users\postgres

2014-09-11 22:59 - 2013-10-28 19:20 - 01593956 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI

2014-09-11 22:59 - 2009-07-14 19:58 - 00699416 _____ () C:\Windows\system32\perfh007.dat

2014-09-11 22:59 - 2009-07-14 19:58 - 00149556 _____ () C:\Windows\system32\perfc007.dat

2014-09-11 22:59 - 2009-07-14 07:13 - 01593956 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-09-11 22:58 - 2013-10-28 19:49 - 00000000 ____D () C:\Windows\system32\MRT

2014-09-11 22:40 - 2013-10-28 19:49 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-09-11 22:39 - 2014-05-07 03:01 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-09-07 13:30 - 2014-08-26 11:06 - 09121002 _____ () C:\Windows\SysWOW64\console.log

2014-09-07 13:20 - 2014-09-07 13:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security Task Manager

2014-09-07 13:20 - 2014-09-07 13:20 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager

2014-09-07 13:19 - 2014-09-07 13:19 - 02365840 _____ () C:\Users\D\Downloads\SecurityTaskManager_Setup.exe

2014-09-05 04:10 - 2014-09-11 14:26 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-09-05 04:05 - 2014-09-11 14:26 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-09-04 17:20 - 2014-01-23 18:01 - 00000000 ____D () C:\Users\D\AppData\Local\Equilab

2014-09-03 19:40 - 2014-08-25 14:23 - 00000000 ____D () C:\Users\D\AppData\Roaming\Spotify

2014-08-30 09:06 - 2013-10-28 18:28 - 00000000 ____D () C:\Program Files (x86)\PokerStars.EU

2014-08-29 11:21 - 2009-07-14 06:45 - 00298320 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-08-26 13:06 - 2014-08-26 13:06 - 00001075 _____ () C:\Users\D\AppData\Roaming\Microsoft\Windows\Start Menu\PokerRanger.lnk

2014-08-26 13:06 - 2014-08-26 13:06 - 00001051 _____ () C:\Users\postgres\Desktop\PokerRanger.lnk

2014-08-26 13:06 - 2014-08-26 13:06 - 00001051 _____ () C:\Users\D\Desktop\PokerRanger.lnk

2014-08-26 13:06 - 2014-08-26 13:06 - 00000000 ____D () C:\Users\D\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PokerRanger

2014-08-26 13:06 - 2014-08-26 13:06 - 00000000 ____D () C:\Users\D\AppData\Local\PokerRanger

2014-08-26 13:06 - 2014-08-26 13:06 - 00000000 ____D () C:\Users\D\AppData\Local\CrashRpt

2014-08-26 13:06 - 2014-08-26 13:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PokerRanger

2014-08-26 13:06 - 2014-08-26 13:06 - 00000000 ____D () C:\Program Files (x86)\PokerRanger

2014-08-26 11:27 - 2014-08-26 11:27 - 28936542 _____ () C:\Users\D\Downloads\PokerRangerSetup.exe

2014-08-26 11:07 - 2014-08-25 14:26 - 00000000 ____D () C:\Users\D\AppData\Local\Spotify

2014-08-25 17:19 - 2014-08-25 17:18 - 25781712 _____ (DVDVideoSoft Ltd. ) C:\Users\D\Downloads\FreeVideoCallRecorder(1).exe

2014-08-25 17:06 - 2014-08-25 17:06 - 01040024 _____ () C:\Users\D\Downloads\Free-Video-Call-Recorder-for-Skype-lnstall.exe

2014-08-25 16:49 - 2014-08-25 16:46 - 00000000 ____D () C:\Users\D\Desktop\Playersvk

2014-08-25 16:49 - 2014-01-27 14:47 - 00002217 _____ () C:\Users\D\URPreferences.xml

2014-08-25 14:26 - 2014-08-25 14:26 - 00001789 _____ () C:\Users\D\Desktop\Spotify.lnk

2014-08-25 14:26 - 2014-08-25 14:26 - 00001775 _____ () C:\Users\D\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk

2014-08-25 14:22 - 2014-08-25 14:22 - 00136352 _____ (Spotify Ltd) C:\Users\D\Downloads\SpotifySetup.exe

2014-08-23 11:51 - 2013-10-28 18:35 - 00000000 ____D () C:\Users\D\AppData\Local\In The Money

2014-08-23 04:07 - 2014-08-28 14:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll

2014-08-23 03:45 - 2014-08-28 14:23 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll

2014-08-23 02:59 - 2014-08-28 14:23 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-08-22 12:43 - 2013-11-11 10:56 - 00000000 ____D () C:\ProgramData\Skype

2014-08-19 20:05 - 2014-09-11 23:01 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-08-19 19:39 - 2014-09-11 23:01 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-08-19 13:21 - 2014-08-19 13:21 - 00002031 _____ () C:\Users\D\Downloads\fold_resteal_to_4-bet.pt4stat

