Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Bluescreen,Deltasearch,Aufbau sehr langsam (https://www.trojaner-board.de/157231-bluescreen-deltasearch-aufbau-sehr-langsam.html)

BlackKisu 04.08.2014 16:54
Bluescreen,Deltasearch,Aufbau sehr langsam
 
Guuuten Tag,
ich bin zum ersten mal hier und muss dazu sagen ich habe von all dem keine Ahnung. Also leider auch nicht wie ich Bilder und Logs einfüge sollte das irgendwann von nöten sein. Dafür schonmal entschuldigung ^^'

Zur Info

Ich habe einen Asus Laptop mit Windows Vista

Nun zu meinem 1. Problem:

Schon seit längerem stürzt mein Lapi in den Bluescreen ab. Es ist unterschiedlich wann unterschiedlich oft und also ich kann nicht genau sagen es passiert immer nach einer Std oder so. Ich saß schon 3 Std am PC is nix passiert dann hab ich den PC grade hoch gefahren hol mir was zu trinken zack Blue Screen ... dann fahr ich ihn wieder hoch, der is noch im Aufbau , zack Bluescreen. Wenn der Lapi im besagten Bluescreen is tut sich garnix ... er fährt nich hoch nicht runter tut nix ... ich muss dann ewig lang auf den Power Knopf drücken bis er ausgeht und ihn dann per Powerknopf neu starten worauf dann dort steht das Windows nicht Ordnungsgemäß runtergefahren wurde und sowas halt. Das ist ganz schön nervig.

Mein 2. Problem is:

Ich habe ganz ehrlich jetzte ... nix runter geladen oder so und hatte den einen Tag so ein seltsames Spiel auf dem Desktop und Delta search ich dachte noch meine Mutter hat sich irgendwas runter geladen und hab sie gefragt sie wars nicht und dachte ich wars. Naja das spiel ist deinstaliert aber das Deltasearch is immernoch da und nervt mich tierisch.

Mein 3. Problem:

Ist ziemlich allgemein, der Laptop is sooooooo langsam der brauch ewig bis der hoch gefahren is und bis der mal ne Internetseite aufgebaut hat mein Gott da kann ich noch n Kuchen Backen und Dekorieren. Hab schon alles unwichtige deinstaliert und gelöscht was ich nimmer brauche, hab kein skype kein icq oder sonst was drauf und ich lade nichts runter, das einzige was ich auf dem Laptop mache ist Briefe schreiben Dokumente schreiben, bei ebay an und an was bestellen und hin und wieder ganz gerne mal Facebook benutzen und darüber würde ich auch gerne mal ein spiel spielen aber der Laptop is so langsam das sogar die Smileys hängen bleiben und ein Youtube video das eig. 5 min geht 10 min brauch zum laden davon dann 1 min abspielt und sich dann wieder aufhängt.

Zur INfo

Ich habe bereitsAVG 2014, RegCleanPro und Avast Antivirus aufem PC gehabt hab sie laufen lassen und die haben nix angezeigt von irgendwelchen Viren oder trojanern oder so. Außer RegCleanPro der sagte mir ich habe einen Keychecker oder so drauf und 3 trojaner die habe ich gelöscht, dann sagte der noch was von administrations fehlern hab alles beheben lassen aber funzt nix, jetzt sind die halt auch noch abgelaufen aber geändert hat sich nix.
ich bin wirklich verzweifelt weil ich kein Geld hab um mir irgendwelche antivirus programme runter zu laden und dafür geld zu bezahlen die dann zum schluss auch noch nix taugen.

Bitte Bitte ich hoffe ihr könnt mir helfen

schrauber 04.08.2014 16:56
hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


BlackKisu 04.08.2014 17:18
Wow Danke für die Schnell Antwort hier die Logs hoffe du kannst mehr damit anfangen als ich XD



FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:2-08-2014
Ran by Shorty (administrator) on SHORTY-PC on 04-08-2014 18:07:17
Running from C:\Users\Shorty\Documents
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgrsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgcsrvx.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUSTek Computer Inc.) C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe
() C:\Program Files\ASUS\ATK Hotkey\AsLdrSrv.exe
(ALWIL Software) C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
() C:\Program Files\ATKGFNEX\GFNEXSrv.exe
(Cherished Technololgy LIMITED) C:\ProgramData\IePluginService\PluginService.exe
(Cherished Technololgy LIMITED) C:\ProgramData\IePluginServices\PluginService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgwdsvc.exe
(ASUS) C:\Program Files\ASUS\ASUS CopyProtect\ASPG.exe
(ATK) C:\Program Files\P4G\BatteryLife.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\MsgTranAgt.exe
(ASUS) C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
() C:\Program Files\ASUS\ASUS Live Update\ALU.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\HControl.exe
() C:\Program Files\Wireless Console 2\wcourier.exe
(ATK) C:\Program Files\ASUS\Splendid\ACMON.exe
(DeviceVM) C:\ASUS.SYS\DVMExportService.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe
(ASUS) C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe
() C:\Program Files\V-bates\ExtensionUpdaterService.exe
(ASUS) C:\Program Files\ASUS\ATK Media\DMedia.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\KBFiltr.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\WDC.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(ASUSTeK) C:\Windows\System32\ACEngSvr.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(ASUSTek Computer Inc.) C:\Program Files\ASUS\ASUS Data Security Manager\ADSMTray.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(ASUS) C:\Windows\AsScrPro.exe
(ALWIL Software) C:\Program Files\Alwil Software\Avast4\ashDisp.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgui.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgnsx.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgemcx.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Premium Sound\SRSPremiumSoundBig_Small.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil32_14_0_0_145_ActiveX.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-3212465446-2577034139-3834760431-1000\...\Run: [LightScribe Control Panel] => C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2008-06-09] (Hewlett-Packard Company)
HKU\S-1-5-21-3212465446-2577034139-3834760431-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-3212465446-2577034139-3834760431-1000\...\Run: [SRS Premium Sound] => C:\Program Files\SRS Labs\SRS Premium Sound\SRSPremiumSoundBig_Small.exe [2334720 2008-11-09] (SRS Labs, Inc.)
HKU\S-1-5-21-3212465446-2577034139-3834760431-1000\...\MountPoints2: {345a78dc-7525-11e2-96cc-00248c5abbdd} - G:\AutoRun.exe {D2D77DC2-8299-11D1-8949-444553540000} 5.2066.1.A11B02 PID_0083
AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL => C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll [123392 2010-08-01] (Google)
Lsa: [Notification Packages] scecli C:\Program Files\ASUS\ASUS Data Security Manager\ASPWDFLT
ShellIconOverlayIdentifiers: ADSMOverlayIcon -> {A825576B-0042-4F0F-8FB0-93CE0F054E69} => C:\Program Files\ASUS\ASUS Data Security Manager\OverlayIconShlExt.dll ()
ShellIconOverlayIdentifiers: ADSMOverlayIcon1 -> {A8D448F4-0431-45AC-9F5E-E1B434AB2249} => C:\Program Files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll ()
BootExecute: autocheck autochk *
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.qone8.com/web/?type=ds&ts=1396780050&from=air&uid=WDCXWD3200BEVT-22ZCT0_WD-WXEX08HCA748CA748&q={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.delta-homes.com/?type=hp&ts=1402587678&from=wpm0612&uid=WDCXWD3200BEVT-22ZCT0_WD-WXEX08HCA748CA748
HKCU\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60347
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.qone8.com/web/?type=ds&ts=1396780050&from=air&uid=WDCXWD3200BEVT-22ZCT0_WD-WXEX08HCA748CA748&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.delta-homes.com/?type=hp&ts=1402587678&from=wpm0612&uid=WDCXWD3200BEVT-22ZCT0_WD-WXEX08HCA748CA748
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.delta-homes.com/?type=hp&ts=1402587678&from=wpm0612&uid=WDCXWD3200BEVT-22ZCT0_WD-WXEX08HCA748CA748
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.qone8.com/web/?type=ds&ts=1396780050&from=air&uid=WDCXWD3200BEVT-22ZCT0_WD-WXEX08HCA748CA748&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.qone8.com/web/?type=ds&ts=1396780050&from=air&uid=WDCXWD3200BEVT-22ZCT0_WD-WXEX08HCA748CA748&q={searchTerms}
URLSearchHook: HKLM - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
URLSearchHook: HKLM - (No Name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} -  No File
URLSearchHook: HKLM - Softonic Deutsch Toolbar - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Program Files\Softonic_Deutsch\tbSof0.dll (Conduit Ltd.)
URLSearchHook: HKCU - Softonic Deutsch Toolbar - {8DBB6D8E-E4A6-4E3B-9753-AF78B226441C} - C:\Program Files\Softonic_Deutsch\tbSof0.dll (Conduit Ltd.)
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://start.qone8.com/?type=sc&ts=1396780050&from=air&uid=WDCXWD3200BEVT-22ZCT0_WD-WXEX08HCA748CA748
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.qone8.com/web/?type=ds&ts=1396780050&from=air&uid=WDCXWD3200BEVT-22ZCT0_WD-WXEX08HCA748CA748&q={searchTerms}
SearchScopes: HKLM - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=cmi_14_14_ie&cd=2XzuyEtN2Y1L1QzutDtDtByEzz0CyD0A0B0B0D0DtDzzzyyEtN0D0Tzu0SzztByCtN1L2XzutBtFtCzztFzytFtDtN1L1CzutCyEtDtAtDyD1V1QtN1L1G1B1V1N2Y1L1Qzu2StAzy0Bzzzy0EyCyEtG0D0A0D0DtGyEtAyEzztGtCyEyD0BtGtA0E0B0F0FtD0EtB0AtBtCzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2StByB0FyDyEtDtB0DtGyD0C0AtAtGyE0EyEzytG0D0B0BtAtGyCzztDtAtA0Czy0B0FtDyCtD2Q&cr=402297842&ir=
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.qone8.com/web/?type=ds&ts=1396780050&from=air&uid=WDCXWD3200BEVT-22ZCT0_WD-WXEX08HCA748CA748&q={searchTerms}
SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUS
SearchScopes: HKLM - {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL =
SearchScopes: HKLM - {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms}
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=cmi_14_14_ie&cd=2XzuyEtN2Y1L1QzutDtDtByEzz0CyD0A0B0B0D0DtDzzzyyEtN0D0Tzu0SzztByCtN1L2XzutBtFtCzztFzytFtDtN1L1CzutCyEtDtAtDyD1V1QtN1L1G1B1V1N2Y1L1Qzu2StAzy0Bzzzy0EyCyEtG0D0A0D0DtGyEtAyEzztGtCyEyD0BtGtA0E0B0F0FtD0EtB0AtBtCzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2StByB0FyDyEtDtB0DtGyD0C0AtAtGyE0EyEzytG0D0B0BtAtGyCzztDtAtA0Czy0B0FtDyCtD2Q&cr=402297842&ir=
SearchScopes: HKCU - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} URL = hxxp://www.crawler.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=60347
SearchScopes: HKCU - {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUS_de
SearchScopes: HKCU - {70D46D94-BF1E-45ED-B567-48701376298E} URL = hxxp://127.0.0.1:4664/search&s=R_iLDATEp5s-mn15ot1_9WsufqM?q={searchTerms}
SearchScopes: HKCU - {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3323914&octid=EB_ORIGINAL_CTID&ISID=M81792C38-277B-41B8-84BA-3621AFBDF2A6&SearchSource=58&CUI=&UM=5&UP=SP4080CDAA-D2AA-4753-A83A-D21A9B9C2558&q={searchTerms}&SSPV=
SearchScopes: HKCU - {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms}
BHO: Adobe PDF Reader -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: V-bates -> {21EAF666-26B3-4a3c-ABD0-CA2F5A326744} -> C:\Program Files\V-bates\Extension32.dll ()
BHO: IETabPage Class -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> C:\Program Files\SupTab\SupTab.dll (Thinknice Co. Limited)
BHO: No Name -> {71e129ff-6c2a-4984-818c-7e2c998b8d99} ->  No File
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Softonic Deutsch Toolbar -> {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} -> C:\Program Files\Softonic_Deutsch\tbSof0.dll (Conduit Ltd.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: FlowSurf -> {E3F1CA13-EA0E-4617-8D03-3EAA6A94A7E0} -> C:\Program Files\Flowsurf\FlowSurf.dll (FlowSurf Inc.)
BHO: mysearchdial Helper Object -> {EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD} -> C:\Program Files\Mysearchdial\1.8.29.0\bh\mysearchdial.dll (MySearchDial)
BHO: AlxHelper Class -> {F443A627-5009-4323-9C1D-7FD598D0D712} ->  No File
Toolbar: HKLM - Softonic Deutsch Toolbar - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Program Files\Softonic_Deutsch\tbSof0.dll (Conduit Ltd.)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Toolbar: HKLM - Amazon Browser Bar - {EA582743-9076-4178-9AA6-7393FDF4D5CE} -  No File
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Softonic Deutsch Toolbar - {8DBB6D8E-E4A6-4E3B-9753-AF78B226441C} - C:\Program Files\Softonic_Deutsch\tbSof0.dll (Conduit Ltd.)
Toolbar: HKCU - No Name - {EEE6C35B-6118-11DC-9C72-001320C79847} -  No File
Toolbar: HKCU - No Name - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default
FF DefaultSearchEngine: Crawler Search
FF SearchEngineOrder.1: Crawler Search
FF Plugin: @google.com/npPicasa2,version=2.0.0 -> C:\Program Files\Picasa2\npPicasa2.dll (Google, Inc.)
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.)
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.3 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.updaterss.com/SaveSenseLive Update;version=3 -> C:\Program Files\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll (SaveSense)
FF Plugin: @tools.updaterss.com/SaveSenseLive Update;version=9 -> C:\Program Files\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll (SaveSense)
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF user.js: detected! => C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\user.js
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll (Sun Microsystems, Inc.)
FF SearchPlugin: C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\searchplugins\icqplugin.xml
FF SearchPlugin: C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\searchplugins\sweetim.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\crawlersrch.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\googledesktop.xml
FF Extension: Amazon Browser Bar - C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\Extensions\abb@amazon.com [2013-10-14]
FF Extension: Plus-HD-1.5 - C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\Extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com [2013-09-07]
FF Extension: Messenger Plus! Community Smartbar - C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\Extensions\helperbar@helperbar.com [2013-07-28]
FF Extension: No Name - C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\Extensions\staged [2013-02-16]
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-06-02]
FF Extension: ICQ Toolbar - C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\Extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2010-12-01]
FF Extension: Messenger Plus! Community Smartbar - C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\Extensions\{ec736a7c-237c-4d97-b92e-a1baabe47216} [2013-03-23]
FF Extension: SweetIM Toolbar for Firefox - C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\Extensions\{EEE6C361-6118-11DC-9C72-001320C79847} [2010-12-01]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012-02-06]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010-07-02]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [2010-09-05]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2010-10-20]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2010-12-20]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011-02-16]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [2011-06-22]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} [2012-02-17]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-19]
FF HKLM\...\Firefox\Extensions: [{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}] - C:\Program Files\V-bates\Firefox
FF Extension: V-bates - C:\Program Files\V-bates\Firefox [2014-04-06]
FF Extension: SaveSense - C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\staged\{2d7886a0-85bb-4bf2-b684-ba92b4b21d23} [2014-04-06]

