Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Trotz Malwarebytes und Adawarecleaner Popupfenster (https://www.trojaner-board.de/177874-trotz-malwarebytes-adawarecleaner-popupfenster.html)

Soehrgoz 15.04.2016 10:20
Trotz Malwarebytes und Adawarecleaner Popupfenster
 
Hallo und guten Tag,

hab mich ja schon eingelesen in das Forum und gestern meinen Laptop mal mit den obengenannten Programmen versucht zu befreien.

Da ich erst heute abend wieder an meinen Laptop komme, kann ich evtl. Logfiles auch hier posten. Aber wieso haben die beiden Programme das nicht geschafft, stellt sich mir halt die Frage!!!:confused:

Ich öffne Firefox, will eine Seite laden und es öffnet sich erstens eine andere Seite die ich gar nicht will und / oder Popups und es wird mir andauernd Werbung auf Seiten eingeblendet.

Für evtl. Antworten wäre ich Dankbar.

LG
Soehrgoz

burningice 15.04.2016 10:22
:hallo:
Mein Name ist Rafael und ich werde dir bei der Bereinigung helfen.

Damit ich dir optimal helfen kann, halte dich bitte an folgende Regeln:
  • Bitte lies meine Posts komplett durch bevor du sie abarbeitest
  • Wenn ein Problem auftauchen sollte oder dir etwas unklar ist, unterbreche deine Arbeit und beschreibe es so genau wie möglich.
  • Bitte kein Crossposting
  • Installiere oder Deinstalliere keine Software ohne Aufforderung
  • Bitte verwende nur die Tools, welche hier im Thread erwähnt werden und führe sie nur gemäß Anweisung aus
  • Bitte antworte innerhalb von 24h um eine sinnvolle Bereinigung zu ermöglichen
  • Poste die Logs immer in CODE-Tags (#-Button), zur Not die Logs einfach aufteilen
  • Wichtig: Nur weil dein Problem mit einem Schritt plötzlich behoben ist, bedeutet das nicht, dass dein PC auch sauber ist. Mache solange weiter, bis ich dir sage, dass dein PC "clean" ist
  • Wenn ich dir nicht binnen 36h antworte, sende mir bitte eine persönliche Nachricht!
Los geht's :abklatsch:

Ohne Logs weiß ich nix ;)
Poste bitte das Adwcleaner und Malwarebytes Logfile.

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


Soehrgoz 15.04.2016 22:27
schuldige war falsch eingegeben

Soehrgoz 15.04.2016 22:45
Code:
<?xml version="1.0" encoding="UTF-16" ?>
<mbam-log>
<header>
<date>2016/04/15 22:11:05 +0200</date>
<logfile>mbam-log-2016-04-15 (22-09-56).xml</logfile>
<isadmin>yes</isadmin>
</header>
<engine>
<version>2.2.1.1043</version>
<malware-database>v2016.04.15.05</malware-database>
<rootkit-database>v2016.04.09.01</rootkit-database>
<license>trial</license>
<file-protection>enabled</file-protection>
<web-protection>enabled</web-protection>
<self-protection>disabled</self-protection>
</engine>
<system>
<hostname>SCHWARZEGIRL</hostname>
<ip>192.168.0.29</ip>
<osversion>Windows 8.1</osversion>
<arch>x64</arch>
<username>Schatz</username>
<filesys>NTFS</filesys>
</system>
<summary>
<type>threat</type>
<result>completed</result>
<objects>360877</objects>
<time>1310</time>
<processes>0</processes>
<modules>0</modules>
<keys>0</keys>
<values>1</values>
<datas>1</datas>
<folders>54</folders>
<files>179</files>
<sectors>0</sectors>
</summary>
<options>
<memory>enabled</memory>
<startup>enabled</startup>
<filesystem>enabled</filesystem>
<archives>enabled</archives>
<rootkits>disabled</rootkits>
<deeprootkit>disabled</deeprootkit>
<heuristics>enabled</heuristics>
<pup>enabled</pup>
<pum>enabled</pum>
</options>
<items>
<value><path>HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS</path><valuename>AutoConfigUrl</valuename><vendor>Hijack.AutoConfigURL.ShrtCln</vendor><action>success</action><valuedata>hxxp://stopblock.me/wpad.dat?35ade8c4837d2e8a8976f6dffa3d5efb227413</valuedata><hash>42df139c99006dc97d929ae1a0648c74</hash></value>
<data><path>HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES</path><valuename>DefaultScope</valuename><vendor>PUP.Optional.Qone8</vendor><action>replaced</action><valuedata>{33BB0A4E-99AF-4226-BDF6-49120163DE86}</valuedata><baddata>{33BB0A4E-99AF-4226-BDF6-49120163DE86}</baddata><gooddata>{0633EE93-D776-472f-A0FF-E1416B8B2E3A}</gooddata><hash>e73a7d32aeebb97dba9b81b6887d0ff1</hash></data>
<folder><path>C:\Users\Schatz\AppData\Roaming\updates</path><vendor>PUP.Optional.PCProCleaner</vendor><action>success</action><hash>978ac9e60d8cc571adc2e374e71d0af6</hash></folder>
<folder><path>C:\Users\Schatz\Documents\PPC-software</path><vendor>PUP.Optional.ProCleaningSoftware</vendor><action>success</action><hash>f1307936afea82b413cb069fda2ab848</hash></folder>
<folder><path>C:\Program Files (x86)\Sosition</path><vendor>PUP.Optional.YesSearches</vendor><action>success</action><hash>928fb8f76336e94dbe25aff8fd070ff1</hash></folder>
<folder><path>C:\Program Files (x86)\hohobnd</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></folder>
<folder><path>C:\Program Files (x86)\hohobnd\dmp</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></folder>
<folder><path>C:\Program Files (x86)\hohobnd\dmp\CCeuter.exe</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></folder>
<folder><path>C:\Program Files (x86)\hohobnd\dmp\ghabuk.exe</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></folder>
<folder><path>C:\Program Files (x86)\hohobnd\dmp\SstrprSrv.exe</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></folder>
<folder><path>C:\Program Files (x86)\hohobnd\dmp\SstrprTsk.exe</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}</path><vendor>PUP.Optional.SetSearchSetting</vendor><action>success</action><hash>c35e7e319efbea4c0f1f95cf947106fa</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adblockplus</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz\antitracking</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz\telemetry-categories</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz_thumbnails</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\crashes</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\crashes\events</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\datareporting</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\components</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\META-INF</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\gmp</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\healthreport</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\gmp-gmpopenh264</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\gmp-gmpopenh264\1.1</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\gmp-gmpopenh264\1.3</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\searchplugins</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\minidumps</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionstore-backups</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\chrome</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\chrome\idb</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\chrome\idb\2588645841ssegtnti</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++web.de</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++web.de\idb</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++web.de\idb\301792106ttes</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++www.amazon.de</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++www.amazon.de\idb</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++www.amazon.de\idb\2153786202SecrroitpSt</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\moz-safe-about+home</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\moz-safe-about+home\idb</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\moz-safe-about+home\idb\818200132aebmoouht</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\temporary</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\temporary\https+++www.facebook.com</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\temporary\https+++www.facebook.com\asmjs</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\webapps</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<file><path>C:\Program Files (x86)\hohobnd\CCeuter.exe</path><vendor>PUP.Optional.YesSearches</vendor><action>success</action><hash>7fa2fcb354452e080a055ecb10f26d93</hash></file>
<file><path>C:\Program Files (x86)\hohobnd\FFeuter.exe</path><vendor>PUP.Optional.YesSearches</vendor><action>success</action><hash>45dcddd2e7b2a393119955d3877bfc04</hash></file>
<file><path>C:\Users\Schatz\Downloads\iMeshSetup-r1487-w-bf.exe</path><vendor>PUP.Optional.iMeshMusicBoxTB</vendor><action>success</action><hash>938e08a7a3f61422401b400e2fd250b0</hash></file>
<file><path>C:\Users\Schatz\Downloads\SoftonicDownloader_fuer_icq(1).exe</path><vendor>PUP.Optional.SofTonic</vendor><action>success</action><hash>9b86149b178270c61b3d1d2ee71abc44</hash></file>
<file><path>C:\Users\Schatz\Downloads\CDex_TSV44ML77.exe</path><vendor>PUP.Optional.Conduit</vendor><action>success</action><hash>9f82ebc46237e6507b21b19b1de4837d</hash></file>
<file><path>C:\Users\Schatz\Downloads\CryptLoad_1.1.8.rar</path><vendor>PUP.Optional.NetCat</vendor><action>success</action><hash>849d901f2574a98de78f0c80df233dc3</hash></file>
<file><path>C:\Users\Schatz\Downloads\SoftonicDownloader_fuer_icq.exe</path><vendor>PUP.Optional.SofTonic</vendor><action>success</action><hash>5bc609a6ff9afc3a74e459f2e120b24e</hash></file>
<file><path>C:\Windows\Installer\57a7d3b8.msi</path><vendor>PUP.Optional.Iminent</vendor><action>success</action><hash>10112c834356c86e7be72b23966b06fa</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\adbeaverSG@adbeaver.org.xpi</path><vendor>PUP.Optional.AdBeaver</vendor><action>success</action><hash>3ce5604fe5b443f33c28ee4a72918977</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\adbeaverSG@adbeaver.org.xpi</path><vendor>PUP.Optional.AdBeaver</vendor><action>success</action><hash>48d9872804954aec85df25136e9528d8</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\updates\updates.aiu</path><vendor>PUP.Optional.PCProCleaner</vendor><action>success</action><hash>978ac9e60d8cc571adc2e374e71d0af6</hash></file>
<file><path>C:\Users\Schatz\Documents\PPC-software\logerror.txt</path><vendor>PUP.Optional.ProCleaningSoftware</vendor><action>success</action><hash>f1307936afea82b413cb069fda2ab848</hash></file>
<file><path>C:\Program Files (x86)\Sosition\{A16B1AF7-982D-40C3-B5C1-633E1A6A6678}</path><vendor>PUP.Optional.YesSearches</vendor><action>success</action><hash>928fb8f76336e94dbe25aff8fd070ff1</hash></file>
<file><path>C:\Windows\System32\Tasks\Sosition Reports</path><vendor>PUP.Optional.YesSearches</vendor><action>success</action><hash>bb66802fadec1125994cffa8f60ed030</hash></file>
<file><path>C:\Program Files (x86)\hohobnd\conf.json</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></file>
<file><path>C:\Program Files (x86)\hohobnd\@E9438230-A7DF-4D1F-8F2D-CA1D0F0F7924.xpi</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></file>
<file><path>C:\Program Files (x86)\hohobnd\Uninst.exe</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></file>
<file><path>C:\Program Files (x86)\hohobnd\{A16B1AF7-982D-40C3-B5C1-633E1A6A6678}</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}\install.rdf</path><vendor>PUP.Optional.SetSearchSetting</vendor><action>success</action><hash>c35e7e319efbea4c0f1f95cf947106fa</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}\bootstrap.js</path><vendor>PUP.Optional.SetSearchSetting</vendor><action>success</action><hash>c35e7e319efbea4c0f1f95cf947106fa</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}\search.json</path><vendor>PUP.Optional.SetSearchSetting</vendor><action>success</action><hash>c35e7e319efbea4c0f1f95cf947106fa</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\prefs.js</path><vendor>PUP.Optional.DeskCut</vendor><action>replaced</action><baddata>deskCutv2@gmail.com</baddata><gooddata></gooddata><hash>889957581f7adc5a9ff1a8c15da8a15f</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js</path><vendor>PUP.Optional.DeskCut</vendor><action>replaced</action><baddata>deskCutv2@gmail.com</baddata><gooddata></gooddata><hash>cd54416ecdcc2a0cf79944252dd8dd23</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\searchplugins\DD1B66D4.xml</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>c160c2eda3f6b3832205c99e19ecba46</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adbeaver-log.txt</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\addons.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\addons.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\addons.sqlite-journal</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\blocklist.xml</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cert8.db</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils.zip</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz.db</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz.dbattrack</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz.dbhumanweb</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz.dbusafe</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\compatibility.ini</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\content-prefs.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cookies.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cookies.sqlite-shm</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cookies.sqlite-wal</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions.ini</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions.sqlite.protect</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\formhistory.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\healthreport.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\healthreport.sqlite-shm</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\healthreport.sqlite-wal</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\key3.db</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\lightnings.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\localstore.rdf</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\logins.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\marionette.log</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\smartcliqz-custom-data-cache.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\mimeTypes.rdf</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\permissions.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\places.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\places.sqlite-shm</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\places.sqlite-wal</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\pluginreg.dat</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\search-metadata.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\secmod.db</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionCheckpoints.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionstore.bak</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionstore.bak-20140825202822</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionstore.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\signons.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\SiteSecurityServiceState.txt</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\Telemetry.FailedProfileLocks.txt</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\times.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\urlclassifierkey3.txt</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\webappsstore.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\webappsstore.sqlite-shm</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\webappsstore.sqlite-wal</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\xulstore.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adblockplus\elemhide.css</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adblockplus\patterns-backup1.ini</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adblockplus\patterns-backup2.ini</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adblockplus\patterns-backup3.ini</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adblockplus\patterns-backup4.ini</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adblockplus\patterns-backup5.ini</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adblockplus\patterns.ini</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-02-15_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-02-17_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-02-19_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-02-26_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-03-05_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-03-23_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-03-27_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-03-31_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-04-22_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-08-17_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-09-18_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-12-07_28_5LeUQwpRPS1lEGYQvcieDA==.jsonlz4</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2015-11-15_28_lk0H1mCFKKIDCLw+hlHIaQ==.jsonlz4</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2016-04-07_29_ElanrkgLfmTAFxN436P3Bw==.jsonlz4</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\certutil.exe</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\freebl3.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\libnspr4.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\libplc4.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\libplds4.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\msvcr100.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\nss3.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\nssckbi.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\nssdbm3.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\nssutil3.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\smime3.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\softokn3.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\sqlite3.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\ssl3.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz\smartcliqz-trigger-urls-cache.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz\antitracking\cookie_whitelist.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz\antitracking\tracker_owners.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz\telemetry-categories\categories.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\crashes\store.json.mozlz4</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\datareporting\state.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\cliqz@cliqz.com.xpi</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\{b5ff4533-981b-4303-87ae-ff7b33382325}.xpi</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\chrome.jar</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\chrome.manifest</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\install.rdf</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\components\aboutNetError.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\components\mCollectAutoComplete.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-debug.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-general.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-highlight.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-login.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-neterror.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-newtab.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-pref.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-search.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-shopping.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-tracking.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-util.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\META-INF\manifest.mf</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\META-INF\mozilla.rsa</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\META-INF\mozilla.sf</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}\bootstrap.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}\install.rdf</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}\search.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\healthreport\state.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\gmp-gmpopenh264\1.1\gmpopenh264.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\gmp-gmpopenh264\1.1\gmpopenh264.info</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\gmp-gmpopenh264\1.3\gmpopenh264.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\gmp-gmpopenh264\1.3\gmpopenh264.info</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\searchplugins\bing-lavasoft.xml</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\searchplugins\youtube.xml</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\minidumps\16595f46-1b5b-4859-94ae-c8d31ba7fdc4.dmp</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\minidumps\18940f69-c432-49bd-a7ed-9ca8c0bfdd9e.dmp</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\minidumps\222ba3f1-322f-48cf-a608-a563f8142d64.dmp</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\minidumps\222ba3f1-322f-48cf-a608-a563f8142d64.extra</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\minidumps\49062ef6-033e-4fe6-b2cf-910ae14e6804.dmp</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\minidumps\9130cf14-4bb0-49ce-a24c-56d92ccdf2fa.dmp</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\minidumps\9130cf14-4bb0-49ce-a24c-56d92ccdf2fa.extra</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionstore-backups\previous.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionstore-backups\recovery.bak</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionstore-backups\recovery.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionstore-backups\upgrade.js-20150108202552</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\chrome\.metadata</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\chrome\idb\2588645841ssegtnti.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++web.de\.metadata</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++web.de\idb\301792106ttes.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++www.amazon.de\.metadata</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++www.amazon.de\idb\2153786202SecrroitpSt.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\moz-safe-about+home\.metadata</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\moz-safe-about+home\idb\818200132aebmoouht.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\temporary\https+++www.facebook.com\.metadata</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\temporary\https+++www.facebook.com\asmjs\metadata</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\temporary\https+++www.facebook.com\asmjs\module13</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\temporary\https+++www.facebook.com\asmjs\module14</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\temporary\https+++www.facebook.com\asmjs\module15</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\webapps\webapps.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js</path><vendor>PUP.Optional.HohoSearch</vendor><action>replaced</action><baddata>user_pref(&quot;browser.search.searchengine.hp&quot;, &quot;hxxp://www.hohosearch.com/?ts=AHEqA3EtAHMlBE..&amp;v=20160412&amp;uid=E9FA6529327CEEC1BDEC07434F4F02E2&amp;ptid=epf2&amp;mode=ffsengext&quot;);</baddata><gooddata></gooddata><hash>63be7e31841561d52267e384cb3a2dd3</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js</path><vendor>PUP.Optional.HohoSearch</vendor><action>replaced</action><baddata>ile the application is running,
 * the changes will be overwritten when the application exits.
 *
 * To make a manual change to preferences, you can visit the URL about:config
 */

user_p</baddata><gooddata></gooddata><hash>4bd63e7110899d99ee9ba3c416efb44c</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js</path><vendor>PUP.Optional.HohoSearch</vendor><action>replaced</action><baddata>ning,
 * the changes will be overwritten when the application exits.
 *
 * To make a manual change to preferences, you can visit the URL about:config
 */

user_pref(&quot;accessibility.typeahea</baddata><gooddata></gooddata><hash>57ca129d712849edf49524439b6a55ab</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js</path><vendor>PUP.Optional.WinYahoo</vendor><action>replaced</action><baddata>user_pref(&quot;browser.startup.homepage&quot;, &quot;https://de.search.yahoo.com/yhs/web?hspart=iry&amp;hsimp=yhs-fullyhosted_003&amp;type=wbf_adsafld_16_15&amp;param1=1&amp;param2=f%3D1%26b%3DFirefox%26cc%3Dde%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzuzzyE0AyC0Czz0Fzy0AyEzytBtD0DtDyDtN0D0Tzu0StCyDyCtAtN1L2XzutAtFtBtDtFtCtFtBtN1L1Czu1BtBtN1L1G1B1V1N2Y1L1Qzu2StAtByByEyCyEtBtBtGyD0EtDtAtGzzyB0E0FtGtC0ByBzytGzztBzy0AtC0Dzz0FyBzytDyB2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0Azy0FyByCtCyBtAtGyCtA0DyDtGyEtC0F0DtGzyyDyEtDtG0DtD0C0AtB0AtD0F0DyD0F0C2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCzzyDtA%26cr%3D489122474%26a%3Dwbf_adsafld_16_15%26os_ver%3D6.3%26os%3DWindows%2B8.1&quot;);</baddata><gooddata>user_pref(&quot;browser.startup.homepage&quot;, &quot;https://www.malwarebytes.org/restorebrowser/</gooddata><hash>27fa3b74891042f4d2b3006918ed49b7</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js</path><vendor>PUP.Optional.DeskCut</vendor><action>replaced</action><baddata>deskCutv2@gmail.com</baddata><gooddata></gooddata><hash>e8390ca32f6a201619773732818454ac</hash></file>
</items>
</mbam-log>
Code:
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:13-04-2016
durchgeführt von Schatz (2016-04-15 23:42:26)
Gestartet von C:\Users\Schatz\AppData\Local\Temp\scoped_dir7056_9558
Windows 8.1 (X64) (2015-08-21 23:35:56)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-3205940643-3366264869-3578409839-500 - Administrator - Disabled)
Gast (S-1-5-21-3205940643-3366264869-3578409839-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3205940643-3366264869-3578409839-1004 - Limited - Enabled)
Schatz (S-1-5-21-3205940643-3366264869-3578409839-1002 - Administrator - Enabled) => C:\Users\Schatz

