Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   australian brewingcompany - wie entfernen (https://www.trojaner-board.de/145219-australian-brewingcompany-entfernen.html)

speedydino 26.11.2013 21:06
australian brewingcompany - wie entfernen
 
beim Scannen mit gmer gab es einen Blue Screen und das System hat neu gestartet. Fehlermeldung

Problemsignatur:
Problemereignisname: BlueScreen
Betriebsystemversion: 6.1.7601.2.1.0.768.3
Gebietsschema-ID: 1031

Zusatzinformationen zum Problem:
BCCode: 1000007e
BCP1: FFFFFFFF80000004
BCP2: FFFFF8000304BCE8
BCP3: FFFFF880009A9998
BCP4: FFFFF880009A91F0
OS Version: 6_1_7601
Service Pack: 1_0
Product: 768_1

Dateien, die bei der Beschreibung des Problems hilfreich sind:
C:\Windows\Minidump\112613-23680-01.dmp
C:\Users\Manuela\AppData\Local\Temp\WER-48531-0.sysdata.xml

Lesen Sie unsere Datenschutzbestimmungen online:
hxxp://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0407

Wenn die Onlinedatenschutzbestimmungen nicht verfügbar sind, lesen Sie unsere Datenschutzbestimmungen offline:
C:\Windows\system32\de-DE\erofflps.txt


Scan mit Frst
FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-11-2013 01
Ran by Manuela (administrator) on MANUELA-PC on 26-11-2013 20:40:59
Running from C:\Users\Manuela\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(SAMSUNG Electronics) C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(SEC) C:\Program Files (x86)\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
() C:\Users\Manuela\AppData\LocalLow\StumbleUpon\IE\StumbleUponUpdater.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe
() C:\Program Files (x86)\Amazon Browser Bar\ToolbarUpdaterService.exe
(Wajam) C:\Program Files (x86)\Wajam\Updater\WajamUpdaterV3.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Opera Software) C:\Program Files (x86)\Opera\opera.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9644576 2009-12-15] (Realtek Semiconductor)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1266912 2013-10-23] (Microsoft Corporation)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2074408 2013-11-14] (Synaptics Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [Facebook Update] - C:\Users\Manuela\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-12] (Facebook Inc.)
HKCU\...\Run: [BackgroundContainer] - "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\Manuela\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun <===== ATTENTION
MountPoints2: E - E:\setup.EXE /AUTORUN
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [683576 2013-11-25] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
AppInit_DLLs-x32: C:\PROGRA~2\CLONED~1\DVDGHO~1\DVDGHO~1.DLL [ ] ()
IFEO\broadcam.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IFEO\ccleaner64.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IFEO\chrome.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IFEO\firefox.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IFEO\uninst.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.certified-toolbar.com?si=46364&st=chrome&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7&q=
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p23_serp_ie_de_display?ie=UTF8&tagbase=bds-p23&tbrId=v1_abb-channel-23_a76337893a2f4851814856562526a95a_39_1006_20131022_DE_ie_sp_
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn
HKCU\Software\Microsoft\Internet Explorer\Main,Start Default_Page_URL = hxxp://search.certified-toolbar.com?si=46364&st=home&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.certified-toolbar.com?si=46364&st=chrome&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7&q=
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.certified-toolbar.com?si=46364&st=chrome&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7&q=
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.certified-toolbar.com?si=46364&st=chrome&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7&q=
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.certified-toolbar.com?si=46364&st=home&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.certified-toolbar.com?si=46364&st=chrome&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7&q=
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Default_Page_URL = hxxp://search.certified-toolbar.com?si=46364&st=home&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.certified-toolbar.com?si=46364&st=chrome&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7&q=
URLSearchHook: HKLM-x32 - RadioTotal Toolbar - {2ee84ac6-8dd6-4a14-bd37-b79c8f9ecf4d} - C:\Program Files (x86)\RadioTotal\prxtbRad1.dll (Conduit Ltd.)
URLSearchHook: HKCU - (No Name) - {7e111a5c-3d11-4f56-9463-5310c3c69025} - No File
URLSearchHook: HKCU - (No Name) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - No File
URLSearchHook: HKCU - RadioTotal Toolbar - {2ee84ac6-8dd6-4a14-bd37-b79c8f9ecf4d} - C:\Program Files (x86)\RadioTotal\prxtbRad1.dll (Conduit Ltd.)
SearchScopes: HKLM-x32 - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://search.certified-toolbar.com?si=46364&st=bs&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7&q={searchTerms}
SearchScopes: HKLM-x32 - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://search.certified-toolbar.com?si=46364&st=bs&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7&q={searchTerms}
SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.certified-toolbar.com?si=46364&st=bs&tid=3869&ver=3.7&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7&q={searchTerms}
SearchScopes: HKCU - DefaultScope {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=horus
SearchScopes: HKCU - {0D7562AE-8EF6-416d-A838-AB665251703A} URL = hxxp://start.facemoods.com/?a=cpd&s={searchTerms}&f=4
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&babsrc=SP_ss_sps&mntrId=12A58E9FFA1ABE53&affID=119357&tt=040713_rdrctful&tsp=4933
SearchScopes: HKCU - {13447CB8-C6D7-498A-B940-086E1598330B} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3317483&CUI=UN86551777817471510&UM=2
SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL =
SearchScopes: HKCU - {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL =
SearchScopes: HKCU - {CEEC11D0-41B5-4098-AF69-8CF1D2E8372A} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=DVS2&o=1586&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^AAA&apn_dtid=^YYYYYY^YY^DE&apn_uid=c64d9547-6b02-4b2c-97ff-5feae50b14d6&apn_sauid=A4F76F5E-A4DA-405C-B931-0B81EE832C94
SearchScopes: HKCU - {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=horus
BHO: Windows Live Family Safety Browser Helper Class - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} -  No File
BHO-x32: Plus-HD-2.4 - {11111111-1111-1111-1111-110311341134} - C:\Program Files (x86)\Plus-HD-2.4\Plus-HD-2.4-bho.dll (Plus HD)
BHO-x32: RadioTotal Toolbar - {2ee84ac6-8dd6-4a14-bd37-b79c8f9ecf4d} - C:\Program Files (x86)\RadioTotal\prxtbRad1.dll (Conduit Ltd.)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Wajam - {A7A6995D-6EE1-4FD1-A258-49395D5BF99C} - C:\Program Files (x86)\Wajam\IE\priam_bho.dll (Wajam)
BHO-x32: StumbleUpon - {DB616CFF-D989-48A8-9C85-E2A8D56AB2CA} - C:\Users\Manuela\AppData\LocalLow\StumbleUpon\IE\StumbleUpon.dll (StumbleUpon Inc.)
BHO-x32: WinSecurity - {f42e9111-a9a5-4482-ad2e-1ef9da85b0bf} - C:\Program Files (x86)\WinSecurity\winsecurity.dll (WinSecurity)
BHO-x32: AlxHelper Class - {F443A627-5009-4323-9C1D-7FD598D0D712} - C:\Program Files (x86)\Amazon Browser Bar\AmazonBrowserBar.3.0.dll (Amazon.com)
Toolbar: HKLM-x32 - No Name - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} -  No File
Toolbar: HKLM-x32 - Amazon Browser Bar - {EA582743-9076-4178-9AA6-7393FDF4D5CE} - C:\Program Files (x86)\Amazon Browser Bar\AmazonBrowserBar.3.0.dll (Amazon.com)
Toolbar: HKLM-x32 - RadioTotal Toolbar - {2ee84ac6-8dd6-4a14-bd37-b79c8f9ecf4d} - C:\Program Files (x86)\RadioTotal\prxtbRad1.dll (Conduit Ltd.)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKCU - No Name - {7E111A5C-3D11-4F56-9463-5310C3C69025} -  No File
Toolbar: HKCU - No Name - {30F9B915-B755-4826-820B-08FBA6BD249D} -  No File
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Toolbar: HKCU - No Name - {EEE6C35B-6118-11DC-9C72-001320C79847} -  No File
Toolbar: HKCU - No Name - {2EE84AC6-8DD6-4A14-BD37-B79C8F9ECF4D} -  No File
Toolbar: HKCU - No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} -  No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\xmodr5w8.default
FF user.js: detected! => C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\xmodr5w8.default\user.js
FF Homepage: hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p23_serp_ff_de_display?ie=UTF8&tagbase=bds-p23&tbrId=v1_abb-channel-23_a76337893a2f4851814856562526a95a_39_1006_20131022_DE_ff_sp_
FF Keyword.URL: hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3317483&SearchSource=2&CUI=UN17336173016023235&UM=2&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Manuela\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrch.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\Web Search.xml
FF Extension: Amazon Browser Bar - C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\xmodr5w8.default\Extensions\abb@amazon.com
FF Extension: Plus-HD-2.4 - C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\xmodr5w8.default\Extensions\ad80235d-5e5a-4a1d-a891-51b66a3e70f8@8f877d80-6977-415f-ac14-b52043838c19.com
FF Extension: ProxTube - Gesperrte YouTube Videos entsperren - C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\xmodr5w8.default\Extensions\ich@maltegoetz.de
FF Extension: No Name - C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\xmodr5w8.default\Extensions\staged
FF Extension: RadioTotal  - C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\xmodr5w8.default\Extensions\{2ee84ac6-8dd6-4a14-bd37-b79c8f9ecf4d}
FF Extension: No Name - C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\profiles\extensions\extensions
FF Extension: No Name - C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\profiles\extensions\searchplugins
FF Extension: ftdownloader - C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\profiles\extensions\ftdownloader@ftdownloader.com.xpi
FF Extension: No Name - C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\profiles\extensions\prefs.js
FF Extension: No Name - C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\profiles\extensions\user.js
FF Extension: No Name - C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\profiles\extensions\user.js.orig
FF HKLM\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\IB Updater\Firefox
FF HKLM\...\Firefox\Extensions: [{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}] - C:\Program Files\IB Updater\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\IB Updater\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}] - C:\Program Files\IB Updater\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{ee8cd9f6-dae3-4889-816b-99fe80dae284}] - C:\Program Files (x86)\WinSecurity\winsecurity.xpi
FF Extension: No Name - C:\Program Files (x86)\WinSecurity\winsecurity.xpi
FF HKCU\...\Firefox\Extensions: [{d94342cc-b2eb-4bb9-8ef0-782a1bd67c83}] - C:\Program Files (x86)\LyricsDroid\133.xpi
FF Extension: No Name - C:\Program Files (x86)\LyricsDroid\133.xpi
FF HKCU\...\Firefox\Extensions: [{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}] - C:\Program Files (x86)\Wajam\Firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi
FF Extension: priam_prefs - C:\Program Files (x86)\Wajam\Firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi

Chrome:
=======
CHR HomePage: hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p23_serp_cr_de_display?ie=UTF8&tagbase=bds-p23&tbrId=v1_abb-channel-23_a76337893a2f4851814856562526a95a_39_1006_20131022_DE_cr_sp_
CHR RestoreOnStartup: "hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p23_serp_cr_de_display?ie=UTF8&tagbase=bds-p23&tbrId=v1_abb-channel-23_a76337893a2f4851814856562526a95a_39_1006_20131022_DE_cr_sp_"
CHR Extension: (New Tab for Chrome) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\fgfdfcbeamjnjdejakdidpniblllnbpg\1.0.0.0_0
CHR Extension: () - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\fmlgoencnlndpglbocajlimaikjohmab\background.html
CHR Extension: (Bargain Workbench) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\gebcpofjimbbchggpnfcaiieolloeodp\1.4.1.0_0
CHR Extension: (Plus-HD-2.4) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\hojmbfiljpkaijkdifoaacbpallpfkkf\1.23.29_0
CHR Extension: (DvdVideoSoft Free Youtube Download) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.0.0_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0
CHR Extension: (Fast Discountz) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\oldchfemoapgakfjnmbngnljnkoapbhd\3.6.1.0_0
CHR Extension: (LyricsDroid) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\olmmlhjmcpkhnmfcbelohhaifhilieje\1.133_0
CHR Extension: (StumbleUpon) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgifblbjgdjhcelbanblbhkhmbnnmhfg\3.97.1_0
CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\IB Updater\source.crx
CHR HKLM\...\Chrome\Extension: [gebcpofjimbbchggpnfcaiieolloeodp] - C:\Users\Manuela\AppData\Local\BargainWorkbench.crx
CHR HKLM\...\Chrome\Extension: [oldchfemoapgakfjnmbngnljnkoapbhd] - C:\Users\Manuela\AppData\Local\FastDiscountz.crx
CHR HKLM-x32\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\IB Updater\source.crx
CHR HKLM-x32\...\Chrome\Extension: [fgfdfcbeamjnjdejakdidpniblllnbpg] - C:\Windows\SysWOW64\jmdp\pnte.crx
CHR HKLM-x32\...\Chrome\Extension: [gebcpofjimbbchggpnfcaiieolloeodp] - C:\Users\Manuela\AppData\Local\BargainWorkbench.crx
CHR HKLM-x32\...\Chrome\Extension: [gkjoindjjcmbdpbfppabdgflnkgbbcli] - C:\Program Files (x86)\FTDownloader.com\FTDownloader10.crx
CHR HKLM-x32\...\Chrome\Extension: [ingolnlcamoheiiladeoecpgdbjjmlaf] - C:\Program Files (x86)\WinSecurity\winsecurity.crx
CHR HKLM-x32\...\Chrome\Extension: [ioighjflakajniehlakelhkdfljfemcd] - C:\Users\Manuela\AppData\Local\CRE\ioighjflakajniehlakelhkdfljfemcd.crx
CHR HKLM-x32\...\Chrome\Extension: [jpmbfleldcgkldadpdinhjjopdfpjfjp] - C:\Users\Manuela\AppData\Local\Wajam\Chrome\wajam.crx
CHR HKLM-x32\...\Chrome\Extension: [khialnikbocfgkohdegnebhmmaifoglp] - C:\Program Files (x86)\Lyrics_Monkey\125.crx
CHR HKLM-x32\...\Chrome\Extension: [kiplfnciaokpcennlkldkdaeaaomamof] - C:\Users\Manuela\AppData\Local\Torch\Plugins\TorchPlugin.crx
CHR HKLM-x32\...\Chrome\Extension: [oldchfemoapgakfjnmbngnljnkoapbhd] - C:\Users\Manuela\AppData\Local\FastDiscountz.crx
CHR HKLM-x32\...\Chrome\Extension: [olmmlhjmcpkhnmfcbelohhaifhilieje] - C:\Program Files (x86)\LyricsDroid\133.crx
CHR HKLM-x32\...\Chrome\Extension: [pgifblbjgdjhcelbanblbhkhmbnnmhfg] - C:\Users\Manuela\AppData\LocalLow\StumbleUpon\CHROME\StumbleUpon.crx

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
S4 BroadCamService; C:\Program Files (x86)\NCH Software\BroadCam\broadcam.exe [2469380 2011-12-27] (NCH Software)
S4 IBUpdaterService; C:\Windows\system32\dmwu.exe [1455408 2013-04-07] ()
S2 ICM_UpdaterService; C:\Program Files (x86)\SAMSUNG\Samsung Networking Wizard\ICM_Service.exe [204883 2011-03-18] ()
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-10-23] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [348376 2013-10-23] (Microsoft Corporation)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-07-07] ()
R2 StumbleUponUpdater; C:\Users\Manuela\AppData\LocalLow\StumbleUpon\IE\StumbleUponUpdater.exe [18432 2011-11-22] ()
S2 SystemStoreService; C:\Program Files (x86)\SoftwareUpdater\SystemStore.exe [296448 2013-04-30] ()
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2099512 2013-10-30] (TuneUp Software)
R2 Updater Service for AMZN; C:\Program Files (x86)\Amazon Browser Bar\ToolbarUpdaterService.exe [222368 2013-03-21] ()
R2 WajamUpdaterV3; C:\Program Files (x86)\Wajam\Updater\WajamUpdaterV3.exe [114176 2013-11-20] (Wajam)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [106904 2013-11-25] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132600 2013-11-25] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-10] (Avira Operations GmbH & Co. KG)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [248240 2013-09-27] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [134944 2013-09-27] (Microsoft Corporation)
S3 rtport; C:\Windows\SysWOW64\drivers\rtport.sys [15144 2010-12-20] (Windows (R) 2003 DDK 3790 provider)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2012-07-07] (Duplex Secure Ltd.)
S3 TridVid; C:\Windows\System32\DRIVERS\tridvid6010.sys [411648 2011-01-21] (10Moons Technologies Co.,Ltd)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2013-09-18] (TuneUp Software)
R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-26 10:12 - 2013-11-26 10:12 - 00377856 _____ C:\Users\Manuela\Desktop\gmer_2.1.19163.exe
2013-11-26 10:05 - 2013-11-26 10:06 - 00032119 _____ C:\Users\Manuela\Desktop\Addition.txt
2013-11-26 10:04 - 2013-11-26 20:40 - 00024322 _____ C:\Users\Manuela\Desktop\FRST.txt
2013-11-26 10:04 - 2013-11-26 10:04 - 00000000 ____D C:\FRST
2013-11-26 10:03 - 2013-11-26 10:03 - 01958474 _____ (Farbar) C:\Users\Manuela\Desktop\FRST64.exe
2013-11-26 09:55 - 2013-11-26 09:55 - 00000586 _____ C:\Windows\SysWOW64\defogger_disable.log
2013-11-26 09:55 - 2013-11-26 09:55 - 00000020 _____ C:\Users\Manuela\defogger_reenable
2013-11-24 20:10 - 2013-11-24 20:10 - 00001979 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-11-24 20:06 - 2013-11-24 20:06 - 00000000 ____D C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam
2013-11-24 20:06 - 2013-11-24 20:06 - 00000000 ____D C:\Users\Manuela\AppData\Local\Wajam
2013-11-24 20:06 - 2013-11-24 20:06 - 00000000 ____D C:\Program Files (x86)\Wajam
2013-11-17 13:23 - 2013-11-17 13:23 - 00002770 _____ C:\Windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013
2013-11-17 13:20 - 2013-11-17 13:20 - 00000000 ____D C:\Users\Manuela\AppData\Local\Avg2014
2013-11-15 18:08 - 2013-10-30 10:45 - 00043320 _____ (TuneUp Software) C:\Windows\system32\uxtuneup.dll
2013-11-15 18:08 - 2013-10-30 10:45 - 00036152 _____ (TuneUp Software) C:\Windows\SysWOW64\uxtuneup.dll
2013-11-15 18:08 - 2013-10-30 10:45 - 00029496 _____ (TuneUp Software) C:\Windows\system32\authuitu.dll
2013-11-15 18:08 - 2013-10-30 10:45 - 00025400 _____ (TuneUp Software) C:\Windows\SysWOW64\authuitu.dll
2013-11-15 18:05 - 2013-11-15 18:05 - 00002169 _____ C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
2013-11-15 18:05 - 2013-11-15 18:05 - 00002149 _____ C:\Users\Public\Desktop\TuneUp Utilities 2014.lnk
2013-11-15 18:05 - 2013-10-30 10:45 - 00040760 _____ (TuneUp Software) C:\Windows\system32\TURegOpt.exe
2013-11-15 18:04 - 2013-11-15 20:03 - 00000000 ____D C:\Program Files (x86)\TuneUp Utilities 2014
2013-11-15 18:03 - 2013-11-15 18:16 - 00000000 __SHD C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2013-11-15 17:53 - 2013-11-26 19:18 - 00003382 _____ C:\Windows\System32\Tasks\BackgroundContainer Startup Task
2013-11-14 21:50 - 2013-11-14 21:50 - 00000082 _____ C:\Windows\SETUP.LOG
2013-11-14 21:50 - 2013-11-14 21:50 - 00000000 ____D C:\Program Files\Synaptics
2013-11-14 21:49 - 2013-11-14 21:50 - 00005486 _____ C:\Windows\DPINST.LOG
2013-11-14 21:49 - 2013-11-14 21:49 - 00000000 ____D C:\Program Files (x86)\Atheros Client Installation Program
2013-11-14 21:48 - 2013-11-14 21:49 - 00000191 _____ C:\Windows\SamsungInstaller.log
2013-11-14 21:48 - 2013-11-14 21:48 - 01721576 _____ (Microsoft Corporation) C:\Windows\system32\WdfCoInstaller01009.dll
2013-11-14 21:48 - 2013-11-14 21:47 - 03669504 _____ (Askey Computer Corporation.) C:\Windows\SysWOW64\AInst3141x.exe
2013-11-14 21:48 - 2013-11-14 21:47 - 00001202 _____ C:\Windows\SysWOW64\WLL3141.cfgx
2013-11-14 21:47 - 2013-11-14 21:47 - 01573888 _____ (Atheros Communications, Inc.) C:\Windows\system32\Drivers\athrx.sys
2013-11-14 21:47 - 2013-11-14 21:47 - 00396584 _____ (Synaptics Incorporated) C:\Windows\system32\SynCOM.dll
2013-11-14 21:47 - 2013-11-14 21:47 - 00316464 _____ (Synaptics Incorporated) C:\Windows\system32\Drivers\SynTP.sys
2013-11-14 21:47 - 2013-11-14 21:47 - 00264488 _____ (Synaptics Incorporated) C:\Windows\system32\SynCtrl.dll
2013-11-14 21:47 - 2013-11-14 21:47 - 00214312 _____ (Synaptics Incorporated) C:\Windows\system32\SynTPAPI.dll
2013-11-14 21:47 - 2013-11-14 21:47 - 00210216 _____ (Synaptics Incorporated) C:\Windows\SysWOW64\SynCtrl.dll
2013-11-14 21:47 - 2013-11-14 21:47 - 00173352 _____ (Synaptics Incorporated) C:\Windows\SysWOW64\SynCOM.dll
2013-11-14 21:47 - 2013-11-14 21:47 - 00147752 _____ (Synaptics Incorporated) C:\Windows\system32\SynTPCo4.dll
2013-11-14 21:47 - 2013-11-14 21:47 - 00107816 _____ (Synaptics Incorporated) C:\Windows\SysWOW64\SynTPCOM.dll
2013-11-14 20:35 - 2013-11-15 17:33 - 00000000 ____D C:\Windows\pss
2013-11-13 23:12 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-13 23:12 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-13 23:12 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-13 23:12 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-13 23:12 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-13 23:12 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-13 23:12 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-13 23:12 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-13 23:12 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-13 23:11 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-13 23:11 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-13 23:11 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-13 23:11 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-13 23:11 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-13 23:11 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-13 23:11 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-13 23:11 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-13 23:11 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-13 23:11 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-13 23:11 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-13 23:11 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-13 23:11 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-13 23:11 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-13 23:11 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-13 23:11 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-13 23:11 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-13 23:11 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-13 23:11 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-13 23:11 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-13 23:11 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-13 23:11 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-13 19:39 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-13 19:39 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-13 19:39 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-13 19:39 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-13 19:39 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-13 19:39 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-13 19:39 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-11-13 19:39 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2013-11-13 19:39 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-13 19:39 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-13 19:39 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-13 19:39 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-13 19:39 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-13 19:39 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-13 19:38 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-13 19:38 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-13 19:38 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-13 19:38 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-13 19:38 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-13 19:38 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-13 19:38 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-13 19:38 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-13 19:38 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-13 19:38 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-13 19:38 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-13 19:38 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-13 19:38 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-13 19:38 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-13 19:38 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-13 19:38 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-12 22:46 - 2013-11-12 22:46 - 00000000 ____D C:\Program Files (x86)\WinSecurity
2013-11-12 22:44 - 2013-11-12 22:44 - 00000000 ____D C:\Users\Manuela\AppData\Roaming\Windows Net Data
2013-11-12 22:42 - 2013-11-15 17:53 - 00000000 ____D C:\Users\Manuela\AppData\Local\Conduit
2013-11-12 22:42 - 2013-11-15 17:53 - 00000000 ____D C:\Program Files (x86)\RadioTotal
2013-11-12 22:42 - 2013-11-14 21:35 - 00000000 ____D C:\ProgramData\Conduit
2013-11-12 22:41 - 2013-11-14 21:36 - 00000000 ____D C:\Program Files (x86)\Conduit
2013-11-12 22:41 - 2013-11-12 22:41 - 00000000 ____D C:\Users\Manuela\AppData\Local\NativeMessaging
2013-11-12 22:41 - 2013-11-12 22:41 - 00000000 ____D C:\Users\Manuela\AppData\Local\CRE
2013-11-07 19:26 - 2013-11-07 19:26 - 00124416 ___SH C:\Users\Manuela\Downloads\Thumbs.db
2013-11-07 17:57 - 2013-11-07 17:57 - 00000000 ____D C:\Users\Manuela\AppData\Local\Software_Updater
2013-11-06 20:31 - 2013-11-06 20:31 - 00001932 _____ C:\Users\Manuela\Desktop\DVD Decrypter.lnk
2013-11-06 20:31 - 2013-11-06 20:31 - 00000000 ____D C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DVD Decrypter
2013-11-06 20:31 - 2013-11-06 20:31 - 00000000 ____D C:\Program Files (x86)\DVD Decrypter
2013-11-06 20:28 - 2013-11-06 20:28 - 03882128 _____ C:\Users\Manuela\Downloads\installer_dvd_decrypter_3_5_4_0_Deutsch.exe
2013-11-06 20:22 - 2013-11-06 20:22 - 00000000 ____D C:\Users\Manuela\Documents\Any Video Converter
2013-10-31 23:04 - 2013-11-26 19:18 - 00002790 _____ C:\Windows\setupact.log
2013-10-31 23:04 - 2013-11-25 17:40 - 00532256 _____ C:\Windows\PFRO.log
2013-10-31 23:04 - 2013-10-31 23:04 - 00000000 _____ C:\Windows\setuperr.log
2013-10-27 20:17 - 2013-11-10 18:05 - 00001106 _____ C:\Windows\DVDXRestrictionFree.ini
2013-10-27 20:17 - 2013-10-27 20:17 - 00000014 _____ C:\Windows\SysWOW64\SysEngine2.SYS
2013-10-27 20:17 - 2013-10-27 20:17 - 00000000 ____D C:\Program Files (x86)\CloneDVD Studio