Chrome:
=======
CHR DefaultNewTabURL:
CHR Plugin: (Shockwave Flash) - F:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.83\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\35.0.1916.153\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - F:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\35.0.1916.153\pdf.dll ()
CHR Plugin: (Wajam) - F:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp\1.24_0\plugins/PriamNPAPI.dll No File
CHR Plugin: (Adobe Acrobat) - F:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.170.4) - F:\Program Files\Mozilla Firefox\plugins\npdeploytk.dll No File
CHR Plugin: (2007 Microsoft Office system) - F:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll No File
CHR Plugin: (Winamp Application Detector) - F:\Program Files\Mozilla Firefox\plugins\npwachk.dll No File
CHR Plugin: (Microsoft® DRM) - F:\Program Files\Windows Media Player\npdrmv2.dll No File
CHR Plugin: (Microsoft® DRM) - F:\Program Files\Windows Media Player\npwmsdrm.dll No File
CHR Plugin: (Windows Media Player Plug-in Dynamic Link Library) - F:\Program Files\Windows Media Player\npdsplay.dll No File
CHR Plugin: (Google Update) - F:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
CHR Plugin: (Google Earth Plugin) - F:\Program Files\Google\Google Earth\plugin\npgeplugin.dll No File
CHR Plugin: (Panda ActiveScan 2.0) - F:\Program Files\Panda Security\ActiveScan 2.0\npwrapper.dll No File
CHR Plugin: (iTunes Application Detector) - F:\Program Files\iTunes\Mozilla Plugins\npitunes.dll No File
CHR Plugin: (Ma-Config.com plugin) - F:\Program Files\ma-config.com\nphardwaredetection.dll No File
CHR Plugin: (Silverlight Plug-In) - f:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Extension: (Quick Sidebar) - C:\Users\Shorty\AppData\Local\Google\Chrome\User Data\Default\Extensions\ainbkicbloikcngphmjfpjdemblcojdd [2014-06-12]
CHR Extension: (Google Wallet) - C:\Users\Shorty\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-04]
CHR Extension: (Extended Protection) - C:\Users\Shorty\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo [2014-06-12]
CHR Extension: (Quick start) - C:\Users\Shorty\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma [2014-04-06]
CHR HKLM\...\Chrome\Extension: [ainbkicbloikcngphmjfpjdemblcojdd] - C:\Users\Shorty\AppData\Local\Google\Chrome\User Data\Default\Extensions\slidebar.crx [2014-06-12]
CHR HKLM\...\Chrome\Extension: [ogfjmhfnldnajmfaofeiaepghjenbgjo] - C:\Users\Shorty\AppData\Local\Google\Chrome\User Data\Default\Extensions\ep.crx [2014-06-12]
CHR HKLM\...\Chrome\Extension: [pelmeidfhdlhlbjimpabfcbnnojbboma] - C:\Users\Shorty\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtabv3.crx [2014-04-06]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ADSMService; C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe [225280 2008-03-31] (ASUSTek Computer Inc.) [File not signed]
R2 ASLDRService; C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe [100920 2008-08-14] ()
R2 aswUpdSv; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [18752 2009-11-25] (ALWIL Software)
R2 ATKGFNEXSrv; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [94208 2007-08-08] () [File not signed]
S3 avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [254040 2009-11-25] (ALWIL Software)
S3 avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [352920 2009-11-25] (ALWIL Software)
R2 AVGIDSAgent; C:\Program Files\AVG\AVG2014\avgidsagent.exe [3244048 2014-07-10] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG2014\avgwdsvc.exe [289328 2014-07-10] (AVG Technologies CZ, s.r.o.)
R2 DvmMDES; C:\ASUS.SYS\DVMExportService.exe [307200 2008-11-20] (DeviceVM) [File not signed]
S3 GoogleDesktopManager-051210-111108; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [30192 2010-08-01] (Google)
S2 gupdate1ca0eed81a80270; C:\Program Files\Google\Update\GoogleUpdate.exe [133104 2009-07-27] (Google Inc.)
R2 IePluginService; C:\ProgramData\IePluginService\PluginService.exe [705136 2014-04-11] (Cherished Technololgy LIMITED)
R2 IePluginServices; C:\ProgramData\IePluginServices\PluginService.exe [761968 2014-06-12] (Cherished Technololgy LIMITED)
R2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [73728 2008-06-09] (Hewlett-Packard Company) [File not signed]
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2014-03-11] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [279776 2014-03-11] (Microsoft Corporation)
S2 savesenselive; C:\Program Files\SaveSenseLive\Update\SaveSenseLive.exe [146920 2014-04-06] (SaveSense)
S3 savesenselivem; C:\Program Files\SaveSenseLive\Update\SaveSenseLive.exe [146920 2014-04-06] (SaveSense)
R2 V-bates Updater; C:\Program Files\V-bates\ExtensionUpdaterService.exe [209408 2014-02-26] () [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 AsDsm; C:\Windows\system32\Drivers\AsDsm.sys [29752 2007-08-11] (Windows (R) Codename Longhorn DDK provider)
R2 ASMMAP; C:\Program Files\ATKGFNEX\ASMMAP.sys [13880 2007-07-24] ()
R1 Avgdiskx; C:\Windows\System32\DRIVERS\avgdiskx.sys [121624 2014-06-30] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [199960 2014-06-17] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [147736 2014-06-17] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [21272 2014-06-17] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [188696 2014-06-17] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [241944 2014-06-17] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [98584 2014-06-17] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [27416 2014-06-17] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [197400 2014-06-17] (AVG Technologies CZ, s.r.o.)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15928 2008-06-03] ( )
R0 lullaby; C:\Windows\System32\DRIVERS\lullaby.sys [15416 2008-05-29] (Windows (R) Codename Longhorn DDK provider)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [231960 2014-01-25] (Microsoft Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ATKACPI.sys [7680 2006-12-14] (ATK0100)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1772544 2008-12-10] ()
R3 SRS_PremiumSound_Service; C:\Windows\System32\drivers\srs_PremiumSound_i386.sys [43904 2008-10-23] ()
S2 aswFsBlk; system32\DRIVERS\aswFsBlk.sys [X]
S1 aswRdr; No ImagePath
S1 aswSP; No ImagePath
S1 aswTdi; No ImagePath
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S1 MpKslae1d6695; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{2A4CA70F-1382-40CC-912B-11A9575A9C88}\MpKslae1d6695.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 upperdev; system32\DRIVERS\usbser_lowerflt.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-04 18:07 - 2014-08-04 18:07 - 00028913 _____ () C:\Users\Shorty\Documents\FRST.txt
2014-08-04 18:07 - 2014-08-04 18:07 - 00000000 ____D () C:\FRST
2014-08-04 18:06 - 2014-08-04 18:06 - 01084928 _____ (Farbar) C:\Users\Shorty\Documents\FRST.exe
2014-08-04 17:07 - 2014-08-04 17:07 - 00000000 ___HD () C:\dvmexp
2014-07-17 14:21 - 2014-07-17 14:21 - 00160032 _____ () C:\Windows\Minidump\Mini071714-01.dmp
2014-07-11 09:53 - 2014-06-07 02:19 - 02051072 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-11 09:53 - 2014-06-06 10:59 - 00506880 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-11 09:53 - 2014-05-30 08:53 - 00273408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-11 09:52 - 2014-06-07 02:05 - 12353024 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-11 09:52 - 2014-06-07 01:25 - 09711616 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-11 09:52 - 2014-06-07 01:12 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-11 09:52 - 2014-06-07 01:04 - 01106432 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-11 09:52 - 2014-06-07 01:03 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-11 09:52 - 2014-06-07 01:02 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-11 09:52 - 2014-06-07 01:00 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-07-11 09:52 - 2014-06-07 00:58 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-11 09:52 - 2014-06-07 00:57 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-11 09:52 - 2014-06-07 00:56 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-07-11 09:52 - 2014-06-07 00:56 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-11 09:52 - 2014-06-07 00:54 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-11 09:52 - 2014-06-07 00:54 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-11 09:52 - 2014-06-07 00:54 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-11 09:52 - 2014-06-07 00:54 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-07-11 09:52 - 2014-06-07 00:53 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-11 09:52 - 2014-06-07 00:53 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-11 09:52 - 2014-06-07 00:53 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-07-11 09:52 - 2014-06-07 00:52 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-11 09:52 - 2014-06-07 00:51 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-07-11 09:52 - 2014-06-07 00:47 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-04 18:07 - 2014-08-04 18:07 - 00028913 _____ () C:\Users\Shorty\Documents\FRST.txt
2014-08-04 18:07 - 2014-08-04 18:07 - 00000000 ____D () C:\FRST
2014-08-04 18:06 - 2014-08-04 18:06 - 01084928 _____ (Farbar) C:\Users\Shorty\Documents\FRST.exe
2014-08-04 17:45 - 2014-04-06 11:15 - 00000284 _____ () C:\Windows\Tasks\FF Watcher {9F5B7DBB-965F-4063-B35B-443370725961}.job
2014-08-04 17:38 - 2012-05-24 09:45 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-04 17:26 - 2014-04-06 10:21 - 00000920 _____ () C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineUA.job
2014-08-04 17:26 - 2009-07-27 21:16 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-04 17:22 - 2014-04-06 10:20 - 00000296 _____ () C:\Windows\Tasks\SaveSense.job
2014-08-04 17:20 - 2009-03-09 17:54 - 01776824 _____ () C:\Windows\WindowsUpdate.log
2014-08-04 17:19 - 2013-10-14 09:01 - 00000000 ____D () C:\Program Files\RegClean Pro
2014-08-04 17:12 - 2014-03-30 16:37 - 00000000 ____D () C:\ProgramData\MFAData
2014-08-04 17:09 - 2013-08-01 16:55 - 00000000 ____D () C:\Users\Shorty\Desktop\Haushaltsplan
2014-08-04 17:08 - 2009-07-14 09:58 - 00031966 _____ () C:\ProgramData\nvModes.dat
2014-08-04 17:08 - 2009-07-14 09:58 - 00031966 _____ () C:\ProgramData\nvModes.001
2014-08-04 17:07 - 2014-08-04 17:07 - 00000000 ___HD () C:\dvmexp
2014-08-04 17:07 - 2014-04-06 10:21 - 00000916 _____ () C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineCore.job
2014-08-04 17:07 - 2009-07-27 21:16 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-04 17:07 - 2009-03-09 20:16 - 00000000 ___HD () C:\temp
2014-08-04 17:07 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-04 17:07 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-04 17:06 - 2013-09-07 10:43 - 00001280 _____ () C:\Windows\Tasks\Plus-HD-1.5-updater.job
2014-08-04 17:06 - 2013-09-07 10:43 - 00001184 _____ () C:\Windows\Tasks\Plus-HD-1.5-codedownloader.job
2014-08-04 17:06 - 2013-09-07 10:43 - 00001084 _____ () C:\Windows\Tasks\Plus-HD-1.5-enabler.job
2014-08-04 17:06 - 2013-09-07 10:42 - 00001880 _____ () C:\Windows\Tasks\Plus-HD-1.5-chromeinstaller.job
2014-08-04 17:06 - 2013-09-07 10:42 - 00001804 _____ () C:\Windows\Tasks\Plus-HD-1.5-firefoxinstaller.job
2014-08-04 17:06 - 2009-07-14 09:54 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-08-04 17:06 - 2008-01-21 04:47 - 00272700 _____ () C:\Windows\PFRO.log
2014-08-04 17:06 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-03 16:25 - 2006-11-02 15:01 - 00032578 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-08-03 16:06 - 2013-10-14 09:02 - 00000266 _____ () C:\Windows\Tasks\RegClean Pro_DEFAULT.job
2014-08-03 10:43 - 2014-04-02 07:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2014-08-03 10:43 - 2014-03-30 16:39 - 00000865 _____ () C:\Users\Public\Desktop\AVG 2014.lnk
2014-08-03 10:34 - 2010-10-04 23:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-08-03 10:29 - 2014-04-06 12:28 - 00000000 ____D () C:\ProgramData\WPM
2014-07-28 12:43 - 2009-07-27 21:08 - 00002174 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-07-28 12:23 - 2009-07-14 09:46 - 00045056 _____ () C:\Windows\system32\acovcnt.exe
2014-07-28 12:22 - 2006-11-02 14:47 - 00532944 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-17 14:30 - 2006-11-02 14:37 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-17 14:21 - 2014-07-17 14:21 - 00160032 _____ () C:\Windows\Minidump\Mini071714-01.dmp
2014-07-17 14:21 - 2011-05-13 22:12 - 00000000 ____D () C:\Windows\Minidump
2014-07-17 14:20 - 2013-10-01 09:20 - 290672313 _____ () C:\Windows\MEMORY.DMP
2014-07-17 14:17 - 2013-08-19 12:53 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-17 14:17 - 2006-11-02 12:24 - 93585272 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-07-11 11:18 - 2012-05-24 09:45 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-07-11 11:18 - 2011-07-05 21:02 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

Files to move or delete:
====================
C:\Users\Public\AlexaNSISPlugin.4756.dll


Some content of TEMP:
====================
C:\Users\Shorty\AppData\Local\Temp\_is1C85.exe
C:\Users\Shorty\AppData\Local\Temp\_is81DC.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-04 17:14

==================== End Of Log ============================
--- --- ---



Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version:2-08-2014
Ran by Shorty at 2014-08-04 18:08:20
Running from C:\Users\Shorty\Documents
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: AVG AntiVirus Free Edition 2014 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus Free Edition 2014 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

ABBYY FineReader 6.0 Sprint (HKLM\...\{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}) (Version: 6.00.1395.4512 - ABBYY Software House)
Adobe Flash Player 14 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Reader 8.1.3 - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-A81300000003}) (Version: 8.1.3 - Adobe Systems Incorporated)
ASUS CopyProtect (HKLM\...\{6B77A7F6-DD63-4F13-A6FF-83137A5AC354}) (Version: 1.0.0008 - ASUS)
ASUS Data Security Manager (HKLM\...\{1C8521E5-5A7B-4A4E-A9CD-AD53116EAEE0}) (Version: 1.00.0007 - ASUS)
ASUS LifeFrame3 (HKLM\...\{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}) (Version: 3.0.13 - ASUS)
ASUS Live Update (HKLM\...\{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}) (Version: 2.5.7 - ASUS)
ASUS Power4Gear Hybrid (HKLM\...\{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}) (Version: 1.1.09 - ASUS)
ASUS SmartLogon (HKLM\...\{64452561-169F-4A36-A2FF-B5E118EC65F5}) (Version: 1.0.0005 - ASUS)
ASUS Splendid Video Enhancement Technology (HKLM\...\{0969AF05-4FF6-4C00-9406-43599238DE0D}) (Version: 1.02.0021 - ASUS)
ASUS Virtual Camera (HKLM\...\{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}) (Version: 1.0.12 - ASUS)
Asus_Camera_ScreenSaver (HKLM\...\Asus_Camera_ScreenSaver) (Version: 2.0.0007 - ASUS)
Atheros Client Installation Program (HKLM\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 7.0 - Atheros)
ATK Generic Function Service (HKLM\...\{D3D54F3E-C5C3-443D-978F-87A72E5616E8}) (Version: 1.00.0008 - ATK)
ATK Hotkey (HKLM\...\{7C05592D-424B-46CB-B505-E0013E8E75C9}) (Version: 1.0.0045 - ASUS)
ATK Media (HKLM\...\{D1E5870E-E3E5-4475-98A6-ADD614524ADF}) (Version: 2.0.0001 - ASUS)
ATKOSD2 (HKLM\...\{3B05F2FB-745B-4012-ADF2-439F36B2E70B}) (Version: 7.0.0002 - ASUS)
avast! Antivirus (HKLM\...\avast!) (Version: 4.8 - Alwil Software)
AVG 2014 (HKLM\...\AVG) (Version: 2014.0.4744 - AVG Technologies)
AVG 2014 (Version: 14.0.3986 - AVG Technologies) Hidden
AVG 2014 (Version: 14.0.4744 - AVG Technologies) Hidden
Camera RAW Plug-In for EPSON Creativity Suite (HKLM\...\{93EA9C3E-BDFD-4309-A605-9B5BBC0CCEFD}) (Version: 2.2.0.0 - SEIKO EPSON CORPORATION)
Cisco EAP-FAST Module (HKLM\...\{415B2719-AD3A-4944-B404-C472DB6085B3}) (Version: 2.1.6 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM\...\{83770D14-21B9-44B3-8689-F7B523F94560}) (Version: 1.0.12 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM\...\{669C7BD8-DAA2-49B6-966C-F1E2AAE6B17E}) (Version: 1.0.13 - Cisco Systems, Inc.)
CyberLink LabelPrint (HKLM\...\{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.0.2908 - CyberLink Corp.)
CyberLink Power2Go (HKLM\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.1924 - CyberLink Corp.)
CyberLink Power2Go (Version: 6.0.1924 - CyberLink Corp.) Hidden
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
EPSON Attach To Email (HKLM\...\InstallShield_{20C45B32-5AB6-46A4-94EF-58950CAF05E5}) (Version: 1.01.0000 - SEIKO EPSON)
EPSON Attach To Email (Version: 1.01.0000 - SEIKO EPSON) Hidden
EPSON Copy Utility 3 (HKLM\...\{67EDD823-135A-4D59-87BD-950616D6E857}) (Version: 3.3.0.0 - )
EPSON Easy Photo Print (HKLM\...\{3D78F2A2-C893-4ABD-B5FE-AD7011837755}) (Version: 1.5.0.0 - SEIKO EPSON CORPORATION)
EPSON File Manager (HKLM\...\{2EB81825-E9EE-44F4-8F51-1240C3898DC6}) (Version: 1.3.0.0 - )
EPSON Scan (HKLM\...\EPSON Scanner) (Version:  - )
EPSON Scan Assistant (HKLM\...\{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}) (Version: 1.10.00 - )
EPSON Stylus CX7300_CX8300_DX7400_DX8400 Handbuch (HKLM\...\EPSON Stylus CX7300_CX8300_DX7400_DX8400 Benutzerhandbuch) (Version:  - )
EPSON-Drucker-Software (HKLM\...\EPSON Printer and Utilities) (Version:  - SEIKO EPSON Corporation)
Express Gate (HKLM\...\{E8CC51B4-F039-4A13-8C23-57661C5A90AC}) (Version: 1.0.4.1 - DeviceVM, Inc.)
Google Chrome (HKLM\...\Google Chrome) (Version: 36.0.1985.125 - Google Inc.)
Google Desktop (HKLM\...\Google Desktop) (Version: 5.9.1005.12335 - Google)
Google Toolbar for Internet Explorer (HKLM\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.24.15 - Google Inc.) Hidden
Java(TM) 6 Update 31 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216031FF}) (Version: 6.0.310 - Oracle)
Junk Mail filter update (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LightScribe System Software  1.14.17.1 (HKLM\...\{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}) (Version: 1.14.17.1 - LightScribe)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Antimalware Service DE-DE Language Pack (Version: 3.0.8402.2 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.3 (HKLM\...\{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}) (Version: 2.0.2313.0 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM\...\{95120000-0120-0407-0000-0000000FF1CE}) (Version: 12.0.6414.1000 - Microsoft Corporation)
Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden
Microsoft Security Client DE-DE Language Pack (Version: 2.1.1116.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.5.216.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218 (HKLM\...\{E503B4BF-F7BB-3D5F-8BC8-F694B1CFF942}) (Version: 9.0.21022.218 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
Norton Internet Security (Version: 16.0.0.125 - Symantec Corporation) Hidden
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.4 - NVIDIA Corporation)
OpenOffice.org 3.2 (HKLM\...\{8D1E61D1-1395-4E97-997F-D002DB3A5074}) (Version: 3.2.9502 - OpenOffice.org)
Picasa 3 (HKLM\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Plus-HD-1.5 (HKLM\...\Plus-HD-1.5) (Version: 1.28.153.1 - Plus HD) <==== ATTENTION
Print Shop Premier 5.0 (HKLM\...\The Print Shop Premier Edition 5.0) (Version:  - )
qone8 uninstaller (HKLM\...\qone8 uninstaller) (Version:  - qone8) <==== ATTENTION
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5745 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM\...\{DC24971E-1946-445D-8A82-CE685433FA7D}) (Version:  - Realtek Semiconductor Corp.)
RegClean Pro (HKLM\...\RegClean Pro_is1) (Version: 6.21 - Systweak Inc) <==== ATTENTION
Segoe UI (Version: 15.4.2271.0615 - Microsoft Corp) Hidden
Softonic_Deutsch Toolbar (HKLM\...\Softonic_Deutsch Toolbar) (Version:  - ) <==== ATTENTION
Spelling Dictionaries Support For Adobe Reader 8 (HKLM\...\{AC76BA86-7AD7-5464-3428-800000000003}) (Version: 8.0.0 - Adobe Systems)
SRS Premium Sound (HKLM\...\{0C29E9A8-3E52-408F-8B2F-6039F46E25E5}) (Version: 1.06.0300 - SRS Labs, Inc.)
SupTab (HKLM\...\SupTab) (Version: 1.1.1.0 - ) <==== ATTENTION
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 10.1.8.0 - Synaptics)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)
USB2.0 UVC 1.3M WebCam (HKLM\...\USB2.0 UVC 1.3M WebCam) (Version:  - )
V-bates 2.0.0.438 (HKLM\...\{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}_is1) (Version: 2.0.0.438 - Wajamu) <==== ATTENTION
Visual Studio 2012 x86 Redistributables (HKLM\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.0.5 (HKLM\...\VLC media player) (Version: 2.0.5 - VideoLAN)
Windows Live Communications Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Essentials (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 15.4.3555.0308 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live SOXE (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM\...\{586509F0-350D-48B5-B763-9CC2F8D96C4C}) (Version: 14.0.8117.416 - Microsoft Corporation)
Windows Live UX Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WinFlash (HKLM\...\{DE10AB76-4756-4913-BE25-55D1C1051F9A}) (Version:  - )
Wireless Console 2 (HKLM\...\{83F73CB1-7705-49D1-9852-84D839CA2A45}) (Version: 2.0.10 - ATK)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3212465446-2577034139-3834760431-1000_Classes\CLSID\{4052D303-74C5-49EA-BC6B-66099C8D4007}\InprocServer32 -> C:\Program Files\Google\Google Desktop Search\GoogleDesktopAPI2.dll (Google)