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )
Adobe Flash Player 21 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 21.0.0.213 - Adobe Systems Incorporated)
Apple Application Support (32-Bit) (HKLM-x32\...\{FE5C2FAA-118D-4509-B51D-3F71CC9E1B3E}) (Version: 4.3 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{2937FD88-C9D6-4B82-B539-37CD0A572F42}) (Version: 4.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{2E4AF2A6-50EA-4260-9BA4-5E582D11879A}) (Version: 9.3.0.15 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.16.282 - Avira Operations GmbH & Co. KG)
Avira Launcher (HKLM-x32\...\{3b87484e-d70b-4b4f-ad59-2ae89571e2cf}) (Version: 1.1.56.9119 - Avira Operations GmbH & Co. KG)
Avira Launcher (HKLM-x32\...\{ccdc9cfe-8ba7-4c6c-ac5f-b2d6cfa49efc}) (Version: 1.1.54.24924 - Avira Operations GmbH & Co. KG)
Avira Launcher (HKLM-x32\...\{d0e166af-1634-4c0b-ae96-2180e61f9d38}) (Version: 1.1.52.15531 - Avira Operations GmbH & Co. KG)
Avira Launcher (HKLM-x32\...\{eac7da46-2097-4dd4-80a6-8b67cbb2b23f}) (Version: 1.1.53.13962 - Avira Operations GmbH & Co. KG)
Avira Launcher (x32 Version: 1.1.56.9119 - Avira Operations GmbH & Co. KG) Hidden
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
CDex - Open Source Digital Audio CD Extractor (HKLM-x32\...\CDex) (Version: 1.70.4.2009 - Georgy Berdyshev)
Chromium (HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\Chromium) (Version: 51.0.2683.0 - Chromium)
CyberLink PhotoNow (HKLM-x32\...\InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.1.7717 - CyberLink Corp.)
CyberLink PowerDirector (Version: 9.0.0.3815c - CyberLink Corp.) Hidden
CyberLink PowerRecover (HKLM-x32\...\InstallShield_{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}) (Version: 5.7.0.0913 - CyberLink Corp.)
CyberLink PowerRecover (Version: 5.7.0.0913 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dolby Advanced Audio v2 (HKLM-x32\...\{B9E70C7A-9F85-4A39-A4A3-BFA3C3BF7613}) (Version: 7.2.8000.17 - Dolby Laboratories Inc)
Fotogalerie (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Fotogalerija (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Fotogalleri (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Fotogalleriet (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Fotoğraf Galerisi (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Fotótár (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Galeria de Fotografias (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Galería de fotos (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Galeria fotografii (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
iCloud (HKLM\...\{4B48E22A-2FB0-4EFA-B99E-954B1E50CD69}) (Version: 5.1.0.34 - Apple Inc.)
ICQ 8.1 (build 6337) (HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\ICQ) (Version: 8.1.6337.0 - Mail.Ru)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2875 - Intel Corporation)
Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (HKLM\...\{E77289CF-12B9-4CAB-A49E-FEAE947F4D95}) (Version: 15.5.4.0423 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\...\{DA2600C1-6BDF-4FD1-8F3D-148929CC1385}) (Version: 2.6.1210.0278 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.6.0.1030 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel(R) WiDi (HKLM\...\{6097158B-0184-4140-BEC3-7885794D2571}) (Version: 3.5.40.0 - Intel Corporation)
Intel® PROSet/Wireless WiFi Software (HKLM\...\{1593C708-5535-47A4-8C0F-F8D4BE2B4560}) (Version: 15.05.6000.1620 - Intel Corporation)
Internet Updater (HKLM-x32\...\InternetUpdater) (Version: 2.6.57 - Parallel Lines Development, LLC) <==== ACHTUNG
IrfanView 64 (remove only) (HKLM\...\IrfanView) (Version: 4.40 - Irfan Skiljan)
iTunes (HKLM\...\{A31C5565-90D9-4615-AE13-94D86C3836C7}) (Version: 12.3.3.17 - Apple Inc.)
Joan Jade und die Tore von Xibalba (HKLM-x32\...\Joan Jade und die Tore von Xibalba) (Version:  - )
Magic Encyclopedia 3 - Illusionen (HKLM-x32\...\Magic Encyclopedia 3 - Illusionen) (Version:  - )
Malwarebytes Anti-Malware Version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Margrave Manor: Der Fluch des gebrochenen Herzens (HKLM-x32\...\Margrave Manor: Der Fluch des gebrochenen Herzens) (Version:  - )
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.11.309.1 - McAfee, Inc.)
Mediathek (HKLM-x32\...\{EFFED0C0-5299-422E-AFE6-8B8066D18A2A}) (Version: 1.4.0 - Medion)
Medion Home Cinema 10 (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)
Medion Home Cinema 10 (x32 Version: 10.1924 - CyberLink Corp.) Hidden
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4805.1003 - Microsoft Corporation)
Microsoft Office Excel Viewer (HKLM-x32\...\{95120000-003F-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\OneDriveSetup.exe) (Version: 17.3.4604.0120 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mobile Partner (HKLM-x32\...\Mobile Partner) (Version: 21.005.15.02.382 - Huawei Technologies Co.,Ltd)
Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Mozilla Firefox 35.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0 (x86 de)) (Version: 35.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 35.0 - Mozilla)
Music Toolbar for Firefox (Dist. by iMesh, Inc.) (HKLM-x32\...\imeshmusicboxtoolbarhaFF) (Version: 1.6.2.0 - APN LLC) <==== ACHTUNG
Music Toolbar for Internet Explorer (Dist. by iMesh, Inc.) (HKLM-x32\...\imeshmusicboxtoolbarhaIE) (Version: 1.6.2.0 - APN LLC) <==== ACHTUNG
Mystery Murders - Jack the Ripper 2 (HKLM-x32\...\Mystery Murders - Jack the Ripper 2) (Version: 1.0.0.221.de - Rondomedia)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4805.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4805.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4805.1003 - Microsoft Corporation) Hidden
Opera Stable 36.0.2130.65 (HKLM-x32\...\Opera 36.0.2130.65) (Version: 36.0.2130.65 - Opera Software)
PHotkey (HKLM-x32\...\{E50C224A-BBF2-428D-9DCF-DBF9DF85C40E}) (Version: 1.00.0081 - Pegatron Corporation)
Podstawowe programy Windows Live (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
QuickLaunch (HKLM-x32\...\{A802F1E3-34C8-4C84-9948-C1C4E37D0FA9}) (Version: 1.00.0019 - Lenovo Group Limited)
QuickTime 7 (HKLM-x32\...\{FF59BD75-466A-4D5A-AD23-AAD87C5FD44C}) (Version: 7.79.80.95 - Apple Inc.)
Raccolta foto (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6722 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.30136 - Realtek Semiconductor Corp.)
Sony PC Companion 2.10.188 (HKLM-x32\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.188 - Sony)
SpringFiles (HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\SpringFiles) (Version: 29.15.39 - hxxp://www.spring-file.com)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.16.0 - Synaptics Incorporated)
Unsolved Mystery Club - Ancient Astronauts (HKLM-x32\...\Unsolved Mystery Club - Ancient Astronauts) (Version:  - )
Updater (HKLM-x32\...\{D54E3D9F-FEB8-4D2D-A138-B69A5C80080B}) (Version: 2.6.53 - Creative Island Media, LLC) <==== ACHTUNG
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - )
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - )
Web Companion (HKLM-x32\...\{503a5c39-884e-4cba-9e30-eacb1b81325c}) (Version: 2.1.1108.2313 - Lavasoft)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
WinRAR 5.21 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.21.0 - win.rar GmbH)
WinZip 20.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C24101}) (Version: 20.0.11659 - WinZip Computing, S.L. )

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

CustomCLSID: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32 -> C:\Program Files\WinZip\adxloader64.dll ()

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {011761AD-7FDF-462E-A515-2ABF8A30BCEB} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-04-07] (Adobe Systems Incorporated)
Task: {0539AB7B-C0A6-42F0-B8CB-0119260DE526} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\BrowserChoice\browserchoice.exe
Task: {08F16DDA-5825-4A48-A46C-DE6E213FAA0D} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2016-03-22] (Microsoft Corporation)
Task: {0D652EDE-957F-4837-8DE6-EA03BA82021D} - System32\Tasks\Search Provided by Yahoo litod => Wscript.exe "C:\ProgramData\{CEE80B8B-44AA-814D-C26C-1F0F582E94C1}\dide.txt" "687474703a2f2f7761676e672e636f6d" "433a5c50726f6772616d446174615c7b43454538304238422d343441412d383134442d433236432d3146304635383245393443317d5c6d6f736f7461" "433a5c50726f6772616d446174615c7b43454538304238422d343441412d383134442d433236 (Der Dateneintrag hat 78 mehr Zeichen).
Task: {0E212A41-43C5-4E31-9EDB-EC1EC720C262} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
Task: {24204B2E-0BE0-45F0-9F7A-9FBA23A33D70} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)
Task: {3014A5FD-762C-490E-BD4B-5C96E0AE1E50} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {5039D926-8E19-4B07-8915-38806EFA5509} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {67EABA3D-88EE-4D8D-ADB8-A27840D63463} - System32\Tasks\{4081A24E-DF42-4119-A43A-3BDCBE61108C} => pcalua.exe -a "C:\Program Files (x86)\iMesh Applications\iMesh\uninstall.exe"
Task: {6F984935-BD8B-4815-A900-D1596DA9BBD1} - System32\Tasks\Opera scheduled Autoupdate 1442781566 => C:\Program Files (x86)\Opera\launcher.exe [2016-04-11] (Opera Software)
Task: {788190E3-6C26-4971-954F-8CA8654008D6} - System32\Tasks\Clteyghuwph System => C:\Program Files (x86)\Clteyghuwph\clteyghuwphSystem.exe [2016-04-12] ()
Task: {7E9D12FA-7387-4DA4-A9E6-5CCE304263B2} - System32\Tasks\Synaptics TouchPad Enhancements => Program Files\Synaptics\SynTP\SynTPEnh.exe
Task: {83632A60-0338-4F8B-B5BE-F31623FE621F} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2016-02-09] (Microsoft Corporation)
Task: {B353DCC0-6453-4226-BDE2-8288B8E744C8} - System32\Tasks\Dolby Selector => C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [2012-08-31] (Dolby Laboratories Inc.)
Task: {C626ED21-6382-4DE3-8F98-58C25FD091BC} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2016-02-09] (Microsoft Corporation)
Task: {D90AC541-5D08-481E-B606-E24F068C2C75} - System32\Tasks\{2FE13EE9-AE44-25EE-1098-2BDFFC5F70F9} => C:\Users\Schatz\AppData\Local\{B9D18~1\UNINST~1.EXE [2013-05-03] ()

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\Search Provided by Yahoo litod.job => Wscript.exe  C:\ProgramData\{CEE80B8B-44AA-814D-C26C-1F0F582E94C1}\dide.txt <==== ACHTUNG
Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
Task: C:\WINDOWS\Tasks\{2FE13EE9-AE44-25EE-1098-2BDFFC5F70F9}.job => C:\Users\Schatz\AppData\Local\{B9D18~1\UNINST~1.EXE

==================== Verknüpfungen =============================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)

Shortcut: C:\Users\Schatz\Desktop\Neuer Ordner\router\FRITZ!Box\reconnect.bat - Verknüpfung.lnk -> D:\Dokumente\Visual Studio 2005\Projects\Linker\Linker\bin\Release\CryptLoad_Secure\router\FRITZ!Box\reconnect.bat (Keine Datei)

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2012-11-30 13:41 - 2012-11-29 15:53 - 00805888 _____ () C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
2016-03-18 22:56 - 2016-03-18 22:56 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2016-03-18 22:56 - 2016-03-18 22:56 - 01329936 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-06-18 20:29 - 2015-10-13 05:34 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2011-03-14 17:27 - 2011-03-14 17:27 - 00346976 _____ () C:\ProgramData\DatacardService\HWDeviceService64.exe
2014-04-22 19:23 - 2014-04-22 19:23 - 00239968 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe
2012-11-28 11:35 - 2012-10-19 13:27 - 00386344 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2012-11-30 13:41 - 2012-11-27 17:18 - 02215424 _____ () C:\Program Files (x86)\PHotkey\PHotkey.exe
2012-11-30 13:41 - 2010-01-12 19:36 - 00117256 _____ () C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
2012-11-30 13:41 - 2010-01-12 19:36 - 00121864 _____ () C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
2012-11-30 13:41 - 2010-12-17 16:04 - 00449032 _____ () C:\Program Files (x86)\PHotkey\ATouch64.exe
2012-11-30 13:41 - 2012-10-23 20:07 - 03471872 _____ () C:\Program Files (x86)\PHotkey\POSD.exe
2012-11-30 13:41 - 2012-08-08 20:10 - 07536128 _____ () C:\Program Files (x86)\PHotkey\GPMTray.exe
2016-04-14 22:54 - 2016-04-14 22:54 - 03670016 _____ () C:\Users\Schatz\Downloads\adwcleaner_5.111.exe
2014-04-22 19:23 - 2014-04-22 19:23 - 00011362 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\mingwm10.dll
2014-04-22 19:23 - 2014-04-22 19:23 - 00043008 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\libgcc_s_dw2-1.dll
2014-04-22 19:23 - 2014-04-22 19:23 - 02415104 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QtCore4.dll
2014-04-22 19:23 - 2014-04-22 19:23 - 01148416 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QtNetwork4.dll
2014-04-22 19:23 - 2014-04-22 19:23 - 00383488 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QueryStrategy.dll
2014-04-22 19:23 - 2014-04-22 19:23 - 00398336 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QtXml4.dll
2015-01-18 21:13 - 2014-05-13 13:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-01-18 21:13 - 2014-05-13 13:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-01-18 21:13 - 2014-05-13 13:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-01-18 21:13 - 2012-08-23 11:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2015-01-18 21:13 - 2012-04-03 18:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2012-11-30 13:41 - 2009-12-18 17:36 - 00973432 _____ () C:\Program Files (x86)\PHotkey\acAuth.dll
2012-11-30 13:41 - 2009-12-18 17:41 - 00129544 _____ () C:\Program Files (x86)\PHotkey\GFNEX.dll
2012-11-23 05:16 - 2012-06-25 11:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2016-03-18 22:56 - 2016-03-18 22:56 - 01040656 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2016-03-18 22:56 - 2016-03-18 22:56 - 00080184 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2016-04-14 21:53 - 2016-04-14 21:52 - 63830568 _____ () C:\Program Files (x86)\Opera\36.0.2130.65\opera.dll
2016-04-14 21:52 - 2016-04-14 21:50 - 02134568 _____ () C:\Program Files (x86)\Opera\36.0.2130.65\libglesv2.dll
2016-04-14 21:52 - 2016-04-14 21:50 - 00082472 _____ () C:\Program Files (x86)\Opera\36.0.2130.65\libegl.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)

AlternateDataStreams: C:\ProgramData\Temp:FC595E85 [286]

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)


==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)

IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

Da befinden sich 7866 mehr Seiten.

IE trusted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\localhost -> localhost
IE trusted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\webcompanion.com -> hxxp://webcompanion.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\123simsen.com -> www.123simsen.com

Da befinden sich 7866 mehr Seiten.


==================== Hosts Inhalt: ==========================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2013-08-22 15:25 - 2016-04-12 22:21 - 00001006 ____N C:\WINDOWS\system32\Drivers\etc\hosts

127.0.0.1      down.baidu2016.com
127.0.0.1      123.sogou.com
127.0.0.1      www.czzsyzgm.com
127.0.0.1      www.czzsyzxl.com
127.0.0.1      union.baidu2019.com

==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKLM\...\StartupApproved\Run32: => "Iminent"
HKLM\...\StartupApproved\Run32: => "IminentMessenger"
HKLM\...\StartupApproved\Run32: => "QuickTime Task"
HKLM\...\StartupApproved\Run32: => "iTunesHelper"
HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\StartupApproved\Run: => "icq"
HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\StartupApproved\Run: => "iMesh"
HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\StartupApproved\Run: => "Sony PC Companion"

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{59EC4CF5-609E-422F-8042-D9CDE0EB6829}] => (Allow) C:\Users\Schatz\AppData\Local\Microsoft\OneDrive\OneDrive.exe
FirewallRules: [{C6EEC361-CE32-4231-ADDE-E5A7C67BEEFB}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{5B967B63-630B-40F4-88C8-61F6D752D127}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{D6ACFA72-D875-4A6E-8D34-1C6AD3F3A06E}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{4F182DE5-4F27-4D5B-8701-9722B9F8662E}] => (Allow) C:\Users\Schatz\AppData\Local\Torch\Plugins\Hola\hola_plugin_x64.exe
FirewallRules: [TCP Query User{BE4E9FEC-D914-4E4F-926F-E01F5DE598C1}C:\program files (x86)\cyberlink\powerdvd10\pdvd10serv.exe] => (Allow) C:\program files (x86)\cyberlink\powerdvd10\pdvd10serv.exe
FirewallRules: [UDP Query User{9CD2DAFF-8500-4EF6-BBF2-E4F1F79E2001}C:\program files (x86)\cyberlink\powerdvd10\pdvd10serv.exe] => (Allow) C:\program files (x86)\cyberlink\powerdvd10\pdvd10serv.exe
FirewallRules: [TCP Query User{4E9A1825-1730-44D7-8A82-7646F852914A}C:\program files (x86)\cyberlink\powerdvd10\pdvd10serv.exe] => (Block) C:\program files (x86)\cyberlink\powerdvd10\pdvd10serv.exe
FirewallRules: [UDP Query User{505D4722-8D42-4D76-99DB-65DFF02FC215}C:\program files (x86)\cyberlink\powerdvd10\pdvd10serv.exe] => (Block) C:\program files (x86)\cyberlink\powerdvd10\pdvd10serv.exe
FirewallRules: [{1E1249F9-4AEB-41B9-9534-E10A4AD394C2}] => (Allow) C:\Program Files (x86)\SpringFiles\SpringFiles.exe
FirewallRules: [{DAD41EE2-07B1-45C1-87CA-AAB75AEA648E}] => (Allow) C:\Program Files (x86)\SpringFiles\SpringFiles.exe
FirewallRules: [{EB85DE1E-22DB-4D7A-9929-4B1B2E98F7C7}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{2AF39E2D-44C3-4877-AACE-797D2BAB21DD}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{2CDD11C8-6D06-4571-AED2-0CC8596C9660}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{7C84D8A8-C127-4CE3-AF1E-985C5A1D50AA}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{8ED0F09F-D5B2-4021-9172-C6B1B1896518}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{7896FC6A-3D88-4BAD-ACE2-9D3EF6E710C8}] => (Allow) C:\Users\Schatz\AppData\Local\Chromium\Application\chrome.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service