==================== One Month Modified Files and Folders =======

2013-11-26 20:42 - 2013-11-26 10:04 - 00024322 _____ C:\Users\Manuela\Desktop\FRST.txt
2013-11-26 20:18 - 2013-06-06 17:18 - 00000294 _____ C:\Windows\Tasks\DSite.job
2013-11-26 20:04 - 2012-06-13 18:26 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-26 19:31 - 2010-06-14 11:51 - 01220751 _____ C:\Windows\WindowsUpdate.log
2013-11-26 19:26 - 2009-07-14 05:45 - 00014144 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-26 19:26 - 2009-07-14 05:45 - 00014144 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-26 19:22 - 2012-12-12 19:08 - 00004184 _____ C:\Windows\System32\Tasks\Software Updater Ui
2013-11-26 19:22 - 2012-12-11 18:29 - 00004208 _____ C:\Windows\System32\Tasks\Software Updater
2013-11-26 19:18 - 2013-11-15 17:53 - 00003382 _____ C:\Windows\System32\Tasks\BackgroundContainer Startup Task
2013-11-26 19:18 - 2013-10-31 23:04 - 00002790 _____ C:\Windows\setupact.log
2013-11-26 19:18 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-26 10:12 - 2013-11-26 10:12 - 00377856 _____ C:\Users\Manuela\Desktop\gmer_2.1.19163.exe
2013-11-26 10:06 - 2013-11-26 10:05 - 00032119 _____ C:\Users\Manuela\Desktop\Addition.txt
2013-11-26 10:04 - 2013-11-26 10:04 - 00000000 ____D C:\FRST
2013-11-26 10:03 - 2013-11-26 10:03 - 01958474 _____ (Farbar) C:\Users\Manuela\Desktop\FRST64.exe
2013-11-26 10:01 - 2012-02-05 09:51 - 00001146 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-868785299-726797094-2297327714-1001UA.job
2013-11-26 09:55 - 2013-11-26 09:55 - 00000586 _____ C:\Windows\SysWOW64\defogger_disable.log
2013-11-26 09:55 - 2013-11-26 09:55 - 00000020 _____ C:\Users\Manuela\defogger_reenable
2013-11-26 09:55 - 2011-01-15 10:03 - 00000000 ____D C:\Users\Manuela
2013-11-26 08:19 - 2013-07-27 16:42 - 00000111 _____ C:\Users\Manuela\AppData\Roaming\WB.CFG
2013-11-26 08:19 - 2013-06-17 13:33 - 00000006 _____ C:\Users\Manuela\AppData\Roaming\WBPU-TTL.DAT
2013-11-25 19:04 - 2011-01-15 10:48 - 00000000 ____D C:\Users\Manuela\AppData\Roaming\Adobe
2013-11-25 17:41 - 2011-01-15 10:11 - 00099984 _____ C:\Users\Manuela\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-25 17:41 - 2010-06-14 12:04 - 00000000 ____D C:\ProgramData\McAfee
2013-11-25 17:41 - 2009-07-14 04:20 - 00000000 ___RD C:\Program Files
2013-11-25 17:40 - 2013-10-31 23:04 - 00532256 _____ C:\Windows\PFRO.log
2013-11-25 17:40 - 2011-03-19 13:32 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-25 17:40 - 2009-07-14 05:45 - 00408320 _____ C:\Windows\system32\FNTCACHE.DAT
2013-11-25 15:03 - 2013-05-07 15:02 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-11-25 15:03 - 2013-04-04 15:29 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-11-25 15:03 - 2013-04-04 15:29 - 00106904 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-11-24 22:01 - 2012-02-05 09:51 - 00001124 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-868785299-726797094-2297327714-1001Core.job
2013-11-24 20:39 - 2011-04-26 10:10 - 00000000 ____D C:\Windows\System32\Tasks\NCH Software
2013-11-24 20:36 - 2011-04-26 10:10 - 00000000 ____D C:\Program Files (x86)\NCH Software
2013-11-24 20:34 - 2012-07-14 15:16 - 00000000 ____D C:\Users\Public\Documents\Pinnacle
2013-11-24 20:29 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-11-24 20:12 - 2012-12-17 21:18 - 00003084 _____ C:\Windows\System32\Tasks\Go for FilesUpdate
2013-11-24 20:10 - 2013-11-24 20:10 - 00001979 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-11-24 20:10 - 2011-01-15 10:05 - 00000000 ____D C:\ProgramData\Adobe
2013-11-24 20:09 - 2011-01-18 21:34 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-11-24 20:06 - 2013-11-24 20:06 - 00000000 ____D C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam
2013-11-24 20:06 - 2013-11-24 20:06 - 00000000 ____D C:\Users\Manuela\AppData\Local\Wajam
2013-11-24 20:06 - 2013-11-24 20:06 - 00000000 ____D C:\Program Files (x86)\Wajam
2013-11-24 20:04 - 2013-08-01 18:58 - 00000133 _____ C:\Users\Manuela\Desktop\Amazon.url
2013-11-19 23:31 - 2012-12-25 22:57 - 00000000 ____D C:\Users\Manuela\Documents\Carolin schlau
2013-11-19 23:31 - 2012-09-10 14:53 - 00000000 ____D C:\Users\Manuela\Documents\Carolin´s Ha
2013-11-19 23:29 - 2010-06-15 04:23 - 00665320 _____ C:\Windows\system32\perfh007.dat
2013-11-19 23:29 - 2010-06-15 04:23 - 00135198 _____ C:\Windows\system32\perfc007.dat
2013-11-19 23:29 - 2009-07-14 06:13 - 01529102 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-19 23:18 - 2013-08-01 19:31 - 00001912 _____ C:\Windows\Tasks\Plus-HD-2.4-chromeinstaller.job
2013-11-19 23:18 - 2013-08-01 19:31 - 00001836 _____ C:\Windows\Tasks\Plus-HD-2.4-firefoxinstaller.job
2013-11-19 23:18 - 2013-08-01 19:31 - 00001292 _____ C:\Windows\Tasks\Plus-HD-2.4-updater.job
2013-11-19 23:18 - 2013-08-01 19:31 - 00001204 _____ C:\Windows\Tasks\Plus-HD-2.4-codedownloader.job
2013-11-19 23:18 - 2013-08-01 19:31 - 00001102 _____ C:\Windows\Tasks\Plus-HD-2.4-enabler.job
2013-11-19 23:18 - 2011-01-15 10:52 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-19 23:18 - 2011-01-15 10:52 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-19 23:15 - 2009-07-14 03:34 - 84148224 _____ C:\Windows\system32\config\SOFTWARE_tureg_old
2013-11-19 23:15 - 2009-07-14 03:34 - 20185088 _____ C:\Windows\system32\config\SYSTEM_tureg_old
2013-11-19 23:15 - 2009-07-14 03:34 - 00262144 _____ C:\Windows\system32\config\SECURITY_tureg_old
2013-11-19 22:10 - 2009-07-14 03:34 - 50069504 _____ C:\Windows\system32\config\COMPONENTS_tureg_old
2013-11-19 22:10 - 2009-07-14 03:34 - 01048576 _____ C:\Windows\system32\config\DEFAULT_tureg_old
2013-11-19 22:10 - 2009-07-14 03:34 - 00262144 _____ C:\Windows\system32\config\SAM_tureg_old
2013-11-19 22:09 - 2013-10-22 06:59 - 00001912 _____ C:\Windows\epplauncher.mif
2013-11-19 22:09 - 2013-10-22 06:57 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-11-19 22:08 - 2013-10-22 06:57 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2013-11-19 19:05 - 2013-03-11 20:09 - 00000000 ____D C:\Users\Manuela\AppData\Roaming\Skype
2013-11-19 11:21 - 2011-04-23 07:02 - 00267936 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2013-11-17 13:23 - 2013-11-17 13:23 - 00002770 _____ C:\Windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013
2013-11-17 13:20 - 2013-11-17 13:20 - 00000000 ____D C:\Users\Manuela\AppData\Local\Avg2014
2013-11-15 20:03 - 2013-11-15 18:04 - 00000000 ____D C:\Program Files (x86)\TuneUp Utilities 2014
2013-11-15 20:03 - 2011-04-26 10:09 - 00000000 ____D C:\Users\Manuela\AppData\Roaming\NCH Software
2013-11-15 18:19 - 2013-08-01 19:31 - 00004334 _____ C:\Windows\System32\Tasks\Plus-HD-2.4-updater
2013-11-15 18:19 - 2013-08-01 19:31 - 00004246 _____ C:\Windows\System32\Tasks\Plus-HD-2.4-codedownloader
2013-11-15 18:19 - 2013-08-01 19:31 - 00004144 _____ C:\Windows\System32\Tasks\Plus-HD-2.4-enabler
2013-11-15 18:19 - 2013-06-23 21:02 - 00002778 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-11-15 18:19 - 2011-01-15 10:52 - 00004118 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-11-15 18:19 - 2011-01-15 10:52 - 00003866 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-11-15 18:17 - 2011-04-25 21:54 - 00000000 ____D C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nero (32-bit)
2013-11-15 18:16 - 2013-11-15 18:03 - 00000000 __SHD C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2013-11-15 18:16 - 2012-09-15 21:00 - 00000000 __SHD C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936}
2013-11-15 18:16 - 2012-07-14 15:15 - 00000000 ____D C:\Users\Manuela\AppData\Local\Downloaded Installations
2013-11-15 18:09 - 2012-09-15 21:00 - 00000000 ____D C:\ProgramData\TuneUp Software
2013-11-15 18:05 - 2013-11-15 18:05 - 00002169 _____ C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
2013-11-15 18:05 - 2013-11-15 18:05 - 00002149 _____ C:\Users\Public\Desktop\TuneUp Utilities 2014.lnk
2013-11-15 18:05 - 2013-10-08 14:59 - 00017408 ___SH C:\Users\Manuela\Desktop\Thumbs.db
2013-11-15 18:05 - 2012-09-15 21:00 - 00000000 ____D C:\Users\Manuela\AppData\Roaming\TuneUp Software
2013-11-15 17:53 - 2013-11-12 22:42 - 00000000 ____D C:\Users\Manuela\AppData\Local\Conduit
2013-11-15 17:53 - 2013-11-12 22:42 - 00000000 ____D C:\Program Files (x86)\RadioTotal
2013-11-15 17:33 - 2013-11-14 20:35 - 00000000 ____D C:\Windows\pss
2013-11-15 17:33 - 2011-01-15 10:18 - 00000000 ___RD C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-15 16:58 - 2011-01-15 10:03 - 00000000 ____D C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2013-11-14 22:08 - 2009-07-14 03:34 - 00000435 _____ C:\Windows\win.ini
2013-11-14 21:50 - 2013-11-14 21:50 - 00000082 _____ C:\Windows\SETUP.LOG
2013-11-14 21:50 - 2013-11-14 21:50 - 00000000 ____D C:\Program Files\Synaptics
2013-11-14 21:50 - 2013-11-14 21:49 - 00005486 _____ C:\Windows\DPINST.LOG
2013-11-14 21:49 - 2013-11-14 21:49 - 00000000 ____D C:\Program Files (x86)\Atheros Client Installation Program
2013-11-14 21:49 - 2013-11-14 21:48 - 00000191 _____ C:\Windows\SamsungInstaller.log
2013-11-14 21:49 - 2010-06-14 11:47 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-11-14 21:48 - 2013-11-14 21:48 - 01721576 _____ (Microsoft Corporation) C:\Windows\system32\WdfCoInstaller01009.dll
2013-11-14 21:47 - 2013-11-14 21:48 - 03669504 _____ (Askey Computer Corporation.) C:\Windows\SysWOW64\AInst3141x.exe
2013-11-14 21:47 - 2013-11-14 21:48 - 00001202 _____ C:\Windows\SysWOW64\WLL3141.cfgx
2013-11-14 21:47 - 2013-11-14 21:47 - 01573888 _____ (Atheros Communications, Inc.) C:\Windows\system32\Drivers\athrx.sys
2013-11-14 21:47 - 2013-11-14 21:47 - 00396584 _____ (Synaptics Incorporated) C:\Windows\system32\SynCOM.dll
2013-11-14 21:47 - 2013-11-14 21:47 - 00316464 _____ (Synaptics Incorporated) C:\Windows\system32\Drivers\SynTP.sys
2013-11-14 21:47 - 2013-11-14 21:47 - 00264488 _____ (Synaptics Incorporated) C:\Windows\system32\SynCtrl.dll
2013-11-14 21:47 - 2013-11-14 21:47 - 00214312 _____ (Synaptics Incorporated) C:\Windows\system32\SynTPAPI.dll
2013-11-14 21:47 - 2013-11-14 21:47 - 00210216 _____ (Synaptics Incorporated) C:\Windows\SysWOW64\SynCtrl.dll
2013-11-14 21:47 - 2013-11-14 21:47 - 00173352 _____ (Synaptics Incorporated) C:\Windows\SysWOW64\SynCOM.dll
2013-11-14 21:47 - 2013-11-14 21:47 - 00147752 _____ (Synaptics Incorporated) C:\Windows\system32\SynTPCo4.dll
2013-11-14 21:47 - 2013-11-14 21:47 - 00107816 _____ (Synaptics Incorporated) C:\Windows\SysWOW64\SynTPCOM.dll
2013-11-14 21:36 - 2013-11-12 22:41 - 00000000 ____D C:\Program Files (x86)\Conduit
2013-11-14 21:36 - 2011-12-27 20:30 - 00000000 ____D C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AVS4YOU
2013-11-14 21:36 - 2011-12-27 20:29 - 00000000 ____D C:\Program Files (x86)\AVS4YOU
2013-11-14 21:36 - 2011-01-24 20:04 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
2013-11-14 21:36 - 2010-06-14 12:03 - 00000000 ____D C:\ProgramData\WinClon
2013-11-14 21:36 - 2010-06-14 11:54 - 00000000 ____D C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2013-11-14 21:36 - 2010-06-14 11:54 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2013-11-14 21:36 - 2010-06-14 11:53 - 00000000 ____D C:\Program Files (x86)\CyberLink
2013-11-14 21:36 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2013-11-14 21:36 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration
2013-11-14 21:35 - 2013-11-12 22:42 - 00000000 ____D C:\ProgramData\Conduit
2013-11-14 20:16 - 2012-02-19 20:05 - 00000000 ____D C:\Users\Manuela\AppData\Roaming\IrfanView
2013-11-14 20:15 - 2012-07-14 15:40 - 00000000 ____D C:\Program Files (x86)\InterVideo
2013-11-14 20:13 - 2011-04-26 10:39 - 00000000 ____D C:\Philips
2013-11-14 18:00 - 2013-08-18 11:46 - 00000000 ____D C:\Windows\rescache
2013-11-14 16:56 - 2013-07-28 12:35 - 00000374 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2013-11-14 16:56 - 2009-08-02 03:27 - 00000000 ____D C:\Windows\Panther
2013-11-13 23:10 - 2013-08-18 02:01 - 00000000 ____D C:\Windows\system32\MRT
2013-11-13 23:03 - 2011-03-18 07:46 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-12 22:46 - 2013-11-12 22:46 - 00000000 ____D C:\Program Files (x86)\WinSecurity
2013-11-12 22:45 - 2012-10-05 21:18 - 00002521 _____ C:\Users\Public\Desktop\Freetec TubeBox.lnk
2013-11-12 22:45 - 2012-10-05 21:18 - 00000000 ____D C:\ProgramData\Package Cache
2013-11-12 22:45 - 2012-10-05 21:18 - 00000000 ____D C:\Program Files (x86)\Freetec
2013-11-12 22:44 - 2013-11-12 22:44 - 00000000 ____D C:\Users\Manuela\AppData\Roaming\Windows Net Data
2013-11-12 22:41 - 2013-11-12 22:41 - 00000000 ____D C:\Users\Manuela\AppData\Local\NativeMessaging
2013-11-12 22:41 - 2013-11-12 22:41 - 00000000 ____D C:\Users\Manuela\AppData\Local\CRE
2013-11-12 22:41 - 2013-08-17 11:26 - 00000000 ____D C:\Users\Manuela\AppData\Local\DownloadGuide
2013-11-10 18:05 - 2013-10-27 20:17 - 00001106 _____ C:\Windows\DVDXRestrictionFree.ini
2013-11-10 18:05 - 2011-02-21 19:08 - 00000085 ___SH C:\ProgramData\.zreglib
2013-11-10 12:01 - 2013-10-22 06:46 - 00000000 ____D C:\Program Files (x86)\Amazon Browser Bar
2013-11-07 19:27 - 2011-02-05 16:35 - 00000000 ____D C:\Users\Manuela\Leder
2013-11-07 19:26 - 2013-11-07 19:26 - 00124416 ___SH C:\Users\Manuela\Downloads\Thumbs.db
2013-11-07 17:57 - 2013-11-07 17:57 - 00000000 ____D C:\Users\Manuela\AppData\Local\Software_Updater
2013-11-06 20:31 - 2013-11-06 20:31 - 00001932 _____ C:\Users\Manuela\Desktop\DVD Decrypter.lnk
2013-11-06 20:31 - 2013-11-06 20:31 - 00000000 ____D C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DVD Decrypter
2013-11-06 20:31 - 2013-11-06 20:31 - 00000000 ____D C:\Program Files (x86)\DVD Decrypter
2013-11-06 20:28 - 2013-11-06 20:28 - 03882128 _____ C:\Users\Manuela\Downloads\installer_dvd_decrypter_3_5_4_0_Deutsch.exe
2013-11-06 20:28 - 2011-08-27 12:50 - 00000000 ____D C:\Users\Manuela\Downloads\Audio (Mp3)
2013-11-06 20:22 - 2013-11-06 20:22 - 00000000 ____D C:\Users\Manuela\Documents\Any Video Converter
2013-10-31 23:04 - 2013-10-31 23:04 - 00000000 _____ C:\Windows\setuperr.log
2013-10-30 10:45 - 2013-11-15 18:08 - 00043320 _____ (TuneUp Software) C:\Windows\system32\uxtuneup.dll
2013-10-30 10:45 - 2013-11-15 18:08 - 00036152 _____ (TuneUp Software) C:\Windows\SysWOW64\uxtuneup.dll
2013-10-30 10:45 - 2013-11-15 18:08 - 00029496 _____ (TuneUp Software) C:\Windows\system32\authuitu.dll
2013-10-30 10:45 - 2013-11-15 18:08 - 00025400 _____ (TuneUp Software) C:\Windows\SysWOW64\authuitu.dll
2013-10-30 10:45 - 2013-11-15 18:05 - 00040760 _____ (TuneUp Software) C:\Windows\system32\TURegOpt.exe
2013-10-29 19:12 - 2013-03-11 20:09 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-10-29 19:12 - 2013-03-11 20:09 - 00000000 ____D C:\ProgramData\Skype
2013-10-29 19:07 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-10-27 20:17 - 2013-10-27 20:17 - 00000014 _____ C:\Windows\SysWOW64\SysEngine2.SYS
2013-10-27 20:17 - 2013-10-27 20:17 - 00000000 ____D C:\Program Files (x86)\CloneDVD Studio

Files to move or delete:
====================
C:\Users\Public\AlexaNSISPlugin.4852.dll


Some content of TEMP:
====================
C:\Users\Manuela\AppData\Local\Temp\0068011384462893mcinst.exe
C:\Users\Manuela\AppData\Local\Temp\avgnt.exe
C:\Users\Manuela\AppData\Local\Temp\ConduitEngine.dll
C:\Users\Manuela\AppData\Local\Temp\iv_uninstall.exe
C:\Users\Manuela\AppData\Local\Temp\uninst.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-20 18:33

==================== End Of Log ============================
--- --- ---

M-K-D-B 26.11.2013 21:11
:hallo:


Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen.


Bitte beachte folgende Hinweise:
  • Falls wir Hinweise auf illegal erworbene Software finden, werden wir den Support unterbrechen bis jegliche Art von illegaler Software vom Rechner entfernt wurde.
  • Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab und poste alle Logdateien in CODE-Tags.
  • Lies dir die Anleitungen sorgfältig durch. Solltest du Probleme haben, stoppe mit deiner Bearbeitung und beschreibe mir dein Problem so gut es geht.
  • Solltest du mir nicht innerhalb von 4 Tagen antworten, gehe ich davon aus, dass du keine Hilfe mehr benötigst. Dann lösche ich dein Thema aus meinem Abo.
    Solltest du einmal länger abwesend sein, so gib mir bitte Bescheid!
  • Während der Bereinigung bitte nichts installieren oder deinstallieren, außer ich bitte dich darum!
  • Alle zu verwendenen Programme sind auf dem Desktop abzuspeichern und von dort zu starten!
    Ich kann Dir niemals eine Garantie geben, dass auch ich alles finde. Eine Formatierung ist meist der schnellere und immer der sicherste Weg.
    Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist.







Schritt 1
Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).





Schritt 2

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.






Schritt 3
Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.







Schritt 4
Bitte lade dir zoek.exe von hier: http://hijackthis.nl/smeenk/
  • Bitte deaktiviere während des Scans alle Virenscanner, da sie das Ergebnis beeinflussen
  • Starte Zoek.exe mit einem Doppelklick.
  • Achtung: Das folgende Skript wurde nur für diesen speziellen Fall geschrieben und könnte andere Computer beschädigen.
  • Kopiere den Text der folgenden Box in das Skriptfenster von zoek:
    Code:
    FFdefaults;
    CHRdefaults;
    iedefaults;
    emptyclsid;
    autoclean;
  • Nun klicke auf "Run script" und sei geduldig bis das Skript durchläuft.
  • Wenn das Tool fertig ist wird sich Notepad mit dem Logfile öffnen (ggf. erst nach einem Neustart). Das Log befindet sich aber auch noch unter c:
  • Bitte poste mir das ZOEK-Log (möglichst in CODE-Tags - #-Symbol im Antwortfenster klicken)





Bitte poste mit deiner nächsten Antwort
  • die Logdatei von AdwCleaner,
  • die Logdatei von JRT,
  • die Logdatei von MBAM,
  • die Logdatei von Zoek.

speedydino 26.11.2013 22:36
AdwCleaner Logfile:
Code:
# AdwCleaner v3.013 - Bericht erstellt am 26/11/2013 um 21:22:46
# Updated 24/11/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Manuela - MANUELA-PC
# Gestartet von : C:\Users\Manuela\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****

[#] Dienst Gelöscht : IBUpdaterService
Dienst Gelöscht : StumbleUponUpdater
[#] Dienst Gelöscht : SystemStoreService
Dienst Gelöscht : Updater Service for AMZN
Dienst Gelöscht : WajamUpdaterV3

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\Conduit
Ordner Gelöscht : C:\ProgramData\NCH Software
Ordner Gelöscht : C:\ProgramData\Partner
Ordner Gelöscht : C:\ProgramData\Tarma Installer
Ordner Gelöscht : C:\ProgramData\Uniblue\DriverScanner
Ordner Gelöscht : C:\Program Files (x86)\AddLyrics
Ordner Gelöscht : C:\Program Files (x86)\Amazon Browser Bar
Ordner Gelöscht : C:\Program Files (x86)\Conduit
Ordner Gelöscht : C:\Program Files (x86)\file scout
Ordner Gelöscht : C:\Program Files (x86)\FreeCompressor
Ordner Gelöscht : C:\Program Files (x86)\goforfiles
Ordner Gelöscht : C:\Program Files (x86)\LyricsDroid
Ordner Gelöscht : C:\Program Files (x86)\NCH Software
Ordner Gelöscht : C:\Program Files (x86)\SoftwareUpdater
Ordner Gelöscht : C:\Program Files (x86)\Wajam
Ordner Gelöscht : C:\Program Files (x86)\WinSecurity
Ordner Gelöscht : C:\Program Files (x86)\Plus-HD-2.4
Ordner Gelöscht : C:\Program Files (x86)\RadioTotal
Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB
Ordner Gelöscht : C:\Windows\assembly\GAC_MSIL\QuickStoresToolbar
Ordner Gelöscht : C:\Windows\SysWOW64\ARFC
Ordner Gelöscht : C:\Windows\SysWOW64\jmdp
Ordner Gelöscht : C:\Windows\SysWOW64\WNLT
Ordner Gelöscht : C:\Windows\System32\ARFC
Ordner Gelöscht : C:\Users\Manuela\AppData\Local\Amazon Browser Bar
Ordner Gelöscht : C:\Users\Manuela\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\Manuela\AppData\Local\DownloadGuide
Ordner Gelöscht : C:\Users\Manuela\AppData\Local\FreeCompressor Air
Ordner Gelöscht : C:\Users\Manuela\AppData\Local\PutLockerDownloader
Ordner Gelöscht : C:\Users\Manuela\AppData\Local\TempDir
Ordner Gelöscht : C:\Users\Manuela\AppData\Local\Wajam
Ordner Gelöscht : C:\Users\Manuela\AppData\Local\Temp\CT3317483
Ordner Gelöscht : C:\Users\Manuela\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Manuela\AppData\LocalLow\Delta
Ordner Gelöscht : C:\Users\Manuela\AppData\LocalLow\facemoods.com
Ordner Gelöscht : C:\Users\Manuela\AppData\LocalLow\GutscheinCodes
Ordner Gelöscht : C:\Users\Manuela\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\Manuela\AppData\LocalLow\SimplyTech
Ordner Gelöscht : C:\Users\Manuela\AppData\LocalLow\StumbleUpon
Ordner Gelöscht : C:\Users\Manuela\AppData\LocalLow\RadioTotal
Ordner Gelöscht : C:\Users\Manuela\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\Manuela\AppData\Roaming\DesktopIconForAmazon
Ordner Gelöscht : C:\Users\Manuela\AppData\Roaming\DSite
Ordner Gelöscht : C:\Users\Manuela\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Manuela\AppData\Roaming\file scout
Ordner Gelöscht : C:\Users\Manuela\AppData\Roaming\FreeCompressor
Ordner Gelöscht : C:\Users\Manuela\AppData\Roaming\goforfiles
Ordner Gelöscht : C:\Users\Manuela\AppData\Roaming\NCH Software
Ordner Gelöscht : C:\Users\Manuela\AppData\Roaming\OCS
Ordner Gelöscht : C:\Users\Manuela\AppData\Roaming\OpenCandy
Ordner Gelöscht : C:\Users\Manuela\AppData\Roaming\PerformerSoft
Ordner Gelöscht : C:\Users\Manuela\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\Manuela\AppData\Roaming\Windows Net Data
Ordner Gelöscht : C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam
Ordner Gelöscht : C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\xmodr5w8.default\CT3317483
Ordner Gelöscht : C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\xmodr5w8.default\Extensions\ad80235d-5e5a-4a1d-a891-51b66a3e70f8@8f877d80-6977-415f-ac14-b52043838c19.com
Ordner Gelöscht : C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\xmodr5w8.default\Extensions\{2ee84ac6-8dd6-4a14-bd37-b79c8f9ecf4d}
Ordner Gelöscht : C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\fgfdfcbeamjnjdejakdidpniblllnbpg
Ordner Gelöscht : C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgifblbjgdjhcelbanblbhkhmbnnmhfg
Ordner Gelöscht : C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\hojmbfiljpkaijkdifoaacbpallpfkkf
Datei Gelöscht : C:\Windows\System32\dmwu.exe
Datei Gelöscht : C:\Windows\System32\ImhxxpComm.dll
Datei Gelöscht : C:\Windows\System32\roboot64.exe
Datei Gelöscht : C:\Users\Manuela\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\QuickStores.url
Datei Gelöscht : C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\QuickStores.url
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\searchplugins\fcmdSrch.xml
Datei Gelöscht : C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\searchplugins\Web Search.xml
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\searchplugins\Web Search.xml
Datei Gelöscht : C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\user.js
Datei Gelöscht : C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\xmodr5w8.default\user.js
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\user.js
Datei Gelöscht : C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_eooncjejnppfjjklapaamhcdmjbilmde_0.localstorage
Datei Gelöscht : C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage
Datei Gelöscht : C:\Windows\System32\Tasks\BackgroundContainer Startup Task
Datei Gelöscht : C:\Windows\Tasks\DSite.job
Datei Gelöscht : C:\Windows\System32\Tasks\DSite
Datei Gelöscht : C:\Windows\System32\Tasks\QtraxPlayer
Datei Gelöscht : C:\Windows\System32\Tasks\Software Updater Ui
Datei Gelöscht : C:\Windows\System32\Tasks\Software Updater
Datei Gelöscht : C:\Windows\Tasks\Plus-HD-2.4-chromeinstaller.job
Datei Gelöscht : C:\Windows\System32\Tasks\Plus-HD-2.4-chromeinstaller
Datei Gelöscht : C:\Windows\Tasks\Plus-HD-2.4-codedownloader.job
Datei Gelöscht : C:\Windows\System32\Tasks\Plus-HD-2.4-codedownloader
Datei Gelöscht : C:\Windows\Tasks\Plus-HD-2.4-enabler.job
Datei Gelöscht : C:\Windows\System32\Tasks\Plus-HD-2.4-enabler
Datei Gelöscht : C:\Windows\Tasks\Plus-HD-2.4-firefoxinstaller.job
Datei Gelöscht : C:\Windows\System32\Tasks\Plus-HD-2.4-firefoxinstaller
Datei Gelöscht : C:\Windows\Tasks\Plus-HD-2.4-updater.job
Datei Gelöscht : C:\Windows\System32\Tasks\Plus-HD-2.4-updater