==================== Restore Points  =========================


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1      localhost
::1            localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {177B1A11-3D4D-47D9-819F-DAA4B13C0860} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-11] (Adobe Systems Incorporated)
Task: {17ED87C0-AA62-490F-8312-7620D34E0095} - System32\Tasks\RegClean Pro_DEFAULT => C:\Program Files\RegClean Pro\RegCleanPro.exe <==== ATTENTION
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {1D556997-88B9-4426-B3F0-3091F1E207A2} - System32\Tasks\SaveSenseLiveUpdateTaskMachineCore => C:\Program Files\SaveSenseLive\Update\SaveSenseLive.exe [2014-04-06] (SaveSense) <==== ATTENTION
Task: {2C5BBC98-F8C5-48D1-8623-6EC3A4EA69AF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2009-07-27] (Google Inc.)
Task: {320124A7-D70F-41DE-A9D1-D5E8E19D5D91} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {3EF249DA-A8BF-4AA6-AB53-84A58E1BBD64} - System32\Tasks\Plus-HD-1.5-chromeinstaller => C:\Program Files\Plus-HD-1.5\Plus-HD-1.5-chromeinstaller.exe
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {53335716-4FBE-4A8B-A339-EB8D69869861} - System32\Tasks\SaveSense => C:\Users\Shorty\AppData\Roaming\SaveSense\UpdateProc\UpdateTask.exe [2013-04-12] () <==== ATTENTION
Task: {554D34D9-D0E1-4704-8BF7-411A21743B55} - System32\Tasks\PrivacyDR_Popup => C:\Program Files\Privacy DR\Splash.exe
Task: {6871676C-3D5D-4FF3-9241-C36279F55CD2} - System32\Tasks\FF Watcher {9F5B7DBB-965F-4063-B35B-443370725961} => C:\Program Files\V-bates\PrefHelper.exe [2014-02-26] ()
Task: {6AA13BD4-61D5-46D0-B715-7E0FFDF72DD7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2009-07-27] (Google Inc.)
Task: {75F1DEE3-CDC4-4109-BBAB-48C41487D268} - System32\Tasks\fsupdate => C:\Program
Task: {78398FFD-E446-40B8-9E20-F51FE6C3D9A6} - System32\Tasks\ASPG => C:\Program Files\ASUS\ASUS CopyProtect\aspg.exe [2008-06-19] (ASUS)
Task: {7E478769-D4BE-4821-81E5-A42B6378C9B0} - System32\Tasks\Microsoft\Windows\RestartManager\{DB9434F7-0AB3-4fec-A585-E24AB4BDD8EE} => C:\Windows\system32\rmclient.exe [2006-11-02] (Microsoft Corporation)
Task: {80848ED1-240B-4383-A6C1-AECDC39E5003} - System32\Tasks\Plus-HD-1.5-updater => C:\Program Files\Plus-HD-1.5\Plus-HD-1.5-updater.exe
Task: {86A54A1F-3BA7-4E81-A16B-A27F4EDC2A39} - System32\Tasks\Plus-HD-1.5-codedownloader => C:\Program Files\Plus-HD-1.5\Plus-HD-1.5-codedownloader.exe
Task: {890E8CCE-3FFA-437E-AA26-F9E9EB47F1EE} - System32\Tasks\PrivacyDR_Start => C:\Program Files\Privacy DR\PrivacyDR.exe
Task: {9E51E563-3101-4D6B-9ECD-33DD984110AF} - System32\Tasks\RegistryDr_Popup => C:\Program Files\Registry Dr\Splash.exe <==== ATTENTION
Task: {A4A2F13B-DA95-428A-965C-68936BE1EF1E} - System32\Tasks\ASUS P4G => C:\Program files\P4G\BatteryLife.exe [2008-10-18] (ATK)
Task: {AB160873-081C-4CF8-A6C7-E414C20CA2C6} - System32\Tasks\RegClean Pro_UPDATES => C:\Program Files\RegClean Pro\RegCleanPro.exe <==== ATTENTION
Task: {C764A332-6AC6-4A6C-9C17-A99DB7FE9DAC} - System32\Tasks\ASUS Live Update => C:\Program Files\ASUS\ASUS Live Update\ALU.exe [2007-11-30] ()
Task: {DFBDB453-C21D-49CC-8D29-EEDB38A31E78} - System32\Tasks\RegistryDr_Start => C:\Program Files\Registry Dr\RegistryDr.exe <==== ATTENTION
Task: {E3F8565B-9B85-4FC3-9979-F8480A82BEEF} - System32\Tasks\SaveSenseLiveUpdateTaskMachineUA => C:\Program Files\SaveSenseLive\Update\SaveSenseLive.exe [2014-04-06] (SaveSense) <==== ATTENTION
Task: {E4A04428-5EB1-4919-A479-0DFD79ED0960} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: {ED9FF6FE-DBBE-4AF6-99D0-F8EF5E1674B3} - System32\Tasks\Plus-HD-1.5-enabler => C:\Program Files\Plus-HD-1.5\Plus-HD-1.5-enabler.exe
Task: {F4A44103-B006-4A8C-B6BE-F5492CD3E3AE} - System32\Tasks\Plus-HD-1.5-firefoxinstaller => C:\Program Files\Plus-HD-1.5\Plus-HD-1.5-firefoxinstaller.exe
Task: {F6E4E352-5067-4180-BB4D-185EADD43839} - System32\Tasks\{60427527-516D-411B-B8CF-6D203CAA33EC} => C:\Program Files\Skype\Phone\Skype.exe
Task: {FF5B47A1-7435-4B6B-9F72-16E2058CE28C} - System32\Tasks\ASUS SmartLogon Console Sensor => C:\Program Files\ASUS\SmartLogon\sensorsrv.exe [2008-06-18] (ASUS)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FF Watcher {9F5B7DBB-965F-4063-B35B-443370725961}.job => C:\Program Files\V-bates\PrefHelper.exe <==== ATTENTION
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Plus-HD-1.5-chromeinstaller.job => C:\Program Files\Plus-HD-1.5\Plus-HD-1.5-chromeinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-1.5-codedownloader.job => C:\Program Files\Plus-HD-1.5\Plus-HD-1.5-codedownloader.exe <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-1.5-enabler.job => C:\Program Files\Plus-HD-1.5\Plus-HD-1.5-enabler.exe <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-1.5-firefoxinstaller.job => C:\Program Files\Plus-HD-1.5\Plus-HD-1.5-firefoxinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-1.5-updater.job => C:\Program Files\Plus-HD-1.5\Plus-HD-1.5-updater.exe <==== ATTENTION
Task: C:\Windows\Tasks\RegClean Pro_DEFAULT.job => C:\Program Files\RegClean Pro\RegCleanPro.exe <==== ATTENTION
Task: C:\Windows\Tasks\RegClean Pro_UPDATES.job => C:\Program Files\RegClean Pro\RegCleanPro.exe <==== ATTENTION
Task: C:\Windows\Tasks\SaveSense.job => C:\Users\Shorty\AppData\Roaming\SAVESE~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineCore.job => C:\Program Files\SaveSenseLive\Update\SaveSenseLive.exe <==== ATTENTION
Task: C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineUA.job => C:\Program Files\SaveSenseLive\Update\SaveSenseLive.exe <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2008-08-14 05:59 - 2008-08-14 05:59 - 00100920 _____ () C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe
2009-03-09 19:50 - 2007-08-08 09:08 - 00094208 _____ () C:\Program Files\ATKGFNEX\GFNEXSrv.exe
2009-03-09 20:11 - 2007-06-15 19:28 - 00147456 _____ () C:\Program Files\ASUS\ASUS Data Security Manager\OverlayIconShlExt.dll
2009-03-09 20:11 - 2007-06-02 02:08 - 00143360 _____ () C:\Program Files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll
2008-08-21 00:49 - 2008-08-21 00:49 - 00016384 _____ () C:\Program files\P4G\DevMng.dll
2008-10-17 01:45 - 2008-10-17 01:45 - 00014848 _____ () C:\Program files\P4G\OvrClk.dll
2009-03-09 19:50 - 2007-03-10 01:16 - 00106496 _____ () C:\Program Files\ATKGFNEX\AGFNEX.dll
2009-03-09 20:13 - 2007-11-30 20:20 - 00051768 _____ () C:\Program Files\ASUS\ASUS Live Update\ALU.exe
2009-03-09 20:09 - 2007-07-06 01:53 - 01040384 _____ () C:\Program Files\Wireless Console 2\wcourier.exe
2007-07-10 07:48 - 2007-07-10 07:48 - 00009216 _____ () C:\Program Files\ASUS\Splendid\GLCDdll.dll
2007-11-13 00:41 - 2007-11-13 00:41 - 00106496 _____ () C:\Program Files\ASUS\ATK Hotkey\MsgTran.dll
2014-04-06 11:15 - 2014-02-26 15:31 - 00209408 _____ () C:\Program Files\V-bates\ExtensionUpdaterService.exe
2007-07-12 22:55 - 2007-07-12 22:55 - 01581056 _____ () C:\Program Files\Common Files\LightScribe\QtCore4.dll
2007-08-14 22:59 - 2007-08-14 22:59 - 06365184 _____ () C:\Program Files\Common Files\LightScribe\QtGui4.dll
2007-07-12 22:55 - 2007-07-12 22:55 - 00131072 _____ () C:\Program Files\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: SkypeUpdate => 2
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: ASUS Camera ScreenSaver => C:\Windows\AsScrProlog.exe
MSCONFIG\startupreg: CLMLServer => "C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe"
MSCONFIG\startupreg: EPSON Stylus DX8400 Series => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE /FU "C:\Windows\TEMP\E_S19E6.tmp" /EF "HKCU"
MSCONFIG\startupreg: Google Desktop Search => "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
MSCONFIG\startupreg: MSC => "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
MSCONFIG\startupreg: Skype => "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: SpywareTerminatorShield => C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
MSCONFIG\startupreg: SpywareTerminatorUpdater => C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
MSCONFIG\startupreg: swg => "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (08/04/2014 05:17:58 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts auf dem Volume (Prozess = C:\Windows\system32\svchost.exe -k netsvcs; Beschreibung = Windows Update; Hr = 0x80070422).

Error: (08/04/2014 05:08:00 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/03/2014 10:42:44 AM) (Source: MsiInstaller) (EventID: 11311) (User: NT-AUTORITÄT)
Description: SA_Error1709: StandardAction(0xC00706AD): Produkt: AVG 2014 -- Fehler 1311. SA_Error1311: StandardAction(0xC007051F): Die Quelldatei (CAB-Datei) wurde nicht gefunden: C:\ProgramData\AVG2014\SetupBackup\lng_esx.cab. Überprüfen Sie, ob die Datei vorhanden ist und Sie darauf zugreifen können.

Error: (08/03/2014 10:42:42 AM) (Source: MsiInstaller) (EventID: 11311) (User: NT-AUTORITÄT)
Description: SA_Error1709: StandardAction(0xC00706AD): Produkt: AVG 2014 -- Fehler 1311. SA_Error1311: StandardAction(0xC007051F): Die Quelldatei (CAB-Datei) wurde nicht gefunden: C:\ProgramData\AVG2014\SetupBackup\lng_ztx.cab. Überprüfen Sie, ob die Datei vorhanden ist und Sie darauf zugreifen können.

Error: (08/03/2014 10:42:40 AM) (Source: MsiInstaller) (EventID: 11311) (User: NT-AUTORITÄT)
Description: SA_Error1709: StandardAction(0xC00706AD): Produkt: AVG 2014 -- Fehler 1311. SA_Error1311: StandardAction(0xC007051F): Die Quelldatei (CAB-Datei) wurde nicht gefunden: C:\ProgramData\AVG2014\SetupBackup\lng_zhx.cab. Überprüfen Sie, ob die Datei vorhanden ist und Sie darauf zugreifen können.

Error: (08/03/2014 10:42:39 AM) (Source: MsiInstaller) (EventID: 11311) (User: NT-AUTORITÄT)
Description: SA_Error1709: StandardAction(0xC00706AD): Produkt: AVG 2014 -- Fehler 1311. SA_Error1311: StandardAction(0xC007051F): Die Quelldatei (CAB-Datei) wurde nicht gefunden: C:\ProgramData\AVG2014\SetupBackup\lng_trx.cab. Überprüfen Sie, ob die Datei vorhanden ist und Sie darauf zugreifen können.

Error: (08/03/2014 10:42:37 AM) (Source: MsiInstaller) (EventID: 11311) (User: NT-AUTORITÄT)
Description: SA_Error1709: StandardAction(0xC00706AD): Produkt: AVG 2014 -- Fehler 1311. SA_Error1311: StandardAction(0xC007051F): Die Quelldatei (CAB-Datei) wurde nicht gefunden: C:\ProgramData\AVG2014\SetupBackup\lng_rux.cab. Überprüfen Sie, ob die Datei vorhanden ist und Sie darauf zugreifen können.

Error: (08/03/2014 10:42:36 AM) (Source: MsiInstaller) (EventID: 11311) (User: NT-AUTORITÄT)
Description: SA_Error1709: StandardAction(0xC00706AD): Produkt: AVG 2014 -- Fehler 1311. SA_Error1311: StandardAction(0xC007051F): Die Quelldatei (CAB-Datei) wurde nicht gefunden: C:\ProgramData\AVG2014\SetupBackup\lng_msx.cab. Überprüfen Sie, ob die Datei vorhanden ist und Sie darauf zugreifen können.

Error: (08/03/2014 10:42:34 AM) (Source: MsiInstaller) (EventID: 11311) (User: NT-AUTORITÄT)
Description: SA_Error1709: StandardAction(0xC00706AD): Produkt: AVG 2014 -- Fehler 1311. SA_Error1311: StandardAction(0xC007051F): Die Quelldatei (CAB-Datei) wurde nicht gefunden: C:\ProgramData\AVG2014\SetupBackup\lng_kox.cab. Überprüfen Sie, ob die Datei vorhanden ist und Sie darauf zugreifen können.

Error: (08/03/2014 10:42:33 AM) (Source: MsiInstaller) (EventID: 11311) (User: NT-AUTORITÄT)
Description: SA_Error1709: StandardAction(0xC00706AD): Produkt: AVG 2014 -- Fehler 1311. SA_Error1311: StandardAction(0xC007051F): Die Quelldatei (CAB-Datei) wurde nicht gefunden: C:\ProgramData\AVG2014\SetupBackup\lng_idx.cab. Überprüfen Sie, ob die Datei vorhanden ist und Sie darauf zugreifen können.