2014-08-19 01:01 - 2014-09-11 23:01 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-08-19 00:29 - 2014-09-11 23:01 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-08-19 00:29 - 2014-09-11 23:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-08-19 00:26 - 2014-09-11 23:01 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-08-19 00:20 - 2014-09-11 23:01 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-08-19 00:19 - 2014-09-11 23:01 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-08-19 00:15 - 2014-09-11 23:01 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-08-19 00:15 - 2014-09-11 23:01 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-08-19 00:14 - 2014-09-11 23:01 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-08-19 00:14 - 2014-09-11 23:01 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-08-19 00:08 - 2014-09-11 23:01 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-08-19 00:08 - 2014-09-11 23:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-08-19 00:08 - 2014-09-11 23:01 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-08-19 00:05 - 2014-09-11 23:01 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-08-19 00:03 - 2014-09-11 23:01 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-08-19 00:03 - 2014-09-11 23:01 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-08-19 00:03 - 2014-09-11 23:01 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-08-18 23:57 - 2014-09-11 23:01 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-08-18 23:56 - 2014-09-11 23:01 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-08-18 23:51 - 2014-09-11 23:01 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-08-18 23:46 - 2014-09-11 23:01 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-08-18 23:45 - 2014-09-11 23:01 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-08-18 23:45 - 2014-09-11 23:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-08-18 23:44 - 2014-09-11 23:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-08-18 23:44 - 2014-09-11 23:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-08-18 23:42 - 2014-09-11 23:01 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-08-18 23:40 - 2014-09-11 23:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-08-18 23:39 - 2014-09-11 23:01 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-08-18 23:39 - 2014-09-11 23:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-08-18 23:39 - 2014-09-11 23:01 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-08-18 23:38 - 2014-09-11 23:01 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-08-18 23:37 - 2014-09-11 23:01 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-08-18 23:36 - 2014-09-11 23:01 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-08-18 23:35 - 2014-09-11 23:01 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-08-18 23:27 - 2014-09-11 23:01 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-08-18 23:25 - 2014-09-11 23:01 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-08-18 23:25 - 2014-09-11 23:01 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-08-18 23:23 - 2014-09-11 23:01 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-08-18 23:23 - 2014-09-11 23:01 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-08-18 23:22 - 2014-09-11 23:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-08-18 23:19 - 2014-09-11 23:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-08-18 23:17 - 2014-09-11 23:01 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-08-18 23:17 - 2014-09-11 23:01 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-08-18 23:16 - 2014-09-11 23:01 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-08-18 23:15 - 2014-09-11 23:01 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-08-18 23:15 - 2014-09-11 23:01 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-08-18 23:09 - 2014-09-11 23:01 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-08-18 23:08 - 2014-09-11 23:01 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-08-18 23:07 - 2014-09-11 23:01 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-08-18 22:55 - 2014-09-11 23:01 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-08-18 22:46 - 2014-09-11 23:01 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-08-18 22:38 - 2014-09-11 23:01 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-08-18 22:38 - 2014-09-11 23:01 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-08-18 22:36 - 2014-09-11 23:01 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-08-18 18:02 - 2014-08-18 18:02 - 00026592 _____ () C:\Users\D\Desktop\statyDefalut.ods

2014-08-18 15:30 - 2014-08-18 15:30 - 00002373 _____ () C:\Users\D\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ICMIZER.lnk

2014-08-18 15:30 - 2014-08-18 15:30 - 00002343 _____ () C:\Users\D\Desktop\ICMIZER.lnk

2014-08-18 15:27 - 2014-08-18 15:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

2014-08-18 15:27 - 2014-08-18 15:27 - 00000000 ____D () C:\Program Files\Microsoft Silverlight

2014-08-18 15:27 - 2014-08-18 15:27 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight

2014-08-18 15:27 - 2014-08-18 15:26 - 13087456 _____ (Microsoft Corporation) C:\Users\D\Downloads\Silverlight_x64.exe

2014-08-18 15:17 - 2014-08-18 15:17 - 00105442 _____ () C:\Users\D\Desktop\955019283.txt

2014-08-18 15:16 - 2014-08-18 15:16 - 00128581 _____ () C:\Users\D\Desktop\955019178.txt

2014-08-18 15:15 - 2014-08-18 15:15 - 00123720 _____ () C:\Users\D\Desktop\955003937.txt

2014-08-18 15:14 - 2014-08-18 15:14 - 00090883 _____ () C:\Users\D\Desktop\954997739.txt
 

Some content of TEMP:

====================

C:\Users\D\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpmjn657.dll

C:\Users\D\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-09-11 17:35
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Kannst du die gestrigen adwCleaner logs bitte auch posten?

und auch bitte ne ne addition.txt von FRST erstellenm

Logo

Code:

# AdwCleaner v3.310 - Bericht erstellt am 16/09/2014 um 17:44:25

# Aktualisiert 12/09/2014 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzername : D - D-PC

# Gestartet von : C:\Users\D\Downloads\AdwCleaner_3.310.exe

# Option : Suchen
 

***** [ Dienste ] *****
 

Dienst Gefunden : CltMngSvc

Dienst Gefunden : SPPD
 

***** [ Dateien / Ordner ] *****
 

Datei Gefunden : C:\Users\D\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ifohbjbgfchkkfhphahclmkpgejiplfo_0.localstorage

Datei Gefunden : C:\Users\D\AppData\Roaming\Mozilla\Firefox\Profiles\pgcy5hwm.default\user.js

Datei Gefunden : C:\Windows\System32\roboot64.exe

Ordner Gefunden : C:\Program Files (x86)\MyPC Backup

Ordner Gefunden : C:\Program Files (x86)\SearchProtect

Ordner Gefunden : C:\ProgramData\apn

Ordner Gefunden : C:\ProgramData\PriceMeterLiveUpdate

Ordner Gefunden : C:\ProgramData\SecTaskMan

Ordner Gefunden : C:\Users\D\AppData\Local\PriceMeterLiveUpdate

Ordner Gefunden : C:\Users\D\AppData\Local\SearchProtect

Ordner Gefunden : C:\Users\D\AppData\Roaming\Systweak
 

***** [ Tasks ] *****
 
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Daten Gefunden : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command [(Default)] - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.dosearches.com/?utm_source=b&utm_medium=cor&utm_campaign=rg&utm_content=sc&from=cor&uid=ST3500418AS_Z3T263CRXXXXZ3T263CR&ts=1384160065

Daten Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\SPVC32~1.DLL

Daten Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\SPVC64~1.DLL

Schlüssel Gefunden : HKCU\Software\ClickConnect

Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\www.superfish.com

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{41564952-412D-5637-00A7-7A786E7484D7}

Schlüssel Gefunden : HKCU\Software\PriceMeterLiveUpdate

Schlüssel Gefunden : HKCU\Software\PriceMeterUpdater

Schlüssel Gefunden : [x64] HKCU\Software\ClickConnect

Schlüssel Gefunden : [x64] HKCU\Software\PriceMeterLiveUpdate

Schlüssel Gefunden : [x64] HKCU\Software\PriceMeterUpdater

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASAPI32

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASMANCS

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\updateBatBrowse_RASAPI32

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\updateBatBrowse_RASMANCS

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PriceMeterLiveUpdate.exe

Schlüssel Gefunden : HKLM\SOFTWARE\PriceMeterLiveUpdate

Schlüssel Gefunden : HKLM\SOFTWARE\systweak

Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{41564952-412D-5637-00A7-7A786E7484D7}

Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{41564952-412D-5637-00A7-7A786E7484D7}]
 

***** [ Browser ] *****
 

-\\ Internet Explorer v11.0.9600.17280
 

Einstellung Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL] - hxxp://search.dosearches.com/web/?utm_source=b&utm_medium=cor&utm_campaign=rg&utm_content=ds&from=cor&uid=ST3500418AS_Z3T263CRXXXXZ3T263CR&ts=1384160065&type=default&q={searchTerms}

Einstellung Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page] - hxxp://search.dosearches.com/web/?utm_source=b&utm_medium=cor&utm_campaign=rg&utm_content=ds&from=cor&uid=ST3500418AS_Z3T263CRXXXXZ3T263CR&ts=1384160065&type=default&q={searchTerms}

Einstellung Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL] - hxxp://search.dosearches.com/web/?utm_source=b&utm_medium=cor&utm_campaign=rg&utm_content=ds&from=cor&uid=ST3500418AS_Z3T263CRXXXXZ3T263CR&ts=1384160065&type=default&q={searchTerms}

Einstellung Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page] - hxxp://search.dosearches.com/web/?utm_source=b&utm_medium=cor&utm_campaign=rg&utm_content=ds&from=cor&uid=ST3500418AS_Z3T263CRXXXXZ3T263CR&ts=1384160065&type=default&q={searchTerms}
 

-\\ Mozilla Firefox v31.0 (x86 de)
 

[ Datei : C:\Users\D\AppData\Roaming\Mozilla\Firefox\Profiles\pgcy5hwm.default\prefs.js ]
 
 

-\\ Google Chrome v37.0.2062.120
 

[ Datei : C:\Users\D\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 

Gefunden [Search Provider] : hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=MEC469C70-6769-4A41-9BB8-D7ADAEB0447A&SearchSource=58&CUI=&UM=5&UP=SPC31D573B-DBDC-4A83-9313-02744CEAAB63&q={searchTerms}&SSPV=

Gefunden [Search Provider] : hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=MEC469C70-6769-4A41-9BB8-D7ADAEB0447A&SearchSource=58&CUI=&UM=5&UP=SPC31D573B-DBDC-4A83-9313-02744CEAAB63&q={searchTerms}&SSPV=

Gefunden [Extension] : booedmolknjekdopkepjjeckmjkdpfgl

Gefunden [Extension] : flpcjncodpafbgdpnkljologafpionhb
 

*************************
 

AdwCleaner[R0].txt - [5296 octets] - [16/09/2014 17:44:25]
 

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [5356 octets] ##########

Code:

# AdwCleaner v3.310 - Bericht erstellt am 16/09/2014 um 17:46:23

# Aktualisiert 12/09/2014 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzername : D - D-PC

# Gestartet von : C:\Users\D\Downloads\AdwCleaner_3.310.exe

# Option : Löschen
 

***** [ Dienste ] *****
 

Dienst Gelöscht : CltMngSvc

[#] Dienst Gelöscht : SPPD
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : C:\ProgramData\apn

Ordner Gelöscht : C:\ProgramData\PriceMeterLiveUpdate

Ordner Gelöscht : C:\ProgramData\SecTaskMan

Ordner Gelöscht : C:\Program Files (x86)\MyPC Backup

Ordner Gelöscht : C:\Program Files (x86)\SearchProtect

Ordner Gelöscht : C:\Users\D\AppData\Local\PriceMeterLiveUpdate

[!] Ordner Gelöscht : C:\Users\D\AppData\Local\SearchProtect

Ordner Gelöscht : C:\Users\D\AppData\Roaming\Systweak

Datei Gelöscht : C:\Windows\System32\roboot64.exe

Datei Gelöscht : C:\Users\D\AppData\Roaming\Mozilla\Firefox\Profiles\pgcy5hwm.default\user.js

Datei Gelöscht : C:\Users\D\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ifohbjbgfchkkfhphahclmkpgejiplfo_0.localstorage
 

***** [ Tasks ] *****
 
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\www.superfish.com

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\updateBatBrowse_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\updateBatBrowse_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{41564952-412D-5637-00A7-7A786E7484D7}

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{41564952-412D-5637-00A7-7A786E7484D7}]

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{41564952-412D-5637-00A7-7A786E7484D7}

Daten Wiederhergestellt : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command

Schlüssel Gelöscht : HKCU\Software\ClickConnect

Schlüssel Gelöscht : HKCU\Software\PriceMeterLiveUpdate

Schlüssel Gelöscht : HKCU\Software\PriceMeterUpdater

Schlüssel Gelöscht : HKLM\SOFTWARE\PriceMeterLiveUpdate

Schlüssel Gelöscht : HKLM\SOFTWARE\systweak

Daten Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\SPVC32~1.DLL

Daten Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\SPVC64~1.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PriceMeterLiveUpdate.exe
 

***** [ Browser ] *****
 

-\\ Internet Explorer v11.0.9600.17280
 

Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]

Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]

Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]

Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
 

-\\ Mozilla Firefox v31.0 (x86 de)
 

[ Datei : C:\Users\D\AppData\Roaming\Mozilla\Firefox\Profiles\pgcy5hwm.default\prefs.js ]
 

Zeile gelöscht : user_pref("browser.search.selectedEngine", "Trovi search");

Zeile gelöscht : user_pref("browser.newtab.url", "hxxp://search.conduit.com/?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=MEC469C70-6769-4A41-9BB8-D7ADAEB0447A&SearchSource=69&CUI=&SSPV=&Lay=1&UM=5&UP=SPC31D573B-DBD[...]
 