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{336D0C35-8A85-403A-B9D2-65C292C39087}]
Wert Gelöscht : [x64] HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{336D0C35-8A85-403A-B9D2-65C292C39087}]
Wert Gelöscht : HKCU\Software\Mozilla\Firefox\Extensions [{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}]
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{FE1DEEEA-DB6D-44B8-83F0-34FC0F9D1052}]
Wert Gelöscht : [x64] HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{FE1DEEEA-DB6D-44B8-83F0-34FC0F9D1052}]
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\fgfdfcbeamjnjdejakdidpniblllnbpg
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\khialnikbocfgkohdegnebhmmaifoglp
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\kiplfnciaokpcennlkldkdaeaaomamof
Schlüssel Gelöscht : HKCU\Software\Google\Chrome\Extensions\pbjikboenpfhbbejgkoklgkhjpfogcam
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\pgifblbjgdjhcelbanblbhkhmbnnmhfg
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\conduit.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\MenuExt\Web-Suche
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [BackgroundContainer]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AlxSSB.AlxTBSSB
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AlxSSB.AlxTBSSB.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AlxTB2.ToolBarProxy
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AlxTB2.ToolBarProxy.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\priam_bho.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\StumbleUpon.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\driverscanner
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\facemoods.facemoodsHlpr
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\facemoods.facemoodsHlpr.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\FTDownloader
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\GutscheinCodes.GutscheinCodesBHO
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\GutscheinCodes.GutscheinCodesBHO.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\StumbleUpon.QTimeCpio
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\StumbleUpon.QTimeCpio.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\wajam.WajamBHO
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\wajam.WajamBHO.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\wajam.WajamDownloader
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\wajam.WajamDownloader.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\driverscanner_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\driverscanner_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\facemoodssrv_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\facemoodssrv_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\FTDownloader_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\FTDownloader_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\HomeTab_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\HomeTab_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IminentSetup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IminentSetup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftwareUpdater_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftwareUpdater_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetim_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetim_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\wajam_install_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\wajam_install_rasmancs
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WajamUpdater
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CrossriderApp0033434.BHO
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CrossriderApp0033434.BHO.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CrossriderApp0033434.Sandbox
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CrossriderApp0033434.Sandbox.1
Schlüssel Gelöscht : HKCU\Software\5a48fdcb33bba44
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT3317483
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_ashampoo-clipfinder-hd[1]_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_ashampoo-clipfinder-hd[1]_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_clonedvd[1]_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_clonedvd[1]_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_freez-flv-to-mp3-converter[1]_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_freez-flv-to-mp3-converter[1]_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_mp3directcut[1]_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_mp3directcut[1]_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_mp3directcut[2]_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_mp3directcut[2]_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_paint-shop-photo-pro_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_paint-shop-photo-pro_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_tubebox[1]_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_tubebox[1]_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{1F02FB61-2BE5-4C16-8199-AEAA16EB0342}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{1FAEE6D5-34F4-42AA-8025-3FD8F3EC4634}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{50F7F0BE-31BA-4145-BD8B-6B0DECFED804}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{59279625-EFF0-4F55-98F0-51EDDD800DD9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5D64294B-1341-4FE7-B6D8-7C36828D4DD5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{64182481-4F71-486B-A045-B233BD0DA8FC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{69A72A8A-84ED-4A75-8CE7-263DBEF3E5D3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AF175732-0D59-716D-F757-9F1492D808D9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B3EAD50C-ECB0-459A-9EDA-F505AB99675B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DB616CFF-D989-48A8-9C85-E2A8D56AB2CA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DDE2C74F-58CC-4D71-8CE1-09DEBB8CFB78}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E57091A7-B5F0-4C42-9329-72ED3E59ED31}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EA582743-9076-4178-9AA6-7393FDF4D5CE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F42E9111-A9A5-4482-AD2E-1EF9DA85B0BF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F443A627-5009-4323-9C1D-7FD598D0D712}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{2EE84AC6-8DD6-4A14-BD37-B79C8F9ECF4D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CA9CDB0D-CB6C-42C0-97AB-9D0207F1635F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110311341134}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220322342234}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0923E315-2D8B-48CE-A37C-AE9A42F9711C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1A1BBE49-C6F1-40EA-9D2F-262F0AF6DDE3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2022154E-7E3E-4809-871E-1B45A6FC7058}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{292ECB89-350E-45D2-816F-52C15305B144}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{36CC2180-B6BF-4951-9578-6B0C40044AAA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{44A36944-22C6-4A08-BC7C-161F3E540DBF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{51F04BD6-3888-4849-864C-617FAE709CE0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6247DD2C-8CF9-4041-A235-93691D71B8B4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{835BED79-DF7E-4096-B355-ED43FA2EA87B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8C953EC4-8CFA-44FB-B32E-1249E5505091}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8E863BD6-50DE-47D0-A6F1-3C1F6DB72451}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9DD36F1E-5111-41C5-ADED-A2A11A2FF3E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A2FB8217-E320-434E-BA79-513E357AD54F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A9379648-F6EB-4F65-A624-1C10411A15D0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A9CEBBF4-9129-479A-9231-E833ED3D3A8F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AFD4D1F9-167C-4884-95AE-B5A9797B0D16}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B3EAD50C-ECB0-459A-9EDA-F505AB99675B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C47788B1-9604-4D7A-A684-F4D450F2D7D2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{CA3B41D0-D4C1-4808-B248-75DA27238828}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D4A2FF6C-087F-4D40-8DFE-92AAD484BFB8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D88B9D5C-A9CF-4C69-906D-1CCA5D85A2EF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E4E394E0-D331-431F-B76D-E3A19193D5F6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F16AB1DB-15C0-4456-A29E-4DF24FB9E3D2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F83AF01C-AA2F-469F-8BE7-D178FB15FD07}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550355345534}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660366346634}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{33D0AD98-3347-4A54-8929-5163EBEB9F72}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DA9FC525-41ED-4C00-B046-946DA7CDD305}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{E69D4A59-73DE-4E38-9FB3-740EC4D9060D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{F905535E-9C87-4A3F-8A3E-4E3B54C461C5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440344344434}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DB616CFF-D989-48A8-9C85-E2A8D56AB2CA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F42E9111-A9A5-4482-AD2E-1EF9DA85B0BF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F443A627-5009-4323-9C1D-7FD598D0D712}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EE84AC6-8DD6-4A14-BD37-B79C8F9ECF4D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110311341134}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DB616CFF-D989-48A8-9C85-E2A8D56AB2CA}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EA582743-9076-4178-9AA6-7393FDF4D5CE}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35D-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F42E9111-A9A5-4482-AD2E-1EF9DA85B0BF}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F443A627-5009-4323-9C1D-7FD598D0D712}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EE84AC6-8DD6-4A14-BD37-B79C8F9ECF4D}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CA9CDB0D-CB6C-42C0-97AB-9D0207F1635F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{11111111-1111-1111-1111-110311341134}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{DB616CFF-D989-48A8-9C85-E2A8D56AB2CA}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EA582743-9076-4178-9AA6-7393FDF4D5CE}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F42E9111-A9A5-4482-AD2E-1EF9DA85B0BF}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F443A627-5009-4323-9C1D-7FD598D0D712}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EE84AC6-8DD6-4A14-BD37-B79C8F9ECF4D}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{11111111-1111-1111-1111-110311341134}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{CA9CDB0D-CB6C-42C0-97AB-9D0207F1635F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110311341134}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CFD485F0-96BD-47CD-BB6D-CD7DDA95F102}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E57091A7-B5F0-4C42-9329-72ED3E59ED31}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{05b1cf28-354a-42fa-a8d1-6f49c44d56ff}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5a58493e-dd49-4832-9ec5-397da24274ed}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8c3ba160-7813-4db2-b8aa-1ac68a8615d1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a0eb16dd-4eca-4c00-998d-5a4895037d4c}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d0f0c769-6a01-44ac-9cbf-e7c0827ec0ce}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{79281BE8-5DBA-42F6-80CD-3AAA861162E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D4F6176C-ACF2-48E0-A8CD-6CEBCD407B82}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0D7562AE-8EF6-416D-A838-AB665251703A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EA582743-9076-4178-9AA6-7393FDF4D5CE}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{2EE84AC6-8DD6-4A14-BD37-B79C8F9ECF4D}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{30F9B915-B755-4826-820B-08FBA6BD249D}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EEE6C35B-6118-11DC-9C72-001320C79847}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{2EE84AC6-8DD6-4A14-BD37-B79C8F9ECF4D}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{2EE84AC6-8DD6-4A14-BD37-B79C8F9ECF4D}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{2EE84AC6-8DD6-4A14-BD37-B79C8F9ECF4D}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0923E315-2D8B-48CE-A37C-AE9A42F9711C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1A1BBE49-C6F1-40EA-9D2F-262F0AF6DDE3}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2022154E-7E3E-4809-871E-1B45A6FC7058}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{292ECB89-350E-45D2-816F-52C15305B144}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{36CC2180-B6BF-4951-9578-6B0C40044AAA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{44A36944-22C6-4A08-BC7C-161F3E540DBF}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{6247DD2C-8CF9-4041-A235-93691D71B8B4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{835BED79-DF7E-4096-B355-ED43FA2EA87B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8E863BD6-50DE-47D0-A6F1-3C1F6DB72451}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9DD36F1E-5111-41C5-ADED-A2A11A2FF3E4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A2FB8217-E320-434E-BA79-513E357AD54F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A9379648-F6EB-4F65-A624-1C10411A15D0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A9CEBBF4-9129-479A-9231-E833ED3D3A8F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{AFD4D1F9-167C-4884-95AE-B5A9797B0D16}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B3EAD50C-ECB0-459A-9EDA-F505AB99675B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C47788B1-9604-4D7A-A684-F4D450F2D7D2}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{CA3B41D0-D4C1-4808-B248-75DA27238828}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D4A2FF6C-087F-4D40-8DFE-92AAD484BFB8}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D88B9D5C-A9CF-4C69-906D-1CCA5D85A2EF}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F16AB1DB-15C0-4456-A29E-4DF24FB9E3D2}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F83AF01C-AA2F-469F-8BE7-D178FB15FD07}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550355345534}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660366346634}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Schlüssel Gelöscht : HKCU\Software\1ClickDownload
Schlüssel Gelöscht : HKCU\Software\Alexa Internet
Schlüssel Gelöscht : HKCU\Software\BabSolution
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\DataMngr
[#] Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar
Schlüssel Gelöscht : HKCU\Software\distromatic
Schlüssel Gelöscht : HKCU\Software\dsiteproducts
Schlüssel Gelöscht : HKCU\Software\filescout
Schlüssel Gelöscht : HKCU\Software\FreeCompressor
Schlüssel Gelöscht : HKCU\Software\IM
Schlüssel Gelöscht : HKCU\Software\Iminent
Schlüssel Gelöscht : HKCU\Software\ImInstaller
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\installedbrowserextensions
Schlüssel Gelöscht : HKCU\Software\NCH Software
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\simplytech
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\StumbleUpon
Schlüssel Gelöscht : HKCU\Software\torch
Schlüssel Gelöscht : HKCU\Software\Wajam
Schlüssel Gelöscht : HKCU\Software\wnlt
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\BackgroundContainer
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Crossrider
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Plus-HD-2.4
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\simplytech
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\StumbleUpon
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\RadioTotal
Schlüssel Gelöscht : HKLM\Software\AedgePerformanceBCN
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\Software\IB Updater
Schlüssel Gelöscht : HKLM\Software\Iminent
Schlüssel Gelöscht : HKLM\Software\NCH Software
Schlüssel Gelöscht : HKLM\Software\Plus-HD-2.4
Schlüssel Gelöscht : HKLM\Software\systweak
Schlüssel Gelöscht : HKLM\Software\torch
Schlüssel Gelöscht : HKLM\Software\Uniblue
Schlüssel Gelöscht : HKLM\Software\Vittalia
Schlüssel Gelöscht : HKLM\Software\Wajam
Schlüssel Gelöscht : HKLM\Software\RadioTotal
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Plus-HD-2.4
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Wajam
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinSecurity
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\wnlt
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RadioTotal Toolbar
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Amazon Browser Bar
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\IB Updater
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Tarma Installer
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\wnlt
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Amazon Browser Bar
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DesktopIconAmazon

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16736

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Default_Page_URL]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Search Bar]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Default_Page_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Bar]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [Start Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [Start Default_Page_URL]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [Search Bar]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [Search Page]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls [Tabs]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Search [SearchAssistant]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Search [Start Page]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Search [Start Default_Page_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Search [Default_Search_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Search [Search Bar]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Search [Search Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [(Default)]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [(Default)]

-\\ Mozilla Firefox v

[ Datei : C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\prefs.js ]

Zeile gelöscht : user_pref("browser.search.defaultenginename", "Web Search");
Zeile gelöscht : user_pref("browser.search.defaultengine", "Web Search");
Zeile gelöscht : user_pref("browser.search.selectedEngine", "Web Search");
Zeile gelöscht : user_pref("browser.search.order.1", "Web Search");
Zeile gelöscht : user_pref("keyword.URL", "hxxp://search.certified-toolbar.com?si=46364&tid=3869&ver=3.7&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7&st=chrome&q=");

[ Datei : C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\xmodr5w8.default\prefs.js ]

Zeile gelöscht : user_pref("CT3317483.FF19Solved", "true");
Zeile gelöscht : user_pref("CT3317483.UserID", "UN17336173016023235");
Zeile gelöscht : user_pref("CT3317483.fullUserID", "UN17336173016023235.IN.20131112224053");
Zeile gelöscht : user_pref("CT3317483.installDate", "12/11/2013 22:40:58");
Zeile gelöscht : user_pref("CT3317483.installSessionId", "{E9E65E1D-60C5-4B42-808B-4C120B0D1E23}");
Zeile gelöscht : user_pref("CT3317483.installSp", "false");
Zeile gelöscht : user_pref("CT3317483.installUsage", "12/11/2013 22:42:43");
Zeile gelöscht : user_pref("CT3317483.installUsageEarly", "12/11/2013 22:42:43");
Zeile gelöscht : user_pref("CT3317483.installerVersion", "1.8.0.14");
Zeile gelöscht : user_pref("CT3317483.keyword", "true");
Zeile gelöscht : user_pref("CT3317483.originalSearchAddressUrl", "");
Zeile gelöscht : user_pref("CT3317483.searchRevert", "true");
Zeile gelöscht : user_pref("CT3317483.searchUserMode", "2");
Zeile gelöscht : user_pref("CT3317483.toolbarInstallDate", "12-11-2013 22:40:53");
Zeile gelöscht : user_pref("CT3317483.versionFromInstaller", "10.21.1.7");
Zeile gelöscht : user_pref("CT3317483.xpeMode", "0");
Zeile gelöscht : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "");
Zeile gelöscht : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3317483&SearchSource=2&CUI=UN17336173016023235&UM=2&q=");
Zeile gelöscht : user_pref("smartbar.addressBarOwnerCTID", "CT3317483");
Zeile gelöscht : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3317483&SearchSource=2&CUI=UN17336173016023235&UM=2&q=");
Zeile gelöscht : user_pref("smartbar.machineId", "/UWPEB9A/0YAEZPBYW8/9H9ALFOVFAZLLDK0UQEL9PV/KDF6ZIAFGZQFP6KKBN5DK0U/XMR5FCSNOCK/JDK7OW");

-\\ Google Chrome v30.0.1599.101

[ Datei : C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Gelöscht : icon_url

*************************

AdwCleaner[R0].txt - [52465 octets] - [26/11/2013 21:21:28]
AdwCleaner[S0].txt - [46251 octets] - [26/11/2013 21:22:46]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [46312 octets] ##########
--- --- ---JRT Logfile:
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.8 (11.05.2013:1)
OS: Windows 7 Home Premium x64
Ran by Manuela on 26.11.2013 at 21:32:56,23
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\\DisplayName
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\\URL