==================== Wiederherstellungspunkte =========================

06-04-2016 09:40:02 Windows Update
10-04-2016 07:27:11 Windows Update
14-04-2016 00:47:36 Windows Update
14-04-2016 23:14:13 JRT Pre-Junkware Removal

==================== Fehlerhafte Geräte im Gerätemanager =============


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (04/15/2016 10:18:39 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073422302

Error: (04/15/2016 10:08:19 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 81541907

Error: (04/15/2016 10:08:19 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 81541907

Error: (04/15/2016 10:08:19 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (04/14/2016 11:03:25 PM) (Source: Avira Service Host) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. Der Dienstprozess konnte keine Verbindung mit dem Dienstcontroller herstellen

Error: (04/14/2016 10:59:44 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Avira.ServiceHost.exe, Version: 1.1.56.9119, Zeitstempel: 0x56a8ea7a
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.18264, Zeitstempel: 0x56e1b34d
Ausnahmecode: 0xe0434352
Fehleroffset: 0x00015b68
ID des fehlerhaften Prozesses: 0x17e4
Startzeit der fehlerhaften Anwendung: 0xAvira.ServiceHost.exe0
Pfad der fehlerhaften Anwendung: Avira.ServiceHost.exe1
Pfad des fehlerhaften Moduls: Avira.ServiceHost.exe2
Berichtskennung: Avira.ServiceHost.exe3
Vollständiger Name des fehlerhaften Pakets: Avira.ServiceHost.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Avira.ServiceHost.exe5

Error: (04/14/2016 10:59:42 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: Avira.ServiceHost.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: System.ComponentModel.Composition.CompositionException
Stapel:
  bei System.ComponentModel.Composition.Hosting.CompositionServices.GetExportedValueFromComposedPart(System.ComponentModel.Composition.Hosting.ImportEngine, System.ComponentModel.Composition.Primitives.ComposablePart, System.ComponentModel.Composition.Primitives.ExportDefinition)
  bei System.ComponentModel.Composition.Hosting.CatalogExportProvider.GetExportedValue(CatalogPart, System.ComponentModel.Composition.Primitives.ExportDefinition, Boolean)
  bei System.ComponentModel.Composition.Hosting.CatalogExportProvider+CatalogExport.GetExportedValueCore()
  bei System.ComponentModel.Composition.Primitives.Export.get_Value()
  bei System.ComponentModel.Composition.ExportServices.GetCastedExportedValue[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.ComponentModel.Composition.Primitives.Export)
  bei System.ComponentModel.Composition.Hosting.ExportProvider.GetExportedValueCore[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.String, System.ComponentModel.Composition.Primitives.ImportCardinality)
  bei Avira.OE.ServiceHost.ServiceHost.Initialize()
  bei Avira.OE.ServiceHost.Program+<>c__DisplayClass1.<OnServiceStart>b__0(System.Object)
  bei System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object)
  bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
  bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
  bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
  bei System.Threading.ThreadPoolWorkQueue.Dispatch()
  bei System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()

Error: (04/14/2016 10:45:29 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Lavasoft.SearchProtect.WinService.exe, Version: 1.0.0.0, Zeitstempel: 0x55ef18d9
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.18264, Zeitstempel: 0x56e1bd71
Ausnahmecode: 0xe0434f4d
Fehleroffset: 0x0000000000008a5c
ID des fehlerhaften Prozesses: 0x17b0
Startzeit der fehlerhaften Anwendung: 0xLavasoft.SearchProtect.WinService.exe0
Pfad der fehlerhaften Anwendung: Lavasoft.SearchProtect.WinService.exe1
Pfad des fehlerhaften Moduls: Lavasoft.SearchProtect.WinService.exe2
Berichtskennung: Lavasoft.SearchProtect.WinService.exe3
Vollständiger Name des fehlerhaften Pakets: Lavasoft.SearchProtect.WinService.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Lavasoft.SearchProtect.WinService.exe5

Error: (04/14/2016 10:35:32 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: svchost.exe_PcaSvc, Version: 6.3.9600.17415, Zeitstempel: 0x54504177
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.3.9600.18194, Zeitstempel: 0x56951674
Ausnahmecode: 0xc0000008
Fehleroffset: 0x00000000000925fa
ID des fehlerhaften Prozesses: 0x404
Startzeit der fehlerhaften Anwendung: 0xsvchost.exe_PcaSvc0
Pfad der fehlerhaften Anwendung: svchost.exe_PcaSvc1
Pfad des fehlerhaften Moduls: svchost.exe_PcaSvc2
Berichtskennung: svchost.exe_PcaSvc3
Vollständiger Name des fehlerhaften Pakets: svchost.exe_PcaSvc4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: svchost.exe_PcaSvc5

Error: (04/14/2016 10:00:02 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Winzipro.exe, Version 2.0.72.3001 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: fe0

Startzeit: 01d1968635572989

Endzeit: 808

Anwendungspfad: C:\Program Files (x86)\WinZip Registry Optimizer\Winzipro.exe

Berichts-ID: 73c02385-027b-11e6-bec1-84a6c8f9a492

Vollständiger Name des fehlerhaften Pakets:

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:


Systemfehler:
=============
Error: (04/15/2016 10:57:10 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "IE Search Set" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (04/15/2016 10:56:53 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Mobile Partner. OUC" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (04/15/2016 10:56:53 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Mobile Partner. OUC erreicht.

Error: (04/15/2016 10:56:17 PM) (Source: Microsoft-Windows-TaskScheduler) (EventID: 413) (User: NT-AUTORITÄT)
Description: Beim Start des Aufgabenplanungsdiensts konnten Aufgaben nicht geladen werden. Zusätzliche Daten: Fehlerwert: 2147942402.

Error: (04/14/2016 11:05:39 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Sosition Reports" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (04/14/2016 11:03:34 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (04/14/2016 11:03:12 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "IE Search Set" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (04/14/2016 11:02:58 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Mobile Partner. OUC" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (04/14/2016 11:02:58 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Mobile Partner. OUC erreicht.

Error: (04/14/2016 11:01:06 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.

Modulpfad: C:\WINDOWS\System32\IWMSSvc.dll


==================== Speicherinformationen ===========================

Prozessor: Intel(R) Celeron(R) CPU 1000M @ 1.80GHz
Prozentuale Nutzung des RAM: 53%
Installierter physikalischer RAM: 3977.11 MB
Verfügbarer physikalischer RAM: 1855.8 MB
Summe virtueller Speicher: 5129.11 MB
Verfügbarer virtueller Speicher: 2291.94 MB

==================== Laufwerke ================================

Drive c: (Boot) (Fixed) (Total:403.61 GB) (Free:336.24 GB) NTFS
Drive d: (Recover) (Fixed) (Total:60 GB) (Free:35.17 GB) NTFS

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 00000000)

Partition: GPT.

==================== Ende von Addition.txt ============================

Soehrgoz 15.04.2016 22:48
Code:
<?xml version="1.0" encoding="UTF-16" ?>
<mbam-log>
<header>
<date>2016/04/15 22:11:05 +0200</date>
<logfile>mbam-log-2016-04-15 (22-09-56).xml</logfile>
<isadmin>yes</isadmin>
</header>
<engine>
<version>2.2.1.1043</version>
<malware-database>v2016.04.15.05</malware-database>
<rootkit-database>v2016.04.09.01</rootkit-database>
<license>trial</license>
<file-protection>enabled</file-protection>
<web-protection>enabled</web-protection>
<self-protection>disabled</self-protection>
</engine>
<system>
<hostname>SCHWARZEGIRL</hostname>
<ip>192.168.0.29</ip>
<osversion>Windows 8.1</osversion>
<arch>x64</arch>
<username>Schatz</username>
<filesys>NTFS</filesys>
</system>
<summary>
<type>threat</type>
<result>completed</result>
<objects>360877</objects>
<time>1310</time>
<processes>0</processes>
<modules>0</modules>
<keys>0</keys>
<values>1</values>
<datas>1</datas>
<folders>54</folders>
<files>179</files>
<sectors>0</sectors>
</summary>
<options>
<memory>enabled</memory>
<startup>enabled</startup>
<filesystem>enabled</filesystem>
<archives>enabled</archives>
<rootkits>disabled</rootkits>
<deeprootkit>disabled</deeprootkit>
<heuristics>enabled</heuristics>
<pup>enabled</pup>
<pum>enabled</pum>
</options>
<items>
<value><path>HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS</path><valuename>AutoConfigUrl</valuename><vendor>Hijack.AutoConfigURL.ShrtCln</vendor><action>success</action><valuedata>hxxp://stopblock.me/wpad.dat?35ade8c4837d2e8a8976f6dffa3d5efb227413</valuedata><hash>42df139c99006dc97d929ae1a0648c74</hash></value>
<data><path>HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES</path><valuename>DefaultScope</valuename><vendor>PUP.Optional.Qone8</vendor><action>replaced</action><valuedata>{33BB0A4E-99AF-4226-BDF6-49120163DE86}</valuedata><baddata>{33BB0A4E-99AF-4226-BDF6-49120163DE86}</baddata><gooddata>{0633EE93-D776-472f-A0FF-E1416B8B2E3A}</gooddata><hash>e73a7d32aeebb97dba9b81b6887d0ff1</hash></data>
<folder><path>C:\Users\Schatz\AppData\Roaming\updates</path><vendor>PUP.Optional.PCProCleaner</vendor><action>success</action><hash>978ac9e60d8cc571adc2e374e71d0af6</hash></folder>
<folder><path>C:\Users\Schatz\Documents\PPC-software</path><vendor>PUP.Optional.ProCleaningSoftware</vendor><action>success</action><hash>f1307936afea82b413cb069fda2ab848</hash></folder>
<folder><path>C:\Program Files (x86)\Sosition</path><vendor>PUP.Optional.YesSearches</vendor><action>success</action><hash>928fb8f76336e94dbe25aff8fd070ff1</hash></folder>
<folder><path>C:\Program Files (x86)\hohobnd</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></folder>
<folder><path>C:\Program Files (x86)\hohobnd\dmp</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></folder>
<folder><path>C:\Program Files (x86)\hohobnd\dmp\CCeuter.exe</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></folder>
<folder><path>C:\Program Files (x86)\hohobnd\dmp\ghabuk.exe</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></folder>
<folder><path>C:\Program Files (x86)\hohobnd\dmp\SstrprSrv.exe</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></folder>
<folder><path>C:\Program Files (x86)\hohobnd\dmp\SstrprTsk.exe</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}</path><vendor>PUP.Optional.SetSearchSetting</vendor><action>success</action><hash>c35e7e319efbea4c0f1f95cf947106fa</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adblockplus</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz\antitracking</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz\telemetry-categories</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz_thumbnails</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\crashes</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\crashes\events</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\datareporting</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\components</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\META-INF</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\gmp</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\healthreport</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\gmp-gmpopenh264</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\gmp-gmpopenh264\1.1</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\gmp-gmpopenh264\1.3</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\searchplugins</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\minidumps</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionstore-backups</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\chrome</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\chrome\idb</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\chrome\idb\2588645841ssegtnti</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++web.de</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++web.de\idb</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++web.de\idb\301792106ttes</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++www.amazon.de</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++www.amazon.de\idb</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++www.amazon.de\idb\2153786202SecrroitpSt</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\moz-safe-about+home</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\moz-safe-about+home\idb</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\moz-safe-about+home\idb\818200132aebmoouht</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\temporary</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\temporary\https+++www.facebook.com</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\temporary\https+++www.facebook.com\asmjs</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<folder><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\webapps</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></folder>
<file><path>C:\Program Files (x86)\hohobnd\CCeuter.exe</path><vendor>PUP.Optional.YesSearches</vendor><action>success</action><hash>7fa2fcb354452e080a055ecb10f26d93</hash></file>
<file><path>C:\Program Files (x86)\hohobnd\FFeuter.exe</path><vendor>PUP.Optional.YesSearches</vendor><action>success</action><hash>45dcddd2e7b2a393119955d3877bfc04</hash></file>
<file><path>C:\Users\Schatz\Downloads\iMeshSetup-r1487-w-bf.exe</path><vendor>PUP.Optional.iMeshMusicBoxTB</vendor><action>success</action><hash>938e08a7a3f61422401b400e2fd250b0</hash></file>
<file><path>C:\Users\Schatz\Downloads\SoftonicDownloader_fuer_icq(1).exe</path><vendor>PUP.Optional.SofTonic</vendor><action>success</action><hash>9b86149b178270c61b3d1d2ee71abc44</hash></file>
<file><path>C:\Users\Schatz\Downloads\CDex_TSV44ML77.exe</path><vendor>PUP.Optional.Conduit</vendor><action>success</action><hash>9f82ebc46237e6507b21b19b1de4837d</hash></file>
<file><path>C:\Users\Schatz\Downloads\CryptLoad_1.1.8.rar</path><vendor>PUP.Optional.NetCat</vendor><action>success</action><hash>849d901f2574a98de78f0c80df233dc3</hash></file>
<file><path>C:\Users\Schatz\Downloads\SoftonicDownloader_fuer_icq.exe</path><vendor>PUP.Optional.SofTonic</vendor><action>success</action><hash>5bc609a6ff9afc3a74e459f2e120b24e</hash></file>
<file><path>C:\Windows\Installer\57a7d3b8.msi</path><vendor>PUP.Optional.Iminent</vendor><action>success</action><hash>10112c834356c86e7be72b23966b06fa</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\adbeaverSG@adbeaver.org.xpi</path><vendor>PUP.Optional.AdBeaver</vendor><action>success</action><hash>3ce5604fe5b443f33c28ee4a72918977</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\adbeaverSG@adbeaver.org.xpi</path><vendor>PUP.Optional.AdBeaver</vendor><action>success</action><hash>48d9872804954aec85df25136e9528d8</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\updates\updates.aiu</path><vendor>PUP.Optional.PCProCleaner</vendor><action>success</action><hash>978ac9e60d8cc571adc2e374e71d0af6</hash></file>
<file><path>C:\Users\Schatz\Documents\PPC-software\logerror.txt</path><vendor>PUP.Optional.ProCleaningSoftware</vendor><action>success</action><hash>f1307936afea82b413cb069fda2ab848</hash></file>
<file><path>C:\Program Files (x86)\Sosition\{A16B1AF7-982D-40C3-B5C1-633E1A6A6678}</path><vendor>PUP.Optional.YesSearches</vendor><action>success</action><hash>928fb8f76336e94dbe25aff8fd070ff1</hash></file>
<file><path>C:\Windows\System32\Tasks\Sosition Reports</path><vendor>PUP.Optional.YesSearches</vendor><action>success</action><hash>bb66802fadec1125994cffa8f60ed030</hash></file>
<file><path>C:\Program Files (x86)\hohobnd\conf.json</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></file>
<file><path>C:\Program Files (x86)\hohobnd\@E9438230-A7DF-4D1F-8F2D-CA1D0F0F7924.xpi</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></file>
<file><path>C:\Program Files (x86)\hohobnd\Uninst.exe</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></file>
<file><path>C:\Program Files (x86)\hohobnd\{A16B1AF7-982D-40C3-B5C1-633E1A6A6678}</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>869b4c634b4ec76f59fa5e09ad584fb1</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}\install.rdf</path><vendor>PUP.Optional.SetSearchSetting</vendor><action>success</action><hash>c35e7e319efbea4c0f1f95cf947106fa</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}\bootstrap.js</path><vendor>PUP.Optional.SetSearchSetting</vendor><action>success</action><hash>c35e7e319efbea4c0f1f95cf947106fa</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}\search.json</path><vendor>PUP.Optional.SetSearchSetting</vendor><action>success</action><hash>c35e7e319efbea4c0f1f95cf947106fa</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\prefs.js</path><vendor>PUP.Optional.DeskCut</vendor><action>replaced</action><baddata>deskCutv2@gmail.com</baddata><gooddata></gooddata><hash>889957581f7adc5a9ff1a8c15da8a15f</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js</path><vendor>PUP.Optional.DeskCut</vendor><action>replaced</action><baddata>deskCutv2@gmail.com</baddata><gooddata></gooddata><hash>cd54416ecdcc2a0cf79944252dd8dd23</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\searchplugins\DD1B66D4.xml</path><vendor>PUP.Optional.HohoSearch</vendor><action>success</action><hash>c160c2eda3f6b3832205c99e19ecba46</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adbeaver-log.txt</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\addons.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\addons.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\addons.sqlite-journal</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\blocklist.xml</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cert8.db</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils.zip</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz.db</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz.dbattrack</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz.dbhumanweb</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz.dbusafe</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\compatibility.ini</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\content-prefs.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cookies.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cookies.sqlite-shm</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cookies.sqlite-wal</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions.ini</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions.sqlite.protect</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\formhistory.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\healthreport.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\healthreport.sqlite-shm</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\healthreport.sqlite-wal</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\key3.db</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\lightnings.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\localstore.rdf</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\logins.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\marionette.log</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\smartcliqz-custom-data-cache.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\mimeTypes.rdf</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\permissions.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\places.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\places.sqlite-shm</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\places.sqlite-wal</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\pluginreg.dat</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\search-metadata.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\secmod.db</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionCheckpoints.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionstore.bak</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionstore.bak-20140825202822</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionstore.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\signons.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\SiteSecurityServiceState.txt</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\Telemetry.FailedProfileLocks.txt</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\times.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\urlclassifierkey3.txt</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\webappsstore.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\webappsstore.sqlite-shm</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\webappsstore.sqlite-wal</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\xulstore.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adblockplus\elemhide.css</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adblockplus\patterns-backup1.ini</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adblockplus\patterns-backup2.ini</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adblockplus\patterns-backup3.ini</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adblockplus\patterns-backup4.ini</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adblockplus\patterns-backup5.ini</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\adblockplus\patterns.ini</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-02-15_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-02-17_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-02-19_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-02-26_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-03-05_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-03-23_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-03-27_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-03-31_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-04-22_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-08-17_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-09-18_5.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2014-12-07_28_5LeUQwpRPS1lEGYQvcieDA==.jsonlz4</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2015-11-15_28_lk0H1mCFKKIDCLw+hlHIaQ==.jsonlz4</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\bookmarkbackups\bookmarks-2016-04-07_29_ElanrkgLfmTAFxN436P3Bw==.jsonlz4</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\certutil.exe</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\freebl3.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\libnspr4.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\libplc4.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\libplds4.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\msvcr100.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\nss3.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\nssckbi.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\nssdbm3.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\nssutil3.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\smime3.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\softokn3.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\sqlite3.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\CertUtils\ssl3.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz\smartcliqz-trigger-urls-cache.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz\antitracking\cookie_whitelist.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz\antitracking\tracker_owners.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\cliqz\telemetry-categories\categories.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\crashes\store.json.mozlz4</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\datareporting\state.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\cliqz@cliqz.com.xpi</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\{b5ff4533-981b-4303-87ae-ff7b33382325}.xpi</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\chrome.jar</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\chrome.manifest</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\install.rdf</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\components\aboutNetError.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\components\mCollectAutoComplete.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-debug.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-general.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-highlight.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-login.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-neterror.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-newtab.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-pref.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-search.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-shopping.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-tracking.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\defaults\preferences\unitedinternet-util.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\META-INF\manifest.mf</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\META-INF\mozilla.rsa</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\browser-mailcheck@web.de\META-INF\mozilla.sf</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}\bootstrap.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}\install.rdf</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}\search.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\healthreport\state.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\gmp-gmpopenh264\1.1\gmpopenh264.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\gmp-gmpopenh264\1.1\gmpopenh264.info</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\gmp-gmpopenh264\1.3\gmpopenh264.dll</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\gmp-gmpopenh264\1.3\gmpopenh264.info</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\searchplugins\bing-lavasoft.xml</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\searchplugins\youtube.xml</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\minidumps\16595f46-1b5b-4859-94ae-c8d31ba7fdc4.dmp</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\minidumps\18940f69-c432-49bd-a7ed-9ca8c0bfdd9e.dmp</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\minidumps\222ba3f1-322f-48cf-a608-a563f8142d64.dmp</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\minidumps\222ba3f1-322f-48cf-a608-a563f8142d64.extra</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\minidumps\49062ef6-033e-4fe6-b2cf-910ae14e6804.dmp</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\minidumps\9130cf14-4bb0-49ce-a24c-56d92ccdf2fa.dmp</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\minidumps\9130cf14-4bb0-49ce-a24c-56d92ccdf2fa.extra</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionstore-backups\previous.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionstore-backups\recovery.bak</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionstore-backups\recovery.js</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\sessionstore-backups\upgrade.js-20150108202552</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\chrome\.metadata</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\chrome\idb\2588645841ssegtnti.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++web.de\.metadata</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++web.de\idb\301792106ttes.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++www.amazon.de\.metadata</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\http+++www.amazon.de\idb\2153786202SecrroitpSt.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\moz-safe-about+home\.metadata</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\persistent\moz-safe-about+home\idb\818200132aebmoouht.sqlite</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\temporary\https+++www.facebook.com\.metadata</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\temporary\https+++www.facebook.com\asmjs\metadata</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\temporary\https+++www.facebook.com\asmjs\module13</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\temporary\https+++www.facebook.com\asmjs\module14</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\storage\temporary\https+++www.facebook.com\asmjs\module15</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\webapps\webapps.json</path><vendor>PUP.Optional.FakeFFProfile</vendor><action>success</action><hash>33ee3f707e1b3ff7c36a5710ec197f81</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js</path><vendor>PUP.Optional.HohoSearch</vendor><action>replaced</action><baddata>user_pref(&quot;browser.search.searchengine.hp&quot;, &quot;hxxp://www.hohosearch.com/?ts=AHEqA3EtAHMlBE..&amp;v=20160412&amp;uid=E9FA6529327CEEC1BDEC07434F4F02E2&amp;ptid=epf2&amp;mode=ffsengext&quot;</baddata><gooddata></gooddata><hash>63be7e31841561d52267e384cb3a2dd3</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js</path><vendor>PUP.Optional.HohoSearch</vendor><action>replaced</action><baddata>ile the application is running,
* the changes will be overwritten when the application exits.
*
* To make a manual change to preferences, you can visit the URL about:config
*/

