Im Moment ist mein Notebook artig und macht, was ICH will.
Hier sind noch mal die Logs - diesmal als Admin durchgeführt.
FRST Logfile:
FRST Logfile:
FRST Logfile:
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-02-2015
Ran by Dörte (administrator) on TABBY on 24-02-2015 20:48:55
Running from C:\Users\Dörte\Desktop
Loaded Profiles: Dörte (Available profiles: Dörte & Dörte_2)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
() C:\Program Files (x86)\PHotkey\PGFNEXSrv.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avp.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
() C:\ProgramData\DatacardService\DCService.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17477_none_fa2b7d3b9b36c7b4\TiWorker.exe
(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkUserAgent.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avpui.exe
() C:\Program Files (x86)\PHotkey\PHotkey.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkUI.exe
() C:\Program Files (x86)\PHotkey\Atouch64.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
() C:\Program Files (x86)\PHotkey\GPMTray.exe
() C:\Program Files (x86)\PHotkey\KeyboardMonitorTool.exe
(Dolby Laboratories Inc.) C:\Program Files\Dolby Digital Plus\ddp.exe
() C:\Program Files (x86)\PHotkey\Dolbyosd.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Price Fountain) C:\Users\Dörte\AppData\Local\PriceFountain\pricefountainw.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Price Fountain) C:\Users\Dörte\AppData\Local\PriceFountain\pricefountain.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\TXE Components\DAL\jhi_service.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\WinStore\WSHost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13667032 2014-02-24] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1381744 2014-02-25] (Realtek Semiconductor)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111576 2013-08-05] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [490760 2013-11-26] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [95192 2013-03-11] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [267224 2013-09-18] (CyberLink Corp.)
HKLM-x32\...\Run: [gmsd_de_115] => [X]
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [ConfirmFileDelete] 1
HKU\S-1-5-21-1641478625-795509677-2549534948-1001\...\Run: [pricefountainw.exe] => C:\Users\Dörte\AppData\Local\PriceFountain\pricefountainw.exe [461824 2014-12-07] (Price Fountain)
Startup: C:\Users\Dörte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Dörte_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Dörte\AppData\Roaming\Dropbox\bin\Dropbox.exe (No File)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://isearch.omiga-plus.com/?type=hp&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://isearch.omiga-plus.com/?type=hp&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://isearch.omiga-plus.com/?type=hp&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://isearch.omiga-plus.com/?type=hp&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B&q={searchTerms}
HKU\S-1-5-21-1641478625-795509677-2549534948-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://isearch.omiga-plus.com/?type=hp&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B
HKU\S-1-5-21-1641478625-795509677-2549534948-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://isearch.omiga-plus.com/?type=hp&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B&q={searchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B&q={searchTerms}
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1641478625-795509677-2549534948-1001 -> DefaultScope {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=tugs&utm_campaign=install_ie&utm_content=ds&from=tugs&uid=3219913727_198264_D6AB162B&ts=1421692099&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1641478625-795509677-2549534948-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=tugs&utm_campaign=install_ie&utm_content=ds&from=tugs&uid=3219913727_198264_D6AB162B&ts=1421692099&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1641478625-795509677-2549534948-1001 -> {0A6D4F05-2404-46E2-A546-992154CF925C} URL = hxxp://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=tugs&utm_campaign=install_ie&utm_content=ds&from=tugs&uid=3219913727_198264_D6AB162B&ts=1421692099&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1641478625-795509677-2549534948-1001 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=tugs&utm_campaign=install_ie&utm_content=ds&from=tugs&uid=3219913727_198264_D6AB162B&ts=1421692099&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1641478625-795509677-2549534948-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=tugs&utm_campaign=install_ie&utm_content=ds&from=tugs&uid=3219913727_198264_D6AB162B&ts=1421692099&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1641478625-795509677-2549534948-1001 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = hxxp://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=tugs&utm_campaign=install_ie&utm_content=ds&from=tugs&uid=3219913727_198264_D6AB162B&ts=1421692099&type=default&q={searchTerms}