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\qtrax
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\lyricsdroid
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-6E41-4FD3-8538-502F5495E5FC}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-868785299-726797094-2297327714-1001\Software\ib updater
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-868785299-726797094-2297327714-1001\Software\sweetim
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\sweetim
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\addlyrics_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\addlyrics_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\plus-hd-2_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\plus-hd-2_rasmancs
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{13447CB8-C6D7-498A-B940-086E1598330B}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{CEEC11D0-41B5-4098-AF69-8CF1D2E8372A}



~~~ Files

Successfully deleted: [File] "C:\Users\Manuela\appdata\locallow\microsoft\silverlight\outofbrowser\index\portal.qtrax.com"
Successfully deleted: [File] C:\Windows\syswow64\shoFF4D.tmp



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\apn"
Successfully deleted: [Folder] "C:\Users\Manuela\appdata\local\cre"
Successfully deleted: [Folder] "C:\Users\Manuela\music\qtrax media library"



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 26.11.2013 at 21:40:34,38
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
--- --- ---

Malwarebytes Anti-Malware (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.11.26.09

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16736
Manuela :: MANUELA-PC [Administrator]

Schutz: Aktiviert

26.11.2013 21:46:49
mbam-log-2013-11-26 (21-46-49).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 209706
Laufzeit: 6 Minute(n), 19 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 2
HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CHROME.EXE (Security.Hijack) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\FIREFOX.EXE (Security.Hijack) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 2
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe|Debugger (Security.Hijack) -> Daten: "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe" -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe|Debugger (Security.Hijack) -> Daten: "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe" -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 3
C:\Users\Manuela\Documents\sysrc_trial_9407_german.exe (PUP.Optional.RegCleanerPro) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Manuela\Downloads\installer_dvd_decrypter_3_5_4_0_Deutsch.exe (PUP.Optional.VIT) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Manuela\Downloads\Setup.exe (Adware.DomaIQ) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Zoek.exe Version 4.0.0.5 Updated 24-November-2013
Tool run by Manuela on 26.11.2013 at 22:03:56,35.
Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Manuela\Desktop\zoek\zoek.pif [Script inserted]

==== System Restore Info ======================

26.11.2013 22:07:25 Zoek.exe System Restore Point Created Succesfully.

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7E111A5C-3D11-4F56-9463-5310C3C69025} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully
HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{7E111A5C-3D11-4F56-9463-5310C3C69025} deleted successfully
HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\Microsoft\Internet Explorer\URLSearchHooks\{7E111A5C-3D11-4F56-9463-5310C3C69025} deleted successfully
HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{41564952-412D-5637-00A7-7A786E7484D7} deleted successfully
HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\Mozilla\Firefox\Extensions\{d94342cc-b2eb-4bb9-8ef0-782a1bd67c83} deleted successfully
HKEY_LOCAL_MACHINE\software\Wow6432Node\mozilla\Firefox\extensions\{ee8cd9f6-dae3-4889-816b-99fe80dae284} deleted successfully

==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");
user_pref("browser.search.useDBForOrder", false);

Added to C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\prefs.js:
user_pref("browser.startup.homepage", "hxxp://www.google.com");
user_pref("browser.search.defaulturl", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "hxxp://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

Deleted from C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\xmodr5w8.default\prefs.js:
user_pref("browser.startup.homepage", "hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p23_serp_ff_de_display?ie=UTF8&tagbase=bds-p23&tbrId=v1_abb-channel-23_a76337893a2f4851814856562526a95a_39_1006_20131022_DE_ff_sp_");

Added to C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\xmodr5w8.default\prefs.js:
user_pref("browser.startup.homepage", "hxxp://www.google.com");
user_pref("browser.search.defaulturl", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "hxxp://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

ProfilePath: C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\extensions

user.js not found
---- Lines browser.startup.page removed from prefs.js ----
user_pref("browser.startup.page", 1);
---- FireFox user.js and prefs.js backups ----

prefs__2221_.backup

ProfilePath: C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\xmodr5w8.default

user.js not found
---- Lines Lyric modified from prefs.js ----

user_pref("extensions.installCache", "[{\"name\":\"app-global\",\"addons\":{\"{972ce4c6-7e08-4474-a285-3208198ce6fd}\":{\"descriptor\":\"C:\\\\Program
---- FireFox user.js and prefs.js backups ----

prefs__2221_.backup

==== Deleting Files \ Folders ======================

C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936} deleted
C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} deleted
C:\PROGRA~2\Amazon deleted
C:\ProgramData\AskPartnerNetwork deleted
C:\ProgramData\OberonGameConsole deleted
C:\ProgramData\Package Cache deleted
C:\Users\Manuela\AppData\Local\BargainWorkbench.crx deleted
C:\Users\Manuela\AppData\Local\FastDiscountz.crx deleted
C:\Users\Manuela\AppData\Local\NativeMessaging deleted
C:\Users\Public\AlexaNSISPlugin.4852.dll deleted
C:\Users\Manuela\AppData\LocalLow\Freeware.de deleted
C:\windows\SysNative\tasks\Go for FilesUpdate deleted
C:\user.js deleted
C:\Windows\Launcher.exe deleted
C:\Windows\SysWow64\searchplugins deleted
C:\Windows\SysWow64\Extensions deleted
C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\ftdownloader@ftdownloader.com.xpi deleted
C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\extensions\staged deleted
C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\xmodr5w8.default\foxydeal.sqlite deleted
C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\xmodr5w8.default\extensions\staged deleted
C:\Users\Manuela\Desktop\Amazon.url deleted

==== Firefox Extensions ======================

ProfilePath: C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\xmodr5w8.default
- Amazon Browser Bar - %ProfilePath%\extensions\abb@amazon.com
- ProxTube - Gesperrte YouTube Videos entsperren - %ProfilePath%\extensions\ich@maltegoetz.de

==== Firefox Plugins ======================

Profilepath: C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\xmodr5w8.default
0B31B0F8FA99CFD009C8FBEA9E20C9DE - C:\Users\Manuela\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll - Facebook Video Calling Plugin
87132527E2256CF6683A18C4EB34DD3B - C:\Windows\system32\Wat\npWatWeb.dll - Windows Activation Technologies


==== Deleted Firefox Extensions ======================

C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\xmodr5w8.default\extensions\abb@amazon.com deleted

==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
gebcpofjimbbchggpnfcaiieolloeodp - C:\Users\Manuela\AppData\Local\BargainWorkbench.crx[]
gkjoindjjcmbdpbfppabdgflnkgbbcli - C:\Program Files (x86)\FTDownloader.com\FTDownloader10.crx[]
ingolnlcamoheiiladeoecpgdbjjmlaf - C:\Program Files (x86)\WinSecurity\winsecurity.crx[]
ioighjflakajniehlakelhkdfljfemcd - C:\Users\Manuela\AppData\Local\CRE\ioighjflakajniehlakelhkdfljfemcd.crx[]
oldchfemoapgakfjnmbngnljnkoapbhd - C:\Users\Manuela\AppData\Local\FastDiscountz.crx[]
olmmlhjmcpkhnmfcbelohhaifhilieje - C:\Program Files (x86)\LyricsDroid\133.crx[]

HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions
gebcpofjimbbchggpnfcaiieolloeodp - C:\Users\Manuela\AppData\Local\BargainWorkbench.crx[]
ioighjflakajniehlakelhkdfljfemcd - C:\Users\Manuela\AppData\Local\CRE\ioighjflakajniehlakelhkdfljfemcd.crx[]
nikpibnbobmbdbheedjfogjlikpgpnhp - C:\Users\Manuela\AppData\Roaming\DVDVideoSoft\dvsYoutubeDownload.crx[15.09.2012 20:58]
oldchfemoapgakfjnmbngnljnkoapbhd - C:\Users\Manuela\AppData\Local\FastDiscountz.crx[]

VIS - Manuela - Default\Extensions\fmlgoencnlndpglbocajlimaikjohmab
Bargain Workbench - Manuela - Default\Extensions\gebcpofjimbbchggpnfcaiieolloeodp
Chrome In-App Payments service - Manuela - Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
Fast Discountz - Manuela - Default\Extensions\oldchfemoapgakfjnmbngnljnkoapbhd
LyricsDroid - Manuela - Default\Extensions\olmmlhjmcpkhnmfcbelohhaifhilieje

==== Chrome Fix ======================

C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\fmlgoencnlndpglbocajlimaikjohmab deleted successfully
C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\gebcpofjimbbchggpnfcaiieolloeodp deleted successfully
C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_gebcpofjimbbchggpnfcaiieolloeodp_0.localstorage deleted successfully
C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\ioighjflakajniehlakelhkdfljfemcd deleted successfully
C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\oldchfemoapgakfjnmbngnljnkoapbhd deleted successfully
C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_oldchfemoapgakfjnmbngnljnkoapbhd_0.localstorage deleted successfully
C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\olmmlhjmcpkhnmfcbelohhaifhilieje deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p23_serp_ie_de_display?ie=UTF8&tagbase=bds-p23&tbrId=v1_abb-channel-23_a76337893a2f4851814856562526a95a_39_1006_20131022_DE_ie_sp_"
"Search Page"="hxxp://www.google.com"
"Default_Page_URL"="hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn"
"Start Default_Page_URL"="hxxp://www.google.com"
"Default_Search_URL"="hxxp://www.google.com"
"Search Bar"="hxxp://www.google.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://search.certified-toolbar.com?si=46364&st=home&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7"
"Start Default_Page_URL"="hxxp://search.certified-toolbar.com?si=46364&st=home&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7"
"Default_Search_URL"="hxxp://search.certified-toolbar.com?si=46364&st=chrome&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7&q="
"Search Bar"="hxxp://search.certified-toolbar.com?si=46364&st=chrome&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7&q="
"Search Page"="hxxp://search.certified-toolbar.com?si=46364&st=chrome&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7&q="
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://search.certified-toolbar.com?si=46364&st=home&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7"
"Start Default_Page_URL"="hxxp://search.certified-toolbar.com?si=46364&st=home&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7"
"Default_Search_URL"="hxxp://search.certified-toolbar.com?si=46364&st=chrome&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7&q="
"Search Bar"="hxxp://search.certified-toolbar.com?si=46364&st=chrome&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7&q="
"Search Page"="hxxp://search.certified-toolbar.com?si=46364&st=chrome&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7&q="
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://www.google.com"
"Start Page"="hxxp://www.google.com"
"Search Page"="hxxp://www.google.com"
"Start Default_Page_URL"="hxxp://www.google.com"
"Search Bar"="hxxp://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://www.google.com"
"Start Page"="hxxp://www.google.com"
"Search Page"="hxxp://www.google.com"
"Start Default_Page_URL"="hxxp://www.google.com"
"Search Bar"="hxxp://www.google.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchURI]
"(Default)"="hxxp://search.certified-toolbar.com?si=46364&st=bs&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7&q=%s"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchURI]
"(Default)"="hxxp://search.certified-toolbar.com?si=46364&st=bs&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7&q=%s"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="hxxp://search.certified-toolbar.com?si=46364&st=bs&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7&q=%s"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\SearchURI]
"(Default)"="hxxp://search.certified-toolbar.com?si=46364&st=bs&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7&q=%s"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Software\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="hxxp://search.certified-toolbar.com?si=46364&st=bs&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7&q=%s"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Software\Microsoft\Internet Explorer\SearchURI]
"(Default)"="hxxp://search.certified-toolbar.com?si=46364&st=bs&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7&q=%s"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="hxxp://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="hxxp://www.google.com"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchURI]
"(Default)"="hxxp://search.certified-toolbar.com?si=46364&st=bs&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7&q=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="hxxp://www.google.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="hxxp://www.google.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="hxxp://www.google.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\Search]
"Start Page"="hxxp://search.certified-toolbar.com?si=46364&st=home&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7"
"Start Default_Page_URL"="hxxp://search.certified-toolbar.com?si=46364&st=home&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7"
"Default_Search_URL"="hxxp://search.certified-toolbar.com?si=46364&st=chrome&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7&q="
"Search Bar"="hxxp://search.certified-toolbar.com?si=46364&st=chrome&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7&q="
"Search Page"="hxxp://search.certified-toolbar.com?si=46364&st=chrome&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7&q="
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Software\Microsoft\Internet Explorer\Search]
"Start Page"="hxxp://search.certified-toolbar.com?si=46364&st=home&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7"
"Start Default_Page_URL"="hxxp://search.certified-toolbar.com?si=46364&st=home&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7"
"Default_Search_URL"="hxxp://search.certified-toolbar.com?si=46364&st=chrome&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7&q="
"Search Bar"="hxxp://search.certified-toolbar.com?si=46364&st=chrome&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7&q="
"Search Page"="hxxp://search.certified-toolbar.com?si=46364&st=chrome&tid=3869&ver=4.3&ts=1375381764796&tguid=46364-3869-1375381764796-80D724F669970CF6F0AE2790535595D7&q="
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"="hxxp://www.google.com"
"Start Page"="hxxp://www.google.com"
"Start Default_Page_URL"="hxxp://www.google.com"
"Default_Search_URL"="hxxp://www.google.com"
"Search Bar"="hxxp://www.google.com"
"Search Page"="hxxp://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Search]
"SearchAssistant"="hxxp://www.google.com"
"Start Page"="hxxp://www.google.com"
"Start Default_Page_URL"="hxxp://www.google.com"
"Default_Search_URL"="hxxp://www.google.com"
"Search Bar"="hxxp://www.google.com"
"Search Page"="hxxp://www.google.com"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]
"Start Page"="hxxp://www.google.com"
"Start Default_Page_URL"="hxxp://www.google.com"
"Default_Search_URL"="hxxp://www.google.com"
"Search Bar"="hxxp://www.google.com"
"Search Page"="hxxp://www.google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Bar"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Page_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
"Start Default_Page_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p23_serp_ie_de_display?ie=UTF8&tagbase=bds-p23&tbrId=v1_abb-channel-23_a76337893a2f4851814856562526a95a_39_1006_20131022_DE_ie_sp_"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Bar"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
"Start Default_Page_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Bar"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
"Start Default_Page_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Bar"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
"Start Default_Page_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Bar"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
"Start Default_Page_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchURI]
"(Default)"="hxxp://search.msn.com/results.asp?q=%s"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchURI]
"(Default)"="hxxp://search.msn.com/results.asp?q=%s"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="hxxp://search.msn.com/results.asp?q=%s"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\SearchURI]
"(Default)"="hxxp://search.msn.com/results.asp?q=%s"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Software\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="hxxp://search.msn.com/results.asp?q=%s"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Software\Microsoft\Internet Explorer\SearchURI]
"(Default)"="hxxp://search.msn.com/results.asp?q=%s"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="hxxp://search.msn.com/results.asp?q=%s"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="hxxp://search.msn.com/results.asp?q=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchURI]
"(Default)"="hxxp://search.msn.com/results.asp?q=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="hxxp://search.msn.com/results.asp?q=%s"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="res://ieframe.dll/tabswelcome.htm"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="res://ieframe.dll/tabswelcome.htm"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Bar"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
"Start Default_Page_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Software\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Bar"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
"Start Default_Page_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Bar"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"SearchAssistant"="hxxp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"
"Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
"Start Default_Page_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Bar"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"SearchAssistant"="hxxp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"
"Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
"Start Default_Page_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Bar"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
"Start Default_Page_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"

==== Reset Google Chrome ======================

C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\preferences was reset successfully
C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\gebcpofjimbbchggpnfcaiieolloeodp deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\gebcpofjimbbchggpnfcaiieolloeodp deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\gkjoindjjcmbdpbfppabdgflnkgbbcli deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\ingolnlcamoheiiladeoecpgdbjjmlaf deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\ioighjflakajniehlakelhkdfljfemcd deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\oldchfemoapgakfjnmbngnljnkoapbhd deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\oldchfemoapgakfjnmbngnljnkoapbhd deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\olmmlhjmcpkhnmfcbelohhaifhilieje deleted successfully
HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions\gebcpofjimbbchggpnfcaiieolloeodp deleted successfully
HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions\ioighjflakajniehlakelhkdfljfemcd deleted successfully
HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions\oldchfemoapgakfjnmbngnljnkoapbhd deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\VIS deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ApnTBMon deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mcagent_exe deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Manuela\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

No FireFox Cache found

==== Empty Chrome Cache ======================

C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

No Java Cache Found

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\Manuela\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on 26.11.2013 at 22:32:13,25 ======================

M-K-D-B 27.11.2013 17:52
Servus,



Wir spüren die letzten Reste auf, damit wir sie später entfernen können:





Schritt 1
Kontrollscan mit FRST
Führe wie zuvor beschrieben einen Scan mit FRST aus.
Setze dazu eine Haken bei Addition.txt rechts unten und klicke auf Scan.
Es werden wieder zwei Logdateien erzeugt. Poste mir diese.





Schritt 2
Lade dir die passende Version von SystemLook vom folgenden Spiegel herunter und speichere das Tool auf dem Desktop:
SystemLook (32 bit) | SystemLook (64 bit)
  • Doppelklicke auf die SystemLook.exe, um das Tool zu starten.
  • Kopiere den Inhalt der folgenden Codebox in das Textfeld des Tools:

    Code:
    :filefind
    *IBUpdater*
    *Wajam*
    *Babylon*
    *Conduit*
    *NCH Software*
    *Tarma Installer*
    *DriverScanner*
    *AddLyrics*
    *Amazon Browser Bar*
    *file scout*
    *FreeCompressor*
    *goforfiles*
    *LyricsDroid*
    *SoftwareUpdater*
    *WinSecurity*
    *Plus-HD*
    *RadioTotal*
    *Crossrider*
    *QuickStores*
    *DownloadGuide*
    *PutLocker*
    *facemoods*
    *SimplyTech*
    *DSite*
    *PerformerSoft*
    *Systweak*
    *Qtrax*
    *GutscheinCodes*
    *ftdownloader*
    *abb@amazon.com*
    *FastDiscountz*
    *BargainWorkbench*
    *fmlgoencnlndpglbocajlimaikjohmab*

    :folderfind
    *IBUpdater*
    *Wajam*
    *Babylon*
    *Conduit*
    *NCH Software*
    *Tarma Installer*
    *DriverScanner*
    *AddLyrics*
    *Amazon Browser Bar*
    *file scout*
    *FreeCompressor*
    *goforfiles*
    *LyricsDroid*
    *SoftwareUpdater*
    *WinSecurity*
    *Plus-HD*
    *RadioTotal*
    *Crossrider*
    *QuickStores*
    *DownloadGuide*
    *PutLocker*
    *facemoods*
    *SimplyTech*
    *DSite*
    *PerformerSoft*
    *Systweak*
    *Qtrax*
    *GutscheinCodes*
    *ftdownloader*
    *abb@amazon.com*
    *FastDiscountz*
    *BargainWorkbench*
    *fmlgoencnlndpglbocajlimaikjohmab*

    :regfind
    IBUpdater
    Wajam
    Babylon
    Conduit
    NCH Software
    Tarma Installer
    DriverScanner
    AddLyrics
    Amazon Browser Bar
    file scout
    FreeCompressor
    goforfiles
    LyricsDroid
    SoftwareUpdater
    WinSecurity
    Plus-HD
    RadioTotal
    Crossrider
    QuickStores
    DownloadGuide
    PutLocker
    facemoods
    SimplyTech
    DSite
    PerformerSoft
    Systweak
    Qtrax
    GutscheinCodes
    ftdownloader
    abb@amazon.com
    FastDiscountz
    BargainWorkbench
    fmlgoencnlndpglbocajlimaikjohmab
  • Klicke nun auf den Button Look, um den Scan zu starten.
  • Der Suchlauf kann einige Zeit dauern.
  • Wenn der Suchlauf beendet ist, wird sich dein Editor mit den Ergebnissen öffnen, poste diese in deinen Thread.
  • Die Ergebnisse werden auch auf dem Desktop als SystemLook.txt gespeichert.








Gibt es noch Probleme mit Malware? Wenn ja, welche?
Wie läuft der Rechner derzeit?





Bitte poste mit deiner nächsten Antwort
  • die beiden Logdateien von FRST,
  • die Logdatei von SystemLook,
  • die Beantwortung der gestellten Fragen.

speedydino 27.11.2013 19:58
Hallo Matthias,

erstmal vielen Dank für deine Hilfe.
Bisher ist mir nichts weiter aufgefallen, aber der Rechner startet seeeehr langsam.






FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-11-2013 01
Ran by Manuela (administrator) on MANUELA-PC on 27-11-2013 19:47:54
Running from C:\Users\Manuela\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(SEC) C:\Program Files (x86)\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe
(SAMSUNG Electronics) C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Opera Software) C:\Program Files (x86)\Opera\opera.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9644576 2009-12-15] (Realtek Semiconductor)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1266912 2013-10-23] (Microsoft Corporation)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2074408 2013-11-14] (Synaptics Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [Facebook Update] - C:\Users\Manuela\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-12] (Facebook Inc.)
MountPoints2: E - E:\setup.EXE /AUTORUN
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [683576 2013-11-25] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
AppInit_DLLs-x32: C:\PROGRA~2\CLONED~1\DVDGHO~1\DVDGHO~1.DLL [ ] ()
IFEO\broadcam.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IFEO\ccleaner64.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IFEO\uninst.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p23_serp_ie_de_display?ie=UTF8&tagbase=bds-p23&tbrId=v1_abb-channel-23_a76337893a2f4851814856562526a95a_39_1006_20131022_DE_ie_sp_
SearchScopes: HKLM-x32 - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search
BHO: Windows Live Family Safety Browser Helper Class - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} -  No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\xmodr5w8.default
FF NewTab: hxxp://www.google.com/
FF DefaultSearchEngine: Google
FF SearchEngineOrder.1: Google
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.com
FF Keyword.URL: hxxp://www.google.com/search?btnG=Google+Search&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Manuela\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Extension: ProxTube - Gesperrte YouTube Videos entsperren - C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\xmodr5w8.default\Extensions\ich@maltegoetz.de
FF Extension: No Name - C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\profiles\extensions\extensions
FF Extension: No Name - C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\profiles\extensions\searchplugins
FF Extension: No Name - C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\profiles\extensions\prefs.js
FF Extension: No Name - C:\Users\Manuela\AppData\Roaming\Mozilla\Firefox\profiles\extensions\user.js.orig

Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (DvdVideoSoft Free Youtube Download) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.0.0_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
S2 ICM_UpdaterService; C:\Program Files (x86)\SAMSUNG\Samsung Networking Wizard\ICM_Service.exe [204883 2011-03-18] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-10-23] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [348376 2013-10-23] (Microsoft Corporation)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-07-07] ()
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2099512 2013-10-30] (TuneUp Software)
S4 BroadCamService; "C:\Program Files (x86)\NCH Software\BroadCam\broadcam.exe" -service [x]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [106904 2013-11-25] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132600 2013-11-25] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-10] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [248240 2013-09-27] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [134944 2013-09-27] (Microsoft Corporation)
S3 rtport; C:\Windows\SysWOW64\drivers\rtport.sys [15144 2010-12-20] (Windows (R) 2003 DDK 3790 provider)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2012-07-07] (Duplex Secure Ltd.)
S3 TridVid; C:\Windows\System32\DRIVERS\tridvid6010.sys [411648 2011-01-21] (10Moons Technologies Co.,Ltd)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2013-09-18] (TuneUp Software)
R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-27 19:48 - 2013-11-27 19:48 - 00165376 _____ C:\Users\Manuela\Desktop\SystemLook_x64.exe
2013-11-26 22:29 - 2013-10-18 01:11 - 00024064 _____ C:\Windows\zoek-delete.exe
2013-11-26 22:06 - 2013-11-26 22:32 - 00028010 _____ C:\zoek-results.log
2013-11-26 22:04 - 2013-11-26 22:04 - 00003144 _____ C:\Windows\System32\Tasks\{A4B3092C-E833-48A7-8189-38A3AC3952BA}
2013-11-26 22:03 - 2013-11-26 22:26 - 00000000 ____D C:\zoek_backup
2013-11-26 22:00 - 2013-11-26 22:00 - 00000000 ____D C:\Users\Manuela\Desktop\zoek
2013-11-26 21:45 - 2013-11-26 21:45 - 00001069 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-11-26 21:45 - 2013-11-26 21:45 - 00000000 ____D C:\Users\Manuela\AppData\Roaming\Malwarebytes
2013-11-26 21:45 - 2013-11-26 21:45 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-26 21:45 - 2013-11-26 21:45 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-26 21:45 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-11-26 21:42 - 2013-11-26 21:42 - 04186953 _____ C:\Users\Manuela\Desktop\zoek.rar
2013-11-26 21:41 - 2013-11-26 21:42 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Manuela\Desktop\mbam-setup-1.75.0.1300.exe
2013-11-26 21:40 - 2013-11-26 21:40 - 00002802 _____ C:\Users\Manuela\Desktop\JRT.txt
2013-11-26 21:32 - 2013-11-26 21:32 - 01034531 _____ (Thisisu) C:\Users\Manuela\Desktop\JRT.exe
2013-11-26 21:32 - 2013-11-26 21:32 - 00000000 ____D C:\Windows\ERUNT
2013-11-26 21:21 - 2013-11-26 21:23 - 00000000 ____D C:\AdwCleaner
2013-11-26 21:20 - 2013-11-26 21:20 - 01091882 _____ C:\Users\Manuela\Desktop\adwcleaner.exe
2013-11-26 20:59 - 2013-11-26 20:59 - 00277384 _____ C:\Windows\Minidump\112613-23680-01.dmp
2013-11-26 20:59 - 2013-11-26 20:59 - 00000000 ____D C:\Windows\Minidump
2013-11-26 10:12 - 2013-11-26 10:12 - 00377856 _____ C:\Users\Manuela\Desktop\gmer_2.1.19163.exe
2013-11-26 10:05 - 2013-11-26 10:06 - 00032119 _____ C:\Users\Manuela\Desktop\Addition.txt
2013-11-26 10:04 - 2013-11-27 19:48 - 00011963 _____ C:\Users\Manuela\Desktop\FRST.txt
2013-11-26 10:04 - 2013-11-26 10:04 - 00000000 ____D C:\FRST
2013-11-26 10:03 - 2013-11-26 10:03 - 01958474 _____ (Farbar) C:\Users\Manuela\Desktop\FRST64.exe
2013-11-26 09:55 - 2013-11-26 09:55 - 00000586 _____ C:\Windows\SysWOW64\defogger_disable.log
2013-11-26 09:55 - 2013-11-26 09:55 - 00000020 _____ C:\Users\Manuela\defogger_reenable
2013-11-24 20:10 - 2013-11-24 20:10 - 00001979 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-11-17 13:23 - 2013-11-17 13:23 - 00002770 _____ C:\Windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013
2013-11-17 13:20 - 2013-11-17 13:20 - 00000000 ____D C:\Users\Manuela\AppData\Local\Avg2014
2013-11-15 18:08 - 2013-10-30 10:45 - 00043320 _____ (TuneUp Software) C:\Windows\system32\uxtuneup.dll
2013-11-15 18:08 - 2013-10-30 10:45 - 00036152 _____ (TuneUp Software) C:\Windows\SysWOW64\uxtuneup.dll
2013-11-15 18:08 - 2013-10-30 10:45 - 00029496 _____ (TuneUp Software) C:\Windows\system32\authuitu.dll
2013-11-15 18:08 - 2013-10-30 10:45 - 00025400 _____ (TuneUp Software) C:\Windows\SysWOW64\authuitu.dll
2013-11-15 18:05 - 2013-11-15 18:05 - 00002169 _____ C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
2013-11-15 18:05 - 2013-11-15 18:05 - 00002149 _____ C:\Users\Public\Desktop\TuneUp Utilities 2014.lnk
2013-11-15 18:05 - 2013-10-30 10:45 - 00040760 _____ (TuneUp Software) C:\Windows\system32\TURegOpt.exe
2013-11-15 18:04 - 2013-11-15 20:03 - 00000000 ____D C:\Program Files (x86)\TuneUp Utilities 2014
2013-11-14 21:50 - 2013-11-14 21:50 - 00000082 _____ C:\Windows\SETUP.LOG
2013-11-14 21:50 - 2013-11-14 21:50 - 00000000 ____D C:\Program Files\Synaptics
2013-11-14 21:49 - 2013-11-14 21:50 - 00005486 _____ C:\Windows\DPINST.LOG
2013-11-14 21:49 - 2013-11-14 21:49 - 00000000 ____D C:\Program Files (x86)\Atheros Client Installation Program
2013-11-14 21:48 - 2013-11-14 21:49 - 00000191 _____ C:\Windows\SamsungInstaller.log
2013-11-14 21:48 - 2013-11-14 21:48 - 01721576 _____ (Microsoft Corporation) C:\Windows\system32\WdfCoInstaller01009.dll
2013-11-14 21:48 - 2013-11-14 21:47 - 03669504 _____ (Askey Computer Corporation.) C:\Windows\SysWOW64\AInst3141x.exe
2013-11-14 21:48 - 2013-11-14 21:47 - 00001202 _____ C:\Windows\SysWOW64\WLL3141.cfgx
2013-11-14 21:47 - 2013-11-14 21:47 - 01573888 _____ (Atheros Communications, Inc.) C:\Windows\system32\Drivers\athrx.sys
2013-11-14 21:47 - 2013-11-14 21:47 - 00396584 _____ (Synaptics Incorporated) C:\Windows\system32\SynCOM.dll