user_p</baddata><gooddata></gooddata><hash>4bd63e7110899d99ee9ba3c416efb44c</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js</path><vendor>PUP.Optional.HohoSearch</vendor><action>replaced</action><baddata>ning,
* the changes will be overwritten when the application exits.
*
* To make a manual change to preferences, you can visit the URL about:config
*/

user_pref(&quot;accessibility.typeahea</baddata><gooddata></gooddata><hash>57ca129d712849edf49524439b6a55ab</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js</path><vendor>PUP.Optional.WinYahoo</vendor><action>replaced</action><baddata>user_pref(&quot;browser.startup.homepage&quot;, &quot;https://de.search.yahoo.com/yhs/web?hspart=iry&amp;hsimp=yhs-fullyhosted_003&amp;type=wbf_adsafld_16_15&amp;param1=1&amp;param2=f%3D1%26b%3DFirefox%26cc%3Dde%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzuzzyE0AyC0Czz0Fzy0 AyEzytBtD0DtDyDtN0D0Tzu0StCyDyCtAtN1L2XzutAtFtBtDtFtCtFtBtN1L1Czu1BtBtN1L1G1B1V1N2Y1L1Qzu2StAtByByEyCyEtBtBtGyD0EtDtAtGzzyB0E0FtGtC0ByBzytGzztBzy0AtC0 Dzz0FyBzytDyB2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0Azy0FyByCtCyBtAtGyCtA0DyDtGyEtC0F0DtGzyyDyEtDtG0DtD0C0AtB0AtD0F0DyD0F0C2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCzzyDtA%26 cr%3D489122474%26a%3Dwbf_adsafld_16_15%26os_ver%3D6.3%26os%3DWindows%2B8.1&quot;</baddata><gooddata>user_pref(&quot;browser.startup.homepage&quot;, &quot;https://www.malwarebytes.org/restorebrowser/</gooddata><hash>27fa3b74891042f4d2b3006918ed49b7</hash></file>
<file><path>C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js</path><vendor>PUP.Optional.DeskCut</vendor><action>replaced</action><baddata>deskCutv2@gmail.com</baddata><gooddata></gooddata><hash>e8390ca32f6a201619773732818454ac</hash></file>
</items>
</mbam-log>
Code:
Adaware Cleaner hat keine Bedrohung gefunden

burningice 17.04.2016 04:23
Schritt: 1
Lade Dir bitte von hier Revo Uninstaller Download Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
  • Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
  • Klicke auf Optionen und wähle als Sprache Deutsch.
  • Suche im Uninstallerfeld nach den Programmen:

    Internet Updater
    Music Toolbar for Firefox
    Music Toolbar for Internet Explorer (Dist. by iMesh, Inc.)
    Updater
    Spybot - Search and Destroy

  • Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
  • Wähle anschließend den Modus "Moderat" aus.
  • Reste löschen:
    Klicke auf dann auf und dann auf .

 


Hinweis: Falls bei der Deinstallation zu Beginn ein Fehler auftritt oder du den aufgerufenen Uninstaller nicht bedienen kannst, breche dieses Setup einfach ab und fahre mit der Entfernung durch Revo wie oben beschrieben fort.

Schritt: 2
http://filepony.de/icon/tiny/malware...ti_malware.png Starte bitte wieder Malwarebytes Anti-Malware
  • Klicke auf die Einstellungen / Erkennung und Schutz und setze dabei den Haken bei "Nach Rootkits suchen"
  • Klicke im Anschluss auf Dashboard und klicke unter dem Punkt Datenbankversion auf "Jetzt aktualisieren"
  • Wechsle zum Reiter Scannen und wähle den Bedrohungssuchlauf aus und klicke im Anschluss auf Suchlauf starten
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Suchlaufprotokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Schritt: 3
Bitte entferne evtl. alte Versionen auf deinem PC.

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).


Schritt: 4
Bitte starte wieder FRST, setze den Haken bei Addition und drücke auf Untersuchen. Poste bitte wieder die beiden Textdateien, die so entstehen.

Soehrgoz 21.04.2016 20:58
Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlaufdatum: 21.04.2016
Suchlaufzeit: 20:47
Protokolldatei: mbam.txt
Administrator: Ja

Version: 2.2.1.1043
Malware-Datenbank: v2016.04.21.05
Rootkit-Datenbank: v2016.04.17.01
Lizenz: Testversion
Malware-Schutz: Aktiviert
Schutz vor bösartigen Websites: Aktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Schatz

Suchlauftyp: Bedrohungssuchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 361745
Abgelaufene Zeit: 36 Min., 37 Sek.

Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(keine bösartigen Elemente erkannt)

Module: 0
(keine bösartigen Elemente erkannt)

Registrierungsschlüssel: 6
PUP.Optional.YesSearches, HKU\S-1-5-18\SOFTWARE\{A16B1AF7-982D-40C3-B5C1-633E1A6A6678}, In Quarantäne, [7702723fb7e285b1332bedd56d95cb35],
PUP.Optional.YesSearches, HKLM\SOFTWARE\{A16B1AF7-982D-40C3-B5C1-633E1A6A6678}, In Quarantäne, [5623c2ef2c6d2610312df0d2c43ea65a],
PUP.Optional.WinYahoo, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{0D652EDE-957F-4837-8DE6-EA03BA82021D}, Löschen bei Neustart, [12678c258217c3732363c4eadf257789],
PUP.Optional.YesSearches, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{788190E3-6C26-4971-954F-8CA8654008D6}, Löschen bei Neustart, [3e3b961b7d1c989e2c613d71af55619f],
PUP.Optional.YesSearches, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Clteyghuwph System, Löschen bei Neustart, [6415bbf6c5d447ef098559559173a15f],
PUP.Optional.WinYahoo, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Search Provided by Yahoo litod, Löschen bei Neustart, [e0997a37cdcc81b5028589259272916f],

Registrierungswerte: 2
PUP.Optional.WinYahoo, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{0D652EDE-957F-4837-8DE6-EA03BA82021D}|Path, \Search Provided by Yahoo litod, Löschen bei Neustart, [12678c258217c3732363c4eadf257789]
PUP.Optional.YesSearches, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{788190E3-6C26-4971-954F-8CA8654008D6}|Path, \Clteyghuwph System, Löschen bei Neustart, [3e3b961b7d1c989e2c613d71af55619f]

Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)

Ordner: 1
PUP.Optional.YesSearches, C:\Program Files (x86)\Clteyghuwph, In Quarantäne, [abceecc50f8a1a1ca7e1dbd3f60e639d],

Dateien: 2
PUP.Optional.WinYahoo, C:\Windows\System32\Tasks\Search Provided by Yahoo litod, In Quarantäne, [7efb4c65a5f495a1ef951f8f34d0926e],
PUP.Optional.YesSearches, C:\Program Files (x86)\Clteyghuwph\{A16B1AF7-982D-40C3-B5C1-633E1A6A6678}, In Quarantäne, [abceecc50f8a1a1ca7e1dbd3f60e639d],

Physische Sektoren: 0
(keine bösartigen Elemente erkannt)


(end)
Code:
# AdwCleaner v5.112 - Bericht erstellt am 21/04/2016 um 21:45:59
# Aktualisiert am 17/04/2016 von Xplode
# Datenbank : 2016-04-19.5 [Server]
# Betriebssystem : Windows 8.1  (X64)
# Benutzername : Schatz - SCHWARZEGIRL
# Gestartet von : C:\Users\Schatz\AppData\Local\Temp\scoped_dir5260_2502\AdwCleaner_5.112.exe
# Option : Löschen
# Unterstützung : hxxp://toolslib.net/forum

***** [ Dienste ] *****


***** [ Ordner ] *****

[-] Ordner gelöscht : C:\Users\Schatz\AppData\Roaming\vnlgp

***** [ Dateien ] *****


***** [ DLLs ] *****


***** [ Verknüpfungen ] *****


***** [ Aufgabenplanung ] *****


***** [ Registrierungsdatenbank ] *****

[-] Schlüssel gelöscht : HKCU\Software\OCS

***** [ Internetbrowser ] *****


*************************

:: "Image File Execution Options" Schlüssel gelöscht
:: "Tracing" Schlüssel gelöscht
:: "Prefetch" Dateien gelöscht
:: Proxy Einstellungen zurückgesetzt
:: Winsock Einstellungen zurückgesetzt
:: Internet Explorer Richtlinien gelöscht
:: Chrome Richtlinien gelöscht

*************************

C:\AdwCleaner\AdwCleaner[C1].txt - [21715 Bytes] - [14/04/2016 22:59:28]
C:\AdwCleaner\AdwCleaner[C2].txt - [1177 Bytes] - [21/04/2016 21:45:59]
C:\AdwCleaner\AdwCleaner[R0].txt - [50690 Bytes] - [21/01/2015 19:39:55]
C:\AdwCleaner\AdwCleaner[S0].txt - [49615 Bytes] - [21/01/2015 19:43:49]
C:\AdwCleaner\AdwCleaner[S1].txt - [25299 Bytes] - [14/04/2016 22:56:01]
C:\AdwCleaner\AdwCleaner[S2].txt - [1100 Bytes] - [15/04/2016 23:31:49]
C:\AdwCleaner\AdwCleaner[S3].txt - [1174 Bytes] - [15/04/2016 23:37:32]
C:\AdwCleaner\AdwCleaner[S4].txt - [1461 Bytes] - [21/04/2016 21:43:10]

########## EOF - C:\AdwCleaner\AdwCleaner[C2].txt - [1691 Bytes] ##########
Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:18-04-2016
durchgeführt von Schatz (Administrator) auf SCHWARZEGIRL (21-04-2016 21:52:12)
Gestartet von C:\Users\Schatz\AppData\Local\Temp\scoped_dir3184_381
Geladene Profile: Schatz (Verfügbare Profile: Schatz)
Platform: Windows 8.1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
() C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
() C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
() C:\Program Files (x86)\PHotkey\PHotkey.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
() C:\Program Files (x86)\PHotkey\Atouch64.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
() C:\Program Files (x86)\PHotkey\POsd.exe
() C:\Program Files (x86)\PHotkey\GPMTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Nico Mak Computing) C:\Program Files\WinZip\FAHWindow64.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.11.309\SSScheduler.exe
(WinZip Computing, S.L.) C:\Program Files\WinZip\WZUpdateNotifier.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(WinZip Computing, S.L.) C:\Program Files\WinZip\WzPreloader.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Opera Software) C:\Program Files (x86)\Opera\36.0.2130.65\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\36.0.2130.65\opera_crashreporter.exe
(Opera Software) C:\Program Files (x86)\Opera\36.0.2130.65\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\36.0.2130.65\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\36.0.2130.65\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\36.0.2130.65\opera.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Farbar) C:\Users\Schatz\Downloads\FRST64 (2).exe


==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13192848 2012-08-30] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1215632 2012-08-17] (Realtek Semiconductor)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2930488 2012-09-21] (Synaptics Incorporated)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176952 2016-03-19] (Apple Inc.)
HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [258576 2012-07-30] (CyberLink Corp.)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-09-01] (Intel Corporation)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-20] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [807392 2016-03-22] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [67384 2016-03-18] (Apple Inc.)
HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [66328 2016-03-30] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKLM\...\Policies\Explorer: [ConfirmFileDelete] 1
HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\Run: [icq] => C:\Users\Schatz\AppData\Roaming\ICQM\icq.exe [28698984 2013-09-25] (ICQ)
HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\Run: [Sony PC Companion] => C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [449760 2013-10-31] (Sony)
HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
HKU\S-1-5-18\...\RunOnce: [iCloud] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloud.exe [60688 2015-12-01] (Apple Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FAH.lnk [2016-04-21]
ShortcutTarget: FAH.lnk -> C:\Program Files\WinZip\FAHConsole.exe (Nico Mak Computing)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2016-04-21]
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.309\SSScheduler.exe (McAfee, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Update Benachrichtigungsdienst.lnk [2016-04-21]
ShortcutTarget: Update Benachrichtigungsdienst.lnk -> C:\Program Files\WinZip\WZUpdateNotifier.exe (WinZip Computing, S.L.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Preloader.lnk [2016-04-21]
ShortcutTarget: WinZip Preloader.lnk -> C:\Program Files\WinZip\WzPreloader.exe (WinZip Computing, S.L.)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{2F7FF8A1-BF58-4A03-8C65-E511FFAD4E7F}: [DhcpNameServer] 192.168.0.1
ManualProxies:

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2016-03-22] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2016-04-21] (Microsoft Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-06-18] (Microsoft Corporation)
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_21_0_0_213.dll [2016-04-07] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_213.dll [2016-04-07] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2016-03-08] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-06-18] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-09-12] (Microsoft Corporation)
FF SearchPlugin: C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\searchplugins\youtube.xml [2015-11-15]
FF SearchPlugin: C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\searchplugins\youtube.xml [2015-11-15]
FF Extension: WEB.DE MailCheck - C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\extensions\browser-mailcheck@web.de [2016-04-12]
FF Extension: DownThemAll! - C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2016-04-13]
FF Extension: Kein Name - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 16.0.0\FFExt\light_plugin_firefox [nicht gefunden]
FF Extension: WEB.DE MailCheck - C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\Extensions\browser-mailcheck@web.de [2016-04-12]
FF Extension: Cliqz - C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\Extensions\cliqz@cliqz.com.xpi [2016-03-22]
FF Extension: Adblock Plus - C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-12-08]
FF Extension: Cliqz - C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\Extensions\cliqz@cliqz.com.xpi [2016-03-22]
FF Extension: Adblock Plus - C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-12-08]
FF HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\cliqz@cliqz.com => nicht gefunden

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [955736 2016-03-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [466504 2016-03-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [466504 2016-03-22] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1424880 2016-03-22] (Avira Operations GmbH & Co. KG)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-03-02] (Apple Inc.)
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [272304 2016-03-30] (Avira Operations GmbH & Co. KG)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2829552 2016-03-08] (Microsoft Corporation)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-13] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-13] (CyberLink)
R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [805888 2012-11-29] () [Datei ist nicht signiert]
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [319376 2014-10-01] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1514464 2016-03-10] (Malwarebytes)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1136608 2016-03-10] (Malwarebytes)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.309\McCHSvc.exe [293128 2016-03-11] (McAfee, Inc.)
S2 Mobile Partner. RunOuc; C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe [239968 2014-04-22] ()
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272176 2012-09-24] ()
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2012-10-19] ()
S3 Sony PC Companion; C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe [155824 2013-02-04] (Avanquest Software) [Datei ist nicht signiert]
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-08-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-08-22] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [1153840 2012-09-24] (Intel® Corporation)
S2 SearchProtectionService; C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WinService.exe [X]

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [150808 2013-11-25] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [243480 2013-11-25] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [196376 2013-11-25] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [294712 2013-10-31] (AVG Technologies CZ, s.r.o.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128664 2016-03-22] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [137952 2016-03-22] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [35488 2016-01-04] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [68936 2016-03-22] (Avira Operations GmbH & Co. KG)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1337216 2012-10-01] (Motorola Solutions, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [27008 2016-03-10] (Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [192216 2016-04-21] (Malwarebytes)
R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [65408 2016-03-10] (Malwarebytes Corporation)
R3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3345376 2013-09-04] (Intel Corporation)
R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [41272 2012-09-21] (Synaptics Incorporated)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [44344 2012-09-21] (Synaptics Incorporated)
R3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [47072 2012-10-09] (Windows (R) Win 7 DDK provider)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-08-22] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [270168 2015-08-22] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-08-22] (Microsoft Corporation)
R3 XHCIPort; C:\Windows\System32\drivers\XHCIPort.sys [188896 2012-10-09] (Windows (R) Win 7 DDK provider)