-\\ Google Chrome v37.0.2062.120
 

[ Datei : C:\Users\D\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 

Gelöscht [Search Provider] : hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=MEC469C70-6769-4A41-9BB8-D7ADAEB0447A&SearchSource=58&CUI=&UM=5&UP=SPC31D573B-DBDC-4A83-9313-02744CEAAB63&q={searchTerms}&SSPV=

Gelöscht [Search Provider] : hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=MEC469C70-6769-4A41-9BB8-D7ADAEB0447A&SearchSource=58&CUI=&UM=5&UP=SPC31D573B-DBDC-4A83-9313-02744CEAAB63&q={searchTerms}&SSPV=

Gelöscht [Startup_urls] : hxxp://search.conduit.com/?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=MEC469C70-6769-4A41-9BB8-D7ADAEB0447A&SearchSource=55&CUI=&UM=5&UP=SPC31D573B-DBDC-4A83-9313-02744CEAAB63&SSPV=

Gelöscht [Homepage] : hxxp://search.conduit.com/?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=MEC469C70-6769-4A41-9BB8-D7ADAEB0447A&SearchSource=55&CUI=&UM=5&UP=SPC31D573B-DBDC-4A83-9313-02744CEAAB63&SSPV=

Gelöscht [Extension] : booedmolknjekdopkepjjeckmjkdpfgl

Gelöscht [Extension] : flpcjncodpafbgdpnkljologafpionhb
 

*************************
 

AdwCleaner[R0].txt - [5464 octets] - [16/09/2014 17:44:25]

AdwCleaner[S0].txt - [5024 octets] - [16/09/2014 17:46:23]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5084 octets] ##########

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-09-2014

Ran by D at 2014-09-17 13:26:59

Running from C:\Users\D\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}

AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.44 - Adobe Systems Incorporated)

Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.08) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)

Akamai NetSession Interface (HKCU\...\Akamai) (Version:  - Akamai Technologies, Inc)

AMD Accelerated Video Transcoding (Version: 13.30.100.40417 - Advanced Micro Devices, Inc.) Hidden

AMD Catalyst Control Center (x32 Version: 2014.0417.2226.38446 - Ihr Firmenname) Hidden

AMD Catalyst Install Manager (HKLM\...\{6119B3A6-3603-9695-0398-CDF2AF0A13F8}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)

AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden

AMD Wireless Display v3.0 (Version: 1.0.0.15 - Advanced Micro Devices, Inc.) Hidden

Apple Application Support (HKLM-x32\...\{21FC2093-6E43-460B-B9B0-5F5AA35BBB0F}) (Version: 3.0 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{FE86CB0C-FCB3-4358-B4B0-B0A41E33B3DD}) (Version: 7.1.0.32 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

AVM FRITZ!fax für FRITZ!Box (HKLM-x32\...\FRITZ! 2.0) (Version:  - AVM Berlin)

Boot Camp-Dienste (HKLM\...\{FA2B2C2A-EA41-495A-9308-60726125D562}) (Version: 5.0.5033 - Apple Inc.)

Canon Easy-WebPrint EX (HKLM-x32\...\Easy-WebPrint EX) (Version: 1.3.5.0 - Canon Inc.)

Canon IJ Network Scanner Selector EX (HKLM-x32\...\Canon_IJ_Network_Scanner_Selector_EX) (Version:  - ‪Canon Inc.‬)

Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version: 3.1.0 - Canon Inc.)

Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version:  - ‪Canon Inc.‬)

Canon MG5400 series Benutzerregistrierung (HKLM-x32\...\Canon MG5400 series Benutzerregistrierung) (Version:  - Canon Inc.‎)

Canon MG5400 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5400_series) (Version: 1.00 - Canon Inc.)

Canon MG5400 series On-screen Manual (HKLM-x32\...\Canon MG5400 series On-screen Manual) (Version: 7.5.0 - Canon Inc.)

Canon My Image Garden (HKLM-x32\...\Canon My Image Garden) (Version: 1.0.0 - Canon Inc.)

Canon My Image Garden Design Files (HKLM-x32\...\Canon My Image Garden Design Files) (Version: 1.0.0 - Canon Inc.)

Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: 3.0.0 - Canon Inc.)

Canon Quick Menu (HKLM-x32\...\CanonQuickMenu) (Version: 2.0.0 - Canon Inc.)

Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center Graphics Previews Common (x32 Version: 2014.0417.2226.38446 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center InstallProxy (x32 Version: 2014.0417.2226.38446 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center Localization All (x32 Version: 2014.0417.2226.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Chinese Standard (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Chinese Traditional (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Czech (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Danish (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Dutch (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help English (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Finnish (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help French (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help German (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Greek (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Hungarian (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Italian (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Japanese (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Korean (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Norwegian (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Polish (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Portuguese (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Russian (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Spanish (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Swedish (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Thai (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

CCC Help Turkish (x32 Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden

ccc-utility64 (Version: 2014.0417.2226.38446 - Advanced Micro Devices, Inc.) Hidden

Dropbox (HKCU\...\Dropbox) (Version: 2.10.27 - Dropbox, Inc.)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 37.0.2062.120 - Google Inc.)

Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden

HoldemResources Calculator (HKLM-x32\...\HoldemResources Calculator) (Version: release - HoldemResources)

ICMIZER (HKCU\...\1396580509.www.icmpoker.com) (Version:  - www.icmpoker.com)

Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.0.1351 - Intel Corporation)

iTunes (HKLM\...\{96B53CA8-5ABB-49D8-96F1-F6C0D73A76C6}) (Version: 11.1.4.62 - Apple Inc.)

Java 7 Update 17 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417017FF}) (Version: 7.0.170 - Oracle)

Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.670 - Oracle)

Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) Hidden

Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{6F6873E3-5C92-4049-B511-231A138DD090}) (Version: 14.0.0.4651 - Kaspersky Lab)

Kaspersky Internet Security (x32 Version: 14.0.0.4651 - Kaspersky Lab) Hidden

Logitech SetPoint 6.65 (HKLM\...\sp6) (Version: 6.65.62 - Logitech)

Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)

Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden

Mozilla Firefox 32.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.1 (x86 de)) (Version: 32.0.1 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)

OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)

PokerRanger  (HKLM-x32\...\PokerRanger) (Version:  - Michael A. Voelkel)

PokerStars.eu (HKLM-x32\...\PokerStars.eu) (Version:  - PokerStars.eu)

PokerStrategy.com Equilab (HKLM-x32\...\{86D09F48-CDAB-4B4C-8806-F6C16F17935A}) (Version: 1.2.8.0 - PokerStrategy.com)

PokerTracker 4 (remove only) (HKLM-x32\...\PokerTracker4) (Version:  - )

PostgreSQL 9.0  (HKLM\...\PostgreSQL 9.0) (Version: 9.0 - PostgreSQL Global Development Group)

PostgreSQL 9.3  (HKLM\...\PostgreSQL 9.3) (Version: 9.3 - PostgreSQL Global Development Group)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5936 - Realtek Semiconductor Corp.)