2013-11-14 21:47 - 2013-11-14 21:47 - 00316464 _____ (Synaptics Incorporated) C:\Windows\system32\Drivers\SynTP.sys
2013-11-14 21:47 - 2013-11-14 21:47 - 00264488 _____ (Synaptics Incorporated) C:\Windows\system32\SynCtrl.dll
2013-11-14 21:47 - 2013-11-14 21:47 - 00214312 _____ (Synaptics Incorporated) C:\Windows\system32\SynTPAPI.dll
2013-11-14 21:47 - 2013-11-14 21:47 - 00210216 _____ (Synaptics Incorporated) C:\Windows\SysWOW64\SynCtrl.dll
2013-11-14 21:47 - 2013-11-14 21:47 - 00173352 _____ (Synaptics Incorporated) C:\Windows\SysWOW64\SynCOM.dll
2013-11-14 21:47 - 2013-11-14 21:47 - 00147752 _____ (Synaptics Incorporated) C:\Windows\system32\SynTPCo4.dll
2013-11-14 21:47 - 2013-11-14 21:47 - 00107816 _____ (Synaptics Incorporated) C:\Windows\SysWOW64\SynTPCOM.dll
2013-11-14 20:35 - 2013-11-15 17:33 - 00000000 ____D C:\Windows\pss
2013-11-13 23:12 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-13 23:12 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-13 23:12 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-13 23:12 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-13 23:12 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-13 23:12 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-13 23:12 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-13 23:12 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-13 23:12 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-13 23:11 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-13 23:11 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-13 23:11 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-13 23:11 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-13 23:11 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-13 23:11 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-13 23:11 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-13 23:11 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-13 23:11 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-13 23:11 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-13 23:11 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-13 23:11 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-13 23:11 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-13 23:11 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-13 23:11 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-13 23:11 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-13 23:11 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-13 23:11 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-13 23:11 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-13 23:11 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-13 23:11 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-13 23:11 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-13 19:39 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-13 19:39 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-13 19:39 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-13 19:39 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-13 19:39 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-13 19:39 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-13 19:39 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-11-13 19:39 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2013-11-13 19:39 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-13 19:39 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-13 19:39 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-13 19:39 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-13 19:39 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-13 19:39 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-13 19:38 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-13 19:38 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-13 19:38 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-13 19:38 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-13 19:38 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-13 19:38 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-13 19:38 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-13 19:38 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-13 19:38 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-13 19:38 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-13 19:38 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-13 19:38 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-13 19:38 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-13 19:38 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-13 19:38 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-13 19:38 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-07 19:26 - 2013-11-07 19:26 - 00124416 ___SH C:\Users\Manuela\Downloads\Thumbs.db
2013-11-07 17:57 - 2013-11-07 17:57 - 00000000 ____D C:\Users\Manuela\AppData\Local\Software_Updater
2013-11-06 20:31 - 2013-11-06 20:31 - 00001932 _____ C:\Users\Manuela\Desktop\DVD Decrypter.lnk
2013-11-06 20:31 - 2013-11-06 20:31 - 00000000 ____D C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DVD Decrypter
2013-11-06 20:31 - 2013-11-06 20:31 - 00000000 ____D C:\Program Files (x86)\DVD Decrypter
2013-11-06 20:22 - 2013-11-06 20:22 - 00000000 ____D C:\Users\Manuela\Documents\Any Video Converter
2013-10-31 23:04 - 2013-11-27 17:43 - 00003070 _____ C:\Windows\setupact.log
2013-10-31 23:04 - 2013-11-26 22:31 - 00533456 _____ C:\Windows\PFRO.log
2013-10-31 23:04 - 2013-10-31 23:04 - 00000000 _____ C:\Windows\setuperr.log

==================== One Month Modified Files and Folders =======

2013-11-27 19:48 - 2013-11-27 19:48 - 00165376 _____ C:\Users\Manuela\Desktop\SystemLook_x64.exe
2013-11-27 19:48 - 2013-11-26 10:04 - 00011963 _____ C:\Users\Manuela\Desktop\FRST.txt
2013-11-27 19:48 - 2010-06-14 11:51 - 01317524 _____ C:\Windows\WindowsUpdate.log
2013-11-27 19:02 - 2012-06-13 18:26 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-27 19:01 - 2012-02-05 09:51 - 00001146 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-868785299-726797094-2297327714-1001UA.job
2013-11-27 17:52 - 2009-07-14 05:45 - 00014144 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-27 17:52 - 2009-07-14 05:45 - 00014144 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-27 17:44 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-27 17:43 - 2013-10-31 23:04 - 00003070 _____ C:\Windows\setupact.log
2013-11-26 22:32 - 2013-11-26 22:06 - 00028010 _____ C:\zoek-results.log
2013-11-26 22:31 - 2013-10-31 23:04 - 00533456 _____ C:\Windows\PFRO.log
2013-11-26 22:26 - 2013-11-26 22:03 - 00000000 ____D C:\zoek_backup
2013-11-26 22:04 - 2013-11-26 22:04 - 00003144 _____ C:\Windows\System32\Tasks\{A4B3092C-E833-48A7-8189-38A3AC3952BA}
2013-11-26 22:01 - 2012-02-05 09:51 - 00001124 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-868785299-726797094-2297327714-1001Core.job
2013-11-26 22:00 - 2013-11-26 22:00 - 00000000 ____D C:\Users\Manuela\Desktop\zoek
2013-11-26 21:45 - 2013-11-26 21:45 - 00001069 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-11-26 21:45 - 2013-11-26 21:45 - 00000000 ____D C:\Users\Manuela\AppData\Roaming\Malwarebytes
2013-11-26 21:45 - 2013-11-26 21:45 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-26 21:45 - 2013-11-26 21:45 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-26 21:42 - 2013-11-26 21:42 - 04186953 _____ C:\Users\Manuela\Desktop\zoek.rar
2013-11-26 21:42 - 2013-11-26 21:41 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Manuela\Desktop\mbam-setup-1.75.0.1300.exe
2013-11-26 21:40 - 2013-11-26 21:40 - 00002802 _____ C:\Users\Manuela\Desktop\JRT.txt
2013-11-26 21:32 - 2013-11-26 21:32 - 01034531 _____ (Thisisu) C:\Users\Manuela\Desktop\JRT.exe
2013-11-26 21:32 - 2013-11-26 21:32 - 00000000 ____D C:\Windows\ERUNT
2013-11-26 21:23 - 2013-11-26 21:21 - 00000000 ____D C:\AdwCleaner
2013-11-26 21:23 - 2011-03-19 13:32 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-26 21:22 - 2012-08-09 11:30 - 00000000 ____D C:\ProgramData\Uniblue
2013-11-26 21:20 - 2013-11-26 21:20 - 01091882 _____ C:\Users\Manuela\Desktop\adwcleaner.exe
2013-11-26 20:59 - 2013-11-26 20:59 - 00277384 _____ C:\Windows\Minidump\112613-23680-01.dmp
2013-11-26 20:59 - 2013-11-26 20:59 - 00000000 ____D C:\Windows\Minidump
2013-11-26 10:12 - 2013-11-26 10:12 - 00377856 _____ C:\Users\Manuela\Desktop\gmer_2.1.19163.exe
2013-11-26 10:06 - 2013-11-26 10:05 - 00032119 _____ C:\Users\Manuela\Desktop\Addition.txt
2013-11-26 10:04 - 2013-11-26 10:04 - 00000000 ____D C:\FRST
2013-11-26 10:03 - 2013-11-26 10:03 - 01958474 _____ (Farbar) C:\Users\Manuela\Desktop\FRST64.exe
2013-11-26 09:55 - 2013-11-26 09:55 - 00000586 _____ C:\Windows\SysWOW64\defogger_disable.log
2013-11-26 09:55 - 2013-11-26 09:55 - 00000020 _____ C:\Users\Manuela\defogger_reenable
2013-11-26 09:55 - 2011-01-15 10:03 - 00000000 ____D C:\Users\Manuela
2013-11-26 08:19 - 2013-07-27 16:42 - 00000111 _____ C:\Users\Manuela\AppData\Roaming\WB.CFG
2013-11-26 08:19 - 2013-06-17 13:33 - 00000006 _____ C:\Users\Manuela\AppData\Roaming\WBPU-TTL.DAT
2013-11-25 19:04 - 2011-01-15 10:48 - 00000000 ____D C:\Users\Manuela\AppData\Roaming\Adobe
2013-11-25 17:41 - 2011-01-15 10:11 - 00099984 _____ C:\Users\Manuela\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-25 17:41 - 2010-06-14 12:04 - 00000000 ____D C:\ProgramData\McAfee
2013-11-25 17:41 - 2009-07-14 04:20 - 00000000 ___RD C:\Program Files
2013-11-25 17:40 - 2009-07-14 05:45 - 00408320 _____ C:\Windows\system32\FNTCACHE.DAT
2013-11-25 15:03 - 2013-05-07 15:02 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-11-25 15:03 - 2013-04-04 15:29 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-11-25 15:03 - 2013-04-04 15:29 - 00106904 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-11-24 20:39 - 2011-04-26 10:10 - 00000000 ____D C:\Windows\System32\Tasks\NCH Software
2013-11-24 20:34 - 2012-07-14 15:16 - 00000000 ____D C:\Users\Public\Documents\Pinnacle
2013-11-24 20:29 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-11-24 20:10 - 2013-11-24 20:10 - 00001979 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-11-24 20:10 - 2011-01-15 10:05 - 00000000 ____D C:\ProgramData\Adobe
2013-11-24 20:09 - 2011-01-18 21:34 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-11-19 23:31 - 2012-12-25 22:57 - 00000000 ____D C:\Users\Manuela\Documents\Carolin schlau
2013-11-19 23:31 - 2012-09-10 14:53 - 00000000 ____D C:\Users\Manuela\Documents\Carolin´s Ha
2013-11-19 23:29 - 2010-06-15 04:23 - 00665320 _____ C:\Windows\system32\perfh007.dat
2013-11-19 23:29 - 2010-06-15 04:23 - 00135198 _____ C:\Windows\system32\perfc007.dat
2013-11-19 23:29 - 2009-07-14 06:13 - 01529102 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-19 23:18 - 2011-01-15 10:52 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-19 23:18 - 2011-01-15 10:52 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-19 23:15 - 2009-07-14 03:34 - 84148224 _____ C:\Windows\system32\config\SOFTWARE_tureg_old
2013-11-19 23:15 - 2009-07-14 03:34 - 20185088 _____ C:\Windows\system32\config\SYSTEM_tureg_old
2013-11-19 23:15 - 2009-07-14 03:34 - 00262144 _____ C:\Windows\system32\config\SECURITY_tureg_old
2013-11-19 22:10 - 2009-07-14 03:34 - 50069504 _____ C:\Windows\system32\config\COMPONENTS_tureg_old
2013-11-19 22:10 - 2009-07-14 03:34 - 01048576 _____ C:\Windows\system32\config\DEFAULT_tureg_old
2013-11-19 22:10 - 2009-07-14 03:34 - 00262144 _____ C:\Windows\system32\config\SAM_tureg_old
2013-11-19 22:09 - 2013-10-22 06:59 - 00001912 _____ C:\Windows\epplauncher.mif
2013-11-19 22:09 - 2013-10-22 06:57 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-11-19 22:08 - 2013-10-22 06:57 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2013-11-19 19:05 - 2013-03-11 20:09 - 00000000 ____D C:\Users\Manuela\AppData\Roaming\Skype
2013-11-19 11:21 - 2011-04-23 07:02 - 00267936 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2013-11-17 13:23 - 2013-11-17 13:23 - 00002770 _____ C:\Windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013
2013-11-17 13:20 - 2013-11-17 13:20 - 00000000 ____D C:\Users\Manuela\AppData\Local\Avg2014
2013-11-15 20:03 - 2013-11-15 18:04 - 00000000 ____D C:\Program Files (x86)\TuneUp Utilities 2014
2013-11-15 18:19 - 2013-06-23 21:02 - 00002778 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-11-15 18:19 - 2011-01-15 10:52 - 00004118 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-11-15 18:19 - 2011-01-15 10:52 - 00003866 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-11-15 18:17 - 2011-04-25 21:54 - 00000000 ____D C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nero (32-bit)
2013-11-15 18:16 - 2012-07-14 15:15 - 00000000 ____D C:\Users\Manuela\AppData\Local\Downloaded Installations
2013-11-15 18:09 - 2012-09-15 21:00 - 00000000 ____D C:\ProgramData\TuneUp Software
2013-11-15 18:05 - 2013-11-15 18:05 - 00002169 _____ C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
2013-11-15 18:05 - 2013-11-15 18:05 - 00002149 _____ C:\Users\Public\Desktop\TuneUp Utilities 2014.lnk
2013-11-15 18:05 - 2013-10-08 14:59 - 00017408 ___SH C:\Users\Manuela\Desktop\Thumbs.db
2013-11-15 18:05 - 2012-09-15 21:00 - 00000000 ____D C:\Users\Manuela\AppData\Roaming\TuneUp Software
2013-11-15 17:33 - 2013-11-14 20:35 - 00000000 ____D C:\Windows\pss
2013-11-15 17:33 - 2011-01-15 10:18 - 00000000 ___RD C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-15 16:58 - 2011-01-15 10:03 - 00000000 ____D C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2013-11-14 22:08 - 2009-07-14 03:34 - 00000435 _____ C:\Windows\win.ini
2013-11-14 21:50 - 2013-11-14 21:50 - 00000082 _____ C:\Windows\SETUP.LOG
2013-11-14 21:50 - 2013-11-14 21:50 - 00000000 ____D C:\Program Files\Synaptics
2013-11-14 21:50 - 2013-11-14 21:49 - 00005486 _____ C:\Windows\DPINST.LOG
2013-11-14 21:49 - 2013-11-14 21:49 - 00000000 ____D C:\Program Files (x86)\Atheros Client Installation Program
2013-11-14 21:49 - 2013-11-14 21:48 - 00000191 _____ C:\Windows\SamsungInstaller.log
2013-11-14 21:49 - 2010-06-14 11:47 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-11-14 21:48 - 2013-11-14 21:48 - 01721576 _____ (Microsoft Corporation) C:\Windows\system32\WdfCoInstaller01009.dll
2013-11-14 21:47 - 2013-11-14 21:48 - 03669504 _____ (Askey Computer Corporation.) C:\Windows\SysWOW64\AInst3141x.exe
2013-11-14 21:47 - 2013-11-14 21:48 - 00001202 _____ C:\Windows\SysWOW64\WLL3141.cfgx
2013-11-14 21:47 - 2013-11-14 21:47 - 01573888 _____ (Atheros Communications, Inc.) C:\Windows\system32\Drivers\athrx.sys
2013-11-14 21:47 - 2013-11-14 21:47 - 00396584 _____ (Synaptics Incorporated) C:\Windows\system32\SynCOM.dll
2013-11-14 21:47 - 2013-11-14 21:47 - 00316464 _____ (Synaptics Incorporated) C:\Windows\system32\Drivers\SynTP.sys
2013-11-14 21:47 - 2013-11-14 21:47 - 00264488 _____ (Synaptics Incorporated) C:\Windows\system32\SynCtrl.dll
2013-11-14 21:47 - 2013-11-14 21:47 - 00214312 _____ (Synaptics Incorporated) C:\Windows\system32\SynTPAPI.dll
2013-11-14 21:47 - 2013-11-14 21:47 - 00210216 _____ (Synaptics Incorporated) C:\Windows\SysWOW64\SynCtrl.dll
2013-11-14 21:47 - 2013-11-14 21:47 - 00173352 _____ (Synaptics Incorporated) C:\Windows\SysWOW64\SynCOM.dll
2013-11-14 21:47 - 2013-11-14 21:47 - 00147752 _____ (Synaptics Incorporated) C:\Windows\system32\SynTPCo4.dll
2013-11-14 21:47 - 2013-11-14 21:47 - 00107816 _____ (Synaptics Incorporated) C:\Windows\SysWOW64\SynTPCOM.dll
2013-11-14 21:36 - 2011-12-27 20:30 - 00000000 ____D C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AVS4YOU
2013-11-14 21:36 - 2011-12-27 20:29 - 00000000 ____D C:\Program Files (x86)\AVS4YOU
2013-11-14 21:36 - 2011-01-24 20:04 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
2013-11-14 21:36 - 2010-06-14 12:03 - 00000000 ____D C:\ProgramData\WinClon
2013-11-14 21:36 - 2010-06-14 11:54 - 00000000 ____D C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2013-11-14 21:36 - 2010-06-14 11:54 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2013-11-14 21:36 - 2010-06-14 11:53 - 00000000 ____D C:\Program Files (x86)\CyberLink
2013-11-14 21:36 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2013-11-14 21:36 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration
2013-11-14 20:16 - 2012-02-19 20:05 - 00000000 ____D C:\Users\Manuela\AppData\Roaming\IrfanView
2013-11-14 20:15 - 2012-07-14 15:40 - 00000000 ____D C:\Program Files (x86)\InterVideo
2013-11-14 20:13 - 2011-04-26 10:39 - 00000000 ____D C:\Philips
2013-11-14 18:00 - 2013-08-18 11:46 - 00000000 ____D C:\Windows\rescache
2013-11-14 16:56 - 2013-07-28 12:35 - 00000374 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2013-11-14 16:56 - 2009-08-02 03:27 - 00000000 ____D C:\Windows\Panther
2013-11-13 23:10 - 2013-08-18 02:01 - 00000000 ____D C:\Windows\system32\MRT
2013-11-13 23:03 - 2011-03-18 07:46 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-12 22:45 - 2012-10-05 21:18 - 00002521 _____ C:\Users\Public\Desktop\Freetec TubeBox.lnk
2013-11-12 22:45 - 2012-10-05 21:18 - 00000000 ____D C:\Program Files (x86)\Freetec
2013-11-10 18:05 - 2013-10-27 20:17 - 00001106 _____ C:\Windows\DVDXRestrictionFree.ini
2013-11-10 18:05 - 2011-02-21 19:08 - 00000085 ___SH C:\ProgramData\.zreglib
2013-11-07 19:27 - 2011-02-05 16:35 - 00000000 ____D C:\Users\Manuela\Leder
2013-11-07 19:26 - 2013-11-07 19:26 - 00124416 ___SH C:\Users\Manuela\Downloads\Thumbs.db
2013-11-07 17:57 - 2013-11-07 17:57 - 00000000 ____D C:\Users\Manuela\AppData\Local\Software_Updater
2013-11-06 20:31 - 2013-11-06 20:31 - 00001932 _____ C:\Users\Manuela\Desktop\DVD Decrypter.lnk
2013-11-06 20:31 - 2013-11-06 20:31 - 00000000 ____D C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DVD Decrypter
2013-11-06 20:31 - 2013-11-06 20:31 - 00000000 ____D C:\Program Files (x86)\DVD Decrypter
2013-11-06 20:28 - 2011-08-27 12:50 - 00000000 ____D C:\Users\Manuela\Downloads\Audio (Mp3)
2013-11-06 20:22 - 2013-11-06 20:22 - 00000000 ____D C:\Users\Manuela\Documents\Any Video Converter
2013-10-31 23:04 - 2013-10-31 23:04 - 00000000 _____ C:\Windows\setuperr.log
2013-10-30 10:45 - 2013-11-15 18:08 - 00043320 _____ (TuneUp Software) C:\Windows\system32\uxtuneup.dll
2013-10-30 10:45 - 2013-11-15 18:08 - 00036152 _____ (TuneUp Software) C:\Windows\SysWOW64\uxtuneup.dll
2013-10-30 10:45 - 2013-11-15 18:08 - 00029496 _____ (TuneUp Software) C:\Windows\system32\authuitu.dll
2013-10-30 10:45 - 2013-11-15 18:08 - 00025400 _____ (TuneUp Software) C:\Windows\SysWOW64\authuitu.dll
2013-10-30 10:45 - 2013-11-15 18:05 - 00040760 _____ (TuneUp Software) C:\Windows\system32\TURegOpt.exe
2013-10-29 19:12 - 2013-03-11 20:09 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-10-29 19:12 - 2013-03-11 20:09 - 00000000 ____D C:\ProgramData\Skype
2013-10-29 19:07 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT

Some content of TEMP:
====================
C:\Users\Manuela\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-20 18:33

==================== End Of Log ============================
--- --- ---

--- --- ---
FRST Additions Logfile:
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-11-2013 01
Ran by Manuela at 2013-11-27 19:49:29
Running from C:\Users\Manuela\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AV: Avira Desktop (Disabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Disabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

==================== Installed Programs ======================

Active@ ISO Burner (x32 Version: 2.5.1)
Adobe AIR (x32 Version: 3.8.0.1430)
Adobe Digital Editions 2.0 (x32 Version: 2.0)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.117)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117)
Adobe Photoshop Elements 8.0 (x32 Version: 8.0)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
Adobe SVG Viewer 3.0 (x32 Version:  3.0)
Amazon Browser Settings (x32 Version: 3.0)
Amazon Kindle (HKCU)
Amazon Music Importer (x32 Version: 2.1.0)
Ashampoo ClipFinder HD v.2.13 (x32 Version: 2.13)
Atheros Client Installation Program (x32 Version: 1.0.2.1119)
Audiograbber 1.83 SE  (x32 Version: 1.83 SE )
Avira Free Antivirus (x32 Version: 14.0.1.749)
AVS Image Converter 2.2.2.218 (x32)
AVS Screen Capture version 2.0.1 (x32)
AVS Update Manager 1.0 (x32)
AVS Video Editor 6 (x32)
AVS Video Recorder 2.4 (x32)
AVS4YOU Software Navigator 1.4 (x32)
BatteryLifeExtender (x32 Version: 1.0.5)
BroadCam Video Streaming Server (x32)
calibre (x32 Version: 0.9.34)
CCleaner (Version: 4.02)
CloneDVD2 (x32 Version: 2.9.3.0)
CyberLink PowerDirector (x32 Version: 7.0.3213)
CyberLink PowerDVD 8 (x32 Version: 8.0.2815b)
CyberLink PowerProducer (x32 Version: 5.0.1.1812)
CyberLink YouCam (x32 Version: 2.0.3625)
Das Interaktive Kartenwerk. Deutschland (x32 Version: 2.0.3)
DVD Decrypter (Remove Only) (x32)
Easy Display Manager (x32 Version: 3.0)
Easy Network Manager (x32 Version: 4.2.8)
Easy SpeedUp Manager (x32 Version: 3.0.0.5)
EasyBatteryManager (x32 Version: 4.0.0.3)
Facebook Video Calling 1.2.0.287 (x32 Version: 1.2.287)
Free Audio CD Burner version 1.4.7 (x32)
Free DVD Decrypter version 1.5.4 (x32)
Free Video to DVD Converter version 5.0.3.1206 (x32)
Free YouTube Download Manager (x32 Version: 1.0.2.40)
Garmin USB Drivers (x32 Version: 2.3.0.0)
Garmin WebUpdater (x32 Version: 2.4.2)
Google Chrome (x32 Version: 30.0.1599.101)
Google Earth Plug-in (x32 Version: 7.1.1.1888)
Google Update Helper (x32 Version: 1.3.21.165)
Intel(R) Graphics Media Accelerator Driver (Version: 8.15.10.2202)
Intel® Matrix Storage Manager
Junk Mail filter update (x32 Version: 14.0.8089.726)
LyricsDroid (x32)
MagicMaps Sachsen Thüringen 4.0 (x32 Version: 4.0)
MagicMaps Support und Update Tool (x32 Version: 1.1.3)
MagicMaps Tour Explorer 25 Deutschland (x32 Version: 4.0.9)
Mahjong Escape Ancient China (x32)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Marvell Miniport Driver (x32 Version: 11.22.3.3)
Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322)
Microsoft .NET Framework 1.1 German Language Pack (x32 Version: 1.1.4322)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Choice Guard (x32 Version: 2.0.48.0)
Microsoft Office 2000 Professional (x32 Version: 9.00.2816)
Microsoft Office 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000)
Microsoft Office Klick-und-Los 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Starter 2010 - Deutsch (x32 Version: 14.0.4763.1000)
Microsoft PowerPoint Viewer (x32 Version: 14.0.6029.1000)
Microsoft Security Client (Version: 4.4.0304.0)
Microsoft Security Essentials (Version: 4.4.304.0)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Visual Studio Tools for Applications 2.0 Runtime (x32 Version: 9.0.30729)
Microsoft Visual Studio Tools for Applications 2.0 Runtime Language Pack - DEU (x32 Version: 9.0.30729)
MSVCRT (x32 Version: 14.0.1468.721)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
OpenOffice.org 3.4.1 (x32 Version: 3.41.9593)
Opera 12.16 (x32 Version: 12.16.1860)
phonostar-Player Version 3.02.8 (x32)
PL-2303 Vista Driver Installer (x32 Version: 3.2.0.0)
QuickTime (x32 Version: 7.55.90.70)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6003)
Samsung Networking Wizard (x32 Version: 1.1.11035.4)
Samsung Recovery Solution 4 (x32 Version: 4.0.0.6)
Samsung Support Center (x32 Version: 1.0.2)
Samsung Update Plus (x32 Version: 2.0)
SAMSUNG USB Driver for Mobile Phones (Version: 1.3.2000.0)
Skype™ 6.9 (x32 Version: 6.9.106)
SMV Converter Tool 3.0 (x32 Version: 1.0.0)
Synaptics Pointing Device Driver (Version: 15.0.10.0)
TubeBox (x32 Version: 4.4.0.0)
TubeBox! (x32 Version: 3.4.6)
TuneUp Utilities 2014 (de-DE) (x32 Version: 14.0.1000.169)
TuneUp Utilities 2014 (x32 Version: 14.0.1000.169)
Uninstall 1.0.0.1 (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
User Guide (x32 Version: 1.0)
Visual C++ 9.0 CRT (x86) WinSXS MSM (x32 Version: 9.0)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (06/03/2009 2.3.0.0) (Version: 06/03/2009 2.3.0.0)
Windows Live Anmelde-Assistent (x32 Version: 5.000.818.5)
Windows Live Communications Platform (x32 Version: 14.0.8064.206)
Windows Live Essentials (x32 Version: 14.0.8089.0726)
Windows Live Essentials (x32 Version: 14.0.8089.726)
Windows Live Family Safety (Version: 14.0.8093.805)
Windows Live Fotogalerie (x32 Version: 14.0.8081.709)
Windows Live Mail (x32 Version: 14.0.8089.0726)
Windows Live Movie Maker (x32 Version: 14.0.8091.0730)
Windows Live Sync (x32 Version: 14.0.8089.726)
Windows Live Writer (x32 Version: 14.0.8089.0726)
Windows Live-Uploadtool (x32 Version: 14.0.8014.1029)
WinRAR 4.01 (32-Bit) (x32 Version: 4.01.0)

==================== Restore Points  =========================

24-11-2013 19:28:16 Removed Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
24-11-2013 19:29:10 Microsoft Visual C++ 2005 Redistributable wird entfernt
24-11-2013 19:29:47 Removed Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
24-11-2013 19:31:14 Removed Photomizer
24-11-2013 19:32:16 Removed Pinnacle VideoSpin.
24-11-2013 19:41:51 Windows-Sicherung
26-11-2013 18:29:50 Windows Update
26-11-2013 21:06:52 zoek.exe restore point

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {059BC6B5-C13B-474A-9342-29A7D77FE32C} - \DSite No Task File
Task: {0933D3DF-7386-42D6-A0D2-6D6F97906BAF} - System32\Tasks\NCH Software\broadcamDowngrade => C:\Program Files (x86)\NCH Software\BroadCam\broadcam.exe
Task: {0BD10AEB-91B6-41D9-8CB1-2AEC29ECCC51} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-01-15] (Google Inc.)
Task: {0E770F45-7A8B-4EF9-835C-D58A42D868A8} - System32\Tasks\SUPBackground => C:\Program Files\Samsung\Samsung Update Plus\SUPBackground.exe
Task: {1ABADC08-47CB-4289-9BE2-3902359F9298} - \Plus-HD-2.4-firefoxinstaller No Task File
Task: {3F5032B5-1ACA-40ED-8E8C-85E2E91F503E} - System32\Tasks\EasyDisplayMgr => C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe [2009-12-17] (Samsung Electronics Co., Ltd.)
Task: {42EE63EA-1AD5-445C-8871-59536CBEE7D2} - \QtraxPlayer No Task File
Task: {441B79DF-5E8D-4585-9C73-15B07AC3053A} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-05-24] (Piriform Ltd)
Task: {4B4567EA-E97C-4DAE-9D0A-813AEA08A23D} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-868785299-726797094-2297327714-1001UA => C:\Users\Manuela\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12] (Facebook Inc.)
Task: {529F2D84-8523-4915-8B98-6973C9EA05E1} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {657FEF37-9684-41FE-9AAA-22FA3AFF4B61} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-01-15] (Google Inc.)
Task: {6D33D801-0C24-4200-A59E-F683F87CB536} - System32\Tasks\NCH Software\broadcamShakeIcon => C:\Program Files (x86)\NCH Software\BroadCam\BroadCam.exe
Task: {71DB5D66-414E-4EC5-9CFC-81ED9D394A28} - \Plus-HD-2.4-codedownloader No Task File
Task: {72C86E13-6851-43DE-B7A5-4331F8B8DC68} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-09] (Adobe Systems Incorporated)
Task: {7F4977F7-57DD-49FE-8C3B-463D8C5A320A} - \Plus-HD-2.4-updater No Task File
Task: {83AED8A2-EE3C-4491-AABC-A711132893D3} - \Go for FilesUpdate No Task File
Task: {86B89009-CE71-41E3-AABF-9C1E7FB76B54} - \Plus-HD-2.4-chromeinstaller No Task File
Task: {8C486767-AED4-465E-A7E4-4C5C97BD3CD1} - System32\Tasks\advSRS4 => C:\Program Files (x86)\Samsung\Samsung Recovery Solution 4\WCScheduler.exe [2010-01-19] (SEC)
Task: {8F56B669-2A39-45AE-9CD4-3BA3433352EB} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\TuneUp Utilities 2014\OneClick.exe [2013-10-30] (TuneUp Software)
Task: {9583011C-949A-4739-8E84-5345002ED128} - \Plus-HD-2.4-enabler No Task File
Task: {AC7129A3-4F16-4AFF-9F9A-A9206F7ED657} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)
Task: {C4F7CA60-F41B-4DFA-87D2-BB4E955248C6} - System32\Tasks\EasyBatteryManager => C:\Program Files (x86)\Samsung\EasyBatteryManager\EasyBatteryMgr4.exe [2009-10-16] (SAMSUNG Electronics co., LTD.)
Task: {D230F82E-2446-45F6-AE4E-405869C4F793} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation)
Task: {D5F3117C-6EA6-45D1-B3CA-6FB138FA81EC} - System32\Tasks\EasySpeedUpManager => C:\Program Files (x86)\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe [2009-10-13] (Samsung Electronics Co., Ltd.)
Task: {D7C4F78F-797D-4602-81E2-2536211F031F} - \Software Updater Ui No Task File
Task: {D9B10D24-1E1E-4823-B029-8B29A7F90CC8} - \BackgroundContainer Startup Task No Task File
Task: {DD742FD1-D09A-4E3F-95D9-28D4B15112E0} - System32\Tasks\SamsungSupportCenter => C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe [2010-05-06] (SAMSUNG Electronics)
Task: {E3491584-0B4C-4808-B227-EE4B7D57979C} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-868785299-726797094-2297327714-1001Core => C:\Users\Manuela\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12] (Facebook Inc.)
Task: {EEA2A079-7FCE-4ABB-BDD3-F8D69CC2F2C0} - System32\Tasks\BatteryLifeExtender => C:\Program Files (x86)\Samsung\BatteryLifeExtender\BatteryLifeExtender.exe [2010-06-01] (Samsung Electronics. Co. Ltd.)
Task: {FD2594B4-F576-49D5-8E40-2E388ACB0854} - \Software Updater No Task File
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-868785299-726797094-2297327714-1001Core.job => C:\Users\Manuela\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-868785299-726797094-2297327714-1001UA.job => C:\Users\Manuela\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2012-11-16 15:15 - 2013-10-10 18:14 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2010-06-14 12:02 - 2006-08-12 04:48 - 00049152 _____ () C:\Program Files (x86)\Samsung\Easy Display Manager\HookDllPS2.dll
2011-12-26 21:11 - 2013-07-06 13:38 - 00835584 _____ () C:\Program Files (x86)\Opera\gstreamer\gstreamer.dll
2011-12-26 21:11 - 2013-07-06 13:38 - 00093696 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstaudioconvert.dll
2011-12-26 21:11 - 2013-07-06 13:38 - 00094208 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstaudioresample.dll
2011-12-26 21:11 - 2013-07-06 13:38 - 00057344 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstautodetect.dll
2011-12-26 21:11 - 2013-07-06 13:38 - 00096256 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstcoreplugins.dll
2011-12-26 21:11 - 2013-07-06 13:38 - 00062976 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstdecodebin2.dll
2011-12-26 21:11 - 2013-07-06 13:38 - 00067072 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstdirectsound.dll
2011-12-26 21:11 - 2013-07-06 13:38 - 00158208 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstffmpegcolorspace.dll
2011-12-26 21:11 - 2013-07-06 13:38 - 00312832 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstoggdec.dll
2011-12-26 21:11 - 2013-07-06 13:38 - 00038912 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstwaveform.dll
2011-12-26 21:11 - 2013-07-06 13:38 - 00073728 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstwavparse.dll
2011-12-26 21:11 - 2013-07-06 13:38 - 00101888 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstwebmdec.dll
2013-10-09 17:02 - 2013-10-09 17:02 - 16233864 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\Temp:661DFA1C
AlternateDataStreams: C:\ProgramData\Temp:9E22BBE8

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (11/27/2013 05:44:47 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (11/26/2013 10:32:40 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (11/26/2013 09:45:13 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.


System errors:
=============
Error: (11/27/2013 05:46:04 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Gatewaydienst auf Anwendungsebene" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (11/27/2013 05:46:03 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Gatewaydienst auf Anwendungsebene erreicht.

Error: (11/26/2013 10:21:54 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (11/26/2013 10:21:54 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (11/26/2013 10:21:53 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (11/26/2013 10:21:52 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (11/26/2013 10:21:52 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.


Microsoft Office Sessions:
=========================
Error: (11/27/2013 05:44:47 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Program Files (x86)\phonostar-Player\phonostar.exe

Error: (11/26/2013 10:32:40 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Program Files (x86)\phonostar-Player\phonostar.exe

Error: (11/26/2013 09:45:13 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Program Files (x86)\phonostar-Player\phonostar.exe


==================== Memory info ===========================

Percentage of memory in use: 43%
Total physical RAM: 3032.61 MB
Available physical RAM: 1725.24 MB
Total Pagefile: 6063.4 MB
Available Pagefile: 4214.55 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:106.39 GB) (Free:12.83 GB) NTFS
Drive d: () (Fixed) (Total:106.39 GB) (Free:14.17 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 233 GB) (Disk ID: EA9CBF94)
Partition 1: (Not Active) - (Size=20 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=106 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=106 GB) - (Type=07 NTFS)

==================== End Of Log ============================