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2016-04-21 21:51 - 2016-04-21 21:51 - 02375680 _____ (Farbar) C:\Users\Schatz\Downloads\FRST64 (2).exe
2016-04-21 21:51 - 2016-04-21 21:51 - 01726464 _____ (Farbar) C:\Users\Schatz\Downloads\FRST (2).exe
2016-04-21 21:50 - 2016-04-21 21:50 - 01726464 _____ (Farbar) C:\Users\Schatz\Downloads\FRST (1).exe
2016-04-21 21:49 - 2016-04-21 21:49 - 00001773 _____ C:\Users\Schatz\Desktop\AdwCleaner[C2].txt
2016-04-21 21:40 - 2016-04-21 21:40 - 03683904 _____ C:\Users\Schatz\Downloads\AdwCleaner_5.112.exe
2016-04-21 21:27 - 2016-04-21 21:40 - 00002941 _____ C:\Users\Schatz\Desktop\mbam.txt
2016-04-21 17:41 - 2016-04-21 17:42 - 00000085 _____ C:\WINDOWS\wininit.ini
2016-04-21 17:13 - 2016-04-21 21:36 - 00001288 _____ C:\Users\Schatz\Desktop\Revo Uninstaller.lnk
2016-04-21 17:13 - 2016-04-21 17:13 - 00000000 ____D C:\Users\Schatz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
2016-04-21 17:13 - 2016-04-21 17:13 - 00000000 ____D C:\Program Files (x86)\VS Revo Group
2016-04-21 17:12 - 2016-04-21 17:12 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Schatz\Downloads\revosetup95.exe
2016-04-16 22:50 - 2016-04-16 22:50 - 01733512 _____ (Kaspersky Lab) C:\Users\Schatz\Downloads\kts16.0.0.614a bcden_9319.exe
2016-04-16 22:24 - 2016-04-21 21:36 - 00000949 _____ C:\Users\Schatz\Desktop\VCDEasy.lnk
2016-04-16 22:24 - 2016-04-16 22:24 - 00000000 ____D C:\Users\Schatz\AppData\Roaming\VCDEasy
2016-04-16 22:24 - 2016-04-16 22:24 - 00000000 ____D C:\Users\Schatz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VCDEasy
2016-04-16 22:24 - 2016-04-16 22:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VCDEasy
2016-04-16 22:24 - 2016-04-16 22:24 - 00000000 ____D C:\Program Files (x86)\VCDEasy
2016-04-16 22:18 - 2016-04-16 22:18 - 01475080 _____ C:\Users\Schatz\Downloads\VCDEasy - CHIP-Installer.exe
2016-04-16 22:03 - 2016-04-16 22:03 - 00000000 ____D C:\Users\Schatz\MediaEspresso
2016-04-15 23:40 - 2016-04-21 21:52 - 00000000 ____D C:\FRST
2016-04-15 23:38 - 2016-04-15 23:38 - 02375168 _____ (Farbar) C:\Users\Schatz\Downloads\FRST64 (1).exe
2016-04-15 23:38 - 2016-04-15 23:38 - 01725952 _____ (Farbar) C:\Users\Schatz\Downloads\FRST.exe
2016-04-15 23:37 - 2016-04-15 23:37 - 02375168 _____ (Farbar) C:\Users\Schatz\Downloads\FRST64.exe
2016-04-15 23:09 - 2016-04-15 23:10 - 00010240 ___SH C:\Users\Schatz\Downloads\Thumbs.db
2016-04-14 23:13 - 2016-04-14 23:13 - 01610352 _____ (Malwarebytes) C:\Users\Schatz\Downloads\JRT.exe
2016-04-14 22:54 - 2016-04-14 22:54 - 03670016 _____ C:\Users\Schatz\Downloads\adwcleaner_5.111.exe
2016-04-14 22:53 - 2016-04-14 22:53 - 03465280 _____ C:\Users\Schatz\Downloads\AdwCleaner_5.110 (1).exe
2016-04-14 22:50 - 2016-04-14 22:50 - 03465280 _____ C:\Users\Schatz\Downloads\AdwCleaner_5.110.exe
2016-04-14 22:25 - 2016-04-21 21:52 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2016-04-14 22:24 - 2016-04-21 21:37 - 00001116 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-04-14 22:24 - 2016-04-14 22:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-04-14 22:24 - 2016-04-14 22:24 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-04-14 22:24 - 2016-04-14 22:24 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-04-14 22:24 - 2016-03-10 14:09 - 00065408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2016-04-14 22:24 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2016-04-14 22:24 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2016-04-14 22:22 - 2016-04-14 22:22 - 22851472 _____ (Malwarebytes ) C:\Users\Schatz\Downloads\mbam-setup-2.2.1.1043.exe
2016-04-14 22:16 - 2016-04-12 22:21 - 00001006 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20160414-221609.backup
2016-04-14 22:01 - 2016-04-14 22:01 - 00000000 ____D C:\Users\Schatz\Documents\ProcAlyzer Dumps
2016-04-13 23:07 - 2016-04-13 23:07 - 01475080 _____ C:\Users\Schatz\Downloads\CryptLoad - CHIP-Installer.exe
2016-04-13 22:58 - 2016-04-14 00:57 - 00002928 _____ C:\Users\Schatz\Downloads\Joey_1985_German_1080p_BluRay_x264-1ydj20o72sja6.dlc
2016-04-13 22:54 - 2016-04-13 22:54 - 00011557 _____ C:\Users\Schatz\Downloads\3d0dae370e_001.htm
2016-04-13 22:34 - 2016-04-13 22:34 - 00011557 _____ C:\Users\Schatz\Downloads\3d0dae370e.htm
2016-04-13 03:07 - 2016-03-31 02:54 - 25817600 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2016-04-13 03:07 - 2016-03-31 02:31 - 02892800 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2016-04-13 03:07 - 2016-03-31 02:25 - 06052352 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2016-04-13 03:07 - 2016-03-31 02:03 - 20352512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2016-04-13 03:07 - 2016-03-31 01:51 - 02285056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2016-04-13 03:07 - 2016-03-31 01:43 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2016-04-13 03:07 - 2016-03-31 01:43 - 00725504 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2016-04-13 03:07 - 2016-03-31 01:43 - 00379392 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2016-04-13 03:07 - 2016-03-31 01:42 - 02131968 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2016-04-13 03:07 - 2016-03-31 01:39 - 15415808 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2016-04-13 03:07 - 2016-03-31 01:30 - 02596864 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2016-04-13 03:07 - 2016-03-31 01:23 - 02056192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2016-04-13 03:07 - 2016-03-31 01:23 - 00693248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2016-04-13 03:07 - 2016-03-31 01:23 - 00330752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2016-04-13 03:07 - 2016-03-31 01:21 - 13811712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2016-04-13 03:07 - 2016-03-31 01:18 - 01547264 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2016-04-13 03:07 - 2016-03-31 01:05 - 02121216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2016-04-13 03:07 - 2016-03-16 01:00 - 00561952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2016-04-13 03:07 - 2016-03-15 16:14 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2016-04-13 03:07 - 2016-03-11 16:48 - 00833024 _____ (Microsoft Corporation) C:\WINDOWS\system32\samsrv.dll
2016-04-13 03:07 - 2016-03-10 20:22 - 00201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2016-04-13 03:07 - 2016-03-10 20:21 - 00401920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys
2016-04-13 03:07 - 2016-03-10 20:20 - 00284672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb10.sys
2016-04-13 03:07 - 2016-03-10 19:44 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2016-04-13 03:07 - 2016-03-10 19:16 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2016-04-13 03:07 - 2016-03-10 19:03 - 00111616 _____ (Microsoft Corporation) C:\WINDOWS\system32\samlib.dll
2016-04-13 03:07 - 2016-03-10 18:48 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\samlib.dll
2016-04-13 03:07 - 2016-02-02 20:16 - 00112640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rasl2tp.sys
2016-04-13 03:06 - 2016-03-31 02:28 - 00571904 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2016-04-13 03:06 - 2016-03-31 02:17 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2016-04-13 03:06 - 2016-03-31 01:56 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2016-04-13 03:06 - 2016-03-31 01:56 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2016-04-13 03:06 - 2016-03-31 01:55 - 00315392 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2016-04-13 03:06 - 2016-03-31 01:53 - 00496640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2016-04-13 03:06 - 2016-03-31 01:50 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2016-04-13 03:06 - 2016-03-31 01:45 - 00663552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2016-04-13 03:06 - 2016-03-31 01:45 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2016-04-13 03:06 - 2016-03-31 01:30 - 04611072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2016-04-13 03:06 - 2016-03-31 01:30 - 00279040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2016-04-13 03:06 - 2016-03-31 01:30 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2016-04-13 03:06 - 2016-03-31 01:27 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2016-04-13 03:06 - 2016-03-31 01:24 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2016-04-13 03:06 - 2016-03-31 01:06 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2016-04-13 03:06 - 2016-03-31 01:02 - 01311744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2016-04-13 03:06 - 2016-03-31 01:00 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2016-04-13 03:05 - 2016-03-03 18:47 - 02345472 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2016-04-13 03:05 - 2016-03-03 18:33 - 01556992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2016-04-13 03:05 - 2016-03-03 03:39 - 01661576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2016-04-13 03:05 - 2016-03-03 03:39 - 01212248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2016-04-13 03:05 - 2016-02-09 03:31 - 22365472 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2016-04-13 03:05 - 2016-02-09 03:31 - 19794896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2016-04-13 03:05 - 2016-02-09 03:31 - 02757616 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2016-04-13 03:05 - 2016-02-09 03:31 - 02412576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2016-04-13 03:05 - 2016-02-08 21:48 - 12879360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2016-04-13 03:05 - 2016-02-08 20:50 - 03120640 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExplorerFrame.dll
2016-04-13 03:05 - 2016-02-08 19:12 - 14466560 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2016-04-13 03:05 - 2016-02-05 16:46 - 01455104 _____ (Microsoft Corporation) C:\WINDOWS\system32\VSSVC.exe
2016-04-13 03:05 - 2016-02-03 17:14 - 00080896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\IPMIDrv.sys
2016-04-13 03:05 - 2016-02-03 17:11 - 01673728 _____ (Microsoft Corporation) C:\WINDOWS\system32\workfolderssvc.dll
2016-04-13 03:05 - 2016-02-02 19:51 - 00162304 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmAuto.dll
2016-04-13 03:05 - 2016-02-02 19:19 - 00144384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmAuto.dll
2016-04-13 03:05 - 2016-02-02 19:15 - 00787456 _____ (Microsoft Corporation) C:\WINDOWS\system32\WorkfoldersControl.dll
2016-04-13 03:05 - 2016-02-02 19:01 - 00031744 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmAgent.dll
2016-04-13 03:05 - 2016-02-02 18:51 - 02609152 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmSvc.dll
2016-04-13 03:05 - 2016-02-02 18:48 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmWmiPl.dll
2016-04-13 03:05 - 2016-02-02 18:46 - 00026112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmAgent.dll
2016-04-13 03:05 - 2016-02-02 18:41 - 02170880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmSvc.dll
2016-04-13 03:05 - 2016-02-02 18:39 - 00236032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmWmiPl.dll
2016-04-13 03:05 - 2016-01-27 17:18 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll
2016-04-13 03:05 - 2016-01-21 21:35 - 00952928 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2016-04-13 03:05 - 2016-01-21 20:42 - 00786152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2016-04-13 03:04 - 2016-04-04 08:35 - 00046768 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2016-04-13 03:04 - 2016-04-02 15:26 - 01386496 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2016-04-13 03:04 - 2016-04-02 15:26 - 01169408 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2016-04-13 03:04 - 2016-03-29 16:05 - 04175872 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2016-04-13 03:04 - 2016-03-28 15:21 - 00698368 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2016-04-13 03:04 - 2016-03-28 15:21 - 00499200 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2016-04-13 03:04 - 2016-03-28 15:21 - 00279040 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2016-04-13 03:04 - 2016-03-28 15:21 - 00215040 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2016-04-13 03:04 - 2016-03-28 15:21 - 00076800 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2016-04-13 03:04 - 2016-03-10 21:19 - 07452512 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2016-04-13 03:04 - 2016-03-10 21:17 - 01663192 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2016-04-13 03:04 - 2016-03-10 21:17 - 01523216 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2016-04-13 03:04 - 2016-03-10 21:17 - 01490128 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2016-04-13 03:04 - 2016-03-10 21:17 - 01358960 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2016-04-13 03:04 - 2016-03-10 21:17 - 01133752 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2016-04-13 03:04 - 2016-03-10 19:48 - 00862720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2016-04-13 03:04 - 2016-03-10 19:43 - 00161280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msorcl32.dll
2016-04-13 03:04 - 2016-03-10 18:55 - 00166400 _____ (Microsoft Corporation) C:\WINDOWS\system32\mtxoci.dll
2016-04-13 03:04 - 2016-03-10 18:42 - 00116736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mtxoci.dll
2016-04-13 03:04 - 2016-03-03 18:13 - 00059392 _____ (Microsoft Corporation) C:\WINDOWS\system32\basesrv.dll
2016-04-13 03:04 - 2016-02-09 03:31 - 00273264 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlows.exe
2016-04-13 03:04 - 2016-02-08 22:55 - 02712576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll
2016-04-13 03:04 - 2016-02-08 22:15 - 02551808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\themecpl.dll
2016-04-13 03:04 - 2016-02-08 22:02 - 01197056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usercpl.dll
2016-04-13 03:04 - 2016-02-08 21:43 - 00524288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2016-04-13 03:04 - 2016-02-08 21:40 - 00539648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hgcpl.dll
2016-04-13 03:04 - 2016-02-08 21:39 - 00305152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\stobject.dll
2016-04-13 03:04 - 2016-02-08 21:37 - 00141312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingMonitor.dll
2016-04-13 03:04 - 2016-02-08 21:35 - 00954880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll
2016-04-13 03:04 - 2016-02-08 21:34 - 00667648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
2016-04-13 03:04 - 2016-02-08 21:33 - 00520192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSync.dll
2016-04-13 03:04 - 2016-02-08 19:55 - 02592256 _____ (Microsoft Corporation) C:\WINDOWS\system32\themecpl.dll
2016-04-13 03:04 - 2016-02-08 19:33 - 01278464 _____ (Microsoft Corporation) C:\WINDOWS\system32\usercpl.dll
2016-04-13 03:04 - 2016-02-08 19:02 - 00653824 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2016-04-13 03:04 - 2016-02-08 19:00 - 00599552 _____ (Microsoft Corporation) C:\WINDOWS\system32\hgcpl.dll
2016-04-13 03:04 - 2016-02-08 18:58 - 00336384 _____ (Microsoft Corporation) C:\WINDOWS\system32\stobject.dll
2016-04-13 03:04 - 2016-02-08 18:55 - 00173056 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingMonitor.dll
2016-04-13 03:04 - 2016-02-08 18:53 - 02171904 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlowUI.dll
2016-04-13 03:04 - 2016-02-08 18:53 - 01348096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2016-04-13 03:04 - 2016-02-08 18:50 - 01220096 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.appcore.dll
2016-04-13 03:04 - 2016-02-08 18:50 - 00841728 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2016-04-13 03:04 - 2016-02-08 18:48 - 00655872 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSync.dll
2016-04-13 03:04 - 2016-02-08 18:47 - 02819584 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll
2016-04-13 03:04 - 2016-02-08 18:44 - 00955392 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll
2016-04-13 03:04 - 2016-02-07 01:05 - 00551256 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2016-04-13 03:04 - 2016-02-07 00:41 - 00316760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volsnap.sys
2016-04-13 03:04 - 2016-02-05 21:07 - 00378712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2016-04-13 03:04 - 2016-02-05 17:11 - 00845312 _____ (Microsoft Corporation) C:\WINDOWS\system32\BFE.DLL
2016-04-13 03:04 - 2016-02-05 17:11 - 00422400 _____ (Microsoft Corporation) C:\WINDOWS\system32\FWPUCLNT.DLL
2016-04-13 03:04 - 2016-02-05 17:07 - 00272384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FWPUCLNT.DLL
2016-04-13 03:04 - 2016-02-05 17:02 - 01083904 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL
2016-04-13 03:04 - 2016-02-04 20:07 - 00222720 _____ (Microsoft Corporation) C:\WINDOWS\system32\dhcpsapi.dll
2016-04-13 03:04 - 2016-02-04 19:35 - 00142848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dhcpsapi.dll
2016-04-13 03:04 - 2016-02-04 18:23 - 00713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
2016-04-13 03:04 - 2016-02-04 18:22 - 00561664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
2016-04-13 03:04 - 2016-02-02 19:18 - 01574912 _____ (Microsoft Corporation) C:\WINDOWS\system32\wbengine.exe
2016-04-13 03:04 - 2016-01-31 19:17 - 00779264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsAnytimeUpgradeui.exe
2016-04-13 03:04 - 2016-01-26 21:15 - 00072024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vpci.sys
2016-04-13 03:04 - 2016-01-22 07:22 - 02487296 _____ (Microsoft Corporation) C:\WINDOWS\system32\storagewmi.dll
2016-04-13 03:04 - 2016-01-22 07:11 - 01482240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\storagewmi.dll
2016-04-13 03:04 - 2016-01-21 00:40 - 00099672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\disk.sys
2016-04-12 23:02 - 2016-04-21 21:36 - 00002324 _____ C:\Users\Schatz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chromium.lnk
2016-04-12 23:02 - 2016-04-21 21:36 - 00002316 _____ C:\Users\Schatz\Desktop\Chromium.lnk
2016-04-12 22:14 - 2016-04-12 22:14 - 00003180 _____ C:\Users\Schatz\Downloads\post_reply.htm
2016-04-12 22:13 - 2016-04-21 21:37 - 00002275 _____ C:\Users\Public\Desktop\WinZip.lnk
2016-04-12 22:13 - 2016-04-21 21:36 - 00002287 _____ C:\ProgramData\Microsoft\Windows\Start Menu\WinZip.lnk
2016-04-12 22:13 - 2016-04-12 22:15 - 00000000 ____D C:\ProgramData\WinZip
2016-04-12 22:13 - 2016-04-12 22:13 - 00000000 ____D C:\Users\Schatz\AppData\Local\WinZip Computing, S.L
2016-04-12 22:13 - 2016-04-12 22:13 - 00000000 ____D C:\Users\Schatz\AppData\Local\WinZip
2016-04-12 22:13 - 2016-04-12 22:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip
2016-04-12 22:12 - 2016-04-12 22:13 - 00000000 ____D C:\Program Files\WinZip
2016-04-12 22:10 - 2016-04-21 21:45 - 00000300 _____ C:\WINDOWS\Tasks\{2FE13EE9-AE44-25EE-1098-2BDFFC5F70F9}.job
2016-04-12 22:10 - 2016-04-13 06:45 - 00002638 _____ C:\WINDOWS\System32\Tasks\{2FE13EE9-AE44-25EE-1098-2BDFFC5F70F9}
2016-04-12 22:10 - 2016-04-12 23:02 - 00000000 ____D C:\Users\Schatz\AppData\Local\Chromium
2016-04-12 22:10 - 2016-04-12 22:10 - 00000000 ____D C:\Users\Schatz\AppData\Local\PPC-software
2016-04-12 22:09 - 2016-04-21 21:46 - 00000008 __RSH C:\ProgramData\ntuser.pol
2016-04-12 22:09 - 2016-04-21 21:09 - 00001006 _____ C:\WINDOWS\Tasks\Search Provided by Yahoo litod.job
2016-04-12 22:09 - 2016-04-12 22:09 - 00000000 ____D C:\Users\Schatz\AppData\Local\Setup225257734
2016-04-12 22:08 - 2016-04-12 22:08 - 00060548 _____ C:\Users\Schatz\Downloads\installer [1].exe
2016-04-12 22:07 - 2016-04-12 22:07 - 00000000 ____D C:\Users\Public\Documents\dmp
2016-04-12 22:01 - 2016-04-21 21:37 - 00001763 _____ C:\Users\Public\Desktop\iTunes.lnk
2016-04-12 22:01 - 2016-04-12 22:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2016-04-12 22:00 - 2016-04-12 22:01 - 00000000 ____D C:\Program Files\iTunes
2016-04-12 22:00 - 2016-04-12 22:00 - 00000000 ____D C:\Program Files\iPod
2016-04-12 22:00 - 2016-04-12 22:00 - 00000000 ____D C:\Program Files (x86)\iTunes