Security Task Manager 1.8g (HKLM-x32\...\Security Task Manager) (Version: 1.8g - Neuber Software)

SitNGo Wizard (HKLM-x32\...\SitNGoWizard) (Version:  - In The Money LLC)

SitNGo Wizard 2 (HKLM-x32\...\SitNGoWizard2) (Version:  - )

Skype™ 6.18 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.)

Spotify (HKCU\...\Spotify) (Version: 0.9.12.10.g89b2a4fc - Spotify AB)

TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.28223 - TeamViewer)

TN2 (HKLM-x32\...\{6B636FF5-14E8-48DD-A251-6C6FF0C761A7}) (Version: 2.3.93 - PASG)

Windows-Treiberpaket - Apple Inc. (AppleUSBEthernet) Net  (02/01/2008 3.10.3.10) (HKLM\...\D53CBF2C12DF51DA5E9C1A9DA97FF0DCA0C524C5) (Version: 02/01/2008 3.10.3.10 - Apple Inc.)

Windows-Treiberpaket - Apple Inc. Apple Bluetooth (03/01/2010 3.0.0.5) (HKLM\...\EA3C044F6FD39CEC8F4F596836BF4197E97E1D39) (Version: 03/01/2010 3.0.0.5 - Apple Inc.)

Windows-Treiberpaket - Apple Inc. Apple Broadcom Bluetooth (10/29/2012 5.0.1.0) (HKLM\...\790D7FBB22FD6EA6B526D13ABE02EA921C86BB4A) (Version: 10/29/2012 5.0.1.0 - Apple Inc.)

Windows-Treiberpaket - Apple Inc. Apple Display (01/23/2009 3.0.0.0) (HKLM\...\E0EAD0CEA9119B77350ED4DE28D9A82E57014D94) (Version: 01/23/2009 3.0.0.0 - Apple Inc.)

Windows-Treiberpaket - Apple Inc. Apple IR Receiver (02/21/2008 2.0.4.0) (HKLM\...\D5BB697E7D0C75712F3AD00AB1B85412CB5C0FD3) (Version: 02/21/2008 2.0.4.0 - Apple Inc.)

Windows-Treiberpaket - Apple Inc. Apple Keyboard (10/29/2012 5.0.3.0) (HKLM\...\59357B4067FCABD09BD751BD9A00336CF05B2E22) (Version: 10/29/2012 5.0.3.0 - Apple Inc.)

Windows-Treiberpaket - Apple Inc. Apple Multitouch (09/11/2012 4.0.3.0) (HKLM\...\B374E899604BD9007FF7564A07F627CCDA58763C) (Version: 09/11/2012 4.0.3.0 - Apple Inc.)

Windows-Treiberpaket - Apple Inc. Apple Multitouch Mouse (09/11/2012 4.0.3.0) (HKLM\...\742CB1BDA52EA9F1BBE482DA6DAA17944652B476) (Version: 09/11/2012 4.0.3.0 - Apple Inc.)

Windows-Treiberpaket - Apple Inc. Apple ODD (05/17/2010 3.1.0.0) (HKLM\...\D6B4CB6AD2F81752C2EF8DCF6AD5EBC567ADD45C) (Version: 05/17/2010 3.1.0.0 - Apple Inc.)

Windows-Treiberpaket - Apple Inc. Apple System Device (08/28/2012 5.0.0.0) (HKLM\...\051EC488BEF1D02E9051B188C43B026A88E197E5) (Version: 08/28/2012 5.0.0.0 - Apple Inc.)

Windows-Treiberpaket - Apple Inc. Apple Wireless Mouse (06/01/2011 4.0.0.1) (HKLM\...\D088EE4BD2819FBA2B349EF9D55176F223419BE6) (Version: 06/01/2011 4.0.0.1 - Apple Inc.)

Windows-Treiberpaket - Apple Inc. Apple Wireless Trackpad (10/29/2011 5.0.0.0) (HKLM\...\551732BB0872DA97E26385C221B172A5BD4DE93C) (Version: 10/29/2011 5.0.0.0 - Apple Inc.)

Windows-Treiberpaket - Atheros Communications Inc. (athr) Net  (11/13/2010 9.2.0.113) (HKLM\...\F0A3F8394866FA91E82C8D5AB92C918FE40FE1DF) (Version: 11/13/2010 9.2.0.113 - Atheros Communications Inc.)

Windows-Treiberpaket - Broadcom (b57nd60a) Net  (09/04/2012 15.4.0.17) (HKLM\...\75E64992A03EC5E73D33586790CC506561DCC5DB) (Version: 09/04/2012 15.4.0.17 - Broadcom)

Windows-Treiberpaket - Broadcom (B57ports) Net  (06/16/2009 1.0.0.1) (HKLM\...\FC2077892425ED71A137B1CB6D99A9CA7475435D) (Version: 06/16/2009 1.0.0.1 - Broadcom)

Windows-Treiberpaket - Broadcom (BCM43XX) Net  (11/13/2012 5.106.199.1) (HKLM\...\3D6DDDCF8961C8C866F6660579A59B5B6CFA281F) (Version: 11/13/2012 5.106.199.1 - Broadcom)

Windows-Treiberpaket - Broadcom Corporation (bScsiSDa) SDHost  (08/14/2012 1.0.0.243) (HKLM\...\ADF3AD5C5705E56E7DEA1447D58EFF216BA1223D) (Version: 08/14/2012 1.0.0.243 - Broadcom Corporation)

Windows-Treiberpaket - Cirrus Logic, Inc. (CirrusFilter) MEDIA  (11/09/2012 6.6001.1.38) (HKLM\...\907F370097451D1FE9BF31A43BF04CDAF69407D4) (Version: 11/09/2012 6.6001.1.38 - Cirrus Logic, Inc.)