System errors:
=============
Error: (08/04/2014 05:09:32 PM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT)
Description: 0x80070032

Error: (08/04/2014 05:08:00 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: aswRdr
aswSP
aswTdi

Error: (08/04/2014 05:08:00 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: aswFsBlk%%2

Error: (08/03/2014 10:45:09 AM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: AVGIDSAgent3758213661 (0xE001CA1D)

Error: (08/03/2014 10:44:58 AM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: AVGIDSAgent3758213661 (0xE001CA1D)

Error: (08/03/2014 10:44:47 AM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: AVGIDSAgent3758213661 (0xE001CA1D)

Error: (08/03/2014 10:44:46 AM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: AVGIDSAgent3758213661 (0xE001CA1D)

Error: (08/03/2014 10:44:45 AM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: AVGIDSAgent3758213661 (0xE001CA1D)

Error: (08/03/2014 10:44:44 AM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: AVGIDSAgent3758213661 (0xE001CA1D)

Error: (08/03/2014 10:44:43 AM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: AVGIDSAgent3758213661 (0xE001CA1D)


Microsoft Office Sessions:
=========================
Error: (08/04/2014 05:17:58 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\svchost.exe -k netsvcsWindows Update0x80070422

Error: (08/04/2014 05:08:00 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/03/2014 10:42:44 AM) (Source: MsiInstaller) (EventID: 11311) (User: NT-AUTORITÄT)
Description: SA_Error1709: StandardAction(0xC00706AD): Produkt: AVG 2014 -- Fehler 1311. SA_Error1311: StandardAction(0xC007051F): Die Quelldatei (CAB-Datei) wurde nicht gefunden: C:\ProgramData\AVG2014\SetupBackup\lng_esx.cab. Überprüfen Sie, ob die Datei vorhanden ist und Sie darauf zugreifen können.(NULL)(NULL)(NULL)(NULL)

Error: (08/03/2014 10:42:42 AM) (Source: MsiInstaller) (EventID: 11311) (User: NT-AUTORITÄT)
Description: SA_Error1709: StandardAction(0xC00706AD): Produkt: AVG 2014 -- Fehler 1311. SA_Error1311: StandardAction(0xC007051F): Die Quelldatei (CAB-Datei) wurde nicht gefunden: C:\ProgramData\AVG2014\SetupBackup\lng_ztx.cab. Überprüfen Sie, ob die Datei vorhanden ist und Sie darauf zugreifen können.(NULL)(NULL)(NULL)(NULL)

Error: (08/03/2014 10:42:40 AM) (Source: MsiInstaller) (EventID: 11311) (User: NT-AUTORITÄT)
Description: SA_Error1709: StandardAction(0xC00706AD): Produkt: AVG 2014 -- Fehler 1311. SA_Error1311: StandardAction(0xC007051F): Die Quelldatei (CAB-Datei) wurde nicht gefunden: C:\ProgramData\AVG2014\SetupBackup\lng_zhx.cab. Überprüfen Sie, ob die Datei vorhanden ist und Sie darauf zugreifen können.(NULL)(NULL)(NULL)(NULL)

Error: (08/03/2014 10:42:39 AM) (Source: MsiInstaller) (EventID: 11311) (User: NT-AUTORITÄT)
Description: SA_Error1709: StandardAction(0xC00706AD): Produkt: AVG 2014 -- Fehler 1311. SA_Error1311: StandardAction(0xC007051F): Die Quelldatei (CAB-Datei) wurde nicht gefunden: C:\ProgramData\AVG2014\SetupBackup\lng_trx.cab. Überprüfen Sie, ob die Datei vorhanden ist und Sie darauf zugreifen können.(NULL)(NULL)(NULL)(NULL)

Error: (08/03/2014 10:42:37 AM) (Source: MsiInstaller) (EventID: 11311) (User: NT-AUTORITÄT)
Description: SA_Error1709: StandardAction(0xC00706AD): Produkt: AVG 2014 -- Fehler 1311. SA_Error1311: StandardAction(0xC007051F): Die Quelldatei (CAB-Datei) wurde nicht gefunden: C:\ProgramData\AVG2014\SetupBackup\lng_rux.cab. Überprüfen Sie, ob die Datei vorhanden ist und Sie darauf zugreifen können.(NULL)(NULL)(NULL)(NULL)

Error: (08/03/2014 10:42:36 AM) (Source: MsiInstaller) (EventID: 11311) (User: NT-AUTORITÄT)
Description: SA_Error1709: StandardAction(0xC00706AD): Produkt: AVG 2014 -- Fehler 1311. SA_Error1311: StandardAction(0xC007051F): Die Quelldatei (CAB-Datei) wurde nicht gefunden: C:\ProgramData\AVG2014\SetupBackup\lng_msx.cab. Überprüfen Sie, ob die Datei vorhanden ist und Sie darauf zugreifen können.(NULL)(NULL)(NULL)(NULL)

Error: (08/03/2014 10:42:34 AM) (Source: MsiInstaller) (EventID: 11311) (User: NT-AUTORITÄT)
Description: SA_Error1709: StandardAction(0xC00706AD): Produkt: AVG 2014 -- Fehler 1311. SA_Error1311: StandardAction(0xC007051F): Die Quelldatei (CAB-Datei) wurde nicht gefunden: C:\ProgramData\AVG2014\SetupBackup\lng_kox.cab. Überprüfen Sie, ob die Datei vorhanden ist und Sie darauf zugreifen können.(NULL)(NULL)(NULL)(NULL)

Error: (08/03/2014 10:42:33 AM) (Source: MsiInstaller) (EventID: 11311) (User: NT-AUTORITÄT)
Description: SA_Error1709: StandardAction(0xC00706AD): Produkt: AVG 2014 -- Fehler 1311. SA_Error1311: StandardAction(0xC007051F): Die Quelldatei (CAB-Datei) wurde nicht gefunden: C:\ProgramData\AVG2014\SetupBackup\lng_idx.cab. Überprüfen Sie, ob die Datei vorhanden ist und Sie darauf zugreifen können.(NULL)(NULL)(NULL)(NULL)


CodeIntegrity Errors:
===================================
  Date: 2014-08-04 18:07:36.833
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\avgidshx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-04 18:07:35.918
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\avgidshx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-04 18:07:34.868
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\avgidshx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-04 18:07:33.912
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\avgidshx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-04 18:07:32.748
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\avgidsdriverx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-04 18:07:31.910
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\avgidsdriverx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-04 18:07:31.067
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\avgidsdriverx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-04 18:07:30.229
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\avgidsdriverx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-03 10:43:24.373
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\SET58F7.tmp" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-03 10:43:22.688
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\SET58F7.tmp" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info ===========================

Percentage of memory in use: 48%
Total physical RAM: 3070.58 MB
Available physical RAM: 1567.47 MB
Total Pagefile: 6349.44 MB
Available Pagefile: 4743.23 MB
Total Virtual: 2047.88 MB
Available Virtual: 1907.56 MB

==================== Drives ================================

Drive c: (VistaOS) (Fixed) (Total:149.04 GB) (Free:115.84 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (DATA) (Fixed) (Total:137.32 GB) (Free:134.37 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298 GB) (Disk ID: 97646C29)
Partition 1: (Not Active) - (Size=12 GB) - (Type=1C)
Partition 2: (Active) - (Size=149 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=137 GB) - (Type=OF Extended)

==================== End Of Log ============================

schrauber 05.08.2014 12:34
Adware & Co. deinstallieren





Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

BlackKisu 05.08.2014 13:47
Ich musste AVG und Microsoft Essentials ausschalten aber währen Combofix am laufen war aktivierte sich AVG und identifizierte Combofix als bedrohung musste dann auf Zulassen klicken dann is alles gelaufen ohne zwischenfall.

Code:
ComboFix 14-08-05.01 - Shorty 05.08.2014  14:22:52.1.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6002.2.1252.49.1031.18.3071.1227 [GMT 2:00]
ausgeführt von:: c:\users\Shorty\Documents\ComboFix.exe
AV: AVG AntiVirus Free Edition 2014 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: AVG AntiVirus Free Edition 2014 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Common Files\ASPG_icon.ico
c:\program files\Flowsurf\FlOWsurf.dll
c:\program files\SaveSenseLive
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdate.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_am.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_ar.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_bg.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_bn.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_ca.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_cs.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_da.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_de.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_el.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_en-GB.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_en.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_es-419.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_es.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_et.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_fa.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_fi.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_fil.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_fr.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_gu.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_hi.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_hr.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_hu.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_id.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_is.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_it.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_iw.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_ja.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_kn.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_ko.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_lt.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_lv.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_ml.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_mr.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_ms.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_nl.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_no.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_pl.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_pt-BR.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_pt-PT.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_ro.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_ru.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_sk.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_sl.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_sr.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_sv.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_sw.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_ta.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_te.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_th.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_tr.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_uk.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_ur.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_vi.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_zh-CN.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\goopdateres_zh-TW.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\psmachine.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\psuser.dll
c:\program files\SaveSenseLive\Update\1.3.23.0\SaveSenseLive.exe
c:\program files\SaveSenseLive\Update\1.3.23.0\SaveSenseLiveBroker.exe
c:\program files\SaveSenseLive\Update\1.3.23.0\SaveSenseLiveHandler.exe
c:\program files\SaveSenseLive\Update\1.3.23.0\SaveSenseLiveHelper.msi
c:\program files\SaveSenseLive\Update\1.3.23.0\SaveSenseLiveOnDemand.exe
c:\program files\SaveSenseLive\Update\SaveSenseLive.exe
c:\programdata\SaveSenseLive
c:\programdata\SaveSenseLive\Update\Log\SaveSenseLive.log
c:\users\Public\AlexaNSISPlugin.4756.dll
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome.manifest
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\api.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\api\asyncDB.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\api\background.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\api\browserAction.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\api\contextMenu.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\api\dbManager.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\api\dom_bg.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\api\fileManager.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\api\firefox.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\api\firefoxNotifications.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\api\firefoxOmnibox.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\api\message.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\api\pageAction.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\api\request.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\api\tabs.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\api\webRequest.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\background.html
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\baseObject.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\browser.xul
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\core\console.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\core\consts.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\core\delegate.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\core\extensionDataStore.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\core\folderIOWrapper.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\core\httpObserver.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\core\IDBWrapper.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\core\installer.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\core\logFile.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\core\prefs.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\core\progressListenerObserver.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\core\registry.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\core\reloadObserver.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\core\reports.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\core\requestObject.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\core\searchSettings.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\core\uninstallObserver.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\core\updateManager.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\core\utils.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\core\xhr.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\dialog.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\main.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\options.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\options.xul
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\chrome\content\search_dialog.xul
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\defaults\preferences\prefs.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\manifest.xml
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins.json
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\1_base.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\101_cortica_m.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\102_dealply_m.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\103_intext_5_m.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\104_jollywallet_m.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\105_corticas_m.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\107_coupish_m.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\108_icm_m.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\116_ads_only_5_m.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\117_coupons_intext_ads_5_m.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\119_similar_web_m.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\120_luck_m.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\123_intext_adv_m.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\124_superfish_no_search_no_coupons_m.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\125_arcadi2_m.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\126_revizer_ws_m.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\127_revizer_p_m.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\128_superfish_pricora_m.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\129_widdit_m.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\13_CrossriderAppUtils.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\135_arcadi3_m.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\138_getdeal_m.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\14_CrossriderUtils.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\141_corticas_ru_m.js.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\142_intext_fa_m.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\155_ibario_pops_m.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\158_50onred_ads_only_no_fb_m.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\159_cortica_rollover_m.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\16_FFAppAPIWrapper.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\17_jQuery.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\21_debug.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\22_resources.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\28_initializer.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\4_jquery_1_7_1.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\47_resources_background.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\64_appApiMessage.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\72_appApiValidation.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\78_CrossriderInfo.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\87_ginyas_wrapper.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\91_monetizationLoader.js.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\92_superfish_m.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\93_superfish_no_coupons_m.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\98_omniCommands.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\userCode\background.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\userCode\extension.js
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\install.rdf
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\locale\en-US\translations.dtd
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\skin\button1.png
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\skin\button2.png
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\skin\button3.png
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\skin\button4.png
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\skin\button5.png
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\skin\crossrider_statusbar.png
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\skin\icon128.png
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\skin\icon16.png
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\skin\icon24.png
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\skin\icon48.png
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\skin\panelarrow-up.png
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\skin\popup.html
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\skin\skin.css
c:\users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\skin\update.css
c:\users\Shorty\AppData\Roaming\SaveSense
c:\users\Shorty\AppData\Roaming\SaveSense\UpdateProc\config.dat
c:\users\Shorty\AppData\Roaming\SaveSense\UpdateProc\info.dat
c:\users\Shorty\AppData\Roaming\SaveSense\UpdateProc\STTL.DAT
c:\users\Shorty\AppData\Roaming\SaveSense\UpdateProc\TTL.DAT
c:\users\Shorty\AppData\Roaming\SaveSense\UpdateProc\UpdateTask.exe
c:\windows\system32\aswAF71.tmp
c:\windows\unin0407.exe
C:\WindowsLive_A.TXT
.
.
(((((((((((((((((((((((((((((((((((((((  Treiber/Dienste  )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_savesenselive
-------\Service_savesenselivem
-------\Service_savesenselivem
.
.
(((((((((((((((((((((((  Dateien erstellt von 2014-07-05 bis 2014-08-05  ))))))))))))))))))))))))))))))
.
.
2014-08-05 12:37 . 2014-08-05 12:37        --------        d-----w-        C:\dvmexp
2014-08-05 12:35 . 2014-08-05 12:38        --------        d-----w-        c:\users\Shorty\AppData\Local\temp
2014-08-05 11:51 . 2014-08-05 11:51        --------        d-----w-        c:\program files\VS Revo Group
2014-08-04 16:07 . 2014-08-04 16:08        --------        d-----w-        C:\FRST
2014-08-04 15:18 . 2014-07-02 03:11        8217224        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2E703352-3526-4E10-A8B1-5D63546BDA4A}\mpengine.dll
2014-08-03 08:44 . 2014-05-02 13:11        765968        ------w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{99A19AEF-38F0-4B65-BEE7-D5DF9FEA720D}\gapaengine.dll
2014-08-03 08:41 . 2014-07-02 03:11        8217224        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-07-11 07:53 . 2014-06-02 10:31        1218048        ----a-w-        c:\program files\Windows Journal\NBDoc.DLL
2014-07-11 07:53 . 2014-06-02 10:30        983552        ----a-w-        c:\program files\Windows Journal\JNTFiltr.dll
2014-07-11 07:53 . 2014-06-02 10:30        965120        ----a-w-        c:\program files\Windows Journal\JNWDRV.dll
2014-07-11 07:53 . 2014-06-02 10:30        937472        ----a-w-        c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2014-07-11 07:53 . 2014-06-07 02:08        1305088        ----a-w-        c:\program files\Common Files\Microsoft Shared\ink\tipskins.dll
2014-07-11 07:53 . 2014-06-07 02:08        149504        ----a-w-        c:\program files\Common Files\Microsoft Shared\ink\tabskb.dll
2014-07-11 07:53 . 2014-06-07 00:19        2051072        ----a-w-        c:\windows\system32\win32k.sys
2014-07-11 07:53 . 2014-06-07 02:08        114688        ----a-w-        c:\program files\Common Files\Microsoft Shared\ink\TipBand.dll
2014-07-11 07:53 . 2014-06-06 08:59        506880        ----a-w-        c:\windows\system32\qedit.dll
2014-07-11 07:53 . 2014-05-30 06:53        273408        ----a-w-        c:\windows\system32\drivers\afd.sys
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-08-05 12:37 . 2009-07-14 07:46        45056        ----a-w-        c:\windows\system32\acovcnt.exe
2014-07-11 09:18 . 2012-05-24 07:45        699056        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2014-07-11 09:18 . 2011-07-05 19:02        71344        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2014-06-30 10:43 . 2014-06-30 10:43        121624        ----a-w-        c:\windows\system32\drivers\avgdiskx.sys
2014-06-17 14:22 . 2014-06-17 14:22        188696        ----a-w-        c:\windows\system32\drivers\avgldx86.sys
2014-06-17 14:21 . 2014-06-17 14:21        197400        ----a-w-        c:\windows\system32\drivers\avgtdix.sys
2014-06-17 14:18 . 2014-06-17 14:18        241944        ----a-w-        c:\windows\system32\drivers\avglogx.sys
2014-06-17 14:17 . 2014-06-17 14:17        147736        ----a-w-        c:\windows\system32\drivers\avgidshx.sys
2014-06-17 14:06 . 2014-06-17 14:06        199960        ----a-w-        c:\windows\system32\drivers\avgidsdriverx.sys
2014-06-17 14:06 . 2014-06-17 14:06        98584        ----a-w-        c:\windows\system32\drivers\avgmfx86.sys
2014-06-17 14:06 . 2014-06-17 14:06        27416        ----a-w-        c:\windows\system32\drivers\avgrkx86.sys
2014-06-17 14:06 . 2014-06-17 14:06        21272        ----a-w-        c:\windows\system32\drivers\avgidsshimx.sys
2008-08-08 21:48 . 2008-08-08 21:48        90112        ----a-w-        c:\program files\Common Files\CPInstallAction.dll
2010-08-01 18:19 . 2010-08-01 18:19        119808        ----a-w-        c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ADSMOverlayIcon1]
@="{A8D448F4-0431-45AC-9F5E-E1B434AB2249}"
[HKEY_CLASSES_ROOT\CLSID\{A8D448F4-0431-45AC-9F5E-E1B434AB2249}]
2007-06-02 00:08        143360        ----a-w-        c:\program files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"SRS Premium Sound"="c:\program files\SRS Labs\SRS Premium Sound\SRSPremiumSoundBig_Small.exe" [2008-11-09 2334720]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"P2Go_Menu"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"HControlUser"="c:\program files\ASUS\ATK Hotkey\HControlUser.exe" [2008-08-18 98304]
"ATKOSD2"="c:\program files\ASUS\ATKOSD2\ATKOSD2.exe" [2008-09-03 8105984]
"ATKMEDIA"="c:\program files\ASUS\ATK Media\DMedia.exe" [2008-08-19 159744]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2008-11-25 6691360]
"Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2008-11-25 1833504]
"ADSMTray"="c:\program files\ASUS\ASUS Data Security Manager\ADSMTray.exe" [2008-04-01 266240]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1029416]
"ASUS Screen Saver Protector"="c:\windows\AsScrPro.exe" [2009-03-09 3054136]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-01 13789728]
"AVG_UI"="c:\program files\AVG\AVG2014\avgui.exe" [2014-07-10 5187088]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2014-03-11 951576]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages        REG_MULTI_SZ          scecli c:\program files\ASUS\ASUS Data Security Manager\ASPWDFLT
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-14 23:04        39792        ----a-w-        c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Camera ScreenSaver]
2009-03-09 18:18        47672        ----a-w-        c:\windows\AsScrProlog.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CLMLServer]
2008-07-19 02:52        104936        ----a-w-        c:\program files\CyberLink\Power2Go\CLMLSvc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX8400 Series]
2007-04-12 06:00        182272        ----a-w-        c:\windows\System32\spool\drivers\w32x86\3\E_FATICEE.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2010-08-01 18:19        30192        ----a-w-        c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSC]
2014-03-11 08:13        951576        ----a-w-        c:\program files\Microsoft Security Client\msseces.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-03-09 17:30        39408        ----a-w-        c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation        REG_MULTI_SZ          FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 17:14        451872        ----a-w-        c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-07-28 10:27        1104200        ----a-w-        c:\program files\Google\Chrome\Application\36.0.1985.125\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-08-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-24 09:18]
.
2014-08-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-27 19:07]
.
2014-08-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-27 19:07]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uDefault_Search_URL = hxxp://www.qone8.com/web/?type=ds&ts=1396780050&from=air&uid=WDCXWD3200BEVT-22ZCT0_WD-WXEX08HCA748CA748&q={searchTerms}
mStart Page = hxxp://www.delta-homes.com/?type=hp&ts=1402587678&from=wpm0612&uid=WDCXWD3200BEVT-22ZCT0_WD-WXEX08HCA748CA748
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.2.1 192.168.2.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
SafeBoot-WudfPf
SafeBoot-WudfRd
MSConfigStartUp-Skype - c:\program files\Skype\Phone\Skype.exe
MSConfigStartUp-SpywareTerminatorShield - c:\program files\Spyware Terminator\SpywareTerminatorShield.exe
MSConfigStartUp-SpywareTerminatorUpdater - c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe
AddRemove-The Print Shop Premier Edition 5.0 - c:\windows\unin0407.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2014-08-05 14:38
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
.
C:\ADSM_PData_0150
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 1
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3212465446-2577034139-3834760431-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-3212465446-2577034139-3834760431-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'lsass.exe'(840)
c:\program files\ASUS\ASUS Data Security Manager\ASPWDFLT.dll
.
- - - - - - - > 'Explorer.exe'(1196)
c:\program files\ASUS\ASUS Data Security Manager\OverlayIconShlExt.dll
c:\program files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\progra~1\AVG\AVG2014\avgrsx.exe
c:\program files\AVG\AVG2014\avgcsrvx.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\windows\system32\nvvsvc.exe
c:\program files\ASUS\ASUS Data Security Manager\ADSMSrv.exe
c:\program files\ASUS\ATK Hotkey\ASLDRSrv.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\ATKGFNEX\GFNEXSrv.exe
c:\programdata\IePluginService\PluginService.exe
c:\windows\system32\WLANExt.exe
c:\programdata\IePluginServices\PluginService.exe
c:\program files\AVG\AVG2014\avgidsagent.exe
c:\program files\AVG\AVG2014\avgwdsvc.exe
c:\asus.sys\DVMExportService.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\ASUS\ASUS CopyProtect\aspg.exe
c:\program files\P4G\BatteryLife.exe
c:\program files\ASUS\SmartLogon\sensorsrv.exe
c:\program files\ASUS\ATK Hotkey\MsgTranAgt.exe
c:\program files\ASUS\ATK Hotkey\HControl.exe
c:\program files\Wireless Console 2\wcourier.exe
c:\program files\ASUS\Splendid\ACMON.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\AVG\AVG2014\avgnsx.exe
c:\program files\AVG\AVG2014\avgemcx.exe
c:\windows\System32\ACEngSvr.exe
c:\program files\ASUS\ATK Hotkey\ATKOSD.exe
c:\program files\ASUS\ATK Hotkey\KBFiltr.exe
c:\program files\ASUS\ATK Hotkey\WDC.exe
c:\windows\servicing\TrustedInstaller.exe
c:\windows\system32\conime.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-08-05  14:42:50 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2014-08-05 12:42
.
Vor Suchlauf: 7 Verzeichnis(se), 124.591.255.552 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 125.566.963.712 Bytes frei
.
- - End Of File - - 3EE8B4A10BF9A52139DC1E2327D536DF
64B1E91C5C6C2157642651010728F90F