2016-04-12 21:55 - 2016-04-12 21:55 - 00000000 ____D C:\WINDOWS\System32\Tasks\Apple
2016-04-12 21:55 - 2016-04-12 21:55 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2016-04-12 21:49 - 2016-04-21 21:37 - 00001915 _____ C:\Users\Public\Desktop\QuickTime Player.lnk
2016-04-12 21:49 - 2016-04-12 21:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2016-04-12 21:49 - 2016-04-12 21:49 - 00000000 ____D C:\Program Files (x86)\QuickTime Alternative
2016-04-10 07:41 - 2016-04-05 23:53 - 00829944 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2016-04-10 07:41 - 2016-04-05 23:53 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2016-04-07 21:35 - 2015-12-17 20:29 - 00131584 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2016-04-07 21:35 - 2015-12-17 18:17 - 03547648 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2016-04-06 09:34 - 2016-02-08 22:29 - 00099328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hlink.dll
2016-04-06 09:34 - 2016-02-08 20:14 - 00108544 _____ (Microsoft Corporation) C:\WINDOWS\system32\hlink.dll
2016-04-06 09:34 - 2016-02-08 19:15 - 02880000 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2016-04-06 09:34 - 2016-01-06 20:25 - 00416768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv.sys
2016-04-06 09:34 - 2015-12-30 23:53 - 02017624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2016-04-06 09:32 - 2016-02-05 16:59 - 07784960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2016-04-06 09:32 - 2016-02-05 16:55 - 05264384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2016-04-06 09:32 - 2016-02-05 16:48 - 07075840 _____ (Microsoft Corporation) C:\WINDOWS\system32\glcndFilter.dll
2016-04-06 09:32 - 2016-02-05 16:47 - 05268480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\glcndFilter.dll
2016-04-06 09:31 - 2015-12-20 16:57 - 00839168 _____ (Microsoft Corporation) C:\WINDOWS\system32\netlogon.dll
2016-04-06 09:31 - 2015-12-20 16:43 - 00696320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netlogon.dll
2016-04-06 09:30 - 2016-02-12 21:14 - 00136904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2016-04-06 09:30 - 2016-02-12 17:14 - 03708416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2016-04-06 09:30 - 2016-02-12 16:55 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2016-04-06 09:30 - 2016-02-12 16:54 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2016-04-06 09:30 - 2016-02-12 16:54 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2016-04-06 09:30 - 2016-02-12 16:54 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2016-04-06 09:30 - 2016-02-12 16:51 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2016-04-06 09:30 - 2016-02-12 16:51 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2016-04-06 09:30 - 2016-02-12 16:51 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2016-04-06 09:30 - 2016-02-12 16:48 - 02244096 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2016-04-06 09:30 - 2016-02-12 16:47 - 00897024 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2016-04-06 09:30 - 2016-02-12 16:46 - 00726528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2016-04-06 09:30 - 2016-02-06 20:08 - 00031744 _____ (Microsoft Corporation) C:\WINDOWS\system32\seclogon.dll
2016-04-06 09:30 - 2016-01-05 17:00 - 00570880 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2016-04-06 09:29 - 2016-02-03 17:09 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll
2016-04-06 09:29 - 2016-02-03 17:00 - 00091136 _____ (Microsoft Corporation) C:\WINDOWS\system32\asycfilt.dll
2016-04-06 09:29 - 2016-02-03 17:00 - 00077824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\asycfilt.dll
2016-04-06 09:29 - 2016-01-24 20:19 - 00419160 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys
2016-04-06 09:29 - 2016-01-24 20:19 - 00331608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Classpnp.sys
2016-04-06 09:29 - 2016-01-24 13:57 - 01335296 _____ (Microsoft Corporation) C:\WINDOWS\system32\mispace.dll
2016-04-06 09:29 - 2016-01-24 13:45 - 01063424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mispace.dll
2016-04-06 09:29 - 2016-01-09 03:38 - 00091992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbehci.sys
2016-04-06 09:29 - 2016-01-07 01:46 - 00148752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wscapi.dll
2016-04-06 09:29 - 2016-01-07 01:45 - 00177712 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscapi.dll
2016-04-06 09:29 - 2016-01-06 18:47 - 00146944 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscsvc.dll
2016-04-06 09:27 - 2016-02-05 21:07 - 00292696 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMASF.DLL
2016-04-06 09:27 - 2016-02-05 21:07 - 00243032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMASF.DLL
2016-04-06 09:27 - 2016-02-05 17:03 - 15432704 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2016-04-06 09:27 - 2016-02-05 17:00 - 13318144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2016-04-06 09:27 - 2016-01-13 23:26 - 01737080 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2016-04-06 09:27 - 2016-01-13 23:26 - 01501488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2016-04-06 09:27 - 2016-01-10 20:18 - 00246784 _____ (Microsoft Corporation) C:\WINDOWS\system32\microsoft-windows-system-events.dll
2016-04-06 09:27 - 2016-01-10 18:41 - 01707008 _____ (Microsoft Corporation) C:\WINDOWS\system32\comsvcs.dll
2016-04-06 09:27 - 2016-01-10 18:31 - 01344512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comsvcs.dll
2016-04-06 09:27 - 2015-12-20 16:56 - 00616960 _____ (Microsoft Corporation) C:\WINDOWS\system32\msra.exe
2016-04-06 09:27 - 2015-11-19 16:33 - 00994760 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase.dll
2016-04-06 09:27 - 2015-11-19 16:26 - 00922432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ucrtbase.dll
2016-04-06 09:26 - 2016-02-11 16:21 - 00869576 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvcr120_clr0400.dll
2016-04-06 09:26 - 2016-02-11 16:21 - 00678600 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvcp120_clr0400.dll
2016-04-06 09:26 - 2016-02-11 16:20 - 00875720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcr120_clr0400.dll
2016-04-06 09:26 - 2016-02-11 16:20 - 00536776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcp120_clr0400.dll
2016-04-06 09:26 - 2016-02-04 20:18 - 00358912 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2016-04-06 09:26 - 2016-02-04 20:12 - 00044032 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2016-04-06 09:26 - 2016-02-04 19:44 - 00301568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2016-04-06 09:26 - 2016-02-04 19:39 - 00035840 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2016-04-06 09:26 - 2016-02-04 19:24 - 00603648 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfds.dll
2016-04-06 09:26 - 2016-02-04 19:02 - 00483328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfds.dll
2016-04-06 09:26 - 2016-01-31 21:16 - 00148832 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBSTOR.SYS
2016-04-06 09:26 - 2016-01-09 03:49 - 00218448 _____ (Microsoft Corporation) C:\WINDOWS\system32\rsaenh.dll
2016-04-06 09:26 - 2016-01-09 03:49 - 00192120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rsaenh.dll
2016-04-06 09:26 - 2015-12-30 22:49 - 00470360 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netio.sys
2016-04-06 09:25 - 2016-02-06 18:58 - 00987648 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2016-04-06 09:25 - 2016-02-06 18:32 - 00801792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2016-04-06 09:21 - 2016-01-10 19:50 - 00062464 _____ (Microsoft Corporation) C:\WINDOWS\system32\cfgbkend.dll
2016-04-06 09:21 - 2016-01-10 19:16 - 00898048 _____ (Microsoft Corporation) C:\WINDOWS\system32\CPFilters.dll
2016-04-06 09:21 - 2016-01-10 19:14 - 00048640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cfgbkend.dll
2016-04-06 09:21 - 2016-01-10 19:12 - 00532480 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDec.dll
2016-04-06 09:21 - 2016-01-10 18:51 - 00702976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CPFilters.dll
2016-04-06 09:21 - 2016-01-10 18:49 - 00443392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EncDec.dll
2016-04-06 09:13 - 2016-01-22 07:07 - 02778624 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2016-04-06 09:13 - 2016-01-22 06:58 - 02464256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2016-04-06 09:13 - 2016-01-19 21:13 - 02175008 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll
2016-04-06 09:13 - 2016-01-19 21:13 - 01063464 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinTypes.dll
2016-04-06 09:13 - 2016-01-19 20:23 - 01564496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll
2016-04-06 09:13 - 2016-01-19 20:23 - 00548024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinTypes.dll
2016-04-06 09:13 - 2016-01-19 18:37 - 00267776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wincorlib.dll
2016-04-06 09:13 - 2016-01-10 21:37 - 00442720 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2016-04-06 09:13 - 2016-01-10 20:39 - 00332640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2016-04-06 09:13 - 2016-01-10 18:56 - 00186880 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpapisrv.dll
2016-04-06 09:13 - 2016-01-06 20:25 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys
2016-04-06 09:13 - 2015-12-28 23:42 - 00713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSync.dll
2016-04-06 09:13 - 2015-12-28 22:31 - 00578048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinSync.dll
2016-04-06 08:15 - 2016-04-06 08:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2016-04-21 21:53 - 2013-07-02 22:33 - 00003598 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3205940643-3366264869-3578409839-1002
2016-04-21 21:49 - 2015-10-03 19:14 - 00000000 ____D C:\Users\Schatz\OneDrive
2016-04-21 21:47 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-04-21 21:45 - 2015-01-21 19:39 - 00000000 ____D C:\AdwCleaner
2016-04-21 21:37 - 2016-02-25 16:03 - 00002022 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2016-04-21 21:37 - 2016-01-13 20:37 - 00001152 _____ C:\Users\Public\Desktop\Avira Launcher.lnk
2016-04-21 21:37 - 2015-09-20 22:39 - 00001055 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2016-04-21 21:37 - 2015-09-20 22:39 - 00000996 _____ C:\Users\Public\Desktop\Opera.lnk
2016-04-21 21:37 - 2015-08-22 01:10 - 00001535 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2016-04-21 21:37 - 2015-06-18 19:09 - 00002555 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Excel Viewer.lnk
2016-04-21 21:37 - 2014-08-17 19:16 - 00000930 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk
2016-04-21 21:37 - 2014-08-17 18:59 - 00001067 _____ C:\Users\Public\Desktop\posterXXL Designer.lnk
2016-04-21 21:37 - 2014-08-17 16:05 - 00002523 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2016-04-21 21:37 - 2014-03-27 20:03 - 00002701 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Word Viewer 2003.lnk
2016-04-21 21:37 - 2014-01-20 19:57 - 00002100 _____ C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk
2016-04-21 21:37 - 2013-12-28 10:12 - 00000979 _____ C:\Users\Public\Desktop\AVG 2014.lnk
2016-04-21 21:37 - 2013-07-03 20:48 - 00001149 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2016-04-21 21:37 - 2013-07-03 20:48 - 00001069 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-04-21 21:37 - 2012-12-12 13:36 - 00001112 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MEDIONhome.lnk
2016-04-21 21:37 - 2012-11-23 13:19 - 00002210 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickLaunch.lnk
2016-04-21 21:37 - 2012-11-23 05:44 - 00002014 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel(R) WiDi.lnk
2016-04-21 21:37 - 2012-11-22 14:42 - 00001366 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
2016-04-21 21:37 - 2012-11-22 14:42 - 00001297 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
2016-04-21 21:36 - 2015-10-03 17:53 - 00001218 _____ C:\Users\Schatz\Desktop\DSCN0420 - Verknüpfung.lnk
2016-04-21 21:36 - 2015-10-03 17:53 - 00001218 _____ C:\Users\Schatz\Desktop\DSCN0419 - Verknüpfung.lnk
2016-04-21 21:36 - 2015-10-03 17:53 - 00001218 _____ C:\Users\Schatz\Desktop\DSCN0418 - Verknüpfung.lnk
2016-04-21 21:36 - 2015-10-03 17:53 - 00001218 _____ C:\Users\Schatz\Desktop\DSCN0417 - Verknüpfung.lnk
2016-04-21 21:36 - 2015-10-03 17:53 - 00001218 _____ C:\Users\Schatz\Desktop\DSCN0416 - Verknüpfung.lnk
2016-04-21 21:36 - 2015-10-03 17:53 - 00001218 _____ C:\Users\Schatz\Desktop\DSCN0414 - Verknüpfung.lnk
2016-04-21 21:36 - 2015-09-24 22:06 - 00000954 _____ C:\Users\Schatz\Desktop\RS File Repair.lnk
2016-04-21 21:36 - 2015-09-20 22:38 - 00001219 _____ C:\Users\Schatz\Desktop\File Repair.lnk
2016-04-21 21:36 - 2015-09-20 22:27 - 00002193 _____ C:\Users\Schatz\Desktop\File Repair - CHIP Downloader.lnk
2016-04-21 21:36 - 2015-09-20 21:25 - 00001868 _____ C:\Users\Schatz\Desktop\IrfanView 64 Thumbnails.lnk
2016-04-21 21:36 - 2015-09-20 21:25 - 00000998 _____ C:\Users\Schatz\Desktop\IrfanView 64.lnk
2016-04-21 21:36 - 2015-08-22 01:39 - 00001057 _____ C:\Users\Schatz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-04-21 21:36 - 2015-08-22 01:00 - 00000469 _____ C:\Users\Schatz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
2016-04-21 21:36 - 2015-08-22 01:00 - 00000467 _____ C:\Users\Schatz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
2016-04-21 21:36 - 2015-06-18 20:40 - 00002250 _____ C:\Users\Schatz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2016-04-21 21:36 - 2014-08-17 19:26 - 00001112 _____ C:\Users\Schatz\Desktop\GIMP 2.lnk
2016-04-21 21:36 - 2014-01-11 20:51 - 00000996 _____ C:\Users\Schatz\Desktop\Nightmares from the Deep.lnk
2016-04-21 21:36 - 2014-01-11 20:46 - 00000789 _____ C:\Users\Schatz\Desktop\Invisible Man.lnk
2016-04-21 21:36 - 2014-01-11 20:35 - 00002311 _____ C:\Users\Schatz\Desktop\Play Margrave Manor Der Fluch des gebrochenen Herzens.lnk
2016-04-21 21:36 - 2014-01-11 20:28 - 00001831 _____ C:\Users\Schatz\Desktop\Abyss - Grauen der Tiefe.lnk
2016-04-21 21:36 - 2014-01-11 20:23 - 00001613 _____ C:\Users\Schatz\Desktop\Shadows.lnk
2016-04-21 21:36 - 2014-01-11 20:05 - 00001075 _____ C:\Users\Schatz\Desktop\Nightfall Mysteries - Die Ashburg Verschwörung.lnk
2016-04-21 21:36 - 2013-09-25 09:48 - 00001771 _____ C:\Users\Schatz\Desktop\ICQ.lnk
2016-04-21 21:36 - 2013-09-25 09:48 - 00001629 _____ C:\Users\Schatz\AppData\Roaming\Microsoft\Windows\Start Menu\ICQ.lnk
2016-04-21 21:36 - 2013-09-06 08:53 - 00001479 _____ C:\Users\Schatz\Desktop\Das Schicksal der Marie Antoinette.lnk
2016-04-21 21:36 - 2013-09-04 08:59 - 00001311 _____ C:\Users\Schatz\Desktop\Der Fluch des Blutes.lnk
2016-04-21 21:36 - 2013-08-19 17:06 - 00001467 _____ C:\Users\Schatz\Desktop\Magic Encyclopedia 3 - Illusionen.lnk
2016-04-21 21:36 - 2013-07-01 22:19 - 00002976 _____ C:\Users\Schatz\Desktop\MEDIONmail.lnk
2016-04-21 21:36 - 2013-07-01 22:19 - 00001711 _____ C:\Users\Schatz\Desktop\Kindersicherung einrichten.lnk
2016-04-21 21:36 - 2013-07-01 22:19 - 00001132 _____ C:\Users\Schatz\Desktop\MEDION Serviceportal.lnk
2016-04-21 21:36 - 2013-07-01 22:19 - 00001128 _____ C:\Users\Schatz\Desktop\Gutscheine bei coupons4u.lnk
2016-04-21 21:36 - 2013-07-01 22:19 - 00001112 _____ C:\Users\Schatz\Desktop\MEDIONplay.lnk
2016-04-21 21:36 - 2013-07-01 22:19 - 00001112 _____ C:\Users\Schatz\Desktop\LIFESTORE.lnk
2016-04-21 21:36 - 2013-07-01 22:16 - 00002439 _____ C:\Users\Schatz\Desktop\MEDIONmediathek.lnk
2016-04-21 21:36 - 2013-07-01 22:16 - 00001122 _____ C:\Users\Schatz\Desktop\Windows 8 Info.lnk
2016-04-21 21:29 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\L2Schemas
2016-04-21 21:23 - 2013-08-22 15:36 - 00000000 ____D C:\WINDOWS\Inf
2016-04-21 21:03 - 2013-08-18 07:42 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2016-04-21 17:42 - 2015-01-18 21:13 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2016-04-21 17:42 - 2015-01-18 21:13 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2016-04-21 17:37 - 2014-08-17 15:25 - 00000000 ____D C:\ProgramData\Package Cache
2016-04-21 17:37 - 2014-03-05 22:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2016-04-21 17:33 - 2013-08-22 15:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2016-04-21 17:31 - 2012-11-23 04:35 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2016-04-21 17:29 - 2012-07-26 10:12 - 00000000 ___HD C:\WINDOWS\ELAMBKUP
2016-04-21 17:26 - 2013-08-22 15:25 - 00262144 ___SH C:\WINDOWS\system32\config\ELAM
2016-04-21 17:25 - 2015-06-18 20:29 - 00000000 ____D C:\Program Files\Microsoft Office 15
2016-04-21 17:08 - 2015-09-22 23:16 - 00003950 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{03F45FC3-221C-4A0C-A47F-43723DBBE507}
2016-04-21 16:56 - 2015-09-20 22:38 - 00000000 ____D C:\Program Files (x86)\Opera
2016-04-16 22:53 - 2012-07-26 07:37 - 00000000 ____D C:\Users\Default.migrated
2016-04-16 22:27 - 2013-07-01 22:17 - 00000000 ____D C:\Users\Schatz\AppData\Local\VirtualStore
2016-04-16 22:03 - 2015-08-22 01:00 - 00000000 ____D C:\Users\Schatz
2016-04-16 21:59 - 2013-07-02 22:53 - 00000000 ____D C:\Users\Schatz\AppData\Roaming\CyberLink
2016-04-16 21:58 - 2013-07-01 22:22 - 00000000 ____D C:\Users\Schatz\AppData\Local\CyberLink
2016-04-15 22:55 - 2013-08-22 17:36 - 00000000 __RSD C:\WINDOWS\Media
2016-04-14 22:59 - 2015-09-20 22:33 - 00000000 ____D C:\Users\Schatz\AppData\Roaming\Lavasoft
2016-04-14 22:59 - 2015-09-20 22:33 - 00000000 ____D C:\Program Files (x86)\Lavasoft
2016-04-14 22:59 - 2015-09-20 22:32 - 00000000 ____D C:\ProgramData\Lavasoft
2016-04-14 22:24 - 2015-10-03 17:38 - 00726528 ___SH C:\Users\Schatz\Desktop\Thumbs.db
2016-04-14 21:53 - 2015-09-20 22:39 - 00003876 _____ C:\WINDOWS\System32\Tasks\Opera scheduled Autoupdate 1442781566
2016-04-14 21:42 - 2013-08-22 16:44 - 00488336 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2016-04-14 07:08 - 2015-01-21 19:58 - 00000000 ____D C:\WINDOWS\system32\appraiser
2016-04-14 07:08 - 2013-08-22 17:36 - 00000000 ___RD C:\WINDOWS\ToastData
2016-04-14 02:55 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\rescache
2016-04-14 01:15 - 2012-07-26 09:59 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-04-14 01:11 - 2013-08-19 20:10 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-04-14 01:03 - 2012-11-22 13:29 - 135176864 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-04-13 21:50 - 2014-11-21 05:35 - 01780340 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-04-13 21:50 - 2014-11-21 04:45 - 00766620 _____ C:\WINDOWS\system32\perfh007.dat
2016-04-13 21:50 - 2014-11-21 04:45 - 00159902 _____ C:\WINDOWS\system32\perfc007.dat
2016-04-12 23:24 - 2013-09-05 18:55 - 00000285 _____ C:\Users\Schatz\AppData\Roaming\WB.CFG
2016-04-12 22:00 - 2014-10-31 11:29 - 00000000 ____D C:\Program Files\Common Files\Apple
2016-04-07 22:03 - 2016-02-25 16:03 - 19924672 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerInstaller.exe
2016-04-07 22:03 - 2013-08-18 07:42 - 00003772 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2016-04-06 09:57 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-04-06 09:56 - 2013-08-22 17:36 - 00000000 ___HD C:\Program Files\WindowsApps
2016-04-06 09:44 - 2015-08-22 01:34 - 00000000 ___SD C:\WINDOWS\SysWOW64\GWX
2016-04-06 09:44 - 2015-08-22 01:34 - 00000000 ___SD C:\WINDOWS\system32\GWX
2016-04-06 09:44 - 2014-11-21 05:13 - 00000000 ____D C:\Program Files\Windows Journal
2016-04-06 08:15 - 2015-11-13 20:24 - 00000000 ____D C:\Program Files\McAfee Security Scan
2016-03-22 19:43 - 2013-08-22 17:36 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2016-03-22 19:34 - 2014-03-05 22:36 - 00137952 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys
2016-03-22 19:34 - 2014-03-05 22:36 - 00128664 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2016-03-22 19:34 - 2014-03-05 22:36 - 00068936 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avnetflt.sys