Windows-Treiberpaket - Intel (e1express) Net  (03/26/2010 9.13.41.0) (HKLM\...\159439476E3A00F9FAE49DD6C1A78F2F6288A5B9) (Version: 03/26/2010 9.13.41.0 - Intel)

Windows-Treiberpaket - Intel (e1kexpress) Net  (04/12/2010 11.6.92.0) (HKLM\...\5BEF08C10896D86DC13394FFA75874564B700368) (Version: 04/12/2010 11.6.92.0 - Intel)

Windows-Treiberpaket - Intel (e1qexpress) Net  (12/04/2009 11.4.7.0) (HKLM\...\57AFA39B22ADEC4E383572E9331167546EB3C9C7) (Version: 12/04/2009 11.4.7.0 - Intel)

Windows-Treiberpaket - Intel (e1rexpress) Net  (01/07/2010 11.4.16.0) (HKLM\...\F71DB41300D30088C8D3716343D1429488E605C1) (Version: 01/07/2010 11.4.16.0 - Intel)

Windows-Treiberpaket - Intel (e1yexpress) Net  (04/07/2010 10.1.9.0) (HKLM\...\CB599752301BCA080D135697FDD05900F5A5CF4C) (Version: 04/07/2010 10.1.9.0 - Intel)

Windows-Treiberpaket - Intel System  (07/20/2007 1.2.76.0) (HKLM\...\E2708073906571A0B56F17FD825EF19281ECE29B) (Version: 07/20/2007 1.2.76.0 - Intel)

Windows-Treiberpaket - Marvell (yukonx64) Net  (12/06/2007 10.51.1.3) (HKLM\...\CDD703ED0B390A5643DB748EBFA5BD55FEEC0D8A) (Version: 12/06/2007 10.51.1.3 - Marvell)

Windows-Treiberpaket - NVIDIA Corporation (NVHDA) MEDIA  (07/03/2012 1.3.18.0) (HKLM\...\B46A8C1640335CA36A800E2C6D832964F6F58B54) (Version: 07/03/2012 1.3.18.0 - NVIDIA Corporation)
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 

CustomCLSID: HKU\S-1-5-21-1933391480-3615603964-130723930-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\D\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-1933391480-3615603964-130723930-1000_Classes\CLSID\{087B3AE3-E237-4467-B8DB-5A38AB959AC9}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)

CustomCLSID: HKU\S-1-5-21-1933391480-3615603964-130723930-1000_Classes\CLSID\{3B092F0C-7696-40E3-A80F-68D74DA84210}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)

CustomCLSID: HKU\S-1-5-21-1933391480-3615603964-130723930-1000_Classes\CLSID\{63542C48-9552-494A-84F7-73AA6A7C99C1}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)

CustomCLSID: HKU\S-1-5-21-1933391480-3615603964-130723930-1000_Classes\CLSID\{7BC0E710-5703-45BE-A29D-5D46D8B39262}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\ooofilt_x64.dll (Apache Software Foundation)

CustomCLSID: HKU\S-1-5-21-1933391480-3615603964-130723930-1000_Classes\CLSID\{AE424E85-F6DF-4910-A6A9-438797986431}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\propertyhdl_x64.dll (Apache Software Foundation)

CustomCLSID: HKU\S-1-5-21-1933391480-3615603964-130723930-1000_Classes\CLSID\{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)

CustomCLSID: HKU\S-1-5-21-1933391480-3615603964-130723930-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\D\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-1933391480-3615603964-130723930-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\D\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-1933391480-3615603964-130723930-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\D\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-1933391480-3615603964-130723930-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\D\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-1933391480-3615603964-130723930-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\D\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-1933391480-3615603964-130723930-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\D\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-1933391480-3615603964-130723930-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\D\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-1933391480-3615603964-130723930-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\D\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
 

==================== Restore Points  =========================
 

11-09-2014 20:38:45 Windows Update

12-09-2014 15:47:20 ICM Trainer wird entfernt

14-09-2014 01:00:24 Windows Update
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {19DA5194-A310-41F9-8CE9-4E7263BC4238} - System32\Tasks\{2CB3B094-EDB0-4CA1-8C2A-D3146497C653} => C:\Program Files (x86)\REFLEX\RMK.exe

Task: {3C2D41BB-CFB6-4C7F-BE3D-1E9492A6B63A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-11-06] (Google Inc.)

Task: {3D659369-7E16-4F36-A6A1-8F844A2B88D5} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-11-06] (Google Inc.)

Task: {405C3F39-21B3-4B1A-ACB1-692C2811704A} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {C2576898-861C-4E6E-9683-98D9F2EFD306} - System32\Tasks\{75E4B347-B7CB-4DEB-BEAE-F67FC6F3D9D4} => C:\Program Files (x86)\REFLEX\REFLEX.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 

==================== Loaded Modules (whitelisted) =============
 

2013-12-19 15:27 - 2006-02-23 12:35 - 00020480 _____ () C:\Windows\System32\FritzColorPort64.dll

2013-12-19 15:27 - 2006-02-22 10:39 - 00020480 _____ () C:\Windows\System32\FritzPort64.dll

2013-01-16 18:55 - 2013-01-16 18:55 - 00226144 _____ () C:\Windows\system32\AppleOSSMgr.exe

2013-10-28 19:33 - 2013-10-08 11:21 - 00218624 _____ () C:\Program Files\PostgreSQL\9.0\bin\LIBPQ.dll

2013-10-28 19:33 - 2012-08-14 14:02 - 02258432 _____ () C:\Program Files\PostgreSQL\9.0\bin\libxml2.dll

2013-10-28 18:51 - 2013-10-08 09:23 - 00177664 _____ () C:\Program Files\PostgreSQL\9.3\bin\LIBPQ.dll

2013-10-28 18:51 - 2012-08-14 15:31 - 01328128 _____ () C:\Program Files\PostgreSQL\9.3\bin\libxml2.dll

2014-02-06 01:52 - 2014-02-06 01:52 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2014-02-06 01:52 - 2014-02-06 01:52 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2013-06-17 13:35 - 2013-06-17 13:35 - 00478400 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\dblite.dll

2013-05-08 15:52 - 2013-05-08 15:52 - 01270464 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\kpcengine.2.3.dll

2014-09-17 13:01 - 2014-09-17 13:01 - 00043008 _____ () c:\users\d\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpmjn657.dll