schrauber 05.08.2014 20:33
Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.

BlackKisu 06.08.2014 09:37
Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlauf Datum: 06.08.2014
Suchlauf-Zeit: 09:26:28
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.08.06.02
Rootkit Datenbank: v2014.08.04.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows Vista Service Pack 2
CPU: x86
Dateisystem: NTFS
Benutzer: Shorty

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgebrochen
Durchsuchte Objekte: 0
(No malicious items detected)
Verstrichene Zeit: 0 Min, 21 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 0
(No malicious items detected)

Physische Sektoren: 0
(No malicious items detected)


(end)
Code:
# AdwCleaner v3.302 - Bericht erstellt am 06/08/2014 um 09:51:47
# Aktualisiert 30/07/2014 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzername : Shorty - SHORTY-PC
# Gestartet von : C:\Users\Shorty\Documents\adwcleaner_3.302.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar
Ordner Gelöscht : C:\ProgramData\IePluginService
Ordner Gelöscht : C:\ProgramData\IePluginServices
Ordner Gelöscht : C:\ProgramData\WPM
Ordner Gelöscht : C:\Program Files\Amazon Browser Bar
Ordner Gelöscht : C:\Program Files\ICQ6Toolbar
Ordner Gelöscht : C:\Program Files\Mysearchdial
Ordner Gelöscht : C:\Program Files\Registry Dr
Ordner Gelöscht : C:\Program Files\SupTab
Ordner Gelöscht : C:\Program Files\SweetIM
Ordner Gelöscht : C:\Users\Shorty\AppData\Local\Mobogenie
Ordner Gelöscht : C:\Users\Shorty\AppData\Local\RegistryDr
Ordner Gelöscht : C:\Users\Shorty\AppData\Local\SaveSenseLive
Ordner Gelöscht : C:\Users\Shorty\AppData\Local\Smartbar
Ordner Gelöscht : C:\Users\Shorty\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Shorty\AppData\Roaming\337Games
Ordner Gelöscht : C:\Users\Shorty\AppData\Roaming\Mysearchdial
Ordner Gelöscht : C:\Users\Shorty\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\Shorty\Documents\Mobogenie
Ordner Gelöscht : C:\Users\Shorty\Documents\RegistryDr
Ordner Gelöscht : C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\ICQToolbarData
Ordner Gelöscht : C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\SweetIMToolbarData
Ordner Gelöscht : C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\Extensions\staged\{2d7886a0-85bb-4bf2-b684-ba92b4b21d23}
Ordner Gelöscht : C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\Extensions\{800B5000-A755-47E1-992B-48A1C1357F07}
Ordner Gelöscht : C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\Extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
Ordner Gelöscht : C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\Extensions\abb@amazon.com
Ordner Gelöscht : C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\Extensions\helperbar@helperbar.com
Ordner Gelöscht : C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\Extensions\staged\helperbar@helperbar.com
Ordner Gelöscht : C:\Users\Shorty\AppData\Local\Google\Chrome\User Data\Default\Extensions\ainbkicbloikcngphmjfpjdemblcojdd
Ordner Gelöscht : C:\Users\Shorty\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo
Ordner Gelöscht : C:\Users\Shorty\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma
Datei Gelöscht : C:\Windows\system32\roboot.exe
Datei Gelöscht : C:\Users\Shorty\daemonprocess.txt
Datei Gelöscht : C:\Users\Shorty\AppData\Local\AnyProtectScannerSetup.exe
Datei Gelöscht : C:\Program Files\Mozilla Firefox\searchplugins\crawlersrch.xml
Datei Gelöscht : C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\searchplugins\icqplugin.xml
Datei Gelöscht : C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\user.js
Datei Gelöscht : C:\Users\Shorty\AppData\Local\Google\Chrome\User Data\Default\Extensions\ep.crx

***** [ Tasks ] *****

Task Gelöscht : fsupdate

***** [ Verknüpfungen ] *****

Verknüpfung Desinfiziert : C:\Users\Public\Desktop\Google Chrome.lnk
Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk
Verknüpfung Desinfiziert : C:\Users\Shorty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Verknüpfung Desinfiziert : C:\Users\Shorty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Verknüpfung Desinfiziert : C:\Users\Shorty\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
Verknüpfung Desinfiziert : C:\Users\Shorty\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\ainbkicbloikcngphmjfpjdemblcojdd
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\ICQ\ICQToolBar
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AlxSSB.AlxTBSSB
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AlxSSB.AlxTBSSB.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AlxTB2.ToolBarProxy
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\IePluginServices
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{1F02FB61-2BE5-4C16-8199-AEAA16EB0342}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C292AD0A-C11F-479B-B8DB-743E72D283B0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{008F6853-9CB4-41C5-A950-39D55E5E06BA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{87BEF026-9269-413C-A5B3-11F35451380E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{998745A3-2AE4-488D-8092-B98FB20A00C2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A18D16ED-27B2-4B83-B70C-15E73F099546}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{BEE7E029-5037-4DAD-A2DB-82E397AB1A44}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C1424421-D274-491E-9D47-11C8D8CB5F9A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E57091A7-B5F0-4C42-9329-72ED3E59ED31}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220322202200}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0923E315-2D8B-48CE-A37C-AE9A42F9711C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1A1BBE49-C6F1-40EA-9D2F-262F0AF6DDE3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2022154E-7E3E-4809-871E-1B45A6FC7058}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{292ECB89-350E-45D2-816F-52C15305B144}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{36CC2180-B6BF-4951-9578-6B0C40044AAA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{44A36944-22C6-4A08-BC7C-161F3E540DBF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6247DD2C-8CF9-4041-A235-93691D71B8B4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{835BED79-DF7E-4096-B355-ED43FA2EA87B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8C953EC4-8CFA-44FB-B32E-1249E5505091}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8E863BD6-50DE-47D0-A6F1-3C1F6DB72451}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9DD36F1E-5111-41C5-ADED-A2A11A2FF3E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A2FB8217-E320-434E-BA79-513E357AD54F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A8018C54-B702-4D52-9ACC-8CA78911E633}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A9CEBBF4-9129-479A-9231-E833ED3D3A8F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AFD4D1F9-167C-4884-95AE-B5A9797B0D16}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B3EAD50C-ECB0-459A-9EDA-F505AB99675B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C47788B1-9604-4D7A-A684-F4D450F2D7D2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C6A846C5-D67F-48B4-8552-C22354E56966}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{CA3B41D0-D4C1-4808-B248-75DA27238828}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D4A2FF6C-087F-4D40-8DFE-92AAD484BFB8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D88B9D5C-A9CF-4C69-906D-1CCA5D85A2EF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F83AF01C-AA2F-469F-8BE7-D178FB15FD07}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550355205500}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660366206600}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DA9FC525-41ED-4C00-B046-946DA7CDD305}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8736C681-37A0-40C6-A0F0-4C083409151C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A18D16ED-27B2-4B83-B70C-15E73F099546}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{BEE7E029-5037-4DAD-A2DB-82E397AB1A44}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A18D16ED-27B2-4B83-B70C-15E73F099546}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BEE7E029-5037-4DAD-A2DB-82E397AB1A44}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E57091A7-B5F0-4C42-9329-72ED3E59ED31}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{4B3803EA-5230-4DC3-A7FC-33638F3D3542}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Schlüssel Gelöscht : HKCU\Software\AnyProtect
Schlüssel Gelöscht : HKCU\Software\distromatic
Schlüssel Gelöscht : HKCU\Software\InstalledBrowserExtensions
Schlüssel Gelöscht : HKCU\Software\SoftwareUpdater
Schlüssel Gelöscht : HKCU\Software\systweak
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\DeviceVM
Schlüssel Gelöscht : HKLM\Software\ICQ\ICQToolbar
Schlüssel Gelöscht : HKLM\Software\IePlugin
Schlüssel Gelöscht : HKLM\Software\SupDp
Schlüssel Gelöscht : HKLM\Software\supWPM
Schlüssel Gelöscht : HKLM\Software\systweak
Schlüssel Gelöscht : HKLM\Software\Wpm
Schlüssel Gelöscht : HKLM\Software\yuna software
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}_is1
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\MyPC Backup
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Plus-HD-1.5
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\qone8 uninstaller
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\RegClean Pro_is1
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SaveSense
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SupTab
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Wpm
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\464AA55239C100F32AF2D438EDDC0F47
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5652BA3D5FB98AE31B337BF0AF939856
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86EB95E1AFCBABE3DB9ECCC669B99494

***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16561

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Search_URL]

-\\ Mozilla Firefox v

[ Datei : C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\prefs.js ]

Zeile gelöscht : user_pref("browser.search.defaultenginename", "Crawler Search");
Zeile gelöscht : user_pref("browser.search.defaulturl", "hxxp://search.sweetim.com/search.asp?src=2&q=");
Zeile gelöscht : user_pref("browser.search.order.1", "Crawler Search");
Zeile gelöscht : user_pref("extensions.enabledItems", "helperbar@helperbar.com:1.0,{ec736a7c-237c-4d97-b92e-a1baabe47216}:1.0,{20a82645-c095-46ed-80e3-08825760534b}:1.1,{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20,{C[...]
Zeile gelöscht : user_pref("icqtoolbar.allowSendURL", false);
Zeile gelöscht : user_pref("icqtoolbar.engineVerified", true);
Zeile gelöscht : user_pref("icqtoolbar.geolastmodified", 1351773334);
Zeile gelöscht : user_pref("icqtoolbar.hiddenElements", "itb_options");
Zeile gelöscht : user_pref("icqtoolbar.icqgeo", 49);
Zeile gelöscht : user_pref("icqtoolbar.installTime", "1323343693");
Zeile gelöscht : user_pref("icqtoolbar.installsource", "1");
Zeile gelöscht : user_pref("icqtoolbar.newtab_state", "1");
Zeile gelöscht : user_pref("icqtoolbar.numberOfSearches", 0);
Zeile gelöscht : user_pref("icqtoolbar.skip_default_search", "no");
Zeile gelöscht : user_pref("icqtoolbar.suggestions", false);
Zeile gelöscht : user_pref("icqtoolbar.uniqueID", "196814400214543954671323343693571");
Zeile gelöscht : user_pref("icqtoolbar.usageStatstTimestamp", 1351773361);
Zeile gelöscht : user_pref("icqtoolbar.version", "1.1.7");
Zeile gelöscht : user_pref("icqtoolbar.voucherHideClicks", 0);
Zeile gelöscht : user_pref("icqtoolbar.voucherMoreLinkClicks", 0);
Zeile gelöscht : user_pref("icqtoolbar.voucherRedeemClicks", 0);
Zeile gelöscht : user_pref("icqtoolbar.voucherWasShown", 0);
Zeile gelöscht : user_pref("icqtoolbar.xmlEnableSuggestions", false);
Zeile gelöscht : user_pref("icqtoolbar.xmlLanguage", "de");
Zeile gelöscht : user_pref("sweetim.toolbar.highlight.colors", "#FFFF00,#00FFE4,#5AFF00,#0087FF,#FFCC00,#FF00F0");
Zeile gelöscht : user_pref("sweetim.toolbar.logger.ConsoleHandler.MinReportLevel", "7");
Zeile gelöscht : user_pref("sweetim.toolbar.logger.FileHandler.FileName", "ff-toolbar.log");
Zeile gelöscht : user_pref("sweetim.toolbar.logger.FileHandler.MaxFileSize", "200000");
Zeile gelöscht : user_pref("sweetim.toolbar.logger.FileHandler.MinReportLevel", "7");
Zeile gelöscht : user_pref("sweetim.toolbar.mode.debug", "false");
Zeile gelöscht : user_pref("sweetim.toolbar.previous.keyword.URL", "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.7&q=");
Zeile gelöscht : user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engine=\"hxxp://*google.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"hxxp://search.yahoo.com/*\" param=\"[...]
Zeile gelöscht : user_pref("sweetim.toolbar.search.history.capacity", "10");
Zeile gelöscht : user_pref("sweetim.toolbar.searchguard.enable", "true");
Zeile gelöscht : user_pref("sweetim.toolbar.simapp_id", "{E7C8B667-D50D-4E04-8BFE-4956358F9486}");
Zeile gelöscht : user_pref("sweetim.toolbar.urls.homepage", "hxxp://home.sweetim.com");
Zeile gelöscht : user_pref("sweetim.toolbar.version", "1.1.0.2");

-\\ Google Chrome v36.0.1985.125

[ Datei : C:\Users\Shorty\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Gelöscht [Search Provider] : hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3323914&octid=EB_ORIGINAL_CTID&ISID=M81792C38-277B-41B8-84BA-3621AFBDF2A6&SearchSource=58&CUI=&UM=5&UP=SP4080CDAA-D2AA-4753-A83A-D21A9B9C2558&q={searchTerms}&SSPV=
Gelöscht [Search Provider] : hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=cmi_14_14_ie&cd=2XzuyEtN2Y1L1QzutDtDtByEzz0CyD0A0B0B0D0DtDzzzyyEtN0D0Tzu0SzztByCtN1L2XzutBtFtCzztFzytFtDtN1L1CzutCyEtDtAtDyD1V1QtN1L1G1B1V1N2Y1L1Qzu2StAzy0Bzzzy0EyCyEtG0D0A0D0DtGyEtAyEzztGtCyEyD0BtGtA0E0B0F0FtD0EtB0AtBtCzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2StByB0FyDyEtDtB0DtGyD0C0AtAtGyE0EyEzytG0D0B0BtAtGyCzztDtAtA0Czy0B0FtDyCtD2Q&cr=402297842&ir=
Gelöscht [Search Provider] : hxxp://www.qone8.com/web/?type=ds&ts=1396780050&from=air&uid=WDCXWD3200BEVT-22ZCT0_WD-WXEX08HCA748CA748&q={searchTerms}
Gelöscht [Search Provider] : hxxp://search.delta-homes.com/web/?type=ds&ts=1402587678&from=wpm0612&uid=WDCXWD3200BEVT-22ZCT0_WD-WXEX08HCA748CA748&q={searchTerms}