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2013-09-05 18:55 - 2016-04-12 23:24 - 0000285 _____ () C:\Users\Schatz\AppData\Roaming\WB.CFG
2013-09-05 18:55 - 2014-01-20 20:24 - 0000005 _____ () C:\Users\Schatz\AppData\Roaming\WBPU-TTL.DAT
2016-01-04 17:55 - 2016-01-04 17:55 - 0003584 _____ () C:\Users\Schatz\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-12-30 13:31 - 2015-12-30 13:31 - 0000838 _____ () C:\Users\Schatz\AppData\Local\recently-used.xbel
2012-11-23 05:38 - 2012-11-23 05:38 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2012-11-28 11:00 - 2012-11-28 11:00 - 0000032 _____ () C:\ProgramData\Temp.log

Dateien, die verschoben oder gelöscht werden sollten:
====================
C:\Windows\Tasks\{2FE13EE9-AE44-25EE-1098-2BDFFC5F70F9}.job


Einige Dateien in TEMP:
====================
C:\Users\Schatz\AppData\Local\Temp\avgnt.exe
C:\Users\Schatz\AppData\Local\Temp\libeay32.dll
C:\Users\Schatz\AppData\Local\Temp\msvcr120.dll
C:\Users\Schatz\AppData\Local\Temp\pruq8rtd.dll
C:\Users\Schatz\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2016-04-21 17:53

==================== Ende von FRST.txt ============================
Code:
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:18-04-2016
durchgeführt von Schatz (2016-04-21 21:53:56)
Gestartet von C:\Users\Schatz\AppData\Local\Temp\scoped_dir3184_381
Windows 8.1 (X64) (2015-08-21 23:35:56)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-3205940643-3366264869-3578409839-500 - Administrator - Disabled)
Gast (S-1-5-21-3205940643-3366264869-3578409839-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3205940643-3366264869-3578409839-1004 - Limited - Enabled)
Schatz (S-1-5-21-3205940643-3366264869-3578409839-1002 - Administrator - Enabled) => C:\Users\Schatz

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )
Adobe Flash Player 21 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 21.0.0.213 - Adobe Systems Incorporated)
Apple Application Support (32-Bit) (HKLM-x32\...\{FE5C2FAA-118D-4509-B51D-3F71CC9E1B3E}) (Version: 4.3 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{2937FD88-C9D6-4B82-B539-37CD0A572F42}) (Version: 4.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{2E4AF2A6-50EA-4260-9BA4-5E582D11879A}) (Version: 9.3.0.15 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.16.282 - Avira Operations GmbH & Co. KG)
Avira Launcher (HKLM-x32\...\{74d1ef14-dd39-4749-b051-e183a1e27f5e}) (Version: 1.1.58.35540 - Avira Operations GmbH & Co. KG)
Avira Launcher (x32 Version: 1.1.58.35540 - Avira Operations GmbH & Co. KG) Hidden
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
CDex - Open Source Digital Audio CD Extractor (HKLM-x32\...\CDex) (Version: 1.70.4.2009 - Georgy Berdyshev)
Chromium (HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\Chromium) (Version: 51.0.2683.0 - Chromium)
CyberLink PhotoNow (HKLM-x32\...\InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.1.7717 - CyberLink Corp.)
CyberLink PowerDirector (Version: 9.0.0.3815c - CyberLink Corp.) Hidden
CyberLink PowerRecover (HKLM-x32\...\InstallShield_{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}) (Version: 5.7.0.0913 - CyberLink Corp.)
CyberLink PowerRecover (Version: 5.7.0.0913 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dolby Advanced Audio v2 (HKLM-x32\...\{B9E70C7A-9F85-4A39-A4A3-BFA3C3BF7613}) (Version: 7.2.8000.17 - Dolby Laboratories Inc)
Fotogalerie (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Fotogalerija (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Fotogalleri (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Fotogalleriet (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Fotoğraf Galerisi (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Fotótár (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Galeria de Fotografias (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Galería de fotos (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Galeria fotografii (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
iCloud (HKLM\...\{4B48E22A-2FB0-4EFA-B99E-954B1E50CD69}) (Version: 5.1.0.34 - Apple Inc.)
ICQ 8.1 (build 6337) (HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\ICQ) (Version: 8.1.6337.0 - Mail.Ru)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2875 - Intel Corporation)
Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (HKLM\...\{E77289CF-12B9-4CAB-A49E-FEAE947F4D95}) (Version: 15.5.4.0423 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\...\{DA2600C1-6BDF-4FD1-8F3D-148929CC1385}) (Version: 2.6.1210.0278 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.6.0.1030 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel(R) WiDi (HKLM\...\{6097158B-0184-4140-BEC3-7885794D2571}) (Version: 3.5.40.0 - Intel Corporation)
Intel® PROSet/Wireless WiFi Software (HKLM\...\{1593C708-5535-47A4-8C0F-F8D4BE2B4560}) (Version: 15.05.6000.1620 - Intel Corporation)
IrfanView 64 (remove only) (HKLM\...\IrfanView) (Version: 4.40 - Irfan Skiljan)
iTunes (HKLM\...\{A31C5565-90D9-4615-AE13-94D86C3836C7}) (Version: 12.3.3.17 - Apple Inc.)
Joan Jade und die Tore von Xibalba (HKLM-x32\...\Joan Jade und die Tore von Xibalba) (Version:  - )
Magic Encyclopedia 3 - Illusionen (HKLM-x32\...\Magic Encyclopedia 3 - Illusionen) (Version:  - )
Margrave Manor: Der Fluch des gebrochenen Herzens (HKLM-x32\...\Margrave Manor: Der Fluch des gebrochenen Herzens) (Version:  - )
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.11.309.1 - McAfee, Inc.)
Mediathek (HKLM-x32\...\{EFFED0C0-5299-422E-AFE6-8B8066D18A2A}) (Version: 1.4.0 - Medion)
Medion Home Cinema 10 (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)
Medion Home Cinema 10 (x32 Version: 10.1924 - CyberLink Corp.) Hidden
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4815.1001 - Microsoft Corporation)
Microsoft Office Excel Viewer (HKLM-x32\...\{95120000-003F-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\OneDriveSetup.exe) (Version: 17.3.4604.0120 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mobile Partner (HKLM-x32\...\Mobile Partner) (Version: 21.005.15.02.382 - Huawei Technologies Co.,Ltd)
Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Mozilla Firefox 35.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0 (x86 de)) (Version: 35.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 35.0 - Mozilla)
Mystery Murders - Jack the Ripper 2 (HKLM-x32\...\Mystery Murders - Jack the Ripper 2) (Version: 1.0.0.221.de - Rondomedia)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4805.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4805.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4805.1003 - Microsoft Corporation) Hidden
Opera Stable 36.0.2130.65 (HKLM-x32\...\Opera 36.0.2130.65) (Version: 36.0.2130.65 - Opera Software)
PHotkey (HKLM-x32\...\{E50C224A-BBF2-428D-9DCF-DBF9DF85C40E}) (Version: 1.00.0081 - Pegatron Corporation)
Podstawowe programy Windows Live (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
QuickLaunch (HKLM-x32\...\{A802F1E3-34C8-4C84-9948-C1C4E37D0FA9}) (Version: 1.00.0019 - Lenovo Group Limited)
QuickTime 7 (HKLM-x32\...\{FF59BD75-466A-4D5A-AD23-AAD87C5FD44C}) (Version: 7.79.80.95 - Apple Inc.)
Raccolta foto (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6722 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.30136 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Sony PC Companion 2.10.188 (HKLM-x32\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.188 - Sony)
SpringFiles (HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\SpringFiles) (Version: 29.15.39 - hxxp://www.spring-file.com)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.16.0 - Synaptics Incorporated)
Unsolved Mystery Club - Ancient Astronauts (HKLM-x32\...\Unsolved Mystery Club - Ancient Astronauts) (Version:  - )
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - )
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - )
Web Companion (HKLM-x32\...\{503a5c39-884e-4cba-9e30-eacb1b81325c}) (Version: 2.1.1108.2313 - Lavasoft)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
WinRAR 5.21 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.21.0 - win.rar GmbH)
WinZip 20.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C24101}) (Version: 20.0.11659 - WinZip Computing, S.L. )

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

CustomCLSID: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32 -> C:\Program Files\WinZip\adxloader64.dll ()

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {011761AD-7FDF-462E-A515-2ABF8A30BCEB} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-04-07] (Adobe Systems Incorporated)
Task: {0539AB7B-C0A6-42F0-B8CB-0119260DE526} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\BrowserChoice\browserchoice.exe
Task: {08F16DDA-5825-4A48-A46C-DE6E213FAA0D} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2016-03-22] (Microsoft Corporation)
Task: {24204B2E-0BE0-45F0-9F7A-9FBA23A33D70} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)
Task: {56B876E6-1CBB-4572-B3B5-80FA98933DED} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2016-02-09] (Microsoft Corporation)
Task: {67EABA3D-88EE-4D8D-ADB8-A27840D63463} - System32\Tasks\{4081A24E-DF42-4119-A43A-3BDCBE61108C} => pcalua.exe -a "C:\Program Files (x86)\iMesh Applications\iMesh\uninstall.exe"
Task: {6F984935-BD8B-4815-A900-D1596DA9BBD1} - System32\Tasks\Opera scheduled Autoupdate 1442781566 => C:\Program Files (x86)\Opera\launcher.exe [2016-04-11] (Opera Software)
Task: {7E9D12FA-7387-4DA4-A9E6-5CCE304263B2} - System32\Tasks\Synaptics TouchPad Enhancements => Program Files\Synaptics\SynTP\SynTPEnh.exe
Task: {ADF6A9A1-67AE-4A55-8621-B7D6A353B75B} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2016-02-09] (Microsoft Corporation)
Task: {B353DCC0-6453-4226-BDE2-8288B8E744C8} - System32\Tasks\Dolby Selector => C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [2012-08-31] (Dolby Laboratories Inc.)
Task: {D90AC541-5D08-481E-B606-E24F068C2C75} - System32\Tasks\{2FE13EE9-AE44-25EE-1098-2BDFFC5F70F9} => C:\Users\Schatz\AppData\Local\{B9D18~1\UNINST~1.EXE

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\Search Provided by Yahoo litod.job => Wscript.exe  C:\ProgramData\{CEE80B8B-44AA-814D-C26C-1F0F582E94C1}\dide.txt <==== ACHTUNG
Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
Task: C:\WINDOWS\Tasks\{2FE13EE9-AE44-25EE-1098-2BDFFC5F70F9}.job => C:\Users\Schatz\AppData\Local\{B9D18~1\UNINST~1.EXE

==================== Verknüpfungen =============================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)

Shortcut: C:\Users\Schatz\Desktop\Neuer Ordner\router\FRITZ!Box\reconnect.bat - Verknüpfung.lnk -> D:\Dokumente\Visual Studio 2005\Projects\Linker\Linker\bin\Release\CryptLoad_Secure\router\FRITZ!Box\reconnect.bat (Keine Datei)

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2012-11-30 13:41 - 2012-11-29 15:53 - 00805888 _____ () C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
2016-03-18 22:56 - 2016-03-18 22:56 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2016-03-18 22:56 - 2016-03-18 22:56 - 01329936 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-06-18 20:29 - 2015-10-13 05:34 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2011-03-14 17:27 - 2011-03-14 17:27 - 00346976 _____ () C:\ProgramData\DatacardService\HWDeviceService64.exe
2014-04-22 19:23 - 2014-04-22 19:23 - 00239968 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe
2012-11-28 11:35 - 2012-10-19 13:27 - 00386344 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2012-11-30 13:41 - 2012-11-27 17:18 - 02215424 _____ () C:\Program Files (x86)\PHotkey\PHotkey.exe
2012-11-30 13:41 - 2010-01-12 19:36 - 00117256 _____ () C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
2012-11-30 13:41 - 2010-01-12 19:36 - 00121864 _____ () C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
2012-11-30 13:41 - 2010-12-17 16:04 - 00449032 _____ () C:\Program Files (x86)\PHotkey\ATouch64.exe
2012-11-30 13:41 - 2012-10-23 20:07 - 03471872 _____ () C:\Program Files (x86)\PHotkey\POSD.exe
2012-11-30 13:41 - 2012-08-08 20:10 - 07536128 _____ () C:\Program Files (x86)\PHotkey\GPMTray.exe
2014-04-22 19:23 - 2014-04-22 19:23 - 00011362 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\mingwm10.dll
2014-04-22 19:23 - 2014-04-22 19:23 - 00043008 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\libgcc_s_dw2-1.dll
2014-04-22 19:23 - 2014-04-22 19:23 - 02415104 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QtCore4.dll
2014-04-22 19:23 - 2014-04-22 19:23 - 01148416 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QtNetwork4.dll
2014-04-22 19:23 - 2014-04-22 19:23 - 00383488 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QueryStrategy.dll
2014-04-22 19:23 - 2014-04-22 19:23 - 00398336 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QtXml4.dll
2012-11-30 13:41 - 2009-12-18 17:36 - 00973432 _____ () C:\Program Files (x86)\PHotkey\acAuth.dll
2012-11-30 13:41 - 2009-12-18 17:41 - 00129544 _____ () C:\Program Files (x86)\PHotkey\GFNEX.dll
2016-04-14 21:53 - 2016-04-14 21:52 - 63830568 _____ () C:\Program Files (x86)\Opera\36.0.2130.65\opera.dll
2016-04-14 21:52 - 2016-04-14 21:50 - 02134568 _____ () C:\Program Files (x86)\Opera\36.0.2130.65\libglesv2.dll
2016-04-14 21:52 - 2016-04-14 21:50 - 00082472 _____ () C:\Program Files (x86)\Opera\36.0.2130.65\libegl.dll
2016-04-21 18:09 - 2016-04-21 18:09 - 00016384 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PSIClient\6e7eaf9e7d8430aae7aacf25610e4eec\PSIClient.ni.dll
2012-11-23 05:16 - 2012-06-25 11:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)

AlternateDataStreams: C:\ProgramData\Temp:FC595E85 [286]

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)


==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)

IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

Da befinden sich 7866 mehr Seiten.

IE trusted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\localhost -> localhost
IE trusted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\webcompanion.com -> hxxp://webcompanion.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\123simsen.com -> www.123simsen.com

Da befinden sich 7866 mehr Seiten.