2013-08-23 21:01 - 2013-08-23 21:01 - 25100288 _____ () C:\Users\D\AppData\Roaming\Dropbox\bin\libcef.dll

2013-10-27 10:59 - 2013-01-02 13:23 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

2014-09-15 18:24 - 2014-09-15 18:24 - 03716720 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 

MSCONFIG\startupfolder: C:^Users^D^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk => C:\Windows\pss\Dropbox.lnk.Startup

MSCONFIG\startupreg: CanonQuickMenu => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE /logon

MSCONFIG\startupreg: DVSSkypeRecorder => "C:\Program Files (x86)\DVDVideoSoft\Free Video Call Recorder for Skype\skyui.exe" /minimized

MSCONFIG\startupreg: IJNetworkScannerSelectorEX => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe /FORCE

MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

MSCONFIG\startupreg: Spotify => "C:\Users\D\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart

MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\D\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"

MSCONFIG\startupreg: StartCCC => "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
 

==================== Faulty Device Manager Devices =============
 

Name: Microsoft-Adapter für Miniports virtueller WiFis

Description: Microsoft-Adapter für Miniports virtueller WiFis

Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}

Manufacturer: Microsoft

Service: vwifimp

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 
 

==================== Event log errors: =========================
 

Application errors:

==================
 

System errors:

=============
 

Microsoft Office Sessions:

=========================
 

CodeIntegrity Errors:

===================================

  Date: 2014-09-14 03:49:27.745

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-09-14 03:49:27.729

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-09-14 03:49:27.729

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-09-14 03:49:27.714

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-09-14 03:49:27.714

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-09-14 03:49:27.698

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-09-13 00:09:52.035

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-09-13 00:09:52.033

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-09-13 00:09:52.030

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-09-13 00:09:51.994

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 
 

==================== Memory info =========================== 
 

Processor: Intel(R) Core(TM) i5-2400S CPU @ 2.50GHz

Percentage of memory in use: 43%

Total physical RAM: 4071.73 MB

Available physical RAM: 2320.3 MB

Total Pagefile: 8141.65 MB

Available Pagefile: 5311.95 MB

Total Virtual: 8192 MB

Available Virtual: 8191.83 MB
 

==================== Drives ================================
 

Drive c: (BOOTCAMP) (Fixed) (Total:139.7 GB) (Free:69.25 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

Drive e: (Macintosh HD) (Fixed) (Total:325.26 GB) (Free:256.78 GB) HFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 00005260)
 

Partition: GPT Partition Type.

Partition 2: (Not Active) - (Size=325.3 GB) - (Type=AF)

Partition 3: (Not Active) - (Size=620 MB) - (Type=AB)

Partition 4: (Active) - (Size=139.7 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

CHR DefaultSearchKeyword: Default -> search.conduit.com

CHR DefaultSearchProvider: Default -> Trovi search

CHR DefaultSearchURL: Default -> http://search.conduit.com/Results.aspx?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=MEC469C70-6769-4A41-9BB8-D7ADAEB0447A&SearchSource=58&CUI=&UM=5&UP=SPC31D573B-DBDC-4A83-9313-02744CEAAB63&q={searchTerms}&SSPV=

CHR DefaultSuggestURL: Default -> http://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}

EmptyTemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

jawohl

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 12-09-2014

Ran by D at 2014-09-17 14:09:21 Run:1

Running from C:\Users\D\Downloads

Boot Mode: Normal

==============================================
 

Content of fixlist:

*****************

CHR DefaultSearchKeyword: Default -> search.conduit.com

CHR DefaultSearchProvider: Default -> Trovi search

CHR DefaultSearchURL: Default -> hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=MEC469C70-6769-4A41-9BB8-D7ADAEB0447A&SearchSource=58&CUI=&UM=5&UP=SPC31D573B-DBDC-4A83-9313-02744CEAAB63&q={searchTerms}&SSPV=

CHR DefaultSuggestURL: Default -> hxxp://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}

EmptyTemp:

         

*****************
 

Chrome DefaultSearchKeyword deleted successfully.

CHR DefaultSearchProvider: Default -> Trovi search ==> The Chrome "Settings" can be used to fix the entry.

Chrome DefaultSearchURL deleted successfully.

Chrome DefaultSuggestURL deleted successfully.

EmptyTemp: => Removed 2.7 GB temporary data.
 
 

The system needed a reboot. 
 

==== End of Fixlog ====

Okay, dann Kontrollscans mit MBAM und ESET bitte:

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 

Suchlauf Datum: 17.09.2014

Suchlauf-Zeit: 16:00:49

Logdatei: MW.txt

Administrator: Ja
 

Version: 2.00.2.1012

Malware Datenbank: v2014.09.17.04

Rootkit Datenbank: v2014.09.15.01

Lizenz: Kostenlos

Malware Schutz: Deaktiviert

Bösartiger Webseiten Schutz: Deaktiviert

Self-protection: Deaktiviert
 

Betriebssystem: Windows 7 Service Pack 1

CPU: x64

Dateisystem: NTFS

Benutzer: D
 

Suchlauf-Art: Bedrohungs-Suchlauf

Ergebnis: Abgeschlossen

Durchsuchte Objekte: 345250

Verstrichene Zeit: 6 Min, 50 Sek
 

Speicher: Aktiviert

Autostart: Aktiviert

Dateisystem: Aktiviert

Archive: Aktiviert

Rootkits: Deaktiviert

Heuristics: Aktiviert

PUP: Aktiviert

PUM: Aktiviert
 

Prozesse: 0

(No malicious items detected)
 

Module: 0

(No malicious items detected)
 

Registrierungsschlüssel: 0

(No malicious items detected)
 

Registrierungswerte: 0

(No malicious items detected)
 

Registrierungsdaten: 0

(No malicious items detected)
 

Ordner: 0

(No malicious items detected)
 

Dateien: 0

(No malicious items detected)
 

Physische Sektoren: 0

(No malicious items detected)
 
 

(end)

Code:

ESETSmartInstaller@High as downloader log:

Can not open internetESETSmartInstaller@High as downloader log:

Can not open internetCan not open internetESETSmartInstaller@High as downloader log:

Can not open internetCan not open internetESETSmartInstaller@High as downloader log:

Can not open internetCan not open internetESETSmartInstaller@High as downloader log:

Can not open internetCan not open internetESETSmartInstaller@High as downloader log:

Can not open internetESETSmartInstaller@High as downloader log:

all ok

esets_scanner_update returned -1 esets_gle=1

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7623

# api_version=3.0.2

# EOSSerial=714f17151fd0f34ab74db0ae2d62e3f2

# engine=20199

# end=finished

# remove_checked=false

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2014-09-17 06:24:53

# local_time=2014-09-17 08:24:53 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1031

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode_1='Kaspersky Internet Security'

# compatibility_mode=1292 16777213 100 100 22442 42452715 0 0

# compatibility_mode_1=''

# compatibility_mode=5893 16776574 100 94 3567771 162608143 0 0

# scanned=893068

# found=18

# cleaned=0

# scan_time=14631

sh=558C365776AD71C812363E30D7880CF564028A06 ft=1 fh=e10f04e359590fdb vn="Variante von Win64/Systweak.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\System32\roboot64.exe.vir"

sh=2718053800D44DAE154F30CDCC3B967EF389749F ft=1 fh=3790c7326800cd62 vn="möglicherweise Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\PokerTracker 4\Data\Bin\PartyCommunicator.pt4"

sh=EAE1FC8170C55F791F41AF212752CE889E283FF1 ft=1 fh=739c5c9dda0daf32 vn="möglicherweise Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\PokerTracker 4\Data\Bin\StarsCommunicator.pt4"

sh=07D338E7E0DF7977B7B9D7EC70069E2799E6F650 ft=1 fh=36818b54351b8818 vn="möglicherweise Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\PokerTracker 4\Data\Bin\TiltCommunicator.pt3"

sh=FAC7341A571C709AE52946FF8F6120142664290F ft=1 fh=9dd3926ecd994b9d vn="möglicherweise Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\PokerTracker 4\Data\Bin\TiltCommunicator.pt4"

sh=4AC014FC48447A8C7401F57394DA06004303C0C8 ft=1 fh=cfad18fb7d05deba vn="Variante von Win32/WinloadSDA.G evtl. unerwünschte Anwendung" ac=I fn="C:\Users\D\Downloads\Free-Video-Call-Recorder-for-Skype-lnstall.exe"

sh=072045FF57ACDAB6B482DD7CCF14EBE2ED8736B7 ft=1 fh=9f5779e93d3c096c vn="möglicherweise Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="C:\Users\D\Downloads\PT-Install-v4.10.4.exe"

sh=FA9EBC283C23FCD00F7488FB096133B9FD698F5A ft=1 fh=2ad838cf3f75c13d vn="möglicherweise Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="C:\Users\D\Downloads\PT-Install-v4.10.5.exe"

sh=1A16D1AD7F9415288D069929888F1061028042FD ft=1 fh=39efc771baa2eda0 vn="möglicherweise Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="C:\Users\D\Downloads\PT-Install-v4.10.7.exe"

sh=B7A7422ED9FCD96603AEBFA99BAABF37DE0060E0 ft=1 fh=24b12a998bda4027 vn="möglicherweise Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="C:\Users\D\Downloads\PT-Install-v4.10.9.exe"

sh=A64DDCC72F359852AF36435E39D979CDB9863020 ft=1 fh=c412e01bb31938fa vn="Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="C:\Users\D\Downloads\PT-Install-v4.11.10.exe"

sh=8D2A9E163F07334EA15254C9E48361EDEE3A6A9C ft=1 fh=ab707b389babb24a vn="möglicherweise Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="C:\Users\D\Downloads\PT-Install-v4.11.11.exe"

sh=FAB8F570CA5291C8709D3A49B6A2AE3F4D302E74 ft=1 fh=c4f01c0ea0f2bdce vn="möglicherweise Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="C:\Users\D\Downloads\PT-Install-v4.11.2.exe"

sh=4A8ED2C7E772A6FE78ECD0AEA5FC6342B2100458 ft=1 fh=13735d6a050dd506 vn="möglicherweise Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="C:\Users\D\Downloads\PT-Install-v4.11.3.exe"

sh=05398B9CEE385269AB5F251B1BA228D8D7936C39 ft=1 fh=4f9074fda84d322b vn="möglicherweise Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="C:\Users\D\Downloads\PT-Install-v4.11.6.exe"

sh=0243CAFEE202599850C3E32BDEFC56FED4AB8789 ft=1 fh=274b918a3350a67f vn="möglicherweise Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="C:\Users\D\Downloads\PT-Install-v4.11.exe"

sh=3619BA7DB4D04E04298CE994957F5F221F9E6044 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="E:\Users\blademaster\Library\Safari\ReadingListArchives\3AA1C071-31BD-4719-8526-B957BABFE56E\Page.webarchive"

sh=4B81BD1CF9171DCCED9DA2B5AFD99FEAF24B26DA ft=0 fh=0000000000000000 vn="Variante von OSX/Adware.Genieo.A Anwendung" ac=I fn="E:\usr\lib\libgenkitsa.dylib"

Zitat:

C:\Program Files (x86)\PokerTracker 4

Ist das gewollt?

Zitat:

E:\usr\lib\libgenkitsa.dylib

Wie kommt MacOSX Adware auf dein Windows-System? :wtf:

1. ja ist gewollt

2. Keine ahnung O.o

hab ja nen apple als hardware und hab windows über bootcamp raufgespielt...also 2 betriebssysteme...liegt das daran?

Zitat:

E:\usr\lib\libgenkitsa.dylib

Bitte diese Datei bei Virustotal auswerten lassen und den Ergebnislink posten. Falls Du die Datei nicht siehst, musst Du sie evtl. vorher sichtbar machen.
Wenn die Datei schon ausgewertet sein sollte, bitte eine weitere Auswertung starten.

da ist er

https://www.virustotal.com/de/file/90afdd0ccbac71d1e2c81488b61c65d0b9df1a96947c7901c4a41284d19c048c/analysis/1410983852/

Ach, hab da eine vergessen:

Zitat:

E:\Users\blademaster\Library\Safari\ReadingListArchives\3AA1C071-31BD-4719-8526-B957BABFE56E\Page.webarchive

Bitte auch bei VT auswerten