BHO: Content Blocker Plugin -> {03C04F0A-E2A3-4F7F-BA30-BFA06FFD1358} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)
BHO: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll No File
BHO: Virtual Keyboard Plugin -> {B5D5BB14-C8E2-478D-9C97-574AC10AF9E8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {E3D96E85-529D-4269-AC6A-97CF9E2221E3} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin -> {03C04F0A-E2A3-4F7F-BA30-BFA06FFD1358} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: No Name -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> No File
BHO-x32: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll No File
BHO-x32: Virtual Keyboard Plugin -> {B5D5BB14-C8E2-478D-9C97-574AC10AF9E8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: PriceFountain -> {b608cc98-54de-4775-96c9-097de398500c} -> C:\Users\Dörte\AppData\Local\PriceFountain\PriceFountainIE.dll ()
BHO-x32: Safe Money Plugin -> {E3D96E85-529D-4269-AC6A-97CF9E2221E3} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll No File
Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll No File
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll No File
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{D868610F-91CC-46C1-B0D1-CE1EDBBEE40F}: [NameServer] 193.189.244.225 193.189.244.206
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://isearch.omiga-plus.com/?type=sc&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B
FireFox:
========
FF ProfilePath: C:\Users\Dörte\AppData\Roaming\Mozilla\Firefox\Profiles\er81bz40.default
FF NewTab: hxxp://isearch.omiga-plus.com/newtab/?type=nt&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B
FF SelectedSearchEngine: omiga-plus
FF Homepage: about:home
FF NetworkProxy: "autoconfig_url", "data:text/javascript,function%20FindProxyForURL(url%2C%20host)%20%7B%20var%20lhost%2C%20localIpAddresses%2C%20localDomains%2C%20ipNotation%2C%20i%3B%20function%20isPlainHostNameEx()%20%7B%20return%20!(!!~lhost.indexOf('.')%20%7C%7C%20!!~lhost.indexOf('%3A'))%3B%20%7D%20lhost%20%3D%20host.toLowerCase()%3B%20ipNotation%20%3D%20%2F%5E%5Cd%2B%5C.%5Cd%2B%5C.%5Cd%2B%5C.%5Cd%2B%24%2Fg%3B%20localIpAddresses%20%3D%20%5B'127.0.0.1'%2C'10.*.*.*'%2C'172.1%5B6-9%5D.*.*'%2C'172.2%5B1-9%5D.*.*'%2C'172.3%5B0-1%5D.*.*'%2C'192.168.*.*'%5D%3B%20localDomains%20%3D%20%5B'zeus.pm'%2C'zenguard.biz'%2C'local'%2C'dev'%2C'ip'%2C'box'%2C'lvh.me'%2C'ripe'%2C'invalid'%2C'intra'%2C'intranet'%2C'onion'%2C'vcap.me'%2C'127.0.0.1.xip.io'%2C'smackaho.st'%2C'localtest.me'%2C'site'%5D%3B%20if%20(isPlainHostNameEx())%20%7B%20return%20'DIRECT'%3B%20%7D%20if%20(ipNotation.test(lhost))%20%7B%20for%20(i%20%3D%200%3B%20i%20%3C%20localIpAddresses.length%3B%20i%2B%2B)%20%7B%20if%20(shExpMatch(lhost%2C%20localIpAddresses%5Bi%5D))%20%7B%20return%20'DIRECT'%3B%20%7D%20%7D%20%7D%20for%20(i%20%3D%200%3B%20i%20%3C%20localDomains.length%3B%20i%2B%2B)%20%7B%20if%20(dnsDomainIs(lhost%2C%20localDomains%5Bi%5D))%20%7B%20return%20'DIRECT'%3B%20%7D%20%7D%20return%20'PROXY%20127.0.0.1%3A50938'%3B%20%7D%20%2F*ZenMate*%2F"
FF NetworkProxy: "type", 2
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.1 -> C:\Program Files (x86)\Intel\TXE Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\TXE Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker_6418E0D362104DADA084DC312DFA8ABC -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\content_blocker@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/online_banking_69A4E213815F42BD863D889007201D82 -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\online_banking@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard_294FF26A1D5B455495946778FDE7CEDB -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\virtual_keyboard@kaspersky.com ()
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF user.js: detected! => C:\Users\Dörte\AppData\Roaming\Mozilla\Firefox\Profiles\er81bz40.default\user.js
FF Extension: ZenMate Security & Privacy VPN - C:\Users\Dörte\AppData\Roaming\Mozilla\Firefox\Profiles\er81bz40.default\Extensions\firefox@zenmate.com.xpi [2014-11-23]
FF Extension: PriceFountain - C:\Users\Dörte\AppData\Roaming\Mozilla\Firefox\Profiles\er81bz40.default\Extensions\{b6a94784-0ffb-4121-88c6-435139067ee2}.xpi [2015-01-10]
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor
FF HKLM-x32\...\Firefox\Extensions: [content_blocker_6418E0D362104DADA084DC312DFA8ABC@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\content_blocker@kaspersky.com
FF Extension: Модуль блокування небезпечних веб-сайтів - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\content_blocker@kaspersky.com [2014-12-25]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard_294FF26A1D5B455495946778FDE7CEDB@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Віртуальна клавіатура - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\virtual_keyboard@kaspersky.com [2014-12-25]
FF HKLM-x32\...\Firefox\Extensions: [online_banking_69A4E213815F42BD863D889007201D82@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\online_banking@kaspersky.com
FF Extension: Безпечні платежі - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\online_banking@kaspersky.com [2014-12-25]
Chrome:
=======