--- --- ---

speedydino 27.11.2013 20:29
SystemLook 30.07.11 by jpshortstuff
Log created at 19:51 on 27/11/2013 by Manuela
Administrator - Elevation successful

========== filefind ==========

Searching for "*IBUpdater*"
No files found.

Searching for "*Wajam*"
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Wajam\IE\wajamLogo.bmp.vir --a---- 5430 bytes [16:25 18/04/2013] [16:25 18/04/2013] 7BDDC74307568C40E85C1BB001A31E22
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Wajam\Logos\wajam.ico.vir --a---- 3262 bytes [19:39 20/11/2013] [19:39 20/11/2013] 9FE7A61318B3A1CCB0621E0FBC61CDEE
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Wajam\Updater\WajamUpdaterV3.exe.vir --a---- 114176 bytes [19:39 20/11/2013] [19:39 20/11/2013] 58E407DF43CA11ADE8AECFE629FEACD1
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Local\DownloadGuide\wajam_download.exe.vir --a---- 55363 bytes [21:41 12/11/2013] [21:41 12/11/2013] F0F3706910D84499E7845934117022BA
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Local\Wajam\Chrome\wajam.crx.vir --a---- 57073 bytes [16:25 18/04/2013] [16:25 18/04/2013] 02EADE58BDEEA515E3A199CA74FAED77
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam\Wajam Website.lnk.vir --a---- 1162 bytes [19:06 24/11/2013] [19:06 24/11/2013] 8ABEF758FAB5BA719AA918DC1550BDC8
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fwww.wajam.com%2Ffavicon.png --a---- 526 bytes [22:39 28/07/2013] [22:39 28/07/2013] 71C150AE09424BC84D44176064CA8DF7
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\www.wajam.com.idx --a---- 194 bytes [19:02 15/11/2013] [19:02 15/11/2013] E5FB119378A3323596270BB1C6E6173F
C:\Windows\Prefetch\WAJAMUPDATERV3.EXE-B6E3A8C1.pf --a---- 12772 bytes [08:59 26/11/2013] [18:19 26/11/2013] C521E295703882C0FCBE6D990078C7A6

Searching for "*Babylon*"
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fimg.babylon.com%2Fsite%2Fimages%2Fbabylon-8%2Fcommon%2Fimages%2Ffavicon.png --a---- 1028 bytes [21:19 18/12/2012] [21:19 18/12/2012] 0BD43713A08B2DCCEA64E9A40FCAB258

Searching for "*Conduit*"
C:\AdwCleaner\Quarantine\C\Program Files (x86)\NCH Software\Components\NCHToolbars\conduit\ConduitInstaller.exe.vir --a---- 73080 bytes [19:39 27/12/2011] [19:39 27/12/2011] 9A5E999C90861CE9B7906DBF429D4238
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Local\DownloadGuide\mconduitinstaller.exe.vir --a---- 81768 bytes [21:40 12/11/2013] [21:40 12/11/2013] 7EDD87EE5FAED1733FE49EB16F691BB8
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Local\Temp\CT3317483\conduit.xml.vir --a---- 785 bytes [12:44 01/10/2013] [12:44 01/10/2013] 6ACD8B6E740CB1E9A9FA43F2087592C6
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\Conduit\Community Alerts\Feeds\http___alerts_conduit-services_com_root_1128724_1124413_DE.xml.vir --a---- 181 bytes [14:10 14/03/2011] [14:10 14/03/2011] 16827EAB3715F272A6C4941C70234BA0
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\Conduit\Community Alerts\Feeds\http___alerts_conduit-services_com_root_1801803_1792344_DE.xml.vir --a---- 188 bytes [21:42 12/11/2013] [16:52 15/11/2013] 06AF577664CF4A15954D5235801A24AD
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_conduit_com_83_331_CT3317483_images_635176072176431322_ 24PX_png.png.vir --a---- 806 bytes [16:52 15/11/2013] [16:52 15/11/2013] 2BDCB851C11AC93F6C978C5F1FF66B41
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_conduit_com_83_331_CT3317483_Images_635176073946678181_ png.png.vir --a---- 1401 bytes [16:52 15/11/2013] [16:52 15/11/2013] 8EE6F0425E36A7CB5F36D096AC587852
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_conduit_com_83_331_CT3317483_Images_635176074015630181_ png.png.vir --a---- 1257 bytes [16:52 15/11/2013] [16:52 15/11/2013] A9619F2A6EFE82E0CEFC0FAA1114773A
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_conduit_com_83_331_CT3317483_Images_635176074075222181_ png.png.vir --a---- 1184 bytes [16:52 15/11/2013] [16:52 15/11/2013] 3B628D25E2D2C12DF9221A303BE3E2D8
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_conduit_com_83_331_CT3317483_Images_635176074137778181_ png.png.vir --a---- 1124 bytes [16:52 15/11/2013] [16:52 15/11/2013] 9D1F8DAB536221525EF5D263AA1497A6
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_conduit_com_83_331_CT3317483_images_635176074629286004_ 24PX_png.png.vir --a---- 974 bytes [16:52 15/11/2013] [16:52 15/11/2013] 7B0A0C118F4D05C39AAB4B5BA5948C9C
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_conduit_com_83_331_CT3317483_Images_635181371245125017_ png.png.vir --a---- 388 bytes [16:52 15/11/2013] [16:52 15/11/2013] 399D3B8A3DA4661CFB02D26B15EF9B84
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_conduit_com_83_331_CT3317483_images_635181372094546510_ 24PX_png.png.vir --a---- 1210 bytes [16:52 15/11/2013] [16:52 15/11/2013] 31AC7BF4399F3D26F32D555E6821E6B2
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_conduit_com_83_331_CT3317483_Skins_635176069067752624_p ng.png.vir --a---- 213 bytes [16:52 15/11/2013] [16:52 15/11/2013] 23C389E60E5EC06927735ADFBD8CA40A
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_conduit_com_bankimages_commandcomps_block_gif.gif.vir --a---- 159 bytes [16:52 15/11/2013] [16:52 15/11/2013] FF164EABA285C2E614EBFD967FEF9732
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_About_ png.png.vir --a---- 821 bytes [16:52 15/11/2013] [16:52 15/11/2013] 99D5F75C338F2A877CBF891E0F18746E
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_Browse _png.png.vir --a---- 729 bytes [16:52 15/11/2013] [16:52 15/11/2013] F2291FAB46ED9291A1A2FFE9F88E9D84
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_Contac t_png.png.vir --a---- 531 bytes [16:52 15/11/2013] [16:52 15/11/2013] A847C5F6CE2C700048749892DD2E0619
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_Hide_p ng.png.vir --a---- 669 bytes [16:52 15/11/2013] [16:52 15/11/2013] FED9E00C76F647EE6A0B7CC684C89F0C
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_conduit_com_bankImages_ConduitEngine_ContextMenu_LikeIc on_png.png.vir --a---- 263 bytes [16:52 15/11/2013] [16:52 15/11/2013] 36BD416D16391EFAAAFB2C3C54EAE986
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_MoreFr omPublisher_png.png.vir --a---- 734 bytes [16:52 15/11/2013] [16:52 15/11/2013] 943ADFD9E0DF1507F7BC419802BF4303
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_More_p ng.png.vir --a---- 562 bytes [16:52 15/11/2013] [16:52 15/11/2013] 36C6FB9C84D4AF5C5D7C5B277A0E4A01
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_Option s_png.png.vir --a---- 493 bytes [16:52 15/11/2013] [16:52 15/11/2013] 275C9DA2D536F18F528C80E050C3D705
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_Privac y_png.png.vir --a---- 706 bytes [16:52 15/11/2013] [16:52 15/11/2013] 3AD88BD8E832DA39FAAEDF07AD595F94
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_Refres h_png.png.vir --a---- 674 bytes [16:52 15/11/2013] [16:52 15/11/2013] 650731EEF807C292E699779B12CBE552
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_Upgrad e_png.png.vir --a---- 607 bytes [16:52 15/11/2013] [16:52 15/11/2013] 9B4D914888BCFFCBAE6757A0E450551C
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_conduit_com_images_ClientImages_radio_gif.gif.vir --a---- 419 bytes [16:52 15/11/2013] [16:52 15/11/2013] 01B83C91554738F6AFFB7895BBBA73FB
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_conduit_com_images_eula_png.png.vir --a---- 513 bytes [16:52 15/11/2013] [16:52 15/11/2013] F43944209A64CCD0C9B5A92743F0F787
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_conduit_com_images_main_menu_about_gif.gif.vir --a---- 403 bytes [16:52 15/11/2013] [16:52 15/11/2013] EC3C2B4E0DEC4D880BAFF88ABBF94188
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_conduit_com_images_main_menu_clear_history_gif.gif.vir --a---- 414 bytes [16:52 15/11/2013] [16:52 15/11/2013] A9E001CBC00B06B121DFBC80707F5298
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_conduit_com_images_main_menu_contact_gif.gif.vir --a---- 278 bytes [16:52 15/11/2013] [16:52 15/11/2013] 15DEF39E438E807E2F0E22D44FDC7FB7
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_conduit_com_images_main_menu_help_gif.gif.vir --a---- 405 bytes [16:52 15/11/2013] [16:52 15/11/2013] 995595D4C685D659E8F03CD0A287EDDF
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_conduit_com_images_main_menu_home_page_gif.gif.vir --a---- 405 bytes [16:52 15/11/2013] [16:52 15/11/2013] AA39D8A6B65E208901EBA9F3D4728D3E
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_conduit_com_images_main_menu_options_gif.gif.vir --a---- 361 bytes [16:52 15/11/2013] [16:52 15/11/2013] 464E244E7E2F27FB85E0C3AB69D72104
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_conduit_com_images_main_menu_privacy_gif.gif.vir --a---- 425 bytes [16:52 15/11/2013] [16:52 15/11/2013] 6427565C7105DC497287866100F260BB
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_conduit_com_images_main_menu_refresh_gif.gif.vir --a---- 381 bytes [16:52 15/11/2013] [16:52 15/11/2013] AE7C9F67594A84B096D225601ACB0B2A
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_conduit_com_images_main_menu_shrink_gif.gif.vir --a---- 351 bytes [16:52 15/11/2013] [16:52 15/11/2013] C3EBA0237D68F665AF6D663906221092
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_conduit_com_images_main_menu_upgrade_gif.gif.vir --a---- 399 bytes [16:52 15/11/2013] [16:52 15/11/2013] 8BE02D510B4B2E05AD2611B1E9A0BD56
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_conduit_com_images_Menu_uninstall-icon_png.png.vir --a---- 617 bytes [16:52 15/11/2013] [16:52 15/11/2013] 80648ABDB2DEB2D53DBFD77D57A9C886
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_conduit_com_images_SearchEngines_images_search_gif.gif. vir --a---- 405 bytes [16:52 15/11/2013] [16:52 15/11/2013] 66018EAE0906C9831A821CAE5D1089BB
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_conduit_com_images_SearchEngines_news_icon_gif.gif.vir --a---- 371 bytes [16:52 15/11/2013] [16:52 15/11/2013] 84896837EDB1A78C14DB6A2F3A0AEE3A
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_conduit_com_images_searchengines_search_icon_gif.gif.vi r --a---- 322 bytes [16:52 15/11/2013] [16:52 15/11/2013] 948781E4B6478290050ECA4423B89B1E
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_conduit_com_images_SearchEngines_tfd_gif.gif.vir --a---- 240 bytes [16:52 15/11/2013] [16:52 15/11/2013] AE5A39669C623937C0839E079E1088D5
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___storage_conduit_com_images_SearchEngines_video_gif.gif.vir --a---- 335 bytes [16:52 15/11/2013] [16:52 15/11/2013] 766433EF38BDA83C4FD4932027A4B9D5
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\CacheIcons\http___weather_conduit_com_images_weather_Default_partly_cloudy_night_ gif.gif.vir --a---- 212 bytes [16:52 15/11/2013] [16:52 15/11/2013] 88CD5B8D6F007347115A8A602E5D158B
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\ExternalComponent\http___contextmenu_toolbar_conduit-services_com__name=GottenApps&locale=de&ctid=CT3317483.xml.vir --a---- 7152 bytes [16:52 15/11/2013] [16:52 15/11/2013] F6836FC726FB97D92C027C9240322E31
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\ExternalComponent\http___contextmenu_toolbar_conduit-services_com__name=OtherApps&locale=de&ctid=CT3317483.xml.vir --a---- 5619 bytes [16:52 15/11/2013] [16:52 15/11/2013] BFDCFC4D844DCF87F16F123AA96FE78C
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\ExternalComponent\http___contextmenu_toolbar_conduit-services_com__name=SharedApps&locale=de&ctid=CT3317483.xml.vir --a---- 6685 bytes [16:52 15/11/2013] [16:52 15/11/2013] D89B290A06CB213632BDB0E6F90BCA27
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\ExternalComponent\http___contextmenu_toolbar_conduit-services_com__name=Toolbar&locale=de&ctid=CT3317483&UM=UM_UNINSTALL_ID.xml.vir --a---- 5618 bytes [16:52 15/11/2013] [16:52 15/11/2013] 7A19CBFB0D7EF3CAD6BF28AFFC3E73BB
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\xmodr5w8.default\Extensions\{2ee84ac6-8dd6-4a14-bd37-b79c8f9ecf4d}\Chrome\CT3317483\content\ConduitAbstractionLayer.js.vir --a---- 36402 bytes [12:15 04/11/2013] [12:15 04/11/2013] 115455E3B5034EA10177D137EE85AFC7
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\xmodr5w8.default\Extensions\{2ee84ac6-8dd6-4a14-bd37-b79c8f9ecf4d}\Chrome\CT3317483\content\ConduitAbstractionLayerBack.js.vir --a---- 36402 bytes [12:15 04/11/2013] [12:15 04/11/2013] 115455E3B5034EA10177D137EE85AFC7
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\xmodr5w8.default\Extensions\{2ee84ac6-8dd6-4a14-bd37-b79c8f9ecf4d}\Chrome\CT3317483\content\ConduitAbstractionLayerFront.js.vir --a---- 36402 bytes [12:15 04/11/2013] [12:15 04/11/2013] 115455E3B5034EA10177D137EE85AFC7
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\xmodr5w8.default\Extensions\{2ee84ac6-8dd6-4a14-bd37-b79c8f9ecf4d}\Chrome\CT3317483\content\tb\al\aboutBox\images\conduit-logo-OLD.png.vir --a---- 1305 bytes [12:15 04/11/2013] [12:15 04/11/2013] 5F8EF9A0B050532B90B2645E9627E3F9
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\xmodr5w8.default\Extensions\{2ee84ac6-8dd6-4a14-bd37-b79c8f9ecf4d}\Chrome\CT3317483\content\tb\al\aboutBox\images\conduit-logo.png.vir --a---- 3926 bytes [12:15 04/11/2013] [12:15 04/11/2013] 04EC2FEFD3A417F86E983508778A00DD
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\xmodr5w8.default\Extensions\{2ee84ac6-8dd6-4a14-bd37-b79c8f9ecf4d}\Chrome\CT3317483\content\tb\al\options\images\conduit-logo.png.vir --a---- 3926 bytes [12:15 04/11/2013] [12:15 04/11/2013] 04EC2FEFD3A417F86E983508778A00DD
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\xmodr5w8.default\Extensions\{2ee84ac6-8dd6-4a14-bd37-b79c8f9ecf4d}\lib\log4conduit.jsm.vir --a---- 760 bytes [12:15 04/11/2013] [12:15 04/11/2013] 93898FE6A232C5FCD838D8168F65D802
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\xmodr5w8.default\Extensions\{2ee84ac6-8dd6-4a14-bd37-b79c8f9ecf4d}\Plugins\npConduitFirefoxPlugin.dll.vir --a---- 206624 bytes [12:15 04/11/2013] [12:15 04/11/2013] C041CF22CE21F6ABA9164AC4D648186E
C:\Users\Manuela\AppData\Local\Microsoft\Internet Explorer\DOMStore\0CLZFU2K\storage.conduit[1].xml --a---- 13 bytes [16:52 15/11/2013] [16:52 15/11/2013] C1DDEA3EF6BBEF3E7060A1A9AD89E4C5
C:\Users\Manuela\AppData\Local\Microsoft\Internet Explorer\DOMStore\ILELAEPG\fastcontent.conduit[1].xml --a---- 831 bytes [16:52 15/11/2013] [16:53 15/11/2013] D076AB13906F0F29404277C4BD19C9E4
C:\Users\Manuela\AppData\Local\Microsoft\Internet Explorer\DOMStore\ONK4XIPY\app.mam.conduit[1].xml --a---- 132 bytes [21:42 12/11/2013] [16:52 15/11/2013] 3F083BD2CBCF8C40709FE4CD5C1C6799
C:\Users\Manuela\Documents\Downloads\ConduitInstaller.exe --a---- 203264 bytes [20:56 22/02/2011] [20:56 22/02/2011] 2021E07073C6D1FD7B53ED460B986AE0

Searching for "*NCH Software*"
No files found.

Searching for "*Tarma Installer*"
No files found.

Searching for "*DriverScanner*"
No files found.

Searching for "*AddLyrics*"
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Local\DownloadGuide\Offers\addlyrics.exe.vir --a---- 92628 bytes [10:27 17/08/2013] [10:27 17/08/2013] 8EC2DF2CF0EC1CD95751B27D36DC3094

Searching for "*Amazon Browser Bar*"
No files found.

Searching for "*file scout*"
No files found.

Searching for "*FreeCompressor*"
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fwww.freecompressor.com%2Fimages%2Ffavicon.png --a---- 254 bytes [10:24 09/08/2012] [10:24 09/08/2012] 0547BED201D498534965F3F9C7283C4E

Searching for "*goforfiles*"
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fwww.goforfiles.com%2Ffavicon.png --a---- 381 bytes [09:16 20/04/2013] [09:16 20/04/2013] 1FE05359D9CFB13FD88CF96A12233E33

Searching for "*LyricsDroid*"
No files found.

Searching for "*SoftwareUpdater*"
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SoftwareUpdater\SoftwareUpdater.Bootstrapper.exe.vir --a---- 105984 bytes [10:23 26/02/2013] [20:05 26/11/2013] 221D0FA7BD76C347C4965B978D6632F5
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SoftwareUpdater\SoftwareUpdater.dll.vir --a---- 289280 bytes [18:47 26/02/2013] [15:37 25/11/2013] 4E7E43981D4A4D24D15D1605F3E54C14
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SoftwareUpdater\SoftwareUpdater.Ui.exe.vir --a---- 910848 bytes [18:47 26/02/2013] [15:37 25/11/2013] E86E9815869EB8A7A3097845AC6106E3
C:\Program Files (x86)\Freetec\SystemStore\SoftwareUpdater.Bootstrapper.exe --a---- 60928 bytes [17:29 11/12/2012] [17:01 26/04/2013] 98A73E88E75762BD486E153D640EB70E
C:\Program Files (x86)\Freetec\SystemStore\SoftwareUpdater.dll --a---- 601600 bytes [18:07 12/12/2012] [20:35 29/01/2013] 1484A38CAAA3D39579AF3F3B766C4E46
C:\Program Files (x86)\Freetec\SystemStore\SoftwareUpdater.Ui.exe --a---- 1495552 bytes [18:07 12/12/2012] [16:57 25/02/2013] F07533086583957AD4A9B6011B0259D1
C:\Windows\Prefetch\SOFTWAREUPDATER.BOOTSTRAPPER.-3E3DE645.pf --a---- 203280 bytes [13:57 21/11/2013] [20:04 26/11/2013] 5F4E16028B045EE6481B5821121000CA
C:\Windows\Prefetch\SOFTWAREUPDATER.UI.EXE-2DC84852.pf --a---- 110028 bytes [09:00 26/11/2013] [20:02 26/11/2013] D10DA890F6D7A2CDEE83C3E1C404963C

Searching for "*WinSecurity*"
C:\AdwCleaner\Quarantine\C\Program Files (x86)\WinSecurity\winsecurity.crx.vir --a---- 6068 bytes [11:19 27/08/2013] [11:19 27/08/2013] 4C83872E12A4A297C741C00E3FB61A36
C:\AdwCleaner\Quarantine\C\Program Files (x86)\WinSecurity\winsecurity.dll.vir --a---- 196096 bytes [11:25 27/08/2013] [11:25 27/08/2013] 1DBFBDA1B7787B2A58A9BD5F0463A99C
C:\AdwCleaner\Quarantine\C\Program Files (x86)\WinSecurity\winsecurity.xpi.vir --a---- 7429 bytes [11:21 27/08/2013] [11:21 27/08/2013] 631EE562CE095F26D762802DC1419A9E
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Local\DownloadGuide\WinSecurity.exe.vir --a---- 257520 bytes [21:41 12/11/2013] [21:41 12/11/2013] 63253F77AE9939067D4134E5E384FB14
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\GutscheinCodes\winsecurity.crx.vir --a---- 6068 bytes [21:46 12/11/2013] [11:19 27/08/2013] 4C83872E12A4A297C741C00E3FB61A36
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\GutscheinCodes\winsecurity.dll.vir --a---- 196096 bytes [21:46 12/11/2013] [11:25 27/08/2013] 1DBFBDA1B7787B2A58A9BD5F0463A99C
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\GutscheinCodes\winsecurity.xpi.vir --a---- 7429 bytes [21:46 12/11/2013] [11:21 27/08/2013] 631EE562CE095F26D762802DC1419A9E

Searching for "*Plus-HD*"
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus-HD-2.4\Plus-HD-2.4-bg.exe.vir --a---- 900456 bytes [18:31 01/08/2013] [18:31 01/08/2013] 5E1803B20B9B084D94DB23A3F204909C
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus-HD-2.4\Plus-HD-2.4-bho.dll.vir --a---- 752488 bytes [18:31 01/08/2013] [18:31 01/08/2013] 0E7D1339218566CEFA859828AA7963CB
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus-HD-2.4\Plus-HD-2.4-buttonutil.dll.vir --a---- 397672 bytes [18:31 01/08/2013] [18:31 01/08/2013] EDEC0C58566356E7608706462A66D980
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus-HD-2.4\Plus-HD-2.4-buttonutil.exe.vir --a---- 342888 bytes [18:31 01/08/2013] [18:31 01/08/2013] C5610FD59A4AA188F8991110A88ADF7D
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus-HD-2.4\Plus-HD-2.4-buttonutil64.dll.vir --a---- 477544 bytes [18:31 01/08/2013] [18:31 01/08/2013] 14ED000725883A67863B9331C65036D9
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus-HD-2.4\Plus-HD-2.4-buttonutil64.exe.vir --a---- 447336 bytes [18:31 01/08/2013] [18:31 01/08/2013] 471B4F32D70A816E4195B6F7B82F689B
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus-HD-2.4\Plus-HD-2.4-chromeinstaller.exe.vir --a---- 465256 bytes [18:31 01/08/2013] [18:31 01/08/2013] 4C35E49DB24E8190882EE6F6D1A8C900
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus-HD-2.4\Plus-HD-2.4-codedownloader.exe.vir --a---- 481128 bytes [18:31 01/08/2013] [18:31 01/08/2013] 5645BCC4331E2BF4A4670C414BD4E609
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus-HD-2.4\Plus-HD-2.4-enabler.exe.vir --a---- 351080 bytes [18:31 01/08/2013] [18:31 14/10/2013] C9753689E35549D7184238F827DE4A88
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus-HD-2.4\Plus-HD-2.4-firefoxinstaller.exe.vir --a---- 726888 bytes [18:31 01/08/2013] [18:31 01/08/2013] FCCD03140B7BC393F50298C97024DE41
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus-HD-2.4\Plus-HD-2.4-helper.exe.vir --a---- 316264 bytes [18:31 01/08/2013] [18:31 01/08/2013] 1E8F8A944F52914954A311162A0DCA29
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus-HD-2.4\Plus-HD-2.4-updater.exe.vir --a---- 367976 bytes [18:31 01/08/2013] [18:31 01/08/2013] A95F2AB88A3E63066F75180AEFE1B984
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus-HD-2.4\Plus-HD-2.4.ico.vir --a---- 9662 bytes [12:35 22/07/2013] [12:35 22/07/2013] 739B67DAC0C716F3DA123622BACAB424
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Local\DownloadGuide\plus-hd-3-8.exe.vir --a---- 5502592 bytes [21:40 12/11/2013] [21:41 12/11/2013] 0E533A3A860E21323439E012AFB0B74F
C:\AdwCleaner\Quarantine\C\Windows\System32\Tasks\Plus-HD-2.4-chromeinstaller.vir --a---- 4954 bytes [18:31 01/08/2013] [17:19 15/11/2013] 5CDEC6EF342341ECF0FCCE0D4FD74F34
C:\AdwCleaner\Quarantine\C\Windows\System32\Tasks\Plus-HD-2.4-codedownloader.vir --a---- 4246 bytes [18:31 01/08/2013] [17:19 15/11/2013] 8C7BE4C442358FD8310F07506FCB5C4C
C:\AdwCleaner\Quarantine\C\Windows\System32\Tasks\Plus-HD-2.4-enabler.vir --a---- 4144 bytes [18:31 01/08/2013] [17:19 15/11/2013] 17592D1117BA7801C02CCB0F46C34BF1
C:\AdwCleaner\Quarantine\C\Windows\System32\Tasks\Plus-HD-2.4-firefoxinstaller.vir --a---- 4878 bytes [18:31 01/08/2013] [17:19 15/11/2013] FD15C4753599C41FF2B191B60436C3AD
C:\AdwCleaner\Quarantine\C\Windows\System32\Tasks\Plus-HD-2.4-updater.vir --a---- 4334 bytes [18:31 01/08/2013] [17:19 15/11/2013] 05294B42C36C550DDB5AAFE5BAF87F52
C:\AdwCleaner\Quarantine\C\Windows\Tasks\Plus-HD-2.4-chromeinstaller.job.vir --a---- 1912 bytes [18:31 01/08/2013] [22:18 19/11/2013] DD0BA70B04207811CE7410861562D175
C:\AdwCleaner\Quarantine\C\Windows\Tasks\Plus-HD-2.4-codedownloader.job.vir --a---- 1204 bytes [18:31 01/08/2013] [22:18 19/11/2013] AABC1272A5B203D2F03FF6447BF912A8
C:\AdwCleaner\Quarantine\C\Windows\Tasks\Plus-HD-2.4-enabler.job.vir --a---- 1102 bytes [18:31 01/08/2013] [22:18 19/11/2013] A65E9BFC9922FAC8B7ED4A911FD51BB0
C:\AdwCleaner\Quarantine\C\Windows\Tasks\Plus-HD-2.4-firefoxinstaller.job.vir --a---- 1836 bytes [18:31 01/08/2013] [22:18 19/11/2013] 16AA12E22CF4BABC240F5CAB4BF04359
C:\AdwCleaner\Quarantine\C\Windows\Tasks\Plus-HD-2.4-updater.job.vir --a---- 1292 bytes [18:31 01/08/2013] [22:18 19/11/2013] A79D95046B958CCADFA2B6CFD5C250B2

Searching for "*RadioTotal*"
C:\AdwCleaner\Quarantine\C\Program Files (x86)\RadioTotal\RadioTotalToolbarHelper.exe.vir --a---- 86816 bytes [14:03 01/10/2013] [14:03 01/10/2013] 943F313974A830D4634C73BEB8103F5E
C:\AdwCleaner\Quarantine\C\Program Files (x86)\RadioTotal\RadioTotalToolbarHelper1.exe.vir --a---- 86816 bytes [11:55 06/11/2013] [11:55 06/11/2013] 943F313974A830D4634C73BEB8103F5E
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Local\Conduit\CT3317483\RadioTotalAutoUpdateHelper.exe.vir --a---- 2822480 bytes [14:03 01/10/2013] [16:52 15/11/2013] 6C5AAA9022D124C89733D99AB2C80809

Searching for "*Crossrider*"
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\hojmbfiljpkaijkdifoaacbpallpfkkf\1.23.29_0\crossriderManifest.json.vir --a---- 710 bytes [12:31 27/09/2013] [12:31 27/09/2013] 2B8CBCF3D2B1354C683F1082B9F06E8F
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\hojmbfiljpkaijkdifoaacbpallpfkkf\1.23.29_0\js\lib\crossriderAPI.js.vir --a---- 11136 bytes [12:31 27/09/2013] [12:31 27/09/2013] 52A9B60F6516F4D5D0C9191861B025FC
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\hojmbfiljpkaijkdifoaacbpallpfkkf\1.24.48_0\crossriderManifest.json.vir --a---- 400 bytes [17:06 28/08/2013] [17:06 28/08/2013] 2878C92BB2F9B1FA4F568ADF77FAAF30
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\hojmbfiljpkaijkdifoaacbpallpfkkf\1.24.48_0\extensionData\plugins\13_CrossriderAppUtils.js.vir --a---- 5955 bytes [17:06 28/08/2013] [17:06 28/08/2013] A15314F10FA928B5C242EDDC4B91F503
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\hojmbfiljpkaijkdifoaacbpallpfkkf\1.24.48_0\extensionData\plugins\14_CrossriderUtils.js.vir --a---- 12369 bytes [17:06 28/08/2013] [17:06 28/08/2013] 56E07DB48844B5EB4DD57F053D87A38D
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\hojmbfiljpkaijkdifoaacbpallpfkkf\1.24.48_0\extensionData\plugins\78_CrossriderInfo.js.vir --a---- 2220 bytes [17:06 28/08/2013] [17:06 28/08/2013] EC3226E86137F361EEEF8F1244A0225A
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\hojmbfiljpkaijkdifoaacbpallpfkkf\1.24.48_0\js\lib\crossriderAPI.js.vir --a---- 11366 bytes [17:06 28/08/2013] [17:06 28/08/2013] 7B3ADEF52BEDD686D98A3C0F45278020
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Roaming\Mozilla\Firefox\Profiles\xmodr5w8.default\Extensions\ad80235d-5e5a-4a1d-a891-51b66a3e70f8@8f877d80-6977-415f-ac14-b52043838c19.com\skin\crossrider_statusbar.png.vir --a---- 1361 bytes [18:31 28/08/2013] [18:31 28/08/2013] 8B1EB9CB80417EC0022D278A44AB1DC7

Searching for "*QuickStores*"
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\QuickStores.url.vir --a---- 188 bytes [20:56 22/02/2011] [20:56 22/02/2011] B0D28069C92B114F0485054DFB1329B3
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\QuickStores.url.vir --a---- 188 bytes [20:56 22/02/2011] [20:56 22/02/2011] 08DCD2E27F8A0DA3EB8F6BA8C0952DA9
C:\AdwCleaner\Quarantine\C\Windows\assembly\GAC_MSIL\QuickStoresToolbar\1.0.0.0__318d21d4b0463a3b\QuickStoresToolbar.dll.vir --a---- 37624 bytes [20:56 22/02/2011] [20:56 22/02/2011] E8C8AF2E5AAAFB43B348194DBAC7DBD0

Searching for "*DownloadGuide*"
No files found.

Searching for "*PutLocker*"
No files found.

Searching for "*facemoods*"
No files found.

Searching for "*SimplyTech*"
No files found.

Searching for "*DSite*"
C:\AdwCleaner\Quarantine\C\Windows\System32\Tasks\DSite.vir --a---- 3242 bytes [16:18 06/06/2013] [16:18 06/06/2013] 2D20227B4F996CFA00A5373BD6B6204A
C:\AdwCleaner\Quarantine\C\Windows\Tasks\DSite.job.vir --a---- 294 bytes [16:18 06/06/2013] [20:18 26/11/2013] D54B3CAC7A0CEA30E77AC8414AA99C18

Searching for "*PerformerSoft*"
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fwww.performersoft.com%2Ffavicon.png --a---- 690 bytes [09:54 13/01/2013] [09:54 13/01/2013] 683788D668066752842299DD0CC64EEC

Searching for "*Systweak*"
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fpowerbundle.systweak.com%2Ffavicon.png --a---- 268 bytes [06:18 22/10/2013] [06:18 22/10/2013] 824E0A0D67A76942549D7834935B8E17
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fsystweak.com%2Ffavicon.png --a---- 268 bytes [10:15 22/06/2013] [10:15 22/06/2013] 824E0A0D67A76942549D7834935B8E17
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fwww.systweak.com%2Ffavicon.png --a---- 268 bytes [05:45 22/10/2013] [05:45 22/10/2013] 824E0A0D67A76942549D7834935B8E17
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\www.systweak.com.idx --a---- 122 bytes [16:57 07/11/2013] [16:57 07/11/2013] 6E6C48ACEF68153146031EF21E99BD6C

Searching for "*Qtrax*"
C:\AdwCleaner\Quarantine\C\Windows\System32\Tasks\QtraxPlayer.vir --a---- 3814 bytes [16:19 06/06/2013] [16:19 06/06/2013] F74D906816897982077A1AE41CF22386
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fwww.qtrax.com%2Ffavicon.png --a---- 481 bytes [07:39 21/06/2013] [07:39 21/06/2013] 9FB8DA945C2731D11B770698C730270E

Searching for "*GutscheinCodes*"
No files found.

Searching for "*ftdownloader*"
C:\zoek_backup\C_Users_Manuela_AppData_Roaming_Mozilla_Firefox_Profiles_extensions_ftdownloader@ftdownloader.com.xpi.vir --a---- 197580 bytes [21:22 26/11/2013] [14:47 29/11/2012] AC6AF93B48793A3664EBC1B2F750839F

Searching for "*abb@amazon.com*"
No files found.

Searching for "*FastDiscountz*"
C:\zoek_backup\C_Users_Manuela_AppData_Local_FastDiscountz.crx.vir --a---- 72718 bytes [21:22 26/11/2013] [11:18 08/09/2013] 9BB6069751732E2799DCD85D55180FD1

Searching for "*BargainWorkbench*"
C:\zoek_backup\C_Users_Manuela_AppData_Local_BargainWorkbench.crx.vir --a---- 85126 bytes [21:22 26/11/2013] [13:37 04/09/2013] 3FAAF4C412954AFAAAFC4FC0885849E1
C:\zoek_backup\C_Users_Manuela_AppData_Roaming_Mozilla_Firefox_Profiles_extensions_extensions_staged\{8eaa2500-4118-4c33-9927-988702ba63bd}\content\bargainworkbench.xul --a---- 541 bytes [21:22 26/11/2013] [18:41 19/08/2013] 07ABD2C49D0A4D8DA1C74310970CEBAC
C:\zoek_backup\C_Users_Manuela_AppData_Roaming_Mozilla_Firefox_Profiles_xmodr5w8.default_extensions_staged\{8eaa2500-4118-4c33-9927-988702ba63bd}\content\bargainworkbench.xul --a---- 541 bytes [21:22 26/11/2013] [18:41 19/08/2013] 07ABD2C49D0A4D8DA1C74310970CEBAC

Searching for "*fmlgoencnlndpglbocajlimaikjohmab*"
No files found.

========== folderfind ==========

Searching for "*IBUpdater*"
No folders found.

Searching for "*Wajam*"
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Wajam d------ [20:22 26/11/2013]
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Local\Wajam d------ [20:22 26/11/2013]
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam d------ [20:23 26/11/2013]
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam\Uninstall Wajam d------ [20:23 26/11/2013]

Searching for "*Babylon*"
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Roaming\Babylon d------ [20:23 26/11/2013]

Searching for "*Conduit*"
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Conduit d------ [20:22 26/11/2013]
C:\AdwCleaner\Quarantine\C\Program Files (x86)\NCH Software\Components\NCHToolbars\conduit d------ [20:22 26/11/2013]
C:\AdwCleaner\Quarantine\C\ProgramData\Conduit d------ [20:22 26/11/2013]
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Local\Conduit d------ [20:22 26/11/2013]
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\Conduit d------ [20:22 26/11/2013]
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\Repository\conduit_CT3317483_CT3317483 d------ [20:23 26/11/2013]
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal\Repository\conduit_CT3317483_de d------ [20:23 26/11/2013]
C:\Users\AppData\LocalLow\Conduit d------ [19:04 24/01/2011]

Searching for "*NCH Software*"
C:\AdwCleaner\Quarantine\C\Program Files (x86)\NCH Software d------ [20:22 26/11/2013]
C:\AdwCleaner\Quarantine\C\ProgramData\NCH Software d------ [20:22 26/11/2013]
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Roaming\NCH Software d------ [20:23 26/11/2013]
C:\Windows\System32\Tasks\NCH Software d------ [09:10 26/04/2011]

Searching for "*Tarma Installer*"
C:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer d------ [20:22 26/11/2013]

Searching for "*DriverScanner*"
No folders found.

Searching for "*AddLyrics*"
No folders found.

Searching for "*Amazon Browser Bar*"
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Amazon Browser Bar d------ [20:22 26/11/2013]
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Local\Amazon Browser Bar d------ [20:22 26/11/2013]

Searching for "*file scout*"
C:\AdwCleaner\Quarantine\C\Program Files (x86)\file scout d------ [20:22 26/11/2013]
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Roaming\file scout d------ [20:23 26/11/2013]

Searching for "*FreeCompressor*"
C:\AdwCleaner\Quarantine\C\Program Files (x86)\FreeCompressor d------ [20:22 26/11/2013]
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Local\FreeCompressor Air d------ [20:22 26/11/2013]
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Roaming\FreeCompressor d------ [20:23 26/11/2013]

Searching for "*goforfiles*"
C:\AdwCleaner\Quarantine\C\Program Files (x86)\goforfiles d------ [20:22 26/11/2013]
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Roaming\goforfiles d------ [20:23 26/11/2013]

Searching for "*LyricsDroid*"
C:\AdwCleaner\Quarantine\C\Program Files (x86)\LyricsDroid d------ [20:22 26/11/2013]

Searching for "*SoftwareUpdater*"
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SoftwareUpdater d------ [20:22 26/11/2013]
C:\Users\Manuela\AppData\Local\Software_Updater\SoftwareUpdater.Ui.exe_Url_v5tv5iuxz304n4btkfajkfvuwz3cchwi d------ [16:57 07/11/2013]

Searching for "*WinSecurity*"
C:\AdwCleaner\Quarantine\C\Program Files (x86)\WinSecurity d------ [20:22 26/11/2013]

Searching for "*Plus-HD*"
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus-HD-2.4 d------ [20:22 26/11/2013]

Searching for "*RadioTotal*"
C:\AdwCleaner\Quarantine\C\Program Files (x86)\RadioTotal d------ [20:22 26/11/2013]
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\RadioTotal d------ [20:23 26/11/2013]

Searching for "*Crossrider*"
No folders found.

Searching for "*QuickStores*"
C:\AdwCleaner\Quarantine\C\Windows\assembly\GAC_MSIL\QuickStoresToolbar d------ [20:22 26/11/2013]

Searching for "*DownloadGuide*"
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Local\DownloadGuide d------ [20:22 26/11/2013]

Searching for "*PutLocker*"
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Local\PutLockerDownloader d------ [20:22 26/11/2013]

Searching for "*facemoods*"
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\facemoods.com d------ [20:22 26/11/2013]