*************************

AdwCleaner[R0].txt - [19367 octets] - [06/08/2014 09:44:27]
AdwCleaner[S0].txt - [18478 octets] - [06/08/2014 09:51:47]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [18539 octets] ##########
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.3 (03.23.2014:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Shorty on 06.08.2014 at 10:10:18,26
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3212465446-2577034139-3834760431-1000\Software\sweetim
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\msgplusforskype.skinpack
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{44444444-4444-4444-4444-440344204400}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{44444444-4444-4444-4444-440344204400}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Windows\system32\ai_recyclebin"
Successfully deleted: [Empty Folder] C:\Users\Shorty\appdata\local\{6C710CDA-6FA4-4200-ABED-76A43C2DC943}
Successfully deleted: [Empty Folder] C:\Users\Shorty\appdata\local\{6E64AED0-6B2F-4AA3-8095-88C6B94F38F8}
Successfully deleted: [Empty Folder] C:\Users\Shorty\appdata\local\{AB9F5666-65ED-41B7-B2D7-0E796A70F580}
Successfully deleted: [Empty Folder] C:\Users\Shorty\appdata\local\{FC7BD57C-6A44-490E-8A95-59817C29F391}



~~~ FireFox

Successfully deleted: [Folder] C:\Users\Shorty\AppData\Roaming\mozilla\firefox\profiles\eqq5haqq.default\extensions\staged



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 06.08.2014 at 10:23:39,71
Computer was rebooted
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:2-08-2014
Ran by Shorty (administrator) on SHORTY-PC on 06-08-2014 10:33:28
Running from C:\Users\Shorty\Documents
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgrsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgcsrvx.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUSTek Computer Inc.) C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe
() C:\Program Files\ASUS\ATK Hotkey\AsLdrSrv.exe
(ALWIL Software) C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
() C:\Program Files\ATKGFNEX\GFNEXSrv.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgwdsvc.exe
(DeviceVM) C:\ASUS.SYS\DVMExportService.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(ATK) C:\Program Files\P4G\BatteryLife.exe
(ASUS) C:\Program Files\ASUS\ASUS CopyProtect\ASPG.exe
() C:\Program Files\ASUS\ASUS Live Update\ALU.exe
(ASUS) C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\MsgTranAgt.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\HControl.exe
() C:\Program Files\Wireless Console 2\wcourier.exe
(ATK) C:\Program Files\ASUS\Splendid\ACMON.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\KBFiltr.exe
(ASUSTeK) C:\Windows\System32\ACEngSvr.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgnsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgemcx.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\WDC.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
(ASUS) C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe
(ASUS) C:\Program Files\ASUS\ATK Media\DMedia.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(ASUSTek Computer Inc.) C:\Program Files\ASUS\ASUS Data Security Manager\ADSMTray.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(ASUS) C:\Windows\AsScrPro.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgui.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Premium Sound\SRSPremiumSoundBig_Small.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKU\S-1-5-21-3212465446-2577034139-3834760431-1000\...\Run: [LightScribe Control Panel] => C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2008-06-09] (Hewlett-Packard Company)
HKU\S-1-5-21-3212465446-2577034139-3834760431-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-3212465446-2577034139-3834760431-1000\...\Run: [SRS Premium Sound] => C:\Program Files\SRS Labs\SRS Premium Sound\SRSPremiumSoundBig_Small.exe [2334720 2008-11-09] (SRS Labs, Inc.)
AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll => C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll [123392 2010-08-01] (Google)
Lsa: [Notification Packages] scecli C:\Program Files\ASUS\ASUS Data Security Manager\ASPWDFLT
ShellIconOverlayIdentifiers: ADSMOverlayIcon -> {A825576B-0042-4F0F-8FB0-93CE0F054E69} => C:\Program Files\ASUS\ASUS Data Security Manager\OverlayIconShlExt.dll ()
ShellIconOverlayIdentifiers: ADSMOverlayIcon1 -> {A8D448F4-0431-45AC-9F5E-E1B434AB2249} => C:\Program Files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll ()
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
URLSearchHook: HKLM - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUS
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUS_de
BHO: Adobe PDF Reader -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default
FF Plugin: @google.com/npPicasa2,version=2.0.0 -> C:\Program Files\Picasa2\npPicasa2.dll (Google, Inc.)
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.)
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.3 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll (Sun Microsystems, Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\googledesktop.xml
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-06-02]
FF Extension: Messenger Plus! Community Smartbar - C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\Extensions\{ec736a7c-237c-4d97-b92e-a1baabe47216} [2013-03-23]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012-02-06]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010-07-02]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [2010-09-05]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2010-10-20]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2010-12-20]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011-02-16]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [2011-06-22]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} [2012-02-17]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-19]

Chrome:
=======
CHR HomePage:
CHR DefaultNewTabURL:
CHR Plugin: (Shockwave Flash) - F:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.83\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\35.0.1916.153\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - F:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\35.0.1916.153\pdf.dll ()
CHR Plugin: (Wajam) - F:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp\1.24_0\plugins/PriamNPAPI.dll No File
CHR Plugin: (Adobe Acrobat) - F:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.170.4) - F:\Program Files\Mozilla Firefox\plugins\npdeploytk.dll No File
CHR Plugin: (2007 Microsoft Office system) - F:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll No File
CHR Plugin: (Winamp Application Detector) - F:\Program Files\Mozilla Firefox\plugins\npwachk.dll No File
CHR Plugin: (Microsoft® DRM) - F:\Program Files\Windows Media Player\npdrmv2.dll No File
CHR Plugin: (Microsoft® DRM) - F:\Program Files\Windows Media Player\npwmsdrm.dll No File
CHR Plugin: (Windows Media Player Plug-in Dynamic Link Library) - F:\Program Files\Windows Media Player\npdsplay.dll No File
CHR Plugin: (Google Update) - F:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
CHR Plugin: (Google Earth Plugin) - F:\Program Files\Google\Google Earth\plugin\npgeplugin.dll No File
CHR Plugin: (Panda ActiveScan 2.0) - F:\Program Files\Panda Security\ActiveScan 2.0\npwrapper.dll No File
CHR Plugin: (iTunes Application Detector) - F:\Program Files\iTunes\Mozilla Plugins\npitunes.dll No File
CHR Plugin: (Ma-Config.com plugin) - F:\Program Files\ma-config.com\nphardwaredetection.dll No File
CHR Plugin: (Silverlight Plug-In) - f:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Extension: (No Name) - C:\Users\Shorty\AppData\Local\Google\Chrome\User Data\Default\Extensions\ainbkicbloikcngphmjfpjdemblcojdd [2014-06-12]
CHR Extension: (Google Wallet) - C:\Users\Shorty\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-04]
CHR Extension: (No Name) - C:\Users\Shorty\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo [2014-06-12]
CHR Extension: (No Name) - C:\Users\Shorty\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma [2014-04-06]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ADSMService; C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe [225280 2008-03-31] (ASUSTek Computer Inc.) [File not signed]
R2 ASLDRService; C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe [100920 2008-08-14] ()
R2 aswUpdSv; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [18752 2009-11-25] (ALWIL Software)
R2 ATKGFNEXSrv; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [94208 2007-08-08] () [File not signed]
S3 avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [254040 2009-11-25] (ALWIL Software)
S3 avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [352920 2009-11-25] (ALWIL Software)
R2 AVGIDSAgent; C:\Program Files\AVG\AVG2014\avgidsagent.exe [3244048 2014-07-10] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG2014\avgwdsvc.exe [289328 2014-07-10] (AVG Technologies CZ, s.r.o.)
R2 DvmMDES; C:\ASUS.SYS\DVMExportService.exe [307200 2008-11-20] (DeviceVM) [File not signed]
S3 GoogleDesktopManager-051210-111108; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [30192 2010-08-01] (Google)
S2 gupdate1ca0eed81a80270; C:\Program Files\Google\Update\GoogleUpdate.exe [133104 2009-07-27] (Google Inc.)
R2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [73728 2008-06-09] (Hewlett-Packard Company) [File not signed]
R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2014-03-11] (Microsoft Corporation)
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [279776 2014-03-11] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 AsDsm; C:\Windows\system32\Drivers\AsDsm.sys [29752 2007-08-11] (Windows (R) Codename Longhorn DDK provider)
R2 ASMMAP; C:\Program Files\ATKGFNEX\ASMMAP.sys [13880 2007-07-24] ()
R1 Avgdiskx; C:\Windows\System32\DRIVERS\avgdiskx.sys [121624 2014-06-30] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [199960 2014-06-17] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [147736 2014-06-17] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [21272 2014-06-17] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [188696 2014-06-17] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [241944 2014-06-17] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [98584 2014-06-17] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [27416 2014-06-17] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [197400 2014-06-17] (AVG Technologies CZ, s.r.o.)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15928 2008-06-03] ( )
R0 lullaby; C:\Windows\System32\DRIVERS\lullaby.sys [15416 2008-05-29] (Windows (R) Codename Longhorn DDK provider)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-08-06] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [231960 2014-01-25] (Microsoft Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ATKACPI.sys [7680 2006-12-14] (ATK0100)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1772544 2008-12-10] ()
R3 SRS_PremiumSound_Service; C:\Windows\System32\drivers\srs_PremiumSound_i386.sys [43904 2008-10-23] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S2 aswFsBlk; system32\DRIVERS\aswFsBlk.sys [X]
S1 aswRdr; No ImagePath
S1 aswSP; No ImagePath
S1 aswTdi; No ImagePath
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S1 MpKsl0f79a0dd; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{2E703352-3526-4E10-A8B1-5D63546BDA4A}\MpKsl0f79a0dd.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 upperdev; system32\DRIVERS\usbser_lowerflt.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-06 10:23 - 2014-08-06 10:23 - 00001814 _____ () C:\Users\Shorty\Desktop\JRT.txt
2014-08-06 10:08 - 2014-08-06 10:08 - 00000000 ___HD () C:\dvmexp
2014-08-06 10:04 - 2014-08-06 10:04 - 00000000 ____D () C:\Windows\ERUNT
2014-08-06 10:02 - 2014-08-06 10:02 - 00021041 _____ () C:\Users\Shorty\Desktop\adw.odt
2014-08-06 09:44 - 2014-08-06 09:53 - 00000000 ____D () C:\AdwCleaner
2014-08-06 09:43 - 2014-08-06 09:43 - 01361309 _____ () C:\Users\Shorty\Documents\adwcleaner_3.302.exe
2014-08-06 09:27 - 2014-08-06 09:27 - 00001185 _____ () C:\Users\Shorty\Desktop\mbam.txt
2014-08-06 09:25 - 2014-08-06 09:25 - 00000906 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-06 09:09 - 2014-08-06 10:08 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-06 09:08 - 2014-08-06 09:25 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-08-06 09:08 - 2014-08-06 09:08 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-06 09:08 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-06 09:08 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-06 09:08 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-06 09:07 - 2014-08-06 09:07 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Shorty\Documents\mbam-setup-2.0.2.1012.exe
2014-08-05 14:42 - 2014-08-05 14:42 - 00040877 _____ () C:\ComboFix.txt
2014-08-05 14:21 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-08-05 14:21 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-08-05 14:21 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-08-05 14:21 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-08-05 14:21 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-08-05 14:21 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-08-05 14:21 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-08-05 14:21 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-08-05 14:17 - 2014-08-05 14:42 - 00000000 ____D () C:\Qoobox
2014-08-05 14:16 - 2014-08-05 14:41 - 00000000 ____D () C:\Windows\erdnt
2014-08-05 14:15 - 2014-08-05 14:16 - 05567674 ____R (Swearware) C:\Users\Shorty\Documents\ComboFix.exe
2014-08-05 13:51 - 2014-08-05 13:51 - 00001064 _____ () C:\Users\Shorty\Desktop\Revo Uninstaller.lnk
2014-08-05 13:51 - 2014-08-05 13:51 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-08-05 13:50 - 2014-08-05 13:51 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Shorty\Documents\revosetup95.exe
2014-08-04 18:08 - 2014-08-04 18:09 - 00036634 _____ () C:\Users\Shorty\Documents\Addition.txt
2014-08-04 18:07 - 2014-08-06 10:33 - 00019986 _____ () C:\Users\Shorty\Documents\FRST.txt
2014-08-04 18:07 - 2014-08-06 10:33 - 00000000 ____D () C:\FRST
2014-08-04 18:06 - 2014-08-04 18:06 - 01084928 _____ (Farbar) C:\Users\Shorty\Documents\FRST.exe
2014-07-17 14:21 - 2014-07-17 14:21 - 00160032 _____ () C:\Windows\Minidump\Mini071714-01.dmp
2014-07-11 09:53 - 2014-06-07 02:19 - 02051072 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-11 09:53 - 2014-06-06 10:59 - 00506880 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-11 09:53 - 2014-05-30 08:53 - 00273408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-11 09:52 - 2014-06-07 02:05 - 12353024 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-11 09:52 - 2014-06-07 01:25 - 09711616 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-11 09:52 - 2014-06-07 01:12 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-11 09:52 - 2014-06-07 01:04 - 01106432 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-11 09:52 - 2014-06-07 01:03 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-11 09:52 - 2014-06-07 01:02 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-11 09:52 - 2014-06-07 01:00 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-07-11 09:52 - 2014-06-07 00:58 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-11 09:52 - 2014-06-07 00:57 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-11 09:52 - 2014-06-07 00:56 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-07-11 09:52 - 2014-06-07 00:56 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-11 09:52 - 2014-06-07 00:54 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-11 09:52 - 2014-06-07 00:54 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-11 09:52 - 2014-06-07 00:54 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-11 09:52 - 2014-06-07 00:54 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-07-11 09:52 - 2014-06-07 00:53 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-11 09:52 - 2014-06-07 00:53 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-11 09:52 - 2014-06-07 00:53 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-07-11 09:52 - 2014-06-07 00:52 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-11 09:52 - 2014-06-07 00:51 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-07-11 09:52 - 2014-06-07 00:47 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-06 10:33 - 2014-08-04 18:07 - 00019986 _____ () C:\Users\Shorty\Documents\FRST.txt
2014-08-06 10:33 - 2014-08-04 18:07 - 00000000 ____D () C:\FRST
2014-08-06 10:26 - 2009-07-27 21:16 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-06 10:26 - 2009-07-27 21:16 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-06 10:23 - 2014-08-06 10:23 - 00001814 _____ () C:\Users\Shorty\Desktop\JRT.txt
2014-08-06 10:11 - 2009-03-09 17:54 - 01841138 _____ () C:\Windows\WindowsUpdate.log
2014-08-06 10:10 - 2009-07-14 09:58 - 00031966 _____ () C:\ProgramData\nvModes.dat
2014-08-06 10:10 - 2009-07-14 09:58 - 00031966 _____ () C:\ProgramData\nvModes.001
2014-08-06 10:08 - 2014-08-06 10:08 - 00000000 ___HD () C:\dvmexp
2014-08-06 10:08 - 2014-08-06 09:09 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-06 10:08 - 2009-03-09 20:16 - 00000000 ____D () C:\temp
2014-08-06 10:08 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-06 10:08 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-06 10:08 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-06 10:07 - 2006-11-02 15:01 - 00032578 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-08-06 10:04 - 2014-08-06 10:04 - 00000000 ____D () C:\Windows\ERUNT
2014-08-06 10:02 - 2014-08-06 10:02 - 00021041 _____ () C:\Users\Shorty\Desktop\adw.odt
2014-08-06 09:55 - 2008-01-21 04:47 - 00276250 _____ () C:\Windows\PFRO.log
2014-08-06 09:53 - 2014-08-06 09:44 - 00000000 ____D () C:\AdwCleaner
2014-08-06 09:52 - 2009-07-27 21:08 - 00001074 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-08-06 09:52 - 2009-07-27 21:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-08-06 09:52 - 2009-07-14 09:58 - 00000984 _____ () C:\Users\Shorty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-08-06 09:52 - 2009-07-14 09:45 - 00000000 ____D () C:\Users\Shorty
2014-08-06 09:51 - 2009-07-27 21:04 - 00000000 ____D () C:\ProgramData\ICQ
2014-08-06 09:43 - 2014-08-06 09:43 - 01361309 _____ () C:\Users\Shorty\Documents\adwcleaner_3.302.exe
2014-08-06 09:38 - 2012-05-24 09:45 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-06 09:27 - 2014-08-06 09:27 - 00001185 _____ () C:\Users\Shorty\Desktop\mbam.txt
2014-08-06 09:25 - 2014-08-06 09:25 - 00000906 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-06 09:25 - 2014-08-06 09:08 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-08-06 09:08 - 2014-08-06 09:08 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-06 09:07 - 2014-08-06 09:07 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Shorty\Documents\mbam-setup-2.0.2.1012.exe
2014-08-06 08:29 - 2014-03-30 16:37 - 00000000 ____D () C:\ProgramData\MFAData
2014-08-05 14:42 - 2014-08-05 14:42 - 00040877 _____ () C:\ComboFix.txt
2014-08-05 14:42 - 2014-08-05 14:17 - 00000000 ____D () C:\Qoobox
2014-08-05 14:42 - 2006-11-02 13:18 - 00000000 __RHD () C:\Users\Default
2014-08-05 14:42 - 2006-11-02 13:18 - 00000000 ___RD () C:\Users\Public
2014-08-05 14:41 - 2014-08-05 14:16 - 00000000 ____D () C:\Windows\erdnt
2014-08-05 14:37 - 2009-07-14 09:46 - 00045056 _____ () C:\Windows\system32\acovcnt.exe
2014-08-05 14:37 - 2006-11-02 12:23 - 00000215 _____ () C:\Windows\system.ini
2014-08-05 14:36 - 2006-11-02 12:22 - 49807360 _____ () C:\Windows\system32\config\COMPON~1.bak
2014-08-05 14:36 - 2006-11-02 12:22 - 45350912 _____ () C:\Windows\system32\config\SOFTWARE.bak
2014-08-05 14:36 - 2006-11-02 12:22 - 20709376 _____ () C:\Windows\system32\config\SYSTEM.bak
2014-08-05 14:36 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\SECURITY.bak
2014-08-05 14:36 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\SAM.bak
2014-08-05 14:36 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\DEFAULT.bak
2014-08-05 14:16 - 2014-08-05 14:15 - 05567674 ____R (Swearware) C:\Users\Shorty\Documents\ComboFix.exe
2014-08-05 13:51 - 2014-08-05 13:51 - 00001064 _____ () C:\Users\Shorty\Desktop\Revo Uninstaller.lnk
2014-08-05 13:51 - 2014-08-05 13:51 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-08-05 13:51 - 2014-08-05 13:50 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Shorty\Documents\revosetup95.exe
2014-08-05 13:26 - 2014-04-06 12:20 - 00000118 _____ () C:\Users\Shorty\AppData\Roaming\WB.CFG
2014-08-05 12:13 - 2013-08-01 16:55 - 00000000 ____D () C:\Users\Shorty\Desktop\Haushaltsplan
2014-08-04 18:09 - 2014-08-04 18:08 - 00036634 _____ () C:\Users\Shorty\Documents\Addition.txt
2014-08-04 18:06 - 2014-08-04 18:06 - 01084928 _____ (Farbar) C:\Users\Shorty\Documents\FRST.exe
2014-08-04 17:06 - 2009-07-14 09:54 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-08-03 10:43 - 2014-04-02 07:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2014-08-03 10:43 - 2014-03-30 16:39 - 00000865 _____ () C:\Users\Public\Desktop\AVG 2014.lnk
2014-08-03 10:34 - 2010-10-04 23:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-07-28 12:22 - 2006-11-02 14:47 - 00532944 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-17 14:30 - 2006-11-02 14:37 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-17 14:21 - 2014-07-17 14:21 - 00160032 _____ () C:\Windows\Minidump\Mini071714-01.dmp
2014-07-17 14:21 - 2011-05-13 22:12 - 00000000 ____D () C:\Windows\Minidump
2014-07-17 14:20 - 2013-10-01 09:20 - 290672313 _____ () C:\Windows\MEMORY.DMP
2014-07-17 14:17 - 2013-08-19 12:53 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-17 14:17 - 2006-11-02 12:24 - 93585272 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-07-11 11:18 - 2012-05-24 09:45 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-07-11 11:18 - 2011-07-05 21:02 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

Some content of TEMP:
====================
C:\Users\Shorty\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-06 10:14

==================== End Of Log ============================
--- --- ---

schrauber 07.08.2014 09:21

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

BlackKisu 07.08.2014 11:40
Also das Deltasearch is weg und wie ich bis jetzt festgestellt hab läuft der Lapi besser hab ihn aber auch nicht benutzt während ich deine Anweisungen befolgt habe da ich ihn erstmal ''reparieren'' wollte. Ich hoffe mit den letzten logs is alles gut.


Code:
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=b1565ed841dc00458218dbd7f5a06449
# engine=19542
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-08-07 09:46:05
# local_time=2014-08-07 11:46:05 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode_1='avast! antivirus'
# compatibility_mode=769 16774142 100 93 171341 343689519 0 0
# compatibility_mode_1='AVG AntiVirus Free Edition 2014'
# compatibility_mode=1051 16777213 100 100 4597 94542349 0 0
# compatibility_mode_1='Microsoft Security Essentials'
# compatibility_mode=5895 16777213 100 100 10861845 101585969 0 0
# scanned=141173
# found=54
# cleaned=0
# scan_time=3530
sh=E32ECB71CAA5BA1F62D7E28F6E7D76D226677B01 ft=1 fh=fc7b40d4e32d8af5 vn="Win32/Distromatic.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Amazon Browser Bar\search_protect.exe.vir"
sh=77D9EA4DF11B3FBBB133AE89923E25988C1F1CD6 ft=1 fh=d0268535d57cda92 vn="Win32/AnyProtect.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Shorty\AppData\Local\AnyProtectScannerSetup.exe.vir"
sh=48C826EF00938F035C91C9F6B3E167CB21D96633 ft=1 fh=59fac0a23423ab50 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\Extensions\staged\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_16.dll.vir"
sh=45F4ABE93E1FB333545719948B418FB1207A5085 ft=1 fh=3a58b09db4698b9d vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\Extensions\staged\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_17.dll.vir"
sh=FED76CBD8D5660DEC60B3F16547372DEE7F87FA6 ft=1 fh=9705b06916654cd4 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\Extensions\staged\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_18.dll.vir"
sh=C8F23EFE19C6A36D8921AE5C96F95808EBEFBE05 ft=1 fh=8064b8d931435e04 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\Extensions\staged\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_19.dll.vir"
sh=C7E054C7BA58AE2D703DB29C52346A3ED84FEF57 ft=1 fh=53532950b9749a4f vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\Extensions\staged\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_20.dll.vir"
sh=C546BA3CA78F93EB65DCCEA191BC40B9F940E2EA ft=1 fh=6fd80785d353cf5d vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\Extensions\staged\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_21.dll.vir"
sh=7C15DA5A80F24F0383C992CFB03CF68E95A464B1 ft=1 fh=be427aaf403ae2ff vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\Extensions\staged\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_22.dll.vir"
sh=EEFB8F9EF9B851FC2F5FE0E0BE07057E5E3BEEA9 ft=1 fh=9d490b3d608ec5af vn="Variante von Win32/SweetIM.L evtl. unerwünschte Anwendung" ac=I fn="C:\Config.Msi\f2fb2.rbf"
sh=FABF99D84DAE1B16B0BDBA7003ACA991AE40DB47 ft=1 fh=2aca0aed277d57d6 vn="Win32/SaveSense.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files\SaveSenseLive\Update\SaveSenseLive.exe.vir"
sh=10903598F769E2AC5F1E2372E90F6722A3A860B7 ft=1 fh=89560075533c3d40 vn="Win32/SaveSense.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll.vir"
sh=88482528CE4F67A1004B50BA93282CEACCEDE534 ft=1 fh=e40b702402e604d5 vn="Win32/SaveSense.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files\SaveSenseLive\Update\1.3.23.0\psmachine.dll.vir"
sh=FABF99D84DAE1B16B0BDBA7003ACA991AE40DB47 ft=1 fh=2aca0aed277d57d6 vn="Win32/SaveSense.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files\SaveSenseLive\Update\1.3.23.0\SaveSenseLive.exe.vir"
sh=70D49B9ABA391E6976DAB5C4BEA63733459B3F1C ft=1 fh=0b76a05977e7722a vn="Win32/SaveSense.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files\SaveSenseLive\Update\1.3.23.0\SaveSenseLiveBroker.exe.vir"
sh=FABF99D84DAE1B16B0BDBA7003ACA991AE40DB47 ft=1 fh=2aca0aed277d57d6 vn="Win32/SaveSense.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files\SaveSenseLive\Update\1.3.23.0\SaveSenseLiveHandler.exe.vir"
sh=F09B9B9B1D16D1539D23CC6ACDE0DC7BC983DF59 ft=1 fh=2dbadf99ca2df2d7 vn="Win32/SaveSense.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files\SaveSenseLive\Update\1.3.23.0\SaveSenseLiveOnDemand.exe.vir"
sh=8E404BAFA9CEAC0628F089B4F1AA879EB5A3404E ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\101_cortica_m.js.vir"
sh=957E505E027C2F899F844C27AC8B82EF94AEBB68 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\102_dealply_m.js.vir"
sh=17F6E2411B6C3A285257D050832B0890BBEC046F ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\103_intext_5_m.js.vir"
sh=EB047CB7862459E0F74832AEF6A7954A3663373F ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\104_jollywallet_m.js.vir"
sh=F2126D68553053F0A5A411866DEC205E27283EDA ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\105_corticas_m.js.vir"
sh=A69DBD3502EA9C4EDD7DEAFB23A8FC1C97BAB232 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\107_coupish_m.js.vir"
sh=6FD52BE8732402A681159484442B6AA0351C4243 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\108_icm_m.js.vir"
sh=F0D9BB17EC343592F74C53A4E3E5E460B90DD3E2 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\116_ads_only_5_m.js.vir"
sh=DFB11E05B62F57EDA18112BC002C17EAFD79BEE7 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\117_coupons_intext_ads_5_m.js.vir"
sh=9495814AE107F6739D62A09B1829E5A2DCDA1354 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\119_similar_web_m.js.vir"
sh=D10EA105AB5DB329186B0B6F10541DD58058AEB8 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\120_luck_m.js.vir"
sh=B985E49C6E0E423954A36327BE2EA87F0F287145 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\123_intext_adv_m.js.vir"
sh=EAAF312959AC9CCF5138825927B5E2D38F57E2E1 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\124_superfish_no_search_no_coupons_m.js.vir"
sh=62B063E0D121966E9A83C9AB518DADAE47423555 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\125_arcadi2_m.js.vir"
sh=E254E0BD5C202A441B4F7415C762F7D537A79E24 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\126_revizer_ws_m.js.vir"
sh=5B79E1012732BA64F2D1FDF7DBF44CAD28FE7CDD ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\127_revizer_p_m.js.vir"
sh=4A86247BDE5D2225473389037FA942819FD677CF ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\128_superfish_pricora_m.js.vir"
sh=D9E89F57D3A13498640961F3B9954D67D7EA1039 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\129_widdit_m.js.vir"
sh=B9CFC11B067C54952D592C618BD391AA26B3393B ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\135_arcadi3_m.js.vir"
sh=17483832BF1FA23335B7C1E04A0530AB60CBEDC6 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\138_getdeal_m.js.vir"
sh=90A4F559561CF603A203F93D56C80B17B8152325 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\141_corticas_ru_m.js.js.vir"
sh=8395A2B6D59D2F3EDDCFC863DDA2F674396DC74C ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\142_intext_fa_m.js.vir"
sh=786B0C8D3A9F6EFBCDB103B0FA7F9460D38C5D7B ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\155_ibario_pops_m.js.vir"
sh=A28CB6571CE8071F7AC0A6BA249259A684E96292 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\158_50onred_ads_only_no_fb_m.js.vir"
sh=18C46AE5CB67274764D17F8A40975EEB5C67F795 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\159_cortica_rollover_m.js.vir"
sh=CB95B247FABF95831A2974B87B334DBE4597CEB2 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\91_monetizationLoader.js.js.vir"
sh=93022F69189E8D2F1B4B8717522CA1AFFA59F708 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\92_superfish_m.js.vir"
sh=DEF8CB14886F5A427CEB5E70D8C1D395AC135F4A ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\e180d6e8-52cd-41d9-9002-9e43f22d4c91@7466a5f3-05bd-4c4d-a0e9-9442a8ea8a0e.com\extensionData\plugins\93_superfish_no_coupons_m.js.vir"
sh=8E84B3369C409B88BFF2F167495B5BDA08485065 ft=1 fh=cea6bc5b1fc91d53 vn="Variante von Win32/DealPly.S evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Shorty\AppData\Roaming\SaveSense\UpdateProc\UpdateTask.exe.vir"
sh=48C826EF00938F035C91C9F6B3E167CB21D96633 ft=1 fh=59fac0a23423ab50 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\{ec736a7c-237c-4d97-b92e-a1baabe47216}\components\SmartbarFireFoxRemotePlugin_16.dll"
sh=45F4ABE93E1FB333545719948B418FB1207A5085 ft=1 fh=3a58b09db4698b9d vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\{ec736a7c-237c-4d97-b92e-a1baabe47216}\components\SmartbarFireFoxRemotePlugin_17.dll"
sh=FED76CBD8D5660DEC60B3F16547372DEE7F87FA6 ft=1 fh=9705b06916654cd4 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\{ec736a7c-237c-4d97-b92e-a1baabe47216}\components\SmartbarFireFoxRemotePlugin_18.dll"
sh=C8F23EFE19C6A36D8921AE5C96F95808EBEFBE05 ft=1 fh=8064b8d931435e04 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\extensions\{ec736a7c-237c-4d97-b92e-a1baabe47216}\components\SmartbarFireFoxRemotePlugin_19.dll"
sh=E4333469F3070D049E4FDA053756B96B9F59569B ft=1 fh=5e9b3d881266bb41 vn="Win32/Distromatic evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H2J1515W\distro-search-protect-fix-2[1]"
sh=29E421AB9476F9D2E23DAC7CFDE8DD9EE9D0768A ft=1 fh=d53e88ba43d6b8ab vn="Win32/Distromatic.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N3MY96NK\distro-search-protect-fix-4[1]"
sh=3DAE542BD4F0368B19B4047C0838D3F4FC4DA090 ft=1 fh=9b1350829aeb80db vn="Variante von Win32/Distromatic.C evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YBUAX5ID\distro-abb-fix[1]"
sh=63981687FFC14608CDAE65C7EFEA1B24ACAF1DF4 ft=1 fh=c82ffca9f6717ccb vn="Variante von Win32/Distromatic.C evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YBUAX5ID\distro-search-protect-fix-3[1]"
Code:
Results of screen317's Security Check version 0.99.86 
 Windows Vista Service Pack 2 x86 (UAC is enabled) 
 Internet Explorer 9 
 Internet Explorer 8 
``````````````Antivirus/Firewall Check:``````````````
AVG AntiVirus Free Edition 2014 
Microsoft Security Essentials   
 Antivirus up to date!  (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
 Java(TM) 6 Update 31 
 Java version out of Date!
 Adobe Reader 8 Adobe Reader out of Date!
 Google Chrome 35.0.1916.153 
 Google Chrome 36.0.1985.125 
````````Process Check: objlist.exe by Laurent```````` 
 Microsoft Security Essentials MSMpEng.exe
 Microsoft Security Essentials msseces.exe
 Malwarebytes Anti-Malware mbamservice.exe 
 Malwarebytes Anti-Malware mbam.exe 
 AVG avgwdsvc.exe
 AVG avgrsx.exe
 AVG avgnsx.exe
 AVG avgemc.exe
 Alwil Software Avast4 aswUpdSv.exe
 Malwarebytes Anti-Malware mbamscheduler.exe 
 SRS Labs SRS Premium Sound SRSPremiumSoundBig_Small.exe 
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C:  %
````````````````````End of Log``````````````````````