==================== Hosts Inhalt: ==========================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2013-08-22 15:25 - 2016-04-12 22:21 - 00001006 ____N C:\WINDOWS\system32\Drivers\etc\hosts

127.0.0.1      down.baidu2016.com
127.0.0.1      123.sogou.com
127.0.0.1      www.czzsyzgm.com
127.0.0.1      www.czzsyzxl.com
127.0.0.1      union.baidu2019.com

==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKLM\...\StartupApproved\Run32: => "Iminent"
HKLM\...\StartupApproved\Run32: => "IminentMessenger"
HKLM\...\StartupApproved\Run32: => "QuickTime Task"
HKLM\...\StartupApproved\Run32: => "iTunesHelper"
HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\StartupApproved\Run: => "icq"
HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\StartupApproved\Run: => "iMesh"
HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\StartupApproved\Run: => "Sony PC Companion"

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{59EC4CF5-609E-422F-8042-D9CDE0EB6829}] => (Allow) C:\Users\Schatz\AppData\Local\Microsoft\OneDrive\OneDrive.exe
FirewallRules: [{C6EEC361-CE32-4231-ADDE-E5A7C67BEEFB}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{5B967B63-630B-40F4-88C8-61F6D752D127}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{D6ACFA72-D875-4A6E-8D34-1C6AD3F3A06E}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{4F182DE5-4F27-4D5B-8701-9722B9F8662E}] => (Allow) C:\Users\Schatz\AppData\Local\Torch\Plugins\Hola\hola_plugin_x64.exe
FirewallRules: [TCP Query User{BE4E9FEC-D914-4E4F-926F-E01F5DE598C1}C:\program files (x86)\cyberlink\powerdvd10\pdvd10serv.exe] => (Allow) C:\program files (x86)\cyberlink\powerdvd10\pdvd10serv.exe
FirewallRules: [UDP Query User{9CD2DAFF-8500-4EF6-BBF2-E4F1F79E2001}C:\program files (x86)\cyberlink\powerdvd10\pdvd10serv.exe] => (Allow) C:\program files (x86)\cyberlink\powerdvd10\pdvd10serv.exe
FirewallRules: [TCP Query User{4E9A1825-1730-44D7-8A82-7646F852914A}C:\program files (x86)\cyberlink\powerdvd10\pdvd10serv.exe] => (Block) C:\program files (x86)\cyberlink\powerdvd10\pdvd10serv.exe
FirewallRules: [UDP Query User{505D4722-8D42-4D76-99DB-65DFF02FC215}C:\program files (x86)\cyberlink\powerdvd10\pdvd10serv.exe] => (Block) C:\program files (x86)\cyberlink\powerdvd10\pdvd10serv.exe
FirewallRules: [{1E1249F9-4AEB-41B9-9534-E10A4AD394C2}] => (Allow) C:\Program Files (x86)\SpringFiles\SpringFiles.exe
FirewallRules: [{DAD41EE2-07B1-45C1-87CA-AAB75AEA648E}] => (Allow) C:\Program Files (x86)\SpringFiles\SpringFiles.exe
FirewallRules: [{EB85DE1E-22DB-4D7A-9929-4B1B2E98F7C7}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{2AF39E2D-44C3-4877-AACE-797D2BAB21DD}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{2CDD11C8-6D06-4571-AED2-0CC8596C9660}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{7C84D8A8-C127-4CE3-AF1E-985C5A1D50AA}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{8ED0F09F-D5B2-4021-9172-C6B1B1896518}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{7896FC6A-3D88-4BAD-ACE2-9D3EF6E710C8}] => (Allow) C:\Users\Schatz\AppData\Local\Chromium\Application\chrome.exe

==================== Wiederherstellungspunkte =========================

14-04-2016 00:47:36 Windows Update
14-04-2016 23:14:13 JRT Pre-Junkware Removal
21-04-2016 17:15:00 Revo Uninstaller's restore point - Kaspersky Total Security

==================== Fehlerhafte Geräte im Gerätemanager =============


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (04/21/2016 05:14:54 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073422302

Error: (04/21/2016 05:07:16 PM) (Source: ESENT) (EventID: 454) (User: )
Description: svchost (1668) SRUJet: Bei Datenbankwiederherstellung trat ein unerwarteter Fehler -1216 auf.

Error: (04/21/2016 05:07:16 PM) (Source: ESENT) (EventID: 494) (User: )
Description: svchost (1668) SRUJet: Bei der Datenbankwiederherstellung ist ein Fehler aufgetreten (Fehler -1216), da Verweise auf Datenbank "C:\WINDOWS\system32\SRU\SRUDB.dat" festgestellt wurden, die nicht mehr vorhanden ist. Die Datenbank wurde nicht sauber heruntergefahren, bevor sie entfernt (oder möglicherweise verschoben oder umbenannt) wurde. Das Datenbankmodul lässt den Abschluss der Wiederherstellung für diese Instanz erst dann zu, wenn die fehlende Datenbank wieder verfügbar gemacht wird. Wenn die Datenbank tatsächlich nicht mehr verfügbar oder nicht mehr erforderlich ist, finden Sie Informationen zum Beheben dieses Fehlers in der Microsoft Knowledge Base oder unter dem Link "Weitere Informationen" am Ende dieser Meldung.

Error: (04/21/2016 04:52:52 PM) (Source: ESENT) (EventID: 470) (User: )
Description: svchost (1392) SRUJet: Datenbank C:\WINDOWS\system32\SRU\SRUDB.dat wurde teilweise angehängt. Anhängungsstufe: 3. Fehler: -1019.

Error: (04/21/2016 04:52:52 PM) (Source: ESENT) (EventID: 476) (User: )
Description: svchost (1392) SRUJet: Bei Überprüfung der aus Datei "C:\WINDOWS\system32\SRU\SRUDB.dat" bei Offset 8192 (0x0000000000002000) (Datenbankseite 1 (0x1)) für 4096 (0x00001000) Bytes gelesenen Datenbankseite ist ein Fehler aufgetreten, weil sie keine Seitendaten enthält. Fehler -1019 (0xfffffc05) bei Leseoperation. Wenn dieser Zustand andauert, stellen Sie die Datenbank aus einer vorherigen Sicherung wieder her. Dieses Problem ist vermutlich durch fehlerhafte Hardware bedingt. Wenden Sie sich für weitere Unterstützung bei der Diagnose des Problems an Ihren Hardwarehersteller.

Error: (04/17/2016 07:33:18 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 13234

Error: (04/17/2016 07:33:18 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 13234

Error: (04/17/2016 07:33:18 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (04/17/2016 07:30:33 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: SDUpdate.exe, Version: 2.4.40.94, Zeitstempel: 0x53ad3eee
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.18264, Zeitstempel: 0x56e1b34d
Ausnahmecode: 0x0eedfade
Fehleroffset: 0x00015b68
ID des fehlerhaften Prozesses: 0x1acc
Startzeit der fehlerhaften Anwendung: 0xSDUpdate.exe0
Pfad der fehlerhaften Anwendung: SDUpdate.exe1
Pfad des fehlerhaften Moduls: SDUpdate.exe2
Berichtskennung: SDUpdate.exe3
Vollständiger Name des fehlerhaften Pakets: SDUpdate.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: SDUpdate.exe5

Error: (04/16/2016 10:11:04 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SCHWARZEGIRL)
Description: Bei der Aktivierung der App „CyberLinkCorp.me.PowerDVDforMedion_fyjd2029wheaw!App“ ist folgender Fehler aufgetreten: -2144927142. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.


Systemfehler:
=============
Error: (04/21/2016 09:47:56 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "IE Search Set" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (04/21/2016 09:47:56 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Mobile Partner. OUC" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (04/21/2016 09:47:56 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Mobile Partner. OUC erreicht.

Error: (04/21/2016 09:46:57 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.

Modulpfad: C:\WINDOWS\System32\IWMSSvc.dll

Error: (04/21/2016 09:46:57 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.

Modulpfad: C:\WINDOWS\System32\IWMSSvc.dll

Error: (04/21/2016 09:46:57 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Apple Mobile Device Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%109

Error: (04/21/2016 09:46:55 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" ist vom Dienst "Windows Search" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1069

Error: (04/21/2016 09:46:55 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069

Error: (04/21/2016 09:46:55 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "WSearch" konnte sich nicht als "NT AUTHORITY\SYSTEM" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%50

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).

Error: (04/21/2016 09:46:55 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069


==================== Speicherinformationen ===========================

Prozessor: Intel(R) Celeron(R) CPU 1000M @ 1.80GHz
Prozentuale Nutzung des RAM: 47%
Installierter physikalischer RAM: 3977.11 MB
Verfügbarer physikalischer RAM: 2086.32 MB
Summe virtueller Speicher: 5129.11 MB
Verfügbarer virtueller Speicher: 2728.57 MB

==================== Laufwerke ================================

Drive c: (Boot) (Fixed) (Total:403.61 GB) (Free:336.07 GB) NTFS
Drive d: (Recover) (Fixed) (Total:60 GB) (Free:35.17 GB) NTFS

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 00000000)

Partition: GPT.

==================== Ende von Addition.txt ============================

burningice 22.04.2016 15:58

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Hinweis: Dieser Scan kann schon einmal mehrere Stunden dauern...

Hast du noch irgendwelche Probleme mit deinem Rechner?

Soehrgoz 24.04.2016 08:33
Code:
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=4b6667a6ddadab40a533c2ce1a2fb359
# end=init
# utc_time=2016-04-24 04:39:32
# local_time=2016-04-24 06:39:32 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.2.9200 NT
Update Init
Update Download
Update Finalize
Updated modules version: 29211
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=4b6667a6ddadab40a533c2ce1a2fb359
# end=updated
# utc_time=2016-04-24 04:42:16
# local_time=2016-04-24 06:42:16 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.2.9200 NT
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=4b6667a6ddadab40a533c2ce1a2fb359
# engine=29211
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2016-04-24 07:14:49
# local_time=2016-04-24 09:14:49 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode_1='Avira Antivirus'
# compatibility_mode=1815 16777213 100 100 9451 53200536 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 21282363 110209405 0 0
# scanned=281732
# found=33
# cleaned=0
# scan_time=9152
sh=F3B5A5383BEC4F0ADF8EAD2C4C9D1CD13A9A083B ft=1 fh=3b6eecfc8fe20b29 vn="Win32/Systweak.O evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\FileQuarantine\C\Program Files (x86)\WinZip Registry Optimizer\CleanSchedule.exe.vir"
sh=7BD40B943D61C6193BD584657363ECAD79BC3D3D ft=0 fh=0000000000000000 vn="JS/Lightning.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\FileQuarantine\C\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\deskCutv2@gmail.com\chrome\content\index.html.vir"
sh=F338AF05B3C8FF9D60FB7FF772B2D9EE293353C9 ft=0 fh=0000000000000000 vn="JS/Lightning.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\FileQuarantine\C\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\deskCutv2@gmail.com\chrome\content\js\lib\jquery-2.1.0.min.js.vir"
sh=66709C08173480EF5BC22ED8BF5CFD427276520B ft=0 fh=0000000000000000 vn="JS/Lightning.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\FileQuarantine\C\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\deskCutv2@gmail.com\chrome\content\js\module\mostgrid.js.vir"
sh=827BD4E023C5CD9C32A65F39BE4F76B00879B8CB ft=0 fh=0000000000000000 vn="JS/Lightning.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\FileQuarantine\C\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\deskCutv2@gmail.com\chrome\content\js\pack\common.js.vir"
sh=BF187F6391DE04E413BDEA876241194418C2732A ft=0 fh=0000000000000000 vn="JS/Lightning.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\FileQuarantine\C\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\deskCutv2@gmail.com\chrome\content\js\pack\xagainit.js.vir"
sh=7BD40B943D61C6193BD584657363ECAD79BC3D3D ft=0 fh=0000000000000000 vn="JS/Lightning.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\FileQuarantine\C\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\extensions\deskCutv2@gmail.com\chrome\content\index.html.vir"
sh=F338AF05B3C8FF9D60FB7FF772B2D9EE293353C9 ft=0 fh=0000000000000000 vn="JS/Lightning.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\FileQuarantine\C\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\extensions\deskCutv2@gmail.com\chrome\content\js\lib\jquery-2.1.0.min.js.vir"
sh=66709C08173480EF5BC22ED8BF5CFD427276520B ft=0 fh=0000000000000000 vn="JS/Lightning.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\FileQuarantine\C\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\extensions\deskCutv2@gmail.com\chrome\content\js\module\mostgrid.js.vir"
sh=827BD4E023C5CD9C32A65F39BE4F76B00879B8CB ft=0 fh=0000000000000000 vn="JS/Lightning.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\FileQuarantine\C\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\extensions\deskCutv2@gmail.com\chrome\content\js\pack\common.js.vir"
sh=BF187F6391DE04E413BDEA876241194418C2732A ft=0 fh=0000000000000000 vn="JS/Lightning.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\FileQuarantine\C\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\extensions\deskCutv2@gmail.com\chrome\content\js\pack\xagainit.js.vir"
sh=96D28CD2C73BCFA3BA0B69305972110122C78C13 ft=1 fh=d67a8f0fce9576c9 vn="Variante von Win32/Toolbar.Iminent.K evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Iminent\inst\Bootstrapper\Bootstrapper.exe.vir"
sh=FB5064BA698293D937411707C29F1A38DEFDF2EF ft=1 fh=87edca7535116eae vn="Win32/Somoto.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Schatz\AppData\Local\webplayer\Uninstall.exe.vir"
sh=4C1A2BEACA0702A3EA3EF5005CD064605850813E ft=1 fh=c71c0011871ed107 vn="Win32/Somoto.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Schatz\AppData\Local\webplayer\WebPlayer.exe.vir"
sh=4C1A2BEACA0702A3EA3EF5005CD064605850813E ft=1 fh=c71c0011871ed107 vn="Win32/Somoto.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Schatz\AppData\Local\webplayer\FLV Player\WebPlayer.exe.vir"
sh=C1C66AA7FFD537DF1720DD63E3BE4E009B0793F2 ft=1 fh=c25b5c4dff3942af vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Schatz\AppData\Local\Temp\DMR\dmr_72.exe"
sh=612FD279DC51D1C4E45A6709981ECAD922DCDB08 ft=1 fh=9663c83becf71abd vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Schatz\Desktop\Alte Firefox-Daten\tlw1tx93.default\extensions\{13058AF4-66EB-75FE-B521-F5B654EE2BA4}\components\DatamngrHlpFF20.dll"
sh=832524EB1BFEFA2C8F8918107E6FFA5E9A52C148 ft=1 fh=a3e1f6168899090a vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Schatz\Desktop\Alte Firefox-Daten\tlw1tx93.default\extensions\{13058AF4-66EB-75FE-B521-F5B654EE2BA4}\components\DatamngrHlpFF21.dll"
sh=7B7BF93E3FB5C37A6492B3F3D96E852A6A7D29EF ft=1 fh=18d97f52c40abca4 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Schatz\Desktop\Alte Firefox-Daten\tlw1tx93.default\extensions\{13058AF4-66EB-75FE-B521-F5B654EE2BA4}\components\DatamngrHlpFF22.dll"
sh=A3E1F14C641FCC37DBB94D64DE6E27B0C9ADD598 ft=1 fh=0266f8938a90014c vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Schatz\Desktop\Alte Firefox-Daten\tlw1tx93.default\extensions\{13058AF4-66EB-75FE-B521-F5B654EE2BA4}\components\DatamngrHlpFF23.dll"
sh=D3017C0CADE7B394791990FF5DD2819F0D403271 ft=1 fh=f752dd0e50ca63ee vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Schatz\Desktop\Alte Firefox-Daten\tlw1tx93.default\extensions\{13058AF4-66EB-75FE-B521-F5B654EE2BA4}\components\DatamngrHlpFF24.dll"
sh=614DD490C351752E7F99A373C55207FEFD9B4D2C ft=1 fh=3dfe5dc3fa3a36e2 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Schatz\Desktop\Alte Firefox-Daten\tlw1tx93.default\extensions\{13058AF4-66EB-75FE-B521-F5B654EE2BA4}\components\DatamngrHlpFF4.dll"
sh=8EF7DD9A122BC536BA48289B5A0E1B94526ED513 ft=1 fh=de50e42c2fb03b15 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Schatz\Desktop\Alte Firefox-Daten\tlw1tx93.default\extensions\{13058AF4-66EB-75FE-B521-F5B654EE2BA4}\components\DatamngrHlpFF5.dll"
sh=8FD8EFFBC6CB06DE6F76EFF293EFF664C1A0BA9E ft=1 fh=88ae1dac69ae59e6 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Schatz\Desktop\Alte Firefox-Daten\tlw1tx93.default\extensions\{13058AF4-66EB-75FE-B521-F5B654EE2BA4}\components\DatamngrHlpFF6.dll"
sh=4E463F3331D9FD46EC3DCA4E60B242B723B0BFCE ft=1 fh=19d210181369822b vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Schatz\Desktop\Alte Firefox-Daten\tlw1tx93.default\extensions\{13058AF4-66EB-75FE-B521-F5B654EE2BA4}\components\DatamngrHlpFF7.dll"
sh=E617CFA653F4345B58E5D56B0AAE6ED160C7FFDF ft=1 fh=a8dd0787c9413f1b vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Schatz\Desktop\Alte Firefox-Daten\tlw1tx93.default\extensions\{13058AF4-66EB-75FE-B521-F5B654EE2BA4}\components\DatamngrHlpFF8.dll"
sh=5F38D11E3C3C10213EBCC97561517C06D5703151 ft=1 fh=54435087bca079c1 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Schatz\Desktop\Alte Firefox-Daten\tlw1tx93.default\extensions\{13058AF4-66EB-75FE-B521-F5B654EE2BA4}\components\DatamngrHlpFF9.dll"
sh=99979C1A780E1E7C06F8493A704669D2A4DACBAC ft=1 fh=ac779f0373f0b3cb vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Schatz\Downloads\CryptLoad - CHIP-Installer.exe"
sh=F388221319B0F8865E608A6A3CC1DA9708E55C5D ft=1 fh=39c436cfaae15843 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Schatz\Downloads\File Repair - CHIP-Installer.exe"
sh=B696D5BDCC5B6F8EA404FA4E45AD433D01190F5D ft=1 fh=46094d2e116729d7 vn="NSIS/Agent.NBQ Trojaner" ac=I fn="C:\Users\Schatz\Downloads\installer [1].exe"
sh=7C871804734886A7174B3590E2899F878CD61986 ft=1 fh=1d8b661cd02ab52f vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Schatz\Downloads\SpyBot Search Destroy - CHIP-Installer.exe"
sh=41BEC17709241C0E92CD986F8209FC471164ADAF ft=1 fh=0e63d8bc5a93992e vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Schatz\Downloads\VCDEasy - CHIP-Installer.exe"
sh=258347E9CA0319EDFACB8194FC022A453DE417E3 ft=0 fh=0000000000000000 vn="Variante von Win32/Systweak.L evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\d6facf6.msi"

burningice 24.04.2016 23:15
Was ist mit meiner Frage? :)

Soehrgoz 25.04.2016 09:35
Ach ich habe ganz vergessen das ich die letzten Schritte noch machen muss !!!

was mich noch ein wenig stört ist das er solange beim Hochfahren brauch, was aber auch an den Spielen liegen kann die installiert sind.

Ausserdem sagt er mir das mein Mediaplayer angeblich nicht installiert ist.

Danke dir !!!

LG

burningice 25.04.2016 17:41
Schritt: 1
Bitte deinstalliere dieses Programm:
Web Companion

Schritt: 2
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
C:\Users\Schatz\AppData\Local\Temp\DMR\dmr_72.exe
C:\Users\Schatz\Downloads\installer [1].exe

C:\Windows\Installer\d6facf6.msi
emptytemp:
FF HKU\S-1-5-21-3205940643-3366264869-3578409839-1002\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\extensions\cliqz@cliqz.com => nicht gefunden
FF Extension: Cliqz - C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\Extensions\cliqz@cliqz.com.xpi [2016-03-22]
FF Extension: Cliqz - C:\Users\Schatz\AppData\Roaming\Mozilla\Firefox\Profiles\36lecpt5.default-1388567396924\Extensions\cliqz@cliqz.com.xpi [2016-03-22]
S2 SearchProtectionService; C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WinService.exe [X]
C:\Program Files (x86)\Lavasoft
Task: C:\WINDOWS\Tasks\{2FE13EE9-AE44-25EE-1098-2BDFFC5F70F9}.job => C:\Users\Schatz\AppData\Local\{B9D18~1\UNINST~1.EXE
C:\Users\Schatz\AppData\Local\{B9D18~1
Task: C:\WINDOWS\Tasks\Search Provided by Yahoo litod.job => Wscript.exe  C:\ProgramData\{CEE80B8B-44AA-814D-C26C-1F0F582E94C1}\dide.txt <==== ACHTUNG
C:\ProgramData\{CEE80B8B-44AA-814D-C26C-1F0F582E94C1}

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Schritt: 3
Bitte starte wieder FRST, setze den Haken bei Addition und drücke auf Untersuchen. Poste bitte wieder die beiden Textdateien, die so entstehen.


Alle Zeitangaben in WEZ +1. Es ist jetzt 12:40 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19