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\facemoods.com\facemoods d------ [20:22 26/11/2013]

Searching for "*SimplyTech*"
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\SimplyTech d------ [20:22 26/11/2013]

Searching for "*DSite*"
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Roaming\DSite d------ [20:23 26/11/2013]

Searching for "*PerformerSoft*"
No folders found.

Searching for "*Systweak*"
No folders found.

Searching for "*Qtrax*"
No folders found.

Searching for "*GutscheinCodes*"
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\LocalLow\GutscheinCodes d------ [20:22 26/11/2013]

Searching for "*ftdownloader*"
C:\AdwCleaner\Quarantine\C\Users\Manuela\AppData\Local\PutLockerDownloader\FTDownloader.exe_Url_pbohkzvgtsuxit2rcc3uu50tvv1mqx1b d------ [20:22 26/11/2013]

Searching for "*abb@amazon.com*"
C:\zoek_backup\C_Users_Manuela_AppData_Roaming_Mozilla_Firefox_Profiles_xmodr5w8.default_extensions_abb@amazon.com d-a---- [21:25 26/11/2013]

Searching for "*FastDiscountz*"
No folders found.

Searching for "*BargainWorkbench*"
No folders found.

Searching for "*fmlgoencnlndpglbocajlimaikjohmab*"
C:\zoek_backup\C_Users_Manuela_AppData_Local_Google_Chrome_User Data_Default_Extensions_fmlgoencnlndpglbocajlimaikjohmab d-a---- [21:26 26/11/2013]

========== regfind ==========

Searching for "IBUpdater"
No data found.

Searching for "Wajam"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\wajam_download_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\wajam_download_RASMANCS]

Searching for "Babylon"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
"DllName"="BabylonToolbar.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}]
"DllName"="BabylonToolbar.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
"DllName"="BabylonToolbarTlbr.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
"DllName"="BabylonToolbar.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}]
"DllName"="BabylonToolbar.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
"DllName"="BabylonToolbarTlbr.dll"

Searching for "Conduit"
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476]
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\AppRegisterUsage]
"ServiceUrl"="hxxp://apps.usage.conduit-services.com/AppOperations/AppRegistration.ashx"
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\AppsMetaData]
"ServiceUrl"="hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=EB_TOOLBAR_ID"
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\AppsSettings]
"ServiceUrl"="hxxp://mystuff.conduit-services.com/MyStuffService.ashx?ComponentId=EB_COMP_ID"
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\AppTrackingFirstTime]
"ServiceUrl"="hxxp://tracking.usage.app.conduit-services.com/FirstTime.ashx?current=EB_APPTRACKING_CURRENT_STATE"
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\AppTrackingUsage]
"ServiceUrl"="hxxp://tracking.usage.app.conduit-services.com/Usage.ashx"
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\AppUninstallUsage]
"ServiceUrl"="hxxp://apps.usage.conduit-services.com/AppOperations/AppUninstall.ashx"
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\BrowserToolbarsInfo]
"ServiceUrl"="hxxp://counting.usage.toolbar.conduit-services.com/usage.ashx"
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\ClientErrorLog]
"ServiceUrl"="hxxp://clientlog.users.conduit.com/ClientDiagnostics.asmx?op=ReportDiagnosticsEvent"
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\DynamicDialogs]
"ServiceUrl"="hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=EB_TOOLBAR_VERSION"
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\GottenAppsContextMenu]
"ServiceUrl"="hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&locale=EB_LOCALE"
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\OtherAppsContextMenu]
"ServiceUrl"="hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&locale=EB_LOCALE"
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\SharedAppsContextMenu]
"ServiceUrl"="hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&locale=EB_LOCALE"
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\ToolbarAppComponentUsage]
"ServiceUrl"="hxxp://component.usage.toolbar.conduit-services.com/ToolbarComponentUsage.ashx"
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\ToolbarAppUsage]
"ServiceUrl"="hxxp://usage.toolbar.conduit-services.com/ToolbarUsage.ashx"
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\ToolbarComponentUsage]
"ServiceUrl"="hxxp://component.usage.toolbar.conduit-services.com/ToolbarComponentUsage.ashx"
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\ToolbarContextMenu]
"ServiceUrl"="hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&locale=EB_LOCALE"
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\ToolbarLogin]
"ServiceUrl"="hxxp://login.toolbar.conduit-services.com/Login.ashx"
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\ToolbarSettings]
"ServiceUrl"="hxxp://settings.toolbar.search.conduit.com/root/EB_TOOLBAR_ID/EB_ORIGINAL_CTID"
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\ToolbarSettingsForPublisher]
"ServiceUrl"="hxxp://settings.publisher.toolbar.conduit-services.com/?ctid=EB_TOOLBAR_ID&octid=EB_ORIGINAL_CTID"
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\ToolbarTranslation]
"ServiceUrl"="hxxp://translation.toolbar.conduit-services.com/?locale=EB_LOCALE"
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\ToolbarUsage]
"ServiceUrl"="hxxp://usage.toolbar.conduit-services.com/ToolbarUsage.ashx"
[HKEY_CURRENT_USER\Software\AppDataLow\Software\softonic-de3\toolbar\Repository\conduit_CT2431245]
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476]
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\AppRegisterUsage]
"ServiceUrl"="hxxp://apps.usage.conduit-services.com/AppOperations/AppRegistration.ashx"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\AppsMetaData]
"ServiceUrl"="hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=EB_TOOLBAR_ID"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\AppsSettings]
"ServiceUrl"="hxxp://mystuff.conduit-services.com/MyStuffService.ashx?ComponentId=EB_COMP_ID"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\AppTrackingFirstTime]
"ServiceUrl"="hxxp://tracking.usage.app.conduit-services.com/FirstTime.ashx?current=EB_APPTRACKING_CURRENT_STATE"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\AppTrackingUsage]
"ServiceUrl"="hxxp://tracking.usage.app.conduit-services.com/Usage.ashx"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\AppUninstallUsage]
"ServiceUrl"="hxxp://apps.usage.conduit-services.com/AppOperations/AppUninstall.ashx"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\BrowserToolbarsInfo]
"ServiceUrl"="hxxp://counting.usage.toolbar.conduit-services.com/usage.ashx"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\ClientErrorLog]
"ServiceUrl"="hxxp://clientlog.users.conduit.com/ClientDiagnostics.asmx?op=ReportDiagnosticsEvent"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\DynamicDialogs]
"ServiceUrl"="hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=EB_TOOLBAR_VERSION"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\GottenAppsContextMenu]
"ServiceUrl"="hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&locale=EB_LOCALE"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\OtherAppsContextMenu]
"ServiceUrl"="hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&locale=EB_LOCALE"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\SharedAppsContextMenu]
"ServiceUrl"="hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&locale=EB_LOCALE"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\ToolbarAppComponentUsage]
"ServiceUrl"="hxxp://component.usage.toolbar.conduit-services.com/ToolbarComponentUsage.ashx"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\ToolbarAppUsage]
"ServiceUrl"="hxxp://usage.toolbar.conduit-services.com/ToolbarUsage.ashx"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\ToolbarComponentUsage]
"ServiceUrl"="hxxp://component.usage.toolbar.conduit-services.com/ToolbarComponentUsage.ashx"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\ToolbarContextMenu]
"ServiceUrl"="hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&locale=EB_LOCALE"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\ToolbarLogin]
"ServiceUrl"="hxxp://login.toolbar.conduit-services.com/Login.ashx"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\ToolbarSettings]
"ServiceUrl"="hxxp://settings.toolbar.search.conduit.com/root/EB_TOOLBAR_ID/EB_ORIGINAL_CTID"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\ToolbarSettingsForPublisher]
"ServiceUrl"="hxxp://settings.publisher.toolbar.conduit-services.com/?ctid=EB_TOOLBAR_ID&octid=EB_ORIGINAL_CTID"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\ToolbarTranslation]
"ServiceUrl"="hxxp://translation.toolbar.conduit-services.com/?locale=EB_LOCALE"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\AppDataLow\Software\Freeware.de\toolbar\Repository\conduit_CT2736476\ToolbarUsage]
"ServiceUrl"="hxxp://usage.toolbar.conduit-services.com/ToolbarUsage.ashx"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\AppDataLow\Software\softonic-de3\toolbar\Repository\conduit_CT2431245]

Searching for "NCH Software"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\42c808cd_0]
@="{0.0.0.00000000}.{c54f4c38-31ef-4cb0-884d-47a6726c355d}|\Device\HarddiskVolume3\Program Files (x86)\NCH Software\Prism\prism.exe%b{00000000-0000-0000-0000-000000000000}"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\c11bda6f_0]
@="{0.0.0.00000000}.{c54f4c38-31ef-4cb0-884d-47a6726c355d}|\Device\HarddiskVolume3\Program Files (x86)\NCH Software\VideoPad\videopad.exe%b{00000000-0000-0000-0000-000000000000}"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\dace8ee7_0]
@="{0.0.0.00000000}.{c54f4c38-31ef-4cb0-884d-47a6726c355d}|\Device\HarddiskVolume3\Program Files (x86)\NCH Software\WavePad\wavepad.exe%b{00000000-0000-0000-0000-000000000000}"
[HKEY_CURRENT_USER\Software\NCH Swift Sound\Components\deshaker]
"Path"="C:\Program Files (x86)\NCH Software\Components\deshaker\deshaker.vdf"
[HKEY_CURRENT_USER\Software\NCH Swift Sound\Components\ffmpeg10]
"Path"="C:\Program Files (x86)\NCH Software\Components\ffmpeg10\avcodec-52.dll"
[HKEY_CURRENT_USER\Software\NCH Swift Sound\Components\ffmpeg151]
"Path"="C:\Users\Manuela\AppData\Roaming\NCH Software\Components\ffmpeg151\avcodec-53.nch.dll"
[HKEY_CURRENT_USER\Software\NCH Swift Sound\Components\ffmpeg9]
"Path"="C:\Users\Manuela\AppData\Roaming\NCH Software\Components\ffmpeg9\avcodec-52.dll"
[HKEY_CURRENT_USER\Software\NCH Swift Sound\Components\mp3el2]
"Path"="C:\Program Files (x86)\NCH Software\Components\mp3el2\lame.exe"
[HKEY_CURRENT_USER\Software\NCH Swift Sound\Components\x264]
"Path"="C:\Program Files (x86)\NCH Software\Components\x264\x264.exe"
[HKEY_CURRENT_USER\Software\NCH Swift Sound\Components\x264enc2]
"Path"="C:\Program Files (x86)\NCH Software\Components\x264enc2\x264enc2.exe"
[HKEY_CURRENT_USER\Software\NCH Swift Sound\Components\x264enc4]
"Path"="C:\Program Files (x86)\NCH Software\Components\x264enc4\x264enc4.exe"
[HKEY_CURRENT_USER\Software\Classes\AcroExch.Document\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\PhotoStage\photostage.exe" -extfind Doxillion "%L""
[HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Program Files (x86)\NCH Software\VideoPad\videopad.exe"="VideoPad Videobearbeitungs-Software"
[HKEY_CURRENT_USER\Software\Classes\Nero.BurningROM.11.iso.1\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\PhotoStage\photostage.exe" -extfind ExpressBurn "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\bmsfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" -extfind BMS "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\divxfile\Shell\Convert with Prism Video File Converter\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\flvfile\Shell\Convert with Prism Video File Converter\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mkvfile\Shell\Convert with Prism Video File Converter\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Nero.BurningROM.11.iso.1\shell\Extract with Express Zip\command]
@=""C:\Program Files (x86)\NCH Software\BroadCam\broadcam.exe" -extfind ExpressZip "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\OOBE.Document\shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PDVD8VOBfile\shell\Convert with Prism Video File Converter\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.3gp\Shell\Convert with Prism Video File Converter\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.asf\Shell\Convert with Prism Video File Converter\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.avi\Shell\Convert with Prism Video File Converter\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.divx\Shell\Convert with Prism Video File Converter\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ebp\Shell\Mit Express Burn brennen\command]
@=""C:\Program Files (x86)\NCH Software\ExpressBurn\expressburn.exe" -load "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.flv\Shell\Convert with Prism Video File Converter\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.m4v\Shell\Convert with Prism Video File Converter\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.mkv\Shell\Convert with Prism Video File Converter\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.mod\Shell\Convert with Prism Video File Converter\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.mov\Shell\Convert with Prism Video File Converter\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.mp4\Shell\Convert with Prism Video File Converter\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.mpe\Shell\Convert with Prism Video File Converter\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.mpeg\Shell\Convert with Prism Video File Converter\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.mpg\Shell\Convert with Prism Video File Converter\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.mts\Shell\Convert with Prism Video File Converter\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.vob\Shell\Convert with Prism Video File Converter\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wmv\Shell\Convert with Prism Video File Converter\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\Shell\Diashow erstellen mit PhotoStage Diashow-Ersteller\command]
@=""C:\Program Files (x86)\NCH Software\PhotoStage\photostage.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\vpjfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" -extfind VideoPad "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\Mit Express Zip extrahieren\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" -extfind ExpressZip "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.3GP\shell\Convert with Prism Video File Converter\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.ASF\shell\Convert with Prism Video File Converter\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AVI\shell\Convert with Prism Video File Converter\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.M2TS\shell\Convert with Prism Video File Converter\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MOV\shell\Convert with Prism Video File Converter\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MOV\shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" -extfind VideoPad "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MP4\shell\Convert with Prism Video File Converter\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MP4\shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" -extfind VideoPad "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MPEG\shell\Convert with Prism Video File Converter\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WMV\shell\Convert with Prism Video File Converter\command]
@=""C:\Program Files (x86)\NCH Software\Prism\prism.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers]
"C:\Program Files (x86)\NCH Software\Prism\uninst.exe"="VISTARTM"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0933D3DF-7386-42D6-A0D2-6D6F97906BAF}]
"Path"="\NCH Software\broadcamDowngrade"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6D33D801-0C24-4200-A59E-F683F87CB536}]
"Path"="\NCH Software\broadcamShakeIcon"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\NCH Software]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BroadCam]
"Publisher"="NCH Software"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BroadCam]
"UninstallString"="C:\Program Files (x86)\NCH Software\BroadCam\uninst.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BroadCam]
"DisplayIcon"="C:\Program Files (x86)\NCH Software\BroadCam\uninst.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BroadCam]
"InstallLocation"="C:\Program Files (x86)\NCH Software\BroadCam"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\NCH Swift Sound\Components\deshaker]
"Path"="C:\Program Files (x86)\NCH Software\Components\deshaker\deshaker.vdf"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\NCH Swift Sound\Components\ffmpeg10]
"Path"="C:\Program Files (x86)\NCH Software\Components\ffmpeg10\avcodec-52.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\NCH Swift Sound\Components\mp3el2]
"Path"="C:\Program Files (x86)\NCH Software\Components\mp3el2\lame.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\NCH Swift Sound\Components\x264]
"Path"="C:\Program Files (x86)\NCH Software\Components\x264\x264.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\NCH Swift Sound\Components\x264enc2]
"Path"="C:\Program Files (x86)\NCH Software\Components\x264enc2\x264enc2.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\NCH Swift Sound\Components\x264enc4]
"Path"="C:\Program Files (x86)\NCH Software\Components\x264enc4\x264enc4.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BroadCamService]
"ImagePath"=""C:\Program Files (x86)\NCH Software\BroadCam\broadcam.exe" -service"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{4E0B0C27-719D-41D9-BB32-1C5C69CBB4FB}"="v2.10|Action=Allow|Active=TRUE|Dir=Out|Protocol=17|Profile=Domain|Profile=Private|LPort=4100|App=C:\Program Files (x86)\NCH Software\BroadCam\broadcam.exe|Name=BroadCam Video Streaming Server|Desc=uPNP Router Control Port|EmbedCtxt=BroadCam|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{D971E7C3-4053-407B-B3D6-3EFFEB71BF33}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Domain|Profile=Private|LPort=4100|App=C:\Program Files (x86)\NCH Software\BroadCam\broadcam.exe|Name=BroadCam Video Streaming Server|Desc=uPNP Router Control Port|EmbedCtxt=BroadCam|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\BroadCamService]
"ImagePath"=""C:\Program Files (x86)\NCH Software\BroadCam\broadcam.exe" -service"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{4E0B0C27-719D-41D9-BB32-1C5C69CBB4FB}"="v2.10|Action=Allow|Active=TRUE|Dir=Out|Protocol=17|Profile=Domain|Profile=Private|LPort=4100|App=C:\Program Files (x86)\NCH Software\BroadCam\broadcam.exe|Name=BroadCam Video Streaming Server|Desc=uPNP Router Control Port|EmbedCtxt=BroadCam|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{D971E7C3-4053-407B-B3D6-3EFFEB71BF33}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Domain|Profile=Private|LPort=4100|App=C:\Program Files (x86)\NCH Software\BroadCam\broadcam.exe|Name=BroadCam Video Streaming Server|Desc=uPNP Router Control Port|EmbedCtxt=BroadCam|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BroadCamService]
"ImagePath"=""C:\Program Files (x86)\NCH Software\BroadCam\broadcam.exe" -service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{4E0B0C27-719D-41D9-BB32-1C5C69CBB4FB}"="v2.10|Action=Allow|Active=TRUE|Dir=Out|Protocol=17|Profile=Domain|Profile=Private|LPort=4100|App=C:\Program Files (x86)\NCH Software\BroadCam\broadcam.exe|Name=BroadCam Video Streaming Server|Desc=uPNP Router Control Port|EmbedCtxt=BroadCam|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{D971E7C3-4053-407B-B3D6-3EFFEB71BF33}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Domain|Profile=Private|LPort=4100|App=C:\Program Files (x86)\NCH Software\BroadCam\broadcam.exe|Name=BroadCam Video Streaming Server|Desc=uPNP Router Control Port|EmbedCtxt=BroadCam|"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\42c808cd_0]
@="{0.0.0.00000000}.{c54f4c38-31ef-4cb0-884d-47a6726c355d}|\Device\HarddiskVolume3\Program Files (x86)\NCH Software\Prism\prism.exe%b{00000000-0000-0000-0000-000000000000}"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\c11bda6f_0]
@="{0.0.0.00000000}.{c54f4c38-31ef-4cb0-884d-47a6726c355d}|\Device\HarddiskVolume3\Program Files (x86)\NCH Software\VideoPad\videopad.exe%b{00000000-0000-0000-0000-000000000000}"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\dace8ee7_0]
@="{0.0.0.00000000}.{c54f4c38-31ef-4cb0-884d-47a6726c355d}|\Device\HarddiskVolume3\Program Files (x86)\NCH Software\WavePad\wavepad.exe%b{00000000-0000-0000-0000-000000000000}"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\NCH Swift Sound\Components\deshaker]
"Path"="C:\Program Files (x86)\NCH Software\Components\deshaker\deshaker.vdf"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\NCH Swift Sound\Components\ffmpeg10]
"Path"="C:\Program Files (x86)\NCH Software\Components\ffmpeg10\avcodec-52.dll"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\NCH Swift Sound\Components\ffmpeg151]
"Path"="C:\Users\Manuela\AppData\Roaming\NCH Software\Components\ffmpeg151\avcodec-53.nch.dll"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\NCH Swift Sound\Components\ffmpeg9]
"Path"="C:\Users\Manuela\AppData\Roaming\NCH Software\Components\ffmpeg9\avcodec-52.dll"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\NCH Swift Sound\Components\mp3el2]
"Path"="C:\Program Files (x86)\NCH Software\Components\mp3el2\lame.exe"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\NCH Swift Sound\Components\x264]
"Path"="C:\Program Files (x86)\NCH Software\Components\x264\x264.exe"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\NCH Swift Sound\Components\x264enc2]
"Path"="C:\Program Files (x86)\NCH Software\Components\x264enc2\x264enc2.exe"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\NCH Swift Sound\Components\x264enc4]
"Path"="C:\Program Files (x86)\NCH Software\Components\x264enc4\x264enc4.exe"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\Classes\AcroExch.Document\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\PhotoStage\photostage.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Program Files (x86)\NCH Software\VideoPad\videopad.exe"="VideoPad Videobearbeitungs-Software"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\Classes\Nero.BurningROM.11.iso.1\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\PhotoStage\photostage.exe" -extfind ExpressBurn "%L""
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001_Classes\AcroExch.Document\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\PhotoStage\photostage.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Program Files (x86)\NCH Software\VideoPad\videopad.exe"="VideoPad Videobearbeitungs-Software"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001_Classes\Nero.BurningROM.11.iso.1\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\PhotoStage\photostage.exe" -extfind ExpressBurn "%L""

Searching for "Tarma Installer"
No data found.

Searching for "DriverScanner"
No data found.

Searching for "AddLyrics"
No data found.

Searching for "Amazon Browser Bar"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{008f6853-9cb4-41c5-a950-39d55e5e06ba}\InprocServer32]
@="C:\Program Files (x86)\Amazon Browser Bar\AmazonBrowserBar.3.0.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{87BEF026-9269-413C-A5B3-11F35451380E}\LocalServer32]
@=""C:\Program Files (x86)\Amazon Browser Bar\AmazonBrowserBarSSB.3.0.dll""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8D03FA45-4B8C-4427-BE67-EE8885147151}\InProcServer32]
@="C:\Program Files (x86)\Amazon Browser Bar\AlxSSBPS.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Amazon Browser Settings]
"UninstallString"=""C:\Program Files (x86)\Amazon Browser Bar\uninstall.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Amazon Browser Settings]
"DisplayIcon"="C:\Program Files (x86)\Amazon Browser Bar\uninstall.ico"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{008f6853-9cb4-41c5-a950-39d55e5e06ba}\InprocServer32]
@="C:\Program Files (x86)\Amazon Browser Bar\AmazonBrowserBar.3.0.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{87BEF026-9269-413C-A5B3-11F35451380E}\LocalServer32]
@=""C:\Program Files (x86)\Amazon Browser Bar\AmazonBrowserBarSSB.3.0.dll""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{8D03FA45-4B8C-4427-BE67-EE8885147151}\InProcServer32]
@="C:\Program Files (x86)\Amazon Browser Bar\AlxSSBPS.dll"

Searching for "file scout"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\filescout\command]
@=""C:\Program Files (x86)\File Scout\filescout.exe" /sc "%1""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\command]
@=""C:\Program Files (x86)\File Scout\filescout.exe" /open "%1""

Searching for "FreeCompressor"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\FreeCompressor\"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\FreeCompressor-setup_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\FreeCompressor-setup_RASMANCS]

Searching for "goforfiles"
[HKEY_CURRENT_USER\Software\GoforFiles]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\GoforFiles]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\GoforFiles]
"install_dir"="C:\Program Files (x86)\GoforFiles"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\GoforFiles_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\GoforFiles_RASMANCS]
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\GoforFiles]

Searching for "LyricsDroid"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{77a60bed-26f5-4621-8489-673aead41feb}]
"DisplayName"="LyricsDroid"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{77a60bed-26f5-4621-8489-673aead41feb}]
"UninstallString"="C:\Program Files (x86)\LyricsDroid\Uninstall.exe"

Searching for "SoftwareUpdater"
[HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Program Files (x86)\SoftwareUpdater\SoftwareUpdater.Ui.exe"="Software Updater"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SoftwareUpdater_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SoftwareUpdater_RASMANCS]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\SoftwareUpdater\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\93EA40F4CAE1A3547BC8B12F333055FE\Features]
"SoftwareUpdater"="ProductFeature"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Program Files (x86)\SoftwareUpdater\SoftwareUpdater.Ui.exe"="Software Updater"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Program Files (x86)\SoftwareUpdater\SoftwareUpdater.Ui.exe"="Software Updater"

Searching for "WinSecurity"
No data found.

Searching for "Plus-HD"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1ABADC08-47CB-4289-9BE2-3902359F9298}]
"Path"="\Plus-HD-2.4-firefoxinstaller"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{71DB5D66-414E-4EC5-9CFC-81ED9D394A28}]
"Path"="\Plus-HD-2.4-codedownloader"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7F4977F7-57DD-49FE-8C3B-463D8C5A320A}]
"Path"="\Plus-HD-2.4-updater"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{86B89009-CE71-41E3-AABF-9C1E7FB76B54}]
"Path"="\Plus-HD-2.4-chromeinstaller"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9583011C-949A-4739-8E84-5345002ED128}]
"Path"="\Plus-HD-2.4-enabler"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Plus-HD-2.4-chromeinstaller]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Plus-HD-2.4-codedownloader]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Plus-HD-2.4-enabler]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Plus-HD-2.4-firefoxinstaller]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Plus-HD-2.4-updater]

Searching for "RadioTotal"
No data found.

Searching for "Crossrider"
No data found.

Searching for "QuickStores"
No data found.

Searching for "DownloadGuide"
No data found.

Searching for "PutLocker"
No data found.

Searching for "facemoods"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-868785299-726797094-2297327714-1001\Software\facemoods.com]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-868785299-726797094-2297327714-1001\Software\facemoods.com\facemoods]
[HKEY_CURRENT_USER\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\facemoods.com]
[HKEY_CURRENT_USER\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\facemoods.com\facemoods]
[HKEY_CURRENT_USER\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\facemoods.com\facemoods\Instl]
"InstallDir"="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.6"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-868785299-726797094-2297327714-1001\Software\facemoods.com]
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-868785299-726797094-2297327714-1001\Software\facemoods.com\facemoods]
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\facemoods.com]
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\facemoods.com\facemoods]
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\facemoods.com\facemoods\Instl]
"InstallDir"="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.6"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001_Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\facemoods.com]
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001_Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\facemoods.com\facemoods]
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001_Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\facemoods.com\facemoods\Instl]
"InstallDir"="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.6"

Searching for "SimplyTech"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"newtab"="%appdata%\SimplyTech\home\home.htm"

Searching for "DSite"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BFAD62EE-9D54-4b2a-BF3B-76F90697BD2A}]
@="IE Shell Rebar BandSite"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECD4FC4D-521C-11D0-B792-00A0C90312E1}]
@="Shell Rebar BandSite"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4CF504B0-DE96-11D0-8B3F-00A0C911E8E5}]
@="IBandSite"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFAD62EE-9D54-4b2a-BF3B-76F90697BD2A}]
@="IE Shell Rebar BandSite"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ECD4FC4D-521C-11D0-B792-00A0C90312E1}]
@="Shell Rebar BandSite"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4CF504B0-DE96-11D0-8B3F-00A0C911E8E5}]
@="IBandSite"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation]
"UnattendSites"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\UnattendBackup\AllowedSites]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\UnattendBackup\AllowedSites]
"AllowedSites"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\UnattendBackup\SuggestedSitesEnabled]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\UnattendBackup\TrustedSites]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\UnattendBackup\TrustedSites]
"TrustedSites"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Unattend]
"TrustedSites"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{059BC6B5-C13B-474A-9342-29A7D77FE32C}]
"Path"="\DSite"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DSite]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\BrowserEmulation]
"UnattendSites"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\UnattendBackup\AllowedSites]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\UnattendBackup\AllowedSites]
"AllowedSites"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\UnattendBackup\SuggestedSitesEnabled]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\UnattendBackup\TrustedSites]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\UnattendBackup\TrustedSites]
"TrustedSites"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Unattend]
"TrustedSites"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{BFAD62EE-9D54-4b2a-BF3B-76F90697BD2A}]
@="IE Shell Rebar BandSite"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{ECD4FC4D-521C-11D0-B792-00A0C90312E1}]
@="Shell Rebar BandSite"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{4CF504B0-DE96-11D0-8B3F-00A0C911E8E5}]
@="IBandSite"

Searching for "PerformerSoft"
No data found.

Searching for "Systweak"
No data found.

Searching for "Qtrax"
[HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\D14143D5782BEE842A45208B63A8E465]
"ProductName"="Qtrax Player"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{42EE63EA-1AD5-445C-8871-59536CBEE7D2}]
"Path"="\QtraxPlayer"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\QtraxPlayer]
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\Microsoft\Installer\Products\D14143D5782BEE842A45208B63A8E465]
"ProductName"="Qtrax Player"