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:2-08-2014
Ran by Shorty (administrator) on SHORTY-PC on 07-08-2014 12:30:19
Running from C:\Users\Shorty\Documents
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgrsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgcsrvx.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUSTek Computer Inc.) C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe
() C:\Program Files\ASUS\ATK Hotkey\AsLdrSrv.exe
(ALWIL Software) C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
() C:\Program Files\ATKGFNEX\GFNEXSrv.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgwdsvc.exe
(DeviceVM) C:\ASUS.SYS\DVMExportService.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
(ATK) C:\Program Files\P4G\BatteryLife.exe
(ASUS) C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
() C:\Program Files\ASUS\ASUS Live Update\ALU.exe
(ASUS) C:\Program Files\ASUS\ASUS CopyProtect\ASPG.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\MsgTranAgt.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\HControl.exe
() C:\Program Files\Wireless Console 2\wcourier.exe
(ATK) C:\Program Files\ASUS\Splendid\ACMON.exe
(ASUSTeK) C:\Windows\System32\ACEngSvr.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\KBFiltr.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\WDC.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgnsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgemcx.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
(ASUS) C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe
(ASUS) C:\Program Files\ASUS\ATK Media\DMedia.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(ASUSTek Computer Inc.) C:\Program Files\ASUS\ASUS Data Security Manager\ADSMTray.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(ASUS) C:\Windows\AsScrPro.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgui.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Premium Sound\SRSPremiumSoundBig_Small.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil32_14_0_0_145_ActiveX.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKU\S-1-5-21-3212465446-2577034139-3834760431-1000\...\Run: [LightScribe Control Panel] => C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2008-06-09] (Hewlett-Packard Company)
HKU\S-1-5-21-3212465446-2577034139-3834760431-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-3212465446-2577034139-3834760431-1000\...\Run: [SRS Premium Sound] => C:\Program Files\SRS Labs\SRS Premium Sound\SRSPremiumSoundBig_Small.exe [2334720 2008-11-09] (SRS Labs, Inc.)
AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll => C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll [123392 2010-08-01] (Google)
Lsa: [Notification Packages] scecli C:\Program Files\ASUS\ASUS Data Security Manager\ASPWDFLT
ShellIconOverlayIdentifiers: ADSMOverlayIcon -> {A825576B-0042-4F0F-8FB0-93CE0F054E69} => C:\Program Files\ASUS\ASUS Data Security Manager\OverlayIconShlExt.dll ()
ShellIconOverlayIdentifiers: ADSMOverlayIcon1 -> {A8D448F4-0431-45AC-9F5E-E1B434AB2249} => C:\Program Files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll ()
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
URLSearchHook: HKLM - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUS
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUS_de
BHO: Adobe PDF Reader -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default
FF Plugin: @google.com/npPicasa2,version=2.0.0 -> C:\Program Files\Picasa2\npPicasa2.dll (Google, Inc.)
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.)
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.3 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll (Sun Microsystems, Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\googledesktop.xml
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-06-02]
FF Extension: Messenger Plus! Community Smartbar - C:\Users\Shorty\AppData\Roaming\Mozilla\Firefox\Profiles\eqq5haqq.default\Extensions\{ec736a7c-237c-4d97-b92e-a1baabe47216} [2013-03-23]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012-02-06]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010-07-02]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [2010-09-05]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2010-10-20]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2010-12-20]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011-02-16]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [2011-06-22]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} [2012-02-17]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-19]