CHR HomePage: Default -> hxxp://isearch.omiga-plus.com/?type=hp&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\Dörte\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Dörte\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-11-23]
CHR Extension: (Google Docs) - C:\Users\Dörte\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-11-23]
CHR Extension: (Google Drive) - C:\Users\Dörte\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-11-23]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Dörte\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-11-24]
CHR Extension: (YouTube) - C:\Users\Dörte\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-11-23]
CHR Extension: (Google Search) - C:\Users\Dörte\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-11-23]
CHR Extension: (Kaspersky Protection) - C:\Users\Dörte\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbhjdbfgekjfcfkkfjjmlmojhbllhbho [2015-01-19]
CHR Extension: (Google Sheets) - C:\Users\Dörte\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-11-23]
CHR Extension: (SiteAdvisor) - C:\Users\Dörte\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2014-11-23]
CHR Extension: (Google Wallet) - C:\Users\Dörte\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-23]
CHR Extension: (Gmail) - C:\Users\Dörte\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-11-23]
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - hxxp://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AVP15.0.1; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avp.exe [234520 2014-08-30] (Kaspersky Lab ZAO)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [74712 2013-03-11] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [316376 2013-03-11] (CyberLink)
R2 DCService.exe; C:\ProgramData\DatacardService\DCService.exe [229376 2010-05-08] () [File not signed]
R2 DisplayLinkService; C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe [10571056 2014-07-09] (DisplayLink Corp.)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\TXE Components\DAL\jhi_service.exe [168216 2013-09-29] (Intel Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2014-05-29] ()
R2 PGFNEXSrv; C:\Program Files (x86)\PHotkey\PGFNEXSrv.exe [136192 2014-03-04] () [File not signed]
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [389896 2013-03-06] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3816176 2014-05-29] (Intel® Corporation)
S2 0083561418841089mcinstcleanup; C:\Windows\TEMP\008356~1.EXE -cleanup -nolog [X]
S2 McAfee SiteAdvisor Service; c:\PROGRA~2\mcafee\SITEAD~1\McSACore.exe [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 AX88772; C:\Windows\system32\DRIVERS\ax88772.sys [113864 2013-07-18] (ASIX Electronics Corp.)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
S3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [141624 2014-05-13] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1424184 2014-05-13] (Motorola Solutions, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink)
R0 cm_km_w; C:\Windows\System32\DRIVERS\cm_km_w.sys [238288 2013-01-14] (Kaspersky Lab UK Ltd)
S3 DisplayLinkUsbIo_x64; C:\Windows\system32\DRIVERS\DisplayLinkUsbIo_x64_7.6.56275.0.sys [46384 2014-07-10] ()
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 ewusbnet; C:\Windows\system32\DRIVERS\ewusbnet.sys [250368 2010-04-07] (Huawei Technologies Co., Ltd.)
U5 ew_hwusbdev; C:\Windows\System32\Drivers\ew_hwusbdev.sys [114560 2010-03-20] (Huawei Technologies Co., Ltd.)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [210376 2014-07-03] (Intel Corporation)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [468576 2014-03-31] (Kaspersky Lab ZAO)
R2 kldisk; C:\Windows\system32\DRIVERS\kldisk.sys [46144 2014-07-02] (Kaspersky Lab ZAO)
S0 klelam; C:\Windows\System32\DRIVERS\klelam.sys [29616 2012-07-27] (Kaspersky Lab)
R3 klflt; C:\Windows\system32\DRIVERS\klflt.sys [150536 2014-12-25] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\system32\DRIVERS\klhk.sys [247480 2014-08-12] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [799944 2014-12-25] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\system32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\system32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\system32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\system32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 klwfp; C:\Windows\system32\DRIVERS\klwfp.sys [68616 2014-12-25] (Kaspersky Lab ZAO)
R1 Klwtp; C:\Windows\system32\DRIVERS\klwtp.sys [77512 2014-12-25] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\system32\DRIVERS\kneps.sys [179776 2014-07-09] (Kaspersky Lab ZAO)
R3 NETwNb64; C:\Windows\system32\DRIVERS\Netwbw02.sys [3446240 2014-06-18] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)
R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
R3 PegaRadioSwitch; C:\Windows\System32\drivers\PegaRadioSwitch.sys [23552 2013-08-22] (Windows (R) Win 7 DDK provider)
S3 RtlWlanu; C:\Windows\system32\DRIVERS\rtwlanu.sys [2968280 2014-01-15] (Realtek Semiconductor Corporation )
R3 SensorsHIDClassDriver; C:\Windows\system32\DRIVERS\WUDFRd.sys [227840 2014-05-31] (Microsoft Corporation)
R3 SensorsServiceDriver; C:\Windows\system32\DRIVERS\WUDFRd.sys [227840 2014-05-31] (Microsoft Corporation)