Searching for "GutscheinCodes"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\GutscheinCodes.DLL]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\GutscheinCodes.DLL]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\AppID\GutscheinCodes.DLL]

Searching for "ftdownloader"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\ab6fa856_0]
@="{0.0.0.00000000}.{c54f4c38-31ef-4cb0-884d-47a6726c355d}|\Device\HarddiskVolume3\Program Files (x86)\FTDownloader.com\FTDownloader.exe%b{00000000-0000-0000-0000-000000000000}"
[HKEY_USERS\S-1-5-21-868785299-726797094-2297327714-1001\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\ab6fa856_0]
@="{0.0.0.00000000}.{c54f4c38-31ef-4cb0-884d-47a6726c355d}|\Device\HarddiskVolume3\Program Files (x86)\FTDownloader.com\FTDownloader.exe%b{00000000-0000-0000-0000-000000000000}"

Searching for "abb@amazon.com"
No data found.

Searching for "FastDiscountz"
No data found.

Searching for "BargainWorkbench"
No data found.

Searching for "fmlgoencnlndpglbocajlimaikjohmab"
No data found.

Searching for " "
[HKEY_LOCAL_MACHINE\SOFTWARE\Canon\WIA\Devices\MP630 series]
"ProductId"="MP630 "
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\Microsoft.PowerShell]
"ConfigXML"=" <PlugInConfiguration xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Name="microsoft.powershell" Filename="%windir%\system32\pwrshplugin.dll" SDKVersion="1" XmlRenderingType="text" > <InitializationParameters> <Param Name="PSVersion" Value="2.0"/> </InitializationParameters> <Resources> <Resource ResourceUri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell" SupportsOptions="true" ExactMatch="true"> <Security xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Uri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell" ExactMatch="true" Sddl="O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)"/> <Capability Type="Shell"/> </Resource> </Res
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\Microsoft.PowerShell32]
"ConfigXML"="<PlugInConfiguration xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Name="microsoft.powershell32" Filename="%windir%\system32\pwrshplugin.dll" SDKVersion="1" XmlRenderingType="text" Architecture="32" > <InitializationParameters> <Param Name="PSVersion" Value="2.0"/> </InitializationParameters> <Resources> <Resource ResourceUri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell32" SupportsOptions="true" ExactMatch="true"> <Security xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Uri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell32" ExactMatch="true" Sddl="O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)"/>
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_&REV_0.00#11112658006110&0#]
"DeviceDesc"=" "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_MD86371&PROD_MD86371&REV_0110#60852111 B01063&0#]
"DeviceDesc"="MD86371 "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_SAMSUNG&PROD_S6802&REV_0000#7&7BCF4CF& 0&S6802084D306F&0#]
"DeviceDesc"="S6802 "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_SAMSUNG&PROD_S6802&REV_0000#S6802084D3 06F&0#]
"DeviceDesc"="S6802 "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_SIGMATEL&PROD_MSCN&REV_0100#23DE913C35 80C595&0#]
"DeviceDesc"="MSCN "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_USB2.0&PROD_DISK&REV_1.00#5421DDB57D0B 5093&0#]
"DeviceDesc"="Disk "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_&REV_0.00#11112658006110&0#]
"DeviceDesc"=" "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_MD86371&PROD_MD86371&REV_0110#60852111 B01063&0#]
"DeviceDesc"="MD86371 "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_SAMSUNG&PROD_S6802&REV_0000#7&7BCF4CF& 0&S6802084D306F&0#]
"DeviceDesc"="S6802 "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_SAMSUNG&PROD_S6802&REV_0000#S6802084D3 06F&0#]
"DeviceDesc"="S6802 "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_SIGMATEL&PROD_MSCN&REV_0100#23DE913C35 80C595&0#]
"DeviceDesc"="MSCN "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_USB2.0&PROD_DISK&REV_1.00#5421DDB57D0B 5093&0#]
"DeviceDesc"="Disk "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_&REV_0.00#11112658006110&0#]
"DeviceDesc"=" "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_MD86371&PROD_MD86371&REV_0110#6085 2111B01063&0#]
"DeviceDesc"="MD86371 "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_SAMSUNG&PROD_S6802&REV_0000#7&7BCF 4CF&0&S6802084D306F&0#]
"DeviceDesc"="S6802 "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_SAMSUNG&PROD_S6802&REV_0000#S68020 84D306F&0#]
"DeviceDesc"="S6802 "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_SIGMATEL&PROD_MSCN&REV_0100#23DE91 3C3580C595&0#]
"DeviceDesc"="MSCN "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_USB2.0&PROD_DISK&REV_1.00#5421DDB5 7D0B5093&0#]
"DeviceDesc"="Disk "

-= EOF =-

M-K-D-B 28.11.2013 17:18
Servus,



du hast u.a. 2 Virenscanner, da braucht man sich nicht wundern, wenn der Rechner langsam ist. ;)
Berichte mir bitte nochmal, wie dein Rechner nach den folgenden Schritten läuft. :)



Wir entfernen die letzten Reste und kontrollieren nochmal alles. ESET kann länger (> 2 h) dauern.
Im Anschluss daran räumen wir auf und ich gebe dir noch ein paar Tipps mit auf den Weg.




Schritt 1
Mir ist aufgefallen, dass Du mehr als ein Anti-Virus-Programm mit Hintergrundwächter laufen hast:
Code:
Microsoft Security Essentials
Avira
Das ist gefährlich, da sich die Programme in die Quere kommen können und dadurch Viren erst recht auf dem Rechner landen können. Ausserdem bremst es auch das System aus. Entscheide Dich für eine Variante und deinstalliere die andere über Systemsteuerung => Programme deinstallieren / Software.
Berichte, für welches Anti-Virus-Programm Du Dich entschieden hast.

Zitat:
Speedy hat letztens eine einleuchtende Erklärung dazu geliefert: "Man stelle sich einen Torwart vor, der das Tor hüten soll (Anti-Virus-Programm), der Ball kommt angeflogen (Virus), der Torhüter konzentriert sich auf den Ball und fängt ihn. Jetzt stelle Dir zwei Torhüter im Tor vor ...., die knallen aneinander und der Ball kann ungehindert ins Tor wandern."




Schritt 2
Lade dir TFC (TempFileCleaner von Oldtimer) herunter und speichere es auf den Desktop.
  • Öffne die TFC.exe.
    Vista und Win 7 User mit Rechtsklick "als Administrator starten".
  • Schließe alle anderen Programme.
  • Drücke auf den Button Start.
  • Falls du zu einem Neustart aufgefordert wirst, bestätige diesen.






Schritt 2
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument


Code:
start
AppInit_DLLs-x32: C:\PROGRA~2\CLONED~1\DVDGHO~1\DVDGHO~1.DLL [ ] ()
C:\PROGRA~2\CLONED~1
C:\Windows\System32\Tasks\NCH Software
C:\Users\Manuela\AppData\Local\Software_Updater
Task: {059BC6B5-C13B-474A-9342-29A7D77FE32C} - \DSite No Task File
Task: {0933D3DF-7386-42D6-A0D2-6D6F97906BAF} - System32\Tasks\NCH Software\broadcamDowngrade => C:\Program Files (x86)\NCH Software\BroadCam\broadcam.exe
C:\Program Files (x86)\NCH Software
Task: {1ABADC08-47CB-4289-9BE2-3902359F9298} - \Plus-HD-2.4-firefoxinstaller No Task File
Task: {42EE63EA-1AD5-445C-8871-59536CBEE7D2} - \QtraxPlayer No Task File
Task: {6D33D801-0C24-4200-A59E-F683F87CB536} - System32\Tasks\NCH Software\broadcamShakeIcon => C:\Program Files (x86)\NCH Software\BroadCam\BroadCam.exe
Task: {71DB5D66-414E-4EC5-9CFC-81ED9D394A28} - \Plus-HD-2.4-codedownloader No Task File
Task: {7F4977F7-57DD-49FE-8C3B-463D8C5A320A} - \Plus-HD-2.4-updater No Task File
Task: {83AED8A2-EE3C-4491-AABC-A711132893D3} - \Go for FilesUpdate No Task File
Task: {86B89009-CE71-41E3-AABF-9C1E7FB76B54} - \Plus-HD-2.4-chromeinstaller No Task File
Task: {9583011C-949A-4739-8E84-5345002ED128} - \Plus-HD-2.4-enabler No Task File
Task: {D7C4F78F-797D-4602-81E2-2536211F031F} - \Software Updater Ui No Task File
Task: {D9B10D24-1E1E-4823-B029-8B29A7F90CC8} - \BackgroundContainer Startup Task No Task File
Task: {FD2594B4-F576-49D5-8E40-2E388ACB0854} - \Software Updater No Task File
AlternateDataStreams: C:\ProgramData\Temp:661DFA1C
AlternateDataStreams: C:\ProgramData\Temp:9E22BBE8
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fwww.wajam.com%2Ffavicon.png
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\www.wajam.com.idx
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fimg.babylon.com%2Fsite%2Fimages%2Fbabylon-8%2Fcommon%2Fimages%2Ffavicon.png
C:\Users\Manuela\Documents\Downloads\ConduitInstaller.exe
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fwww.freecompressor.com%2Fimages%2Ffavicon.png
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fwww.goforfiles.com%2Ffavicon.png
Unlock: C:\Program Files (x86)\Freetec
C:\Program Files (x86)\Freetec
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fwww.performersoft.com%2Ffavicon.png
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fpowerbundle.systweak.com%2Ffavicon.png
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fsystweak.com%2Ffavicon.png
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fwww.systweak.com%2Ffavicon.png
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\www.systweak.com.idx
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fwww.qtrax.com%2Ffavicon.png
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\wajam_download_RASAPI32" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\wajam_download_RASMANCS" /f
Reg: reg delete "HKEY_CURRENT_USER\Software\AppDataLow\Software\Freeware.de" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{008f6853-9cb4-41c5-a950-39d55e5e06ba}" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{87BEF026-9269-413C-A5B3-11F35451380E}" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8D03FA45-4B8C-4427-BE67-EE8885147151}" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Amazon Browser Settings" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\filescout" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\FreeCompressor-setup_RASAPI32" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\FreeCompressor-setup_RASMANCS" /f
Reg: reg delete "HKEY_CURRENT_USER\Software\GoforFiles" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\GoforFiles" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\GoforFiles_RASAPI32" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\GoforFiles_RASMANCS" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{77a60bed-26f5-4621-8489-673aead41feb}" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SoftwareUpdater_RASAPI32" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SoftwareUpdater_RASMANCS" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\93EA40F4CAE1A3547BC8B12F333055FE" /f
Reg: reg delete "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-868785299-726797094-2297327714-1001\Software\facemoods.com" /f
Reg: reg delete "HKEY_CURRENT_USER\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\facemoods.com" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs" /v newtab /f
Reg: reg delete "HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\D14143D5782BEE842A45208B63A8E465" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\GutscheinCodes.DLL" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\GutscheinCodes.DLL" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\AppID\GutscheinCodes.DLL" /f
end

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.






Schritt 3
Downloade dir die passende Version von HitmanPro auf deinen Desktop: HitmanPro - 32 Bit | HitmanPro - 64 Bit.
  • Starte die HitmanPro.exe
  • Klicke auf
  • Entferne den Haken bei
  • Klicke auf
    und
  • Akzeptiere die Lizenzbedingungen und klicke auf
  • Klicke auf

    und auf
  • Wenn der Scan beendet wurde, nichts löschen lassen etc. sondern wähle unten links auf der Button-Leiste
    und speichere die Logdatei auf Deinem Desktop.
  • Schließe HitmanPro und poste mir das Log.

 






Schritt 4

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset






Schritt 5
Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.






Bitte poste mit deiner nächsten Antwort
  • die Logdatei von FRST,
  • die Logdatei von HitmanPro,
  • die Logdatei von ESET,
  • die Logdatei von SecurityCheck.

speedydino 30.11.2013 14:19
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 30-11-2013
Ran by Manuela at 2013-11-30 14:18:51 Run:1
Running from C:\Users\Manuela\Downloads
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start
AppInit_DLLs-x32: C:\PROGRA~2\CLONED~1\DVDGHO~1\DVDGHO~1.DLL [ ] ()
C:\PROGRA~2\CLONED~1
C:\Windows\System32\Tasks\NCH Software
C:\Users\Manuela\AppData\Local\Software_Updater
Task: {059BC6B5-C13B-474A-9342-29A7D77FE32C} - \DSite No Task File
Task: {0933D3DF-7386-42D6-A0D2-6D6F97906BAF} - System32\Tasks\NCH Software\broadcamDowngrade => C:\Program Files (x86)\NCH Software\BroadCam\broadcam.exe
C:\Program Files (x86)\NCH Software
Task: {1ABADC08-47CB-4289-9BE2-3902359F9298} - \Plus-HD-2.4-firefoxinstaller No Task File
Task: {42EE63EA-1AD5-445C-8871-59536CBEE7D2} - \QtraxPlayer No Task File
Task: {6D33D801-0C24-4200-A59E-F683F87CB536} - System32\Tasks\NCH Software\broadcamShakeIcon => C:\Program Files (x86)\NCH Software\BroadCam\BroadCam.exe
Task: {71DB5D66-414E-4EC5-9CFC-81ED9D394A28} - \Plus-HD-2.4-codedownloader No Task File
Task: {7F4977F7-57DD-49FE-8C3B-463D8C5A320A} - \Plus-HD-2.4-updater No Task File
Task: {83AED8A2-EE3C-4491-AABC-A711132893D3} - \Go for FilesUpdate No Task File
Task: {86B89009-CE71-41E3-AABF-9C1E7FB76B54} - \Plus-HD-2.4-chromeinstaller No Task File
Task: {9583011C-949A-4739-8E84-5345002ED128} - \Plus-HD-2.4-enabler No Task File
Task: {D7C4F78F-797D-4602-81E2-2536211F031F} - \Software Updater Ui No Task File
Task: {D9B10D24-1E1E-4823-B029-8B29A7F90CC8} - \BackgroundContainer Startup Task No Task File
Task: {FD2594B4-F576-49D5-8E40-2E388ACB0854} - \Software Updater No Task File
AlternateDataStreams: C:\ProgramData\Temp:661DFA1C
AlternateDataStreams: C:\ProgramData\Temp:9E22BBE8
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fwww.wajam.com%2Ffavicon.png
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\www.wajam.com.idx
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fimg.babylon.com%2Fsite%2Fimages%2Fbabylon-8%2Fcommon%2Fimages%2Ffavicon.png
C:\Users\Manuela\Documents\Downloads\ConduitInstaller.exe
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fwww.freecompressor.com%2Fimages%2Ffavicon.png
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fwww.goforfiles.com%2Ffavicon.png
Unlock: C:\Program Files (x86)\Freetec
C:\Program Files (x86)\Freetec
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fwww.performersoft.com%2Ffavicon.png
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fpowerbundle.systweak.com%2Ffavicon.png
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fsystweak.com%2Ffavicon.png
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fwww.systweak.com%2Ffavicon.png
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\www.systweak.com.idx
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fwww.qtrax.com%2Ffavicon.png
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\wajam_download_RASAPI32" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\wajam_download_RASMANCS" /f
Reg: reg delete "HKEY_CURRENT_USER\Software\AppDataLow\Software\Freeware.de" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{008f6853-9cb4-41c5-a950-39d55e5e06ba}" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{87BEF026-9269-413C-A5B3-11F35451380E}" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8D03FA45-4B8C-4427-BE67-EE8885147151}" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Amazon Browser Settings" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\filescout" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\FreeCompressor-setup_RASAPI32" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\FreeCompressor-setup_RASMANCS" /f
Reg: reg delete "HKEY_CURRENT_USER\Software\GoforFiles" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\GoforFiles" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\GoforFiles_RASAPI32" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\GoforFiles_RASMANCS" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{77a60bed-26f5-4621-8489-673aead41feb}" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SoftwareUpdater_RASAPI32" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SoftwareUpdater_RASMANCS" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\93EA40F4CAE1A3547BC8B12F333055FE" /f
Reg: reg delete "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-868785299-726797094-2297327714-1001\Software\facemoods.com" /f
Reg: reg delete "HKEY_CURRENT_USER\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\facemoods.com" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs" /v newtab /f
Reg: reg delete "HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\D14143D5782BEE842A45208B63A8E465" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\GutscheinCodes.DLL" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\GutscheinCodes.DLL" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\AppID\GutscheinCodes.DLL" /f
end

*****************

HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs => Value was restored successfully.
C:\PROGRA~2\CLONED~1 => Moved successfully.
C:\Windows\System32\Tasks\NCH Software => Moved successfully.
C:\Users\Manuela\AppData\Local\Software_Updater => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{059BC6B5-C13B-474A-9342-29A7D77FE32C} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{059BC6B5-C13B-474A-9342-29A7D77FE32C} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DSite => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0933D3DF-7386-42D6-A0D2-6D6F97906BAF} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0933D3DF-7386-42D6-A0D2-6D6F97906BAF} => Key deleted successfully.
C:\Windows\System32\Tasks\NCH Software\broadcamDowngrade not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\NCH Software\broadcamDowngrade => Key deleted successfully.
"C:\Program Files (x86)\NCH Software" => File/Directory not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{1ABADC08-47CB-4289-9BE2-3902359F9298} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1ABADC08-47CB-4289-9BE2-3902359F9298} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Plus-HD-2.4-firefoxinstaller => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{42EE63EA-1AD5-445C-8871-59536CBEE7D2} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{42EE63EA-1AD5-445C-8871-59536CBEE7D2} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\QtraxPlayer => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{6D33D801-0C24-4200-A59E-F683F87CB536} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6D33D801-0C24-4200-A59E-F683F87CB536} => Key deleted successfully.
C:\Windows\System32\Tasks\NCH Software\broadcamShakeIcon not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\NCH Software\broadcamShakeIcon => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{71DB5D66-414E-4EC5-9CFC-81ED9D394A28} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{71DB5D66-414E-4EC5-9CFC-81ED9D394A28} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Plus-HD-2.4-codedownloader => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{7F4977F7-57DD-49FE-8C3B-463D8C5A320A} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7F4977F7-57DD-49FE-8C3B-463D8C5A320A} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Plus-HD-2.4-updater => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{83AED8A2-EE3C-4491-AABC-A711132893D3} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{83AED8A2-EE3C-4491-AABC-A711132893D3} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Go for FilesUpdate => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{86B89009-CE71-41E3-AABF-9C1E7FB76B54} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{86B89009-CE71-41E3-AABF-9C1E7FB76B54} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Plus-HD-2.4-chromeinstaller => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{9583011C-949A-4739-8E84-5345002ED128} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9583011C-949A-4739-8E84-5345002ED128} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Plus-HD-2.4-enabler => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{D7C4F78F-797D-4602-81E2-2536211F031F} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D7C4F78F-797D-4602-81E2-2536211F031F} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Software Updater Ui => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{D9B10D24-1E1E-4823-B029-8B29A7F90CC8} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D9B10D24-1E1E-4823-B029-8B29A7F90CC8} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\BackgroundContainer Startup Task => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{FD2594B4-F576-49D5-8E40-2E388ACB0854} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FD2594B4-F576-49D5-8E40-2E388ACB0854} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Software Updater => Key deleted successfully.
C:\ProgramData\Temp => ":661DFA1C" ADS removed successfully.
C:\ProgramData\Temp => ":9E22BBE8" ADS removed successfully.
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fwww.wajam.com%2Ffavicon.png => Moved successfully.
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\www.wajam.com.idx => Moved successfully.
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fimg.babylon.com%2Fsite%2Fimages%2Fbabylon-8%2Fcommon%2Fimages%2Ffavicon.png => Moved successfully.
C:\Users\Manuela\Documents\Downloads\ConduitInstaller.exe => Moved successfully.
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fwww.freecompressor.com%2Fimages%2Ffavicon.png => Moved successfully.
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fwww.goforfiles.com%2Ffavicon.png => Moved successfully.
"C:\Program Files (x86)\Freetec" => File/Directory unlocked successfully.
C:\Program Files (x86)\Freetec => Moved successfully.
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fwww.performersoft.com%2Ffavicon.png => Moved successfully.
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fpowerbundle.systweak.com%2Ffavicon.png => Moved successfully.
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fsystweak.com%2Ffavicon.png => Moved successfully.
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fwww.systweak.com%2Ffavicon.png => Moved successfully.
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\www.systweak.com.idx => Moved successfully.
C:\Users\Manuela\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fwww.qtrax.com%2Ffavicon.png => Moved successfully.

========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\wajam_download_RASAPI32" /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\wajam_download_RASMANCS" /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKEY_CURRENT_USER\Software\AppDataLow\Software\Freeware.de" /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{008f6853-9cb4-41c5-a950-39d55e5e06ba}" /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{87BEF026-9269-413C-A5B3-11F35451380E}" /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8D03FA45-4B8C-4427-BE67-EE8885147151}" /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Amazon Browser Settings" /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\filescout" /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\FreeCompressor-setup_RASAPI32" /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\FreeCompressor-setup_RASMANCS" /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKEY_CURRENT_USER\Software\GoforFiles" /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\GoforFiles" /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\GoforFiles_RASAPI32" /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\GoforFiles_RASMANCS" /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{77a60bed-26f5-4621-8489-673aead41feb}" /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SoftwareUpdater_RASAPI32" /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SoftwareUpdater_RASMANCS" /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\93EA40F4CAE1A3547BC8B12F333055FE" /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-868785299-726797094-2297327714-1001\Software\facemoods.com" /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKEY_CURRENT_USER\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\facemoods.com" /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs" /v newtab /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\D14143D5782BEE842A45208B63A8E465" /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\GutscheinCodes.DLL" /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\GutscheinCodes.DLL" /f =========

FEHLER: Der angegebene Registrierungsschlssel bzw. Wert wurde nicht gefunden.


========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\AppID\GutscheinCodes.DLL" /f =========

FEHLER: Der angegebene Registrierungsschlssel bzw. Wert wurde nicht gefunden.


========= End of Reg: =========


==== End of Fixlog ====

M-K-D-B 01.12.2013 10:46
Servus,



fehlen noch die Schritte 3-5. :)

speedydino 02.12.2013 18:07
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=425adcac0b780846be93c4fea2bd1d17
# engine=16099
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-12-02 04:39:36
# local_time=2013-12-02 05:39:36 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 96 41179 251422066 18496 0
# compatibility_mode=5893 16776573 100 94 111693 137632226 0 0
# scanned=199766
# found=4
# cleaned=0
# scan_time=21396
sh=FB9B1058F802E600648E9B259B122C33D4C5B8E4 ft=0 fh=0000000000000000 vn="Win32/AdWare.AddLyrics.T application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LyricsDroid\133.crx.vir"
sh=79904DEEE8D0B0585B4FD892FD24F25D8ED50CBB ft=0 fh=0000000000000000 vn="Win32/AdWare.AddLyrics.T application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LyricsDroid\133.xpi.vir"
sh=6F0D7EB5B25D4806957188156580219833265B70 ft=1 fh=7b790525eca3068b vn="a variant of Win32/AdWare.AddLyrics.W application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LyricsDroid\Uninstall.exe.vir"
sh=A1C2454AAEB58074BD61E56A08B7E51A02393332 ft=0 fh=0000000000000000 vn="Win32/AdWare.AddLyrics.T application" ac=I fn="C:\zoek_backup\C_Users_Manuela_AppData_Local_Google_Chrome_User Data_Default_Extensions_olmmlhjmcpkhnmfcbelohhaifhilieje\1.133_0\c.js"

Results of screen317's Security Check version 0.99.76
Windows 7 Service Pack 1 x64 (UAC is disabled!)
Internet Explorer 10
``````````````Antivirus/Firewall Check:``````````````
Avira Desktop
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware Version 1.75.0.1300
TuneUp Utilities 2014
TuneUp Utilities 2014 (de-DE)
TuneUp Utilities 2014
Adobe Flash Player 11.9.900.117
Adobe Reader XI
Google Chrome 30.0.1599.101
Google Chrome 31.0.1650.57
````````Process Check: objlist.exe by Laurent````````
Malwarebytes Anti-Malware mbamservice.exe
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
Malwarebytes' Anti-Malware mbamscheduler.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````

Code:
HitmanPro 3.7.8.208
www.hitmanpro.com

  Computer name . . . . : MANUELA-PC
  Windows . . . . . . . : 6.1.1.7601.X64/2
  User name . . . . . . : Manuela-PC\Manuela
  UAC . . . . . . . . . : Disabled
  License . . . . . . . : Free

  Scan date . . . . . . : 2013-11-30 14:22:17
  Scan mode . . . . . . : Normal
  Scan duration . . . . : 7m 43s
  Disk access mode  . . : Direct disk access (SRB)
  Cloud . . . . . . . . : Internet
  Reboot  . . . . . . . : No

  Threats . . . . . . . : 0
  Traces  . . . . . . . : 9

  Objects scanned . . . : 1.731.744
  Files scanned . . . . : 30.649
  Remnants scanned  . . : 660.892 files / 1.040.203 keys

Potential Unwanted Programs _________________________________________________

  HKU\S-1-5-21-868785299-726797094-2297327714-1001\Software\Microsoft\Internet Explorer\Approved Extensions\{4D2D3B0F-69BE-477A-90F5-FDDB05357975} (Claro)
  HKU\S-1-5-21-868785299-726797094-2297327714-1001\Software\Microsoft\Internet Explorer\Approved Extensions\{98889811-442D-49DD-99D7-DC866BE87DBC} (Claro)

Cookies _____________________________________________________________________

  C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Cookies\03QP2Q1U.txt
  C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Cookies\CAVG001C.txt
  C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Cookies\FFOROQM3.txt
  C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Cookies\NK36RZAS.txt
  C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Cookies\NZK507K3.txt
  C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Cookies\UOBRZJ9Q.txt
  C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Cookies\WCQL21MV.txt
Hallo,

jetzt hab ich alle 5 Schritte :-)
Rechner ist schon schneller :-)

M-K-D-B 02.12.2013 19:25
Servus,




Wenn du keine Probleme mehr hast, dann sind wir hier fertig. Deine Logdateien sind sauber. :daumenhoc
Zum Schluss müssen wir noch ein paar abschließende Schritte unternehmen, um deinen Pc aufzuräumen und abzusichern.



Schritt 1
Ich sehe, dass du sog. Registry Cleaner auf dem System hast.
In deinem Fall TuneUp Utilities 2014 .

Wir empfehlen auf keinen Fall jegliche Art von Registry Cleaner.

Der Grund ist ganz einfach:

Die Registry ist das Hirn des Systems. Funktioniert das Hirn nicht, funktioniert der Rest nicht mehr wirklich.
Wir lesen oft genug von Hilfesuchenden, dass deren System nach der Nutzung von Registry Cleanern nicht mehr booted.
  • Wie soll der Cleaner zu 100% wissen ob der Eintrag benötigt wird oder nicht ?
  • Es ist vollkommen egal ob ein paar verwaiste Registry Einträge am System sind oder nicht.
  • Auch die dauernd angepriesene Beschleunigung des Systems ist nur bedingt wahr. Du würdest es nicht merken.
Ein sogenanntes False Positive von einem Cleaner kann auch dein System unbootbar machen.
Zerstörst Du die Registry, zerstörst Du Windows.

Ich empfehle dir hiermit die oben genannte Software zu deinstallieren und in Zukunft auf solche Art von Software zu verzichten.
Am Ende empfehle ich dir ein anderes Tool, mit dem du deine temporären Dateien entfernen kannst.





Schritt 2
Deine Version von Adobe Flash Player ist veraltet.
Bitte folge diesen Schritte, um Adobe Flash zu aktualisieren:
  • Bitte besuche diese Seite von Adobe.
  • Wähle dein Betriebssystem und deinen Internetbrowser ("Internet Explorer" oder "other" für Firefox zum Beispiel)
  • Deaktiviere gegebenenfalls den Haken vor Google Chrome bzw. McAfee Security Scan.
  • Installiere die neuste Version auf deinem Computer.





Schritt 3
Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.







Schritt 4
Abschließend habe ich noch ein paar Tipps zur Absicherung deines Systems.


Ich kann gar nicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti-Viren-Programm und zusätzlicher Schutz
  • Gehe sicher, dass du immer nur eine Anti-Viren Software installiert hast und dass diese auch up to date ist!
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion bietet zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • AdwCleaner
    Dieses Tool erkennt eine Vielzahl von Werbeprogrammen (Adware) und unerwümschten Programmen (PUPs).
    Starte das Tool einmal die Woche und lass es laufen. Sollte eine neue Version verfügbar sein, so wird dies angezeigt und du kannst dir die neueste Version direkt auf den Desktop downloaden.
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • WOT (Web of trust)
    Dieses AddOn warnt dich, bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser
Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Mozilla Firefox
  • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
  • NoScript
    Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt, wenn Du es bestätigst.
  • AdblockPlus
    Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
    Es spart außerdem Downloadkapazität.


Performance
  • Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
  • Halte dich fern von Registry Cleanern.
    Diese Schaden deinem System mehr als dass sie helfen. Hier ein englischer Link:
    Miekemoes Blogspot ( MVP )


Was du vermeiden solltest:
  • Klicke nicht auf alles, nur weil es dich dazu auffordert und schön bunt ist.
  • Verwende keine P2P oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie z.B. deinFoto.jpg.exe.
  • Lade keine Software von Softonic oder Chip herunter, da diese Installer oft mit Adware oder unerünschter Software versehen sind!



Nun bleibt mir nur noch dir viel Spaß beim sicheren Surfen zu wünschen... ... und vielleicht möchtest du ja das Trojaner-Board unterstützen?

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann.

M-K-D-B 06.12.2013 19:45
Ich bin froh, dass wir helfen konnten :abklatsch:

In diesem Forum kannst du eine kurze Rückmeldung zur Bereinigung abgeben, sofern du das möchtest:
Lob, Kritik und Wünsche
Klicke dazu auf den Button "NEUES THEMA" und poste ein kleines Feedback. Vielen Dank! :)

Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Solltest Du das Thema erneut brauchen, schicke mir bitte eine PM.

Jeder andere bitte hier klicken und einen eigenen Thread erstellen.


Alle Zeitangaben in WEZ +1. Es ist jetzt 10:23 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27