Chrome:
=======
CHR HomePage:
CHR DefaultNewTabURL:
CHR Plugin: (Shockwave Flash) - F:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.83\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\35.0.1916.153\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - F:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\35.0.1916.153\pdf.dll ()
CHR Plugin: (Wajam) - F:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp\1.24_0\plugins/PriamNPAPI.dll No File
CHR Plugin: (Adobe Acrobat) - F:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.170.4) - F:\Program Files\Mozilla Firefox\plugins\npdeploytk.dll No File
CHR Plugin: (2007 Microsoft Office system) - F:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll No File
CHR Plugin: (Winamp Application Detector) - F:\Program Files\Mozilla Firefox\plugins\npwachk.dll No File
CHR Plugin: (Microsoft® DRM) - F:\Program Files\Windows Media Player\npdrmv2.dll No File
CHR Plugin: (Microsoft® DRM) - F:\Program Files\Windows Media Player\npwmsdrm.dll No File
CHR Plugin: (Windows Media Player Plug-in Dynamic Link Library) - F:\Program Files\Windows Media Player\npdsplay.dll No File
CHR Plugin: (Google Update) - F:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
CHR Plugin: (Google Earth Plugin) - F:\Program Files\Google\Google Earth\plugin\npgeplugin.dll No File
CHR Plugin: (Panda ActiveScan 2.0) - F:\Program Files\Panda Security\ActiveScan 2.0\npwrapper.dll No File
CHR Plugin: (iTunes Application Detector) - F:\Program Files\iTunes\Mozilla Plugins\npitunes.dll No File
CHR Plugin: (Ma-Config.com plugin) - F:\Program Files\ma-config.com\nphardwaredetection.dll No File
CHR Plugin: (Silverlight Plug-In) - f:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Extension: (No Name) - C:\Users\Shorty\AppData\Local\Google\Chrome\User Data\Default\Extensions\ainbkicbloikcngphmjfpjdemblcojdd [2014-06-12]
CHR Extension: (Google Wallet) - C:\Users\Shorty\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-04]
CHR Extension: (No Name) - C:\Users\Shorty\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo [2014-06-12]
CHR Extension: (No Name) - C:\Users\Shorty\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma [2014-04-06]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ADSMService; C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe [225280 2008-03-31] (ASUSTek Computer Inc.) [File not signed]
R2 ASLDRService; C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe [100920 2008-08-14] ()
R2 aswUpdSv; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [18752 2009-11-25] (ALWIL Software)
R2 ATKGFNEXSrv; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [94208 2007-08-08] () [File not signed]
S3 avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [254040 2009-11-25] (ALWIL Software)
S3 avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [352920 2009-11-25] (ALWIL Software)
R2 AVGIDSAgent; C:\Program Files\AVG\AVG2014\avgidsagent.exe [3244048 2014-07-10] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG2014\avgwdsvc.exe [289328 2014-07-10] (AVG Technologies CZ, s.r.o.)
R2 DvmMDES; C:\ASUS.SYS\DVMExportService.exe [307200 2008-11-20] (DeviceVM) [File not signed]
S3 GoogleDesktopManager-051210-111108; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [30192 2010-08-01] (Google)
S2 gupdate1ca0eed81a80270; C:\Program Files\Google\Update\GoogleUpdate.exe [133104 2009-07-27] (Google Inc.)
R2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [73728 2008-06-09] (Hewlett-Packard Company) [File not signed]
R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2014-03-11] (Microsoft Corporation)
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [279776 2014-03-11] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 AsDsm; C:\Windows\system32\Drivers\AsDsm.sys [29752 2007-08-11] (Windows (R) Codename Longhorn DDK provider)
R2 ASMMAP; C:\Program Files\ATKGFNEX\ASMMAP.sys [13880 2007-07-24] ()
R1 Avgdiskx; C:\Windows\System32\DRIVERS\avgdiskx.sys [121624 2014-06-30] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [199960 2014-06-17] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [147736 2014-06-17] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [21272 2014-06-17] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [188696 2014-06-17] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [241944 2014-06-17] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [98584 2014-06-17] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [27416 2014-06-17] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [197400 2014-06-17] (AVG Technologies CZ, s.r.o.)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15928 2008-06-03] ( )
R0 lullaby; C:\Windows\System32\DRIVERS\lullaby.sys [15416 2008-05-29] (Windows (R) Codename Longhorn DDK provider)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-08-07] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [231960 2014-01-25] (Microsoft Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ATKACPI.sys [7680 2006-12-14] (ATK0100)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1772544 2008-12-10] ()
R3 SRS_PremiumSound_Service; C:\Windows\System32\drivers\srs_PremiumSound_i386.sys [43904 2008-10-23] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S2 aswFsBlk; system32\DRIVERS\aswFsBlk.sys [X]
S1 aswRdr; No ImagePath
S1 aswSP; No ImagePath
S1 aswTdi; No ImagePath
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S1 MpKsl0f79a0dd; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{2E703352-3526-4E10-A8B1-5D63546BDA4A}\MpKsl0f79a0dd.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 upperdev; system32\DRIVERS\usbser_lowerflt.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-07 12:18 - 2014-08-07 12:18 - 00854410 _____ () C:\Users\Shorty\Documents\SecurityCheck.exe
2014-08-07 12:14 - 2014-08-07 12:14 - 00000000 ___HD () C:\dvmexp
2014-08-07 12:08 - 2014-08-07 12:08 - 00024003 _____ () C:\Users\Shorty\Desktop\ESET.odt
2014-08-07 10:40 - 2014-08-07 10:41 - 02347384 _____ (ESET) C:\Users\Shorty\Documents\esetsmartinstaller_deu.exe
2014-08-06 10:23 - 2014-08-06 10:23 - 00001814 _____ () C:\Users\Shorty\Desktop\JRT.txt
2014-08-06 10:04 - 2014-08-06 10:04 - 00000000 ____D () C:\Windows\ERUNT
2014-08-06 10:02 - 2014-08-06 10:02 - 00021041 _____ () C:\Users\Shorty\Desktop\adw.odt
2014-08-06 09:44 - 2014-08-06 09:53 - 00000000 ____D () C:\AdwCleaner
2014-08-06 09:43 - 2014-08-06 09:43 - 01361309 _____ () C:\Users\Shorty\Documents\adwcleaner_3.302.exe
2014-08-06 09:27 - 2014-08-06 09:27 - 00001185 _____ () C:\Users\Shorty\Desktop\mbam.txt
2014-08-06 09:25 - 2014-08-06 09:25 - 00000906 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-06 09:09 - 2014-08-07 12:16 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-06 09:08 - 2014-08-06 09:25 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-08-06 09:08 - 2014-08-06 09:08 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-06 09:08 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-06 09:08 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-06 09:08 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-06 09:07 - 2014-08-06 09:07 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Shorty\Documents\mbam-setup-2.0.2.1012.exe
2014-08-05 14:42 - 2014-08-05 14:42 - 00040877 _____ () C:\ComboFix.txt
2014-08-05 14:21 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-08-05 14:21 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-08-05 14:21 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-08-05 14:21 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-08-05 14:21 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-08-05 14:21 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-08-05 14:21 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-08-05 14:21 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-08-05 14:17 - 2014-08-05 14:42 - 00000000 ____D () C:\Qoobox
2014-08-05 14:16 - 2014-08-05 14:41 - 00000000 ____D () C:\Windows\erdnt
2014-08-05 14:15 - 2014-08-05 14:16 - 05567674 ____R (Swearware) C:\Users\Shorty\Documents\ComboFix.exe
2014-08-05 13:51 - 2014-08-05 13:51 - 00001064 _____ () C:\Users\Shorty\Desktop\Revo Uninstaller.lnk
2014-08-05 13:51 - 2014-08-05 13:51 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-08-05 13:50 - 2014-08-05 13:51 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Shorty\Documents\revosetup95.exe
2014-08-04 18:08 - 2014-08-04 18:09 - 00036634 _____ () C:\Users\Shorty\Documents\Addition.txt
2014-08-04 18:07 - 2014-08-07 12:30 - 00020216 _____ () C:\Users\Shorty\Documents\FRST.txt
2014-08-04 18:07 - 2014-08-07 12:30 - 00000000 ____D () C:\FRST
2014-08-04 18:06 - 2014-08-04 18:06 - 01084928 _____ (Farbar) C:\Users\Shorty\Documents\FRST.exe
2014-07-17 14:21 - 2014-07-17 14:21 - 00160032 _____ () C:\Windows\Minidump\Mini071714-01.dmp
2014-07-11 09:53 - 2014-06-07 02:19 - 02051072 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-11 09:53 - 2014-06-06 10:59 - 00506880 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-11 09:53 - 2014-05-30 08:53 - 00273408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-11 09:52 - 2014-06-07 02:05 - 12353024 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-11 09:52 - 2014-06-07 01:25 - 09711616 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-11 09:52 - 2014-06-07 01:12 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-11 09:52 - 2014-06-07 01:04 - 01106432 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-11 09:52 - 2014-06-07 01:03 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-11 09:52 - 2014-06-07 01:02 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-11 09:52 - 2014-06-07 01:00 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-07-11 09:52 - 2014-06-07 00:58 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-11 09:52 - 2014-06-07 00:57 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-11 09:52 - 2014-06-07 00:56 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-07-11 09:52 - 2014-06-07 00:56 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-11 09:52 - 2014-06-07 00:54 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-11 09:52 - 2014-06-07 00:54 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-11 09:52 - 2014-06-07 00:54 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-11 09:52 - 2014-06-07 00:54 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-07-11 09:52 - 2014-06-07 00:53 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-11 09:52 - 2014-06-07 00:53 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-11 09:52 - 2014-06-07 00:53 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-07-11 09:52 - 2014-06-07 00:52 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-11 09:52 - 2014-06-07 00:51 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-07-11 09:52 - 2014-06-07 00:47 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-07 12:30 - 2014-08-04 18:07 - 00020216 _____ () C:\Users\Shorty\Documents\FRST.txt
2014-08-07 12:30 - 2014-08-04 18:07 - 00000000 ____D () C:\FRST
2014-08-07 12:26 - 2009-07-27 21:16 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-07 12:19 - 2009-03-09 17:54 - 01882050 _____ () C:\Windows\WindowsUpdate.log
2014-08-07 12:18 - 2014-08-07 12:18 - 00854410 _____ () C:\Users\Shorty\Documents\SecurityCheck.exe
2014-08-07 12:16 - 2014-08-06 09:09 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-07 12:16 - 2009-07-27 21:16 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-07 12:16 - 2009-07-14 09:58 - 00031966 _____ () C:\ProgramData\nvModes.dat
2014-08-07 12:16 - 2009-07-14 09:58 - 00031966 _____ () C:\ProgramData\nvModes.001
2014-08-07 12:14 - 2014-08-07 12:14 - 00000000 ___HD () C:\dvmexp
2014-08-07 12:14 - 2009-07-14 09:46 - 00045056 _____ () C:\Windows\system32\acovcnt.exe
2014-08-07 12:14 - 2009-03-09 20:16 - 00000000 ____D () C:\temp
2014-08-07 12:14 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-07 12:14 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-07 12:14 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-07 12:13 - 2008-01-21 04:47 - 00277040 _____ () C:\Windows\PFRO.log
2014-08-07 12:12 - 2006-11-02 15:01 - 00032578 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-08-07 12:08 - 2014-08-07 12:08 - 00024003 _____ () C:\Users\Shorty\Desktop\ESET.odt
2014-08-07 11:38 - 2012-05-24 09:45 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-07 10:41 - 2014-08-07 10:40 - 02347384 _____ (ESET) C:\Users\Shorty\Documents\esetsmartinstaller_deu.exe
2014-08-07 10:30 - 2014-03-30 16:37 - 00000000 ____D () C:\ProgramData\MFAData
2014-08-06 11:19 - 2013-08-01 16:55 - 00000000 ____D () C:\Users\Shorty\Desktop\Haushaltsplan
2014-08-06 10:23 - 2014-08-06 10:23 - 00001814 _____ () C:\Users\Shorty\Desktop\JRT.txt
2014-08-06 10:04 - 2014-08-06 10:04 - 00000000 ____D () C:\Windows\ERUNT
2014-08-06 10:02 - 2014-08-06 10:02 - 00021041 _____ () C:\Users\Shorty\Desktop\adw.odt
2014-08-06 09:53 - 2014-08-06 09:44 - 00000000 ____D () C:\AdwCleaner
2014-08-06 09:52 - 2009-07-27 21:08 - 00001074 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-08-06 09:52 - 2009-07-27 21:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-08-06 09:52 - 2009-07-14 09:58 - 00000984 _____ () C:\Users\Shorty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-08-06 09:52 - 2009-07-14 09:45 - 00000000 ____D () C:\Users\Shorty
2014-08-06 09:51 - 2009-07-27 21:04 - 00000000 ____D () C:\ProgramData\ICQ
2014-08-06 09:43 - 2014-08-06 09:43 - 01361309 _____ () C:\Users\Shorty\Documents\adwcleaner_3.302.exe
2014-08-06 09:27 - 2014-08-06 09:27 - 00001185 _____ () C:\Users\Shorty\Desktop\mbam.txt
2014-08-06 09:25 - 2014-08-06 09:25 - 00000906 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-06 09:25 - 2014-08-06 09:08 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-08-06 09:08 - 2014-08-06 09:08 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-06 09:07 - 2014-08-06 09:07 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Shorty\Documents\mbam-setup-2.0.2.1012.exe
2014-08-05 14:42 - 2014-08-05 14:42 - 00040877 _____ () C:\ComboFix.txt
2014-08-05 14:42 - 2014-08-05 14:17 - 00000000 ____D () C:\Qoobox
2014-08-05 14:42 - 2006-11-02 13:18 - 00000000 __RHD () C:\Users\Default
2014-08-05 14:42 - 2006-11-02 13:18 - 00000000 ___RD () C:\Users\Public
2014-08-05 14:41 - 2014-08-05 14:16 - 00000000 ____D () C:\Windows\erdnt
2014-08-05 14:37 - 2006-11-02 12:23 - 00000215 _____ () C:\Windows\system.ini
2014-08-05 14:36 - 2006-11-02 12:22 - 49807360 _____ () C:\Windows\system32\config\COMPON~1.bak
2014-08-05 14:36 - 2006-11-02 12:22 - 45350912 _____ () C:\Windows\system32\config\SOFTWARE.bak
2014-08-05 14:36 - 2006-11-02 12:22 - 20709376 _____ () C:\Windows\system32\config\SYSTEM.bak
2014-08-05 14:36 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\SECURITY.bak
2014-08-05 14:36 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\SAM.bak
2014-08-05 14:36 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\DEFAULT.bak
2014-08-05 14:16 - 2014-08-05 14:15 - 05567674 ____R (Swearware) C:\Users\Shorty\Documents\ComboFix.exe
2014-08-05 13:51 - 2014-08-05 13:51 - 00001064 _____ () C:\Users\Shorty\Desktop\Revo Uninstaller.lnk
2014-08-05 13:51 - 2014-08-05 13:51 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-08-05 13:51 - 2014-08-05 13:50 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Shorty\Documents\revosetup95.exe
2014-08-05 13:26 - 2014-04-06 12:20 - 00000118 _____ () C:\Users\Shorty\AppData\Roaming\WB.CFG
2014-08-04 18:09 - 2014-08-04 18:08 - 00036634 _____ () C:\Users\Shorty\Documents\Addition.txt
2014-08-04 18:06 - 2014-08-04 18:06 - 01084928 _____ (Farbar) C:\Users\Shorty\Documents\FRST.exe
2014-08-04 17:06 - 2009-07-14 09:54 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-08-03 10:43 - 2014-04-02 07:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2014-08-03 10:43 - 2014-03-30 16:39 - 00000865 _____ () C:\Users\Public\Desktop\AVG 2014.lnk
2014-08-03 10:34 - 2010-10-04 23:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-07-28 12:22 - 2006-11-02 14:47 - 00532944 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-17 14:30 - 2006-11-02 14:37 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-17 14:21 - 2014-07-17 14:21 - 00160032 _____ () C:\Windows\Minidump\Mini071714-01.dmp
2014-07-17 14:21 - 2011-05-13 22:12 - 00000000 ____D () C:\Windows\Minidump
2014-07-17 14:20 - 2013-10-01 09:20 - 290672313 _____ () C:\Windows\MEMORY.DMP
2014-07-17 14:17 - 2013-08-19 12:53 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-17 14:17 - 2006-11-02 12:24 - 93585272 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-07-11 11:18 - 2012-05-24 09:45 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-07-11 11:18 - 2011-07-05 21:02 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

Some content of TEMP:
====================
C:\Users\Shorty\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-07 12:20

==================== End Of Log ============================
--- --- ---

schrauber 08.08.2014 13:01
Java und Adobe updaten.

Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop.
Schließe nun alle offenen Programme und trenne Dich von dem Internet.
Doppelklick auf die TFC.exe und drücke auf Start.
Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen.




Revo Uninstaller - Download - Filepony
damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren.

Dann:
https://support.mozilla.org/de/kb/fi...einfach-loesen


Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.






Fertig :)

Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.



Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun :)

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

BlackKisu 19.08.2014 22:01
Erstmal sorry das ich mich noch nicht gemeldet habe ich werd das alles Morgen mal in Angriff nehmen ... aber leider hatte uns (Mein Sohn und mich) die Erkältungsfront erwicht und deshalb konnte ich mich nicht melden sorry nochmal. ich erledige alles und sag bescheid ob nun alles funzt!

schrauber 20.08.2014 11:02
ok :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 00:27 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19