R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [87568 2013-07-01] (Intel Corporation)
R3 VirtualButtons; C:\Windows\System32\drivers\VirtualButtons.sys [32024 2013-10-04] (Intel Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
U4 klkbdflt2; \SystemRoot\system32\DRIVERS\klkbdflt2.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-24 20:48 - 2015-02-24 20:49 - 00026994 _____ () C:\Users\Dörte\Desktop\FRST.txt
2015-02-24 20:47 - 2015-02-24 20:47 - 02087424 _____ (Farbar) C:\Users\Dörte\Desktop\FRST64.exe
2015-02-23 20:59 - 2015-02-23 20:59 - 00021988 _____ () C:\Users\Dörte_2\Desktop\Addition.txt
2015-02-23 20:57 - 2015-02-24 20:48 - 00000000 ____D () C:\FRST
2015-02-23 20:57 - 2015-02-23 20:59 - 00042926 _____ () C:\Users\Dörte_2\Desktop\FRST.txt
2015-02-23 20:56 - 2015-02-23 20:56 - 02087424 _____ (Farbar) C:\Users\Dörte_2\Desktop\FRST64.exe
2015-02-21 00:18 - 2015-02-21 00:18 - 00000000 ____D () C:\Users\Dörte_2\Documents\THW
2015-02-20 23:36 - 2014-04-16 00:35 - 00028352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aspnet_counters.dll
2015-02-20 23:36 - 2014-04-16 00:34 - 00029888 _____ (Microsoft Corporation) C:\Windows\system32\aspnet_counters.dll
2015-02-14 20:53 - 2015-02-14 20:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-02-13 14:16 - 2015-02-13 14:16 - 00000000 ____D () C:\Users\Dörte_2\Documents\WOB
2015-02-13 14:06 - 2015-02-13 14:06 - 02327562 _____ () C:\Users\Dörte_2\Downloads\Dateien.zip
2015-02-13 11:42 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-13 11:42 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-11 01:22 - 2015-01-15 23:43 - 00563504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-11 01:22 - 2015-01-15 23:43 - 00177984 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-11 01:22 - 2015-01-14 05:22 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-02-11 01:22 - 2015-01-14 04:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-02-11 01:22 - 2015-01-13 23:11 - 01762840 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-11 01:22 - 2015-01-13 23:04 - 01489072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-11 01:22 - 2015-01-10 10:10 - 07472960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-11 01:22 - 2015-01-10 10:10 - 01733440 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-02-11 01:22 - 2015-01-10 09:28 - 01498360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-02-11 01:22 - 2015-01-10 08:00 - 00430080 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-02-11 01:22 - 2015-01-10 07:38 - 00359424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-02-11 01:22 - 2014-12-09 04:45 - 00393728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-11 01:22 - 2014-12-09 02:56 - 00538624 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-11 01:22 - 2014-10-29 03:51 - 00154112 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-11 01:22 - 2014-10-29 03:50 - 00736768 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-11 01:22 - 2014-10-29 03:06 - 00736768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-02-11 01:22 - 2014-10-29 03:06 - 00154112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-02-11 01:22 - 2014-10-29 03:02 - 00285184 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-02-11 01:22 - 2014-10-29 03:02 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-02-11 01:22 - 2014-10-29 02:57 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-02-11 01:22 - 2014-10-29 02:31 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-11 01:22 - 2014-10-29 02:15 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-02-11 01:22 - 2014-10-29 02:15 - 00005632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-02-11 01:22 - 2014-10-29 02:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-02-11 01:22 - 2014-10-29 02:13 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-02-11 01:22 - 2014-10-29 02:13 - 00008704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-02-11 01:21 - 2015-01-19 19:42 - 01487976 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
2015-02-11 01:21 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-11 01:21 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-11 01:21 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-11 01:21 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-02-11 01:21 - 2015-01-12 03:34 - 00816128 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-02-11 01:21 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-11 01:21 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-11 01:21 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-11 01:21 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-11 01:21 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-02-11 01:21 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-11 01:21 - 2015-01-12 02:58 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-02-11 01:21 - 2015-01-12 02:55 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-02-11 01:21 - 2015-01-12 02:51 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-02-11 01:21 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-11 01:21 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-11 01:21 - 2015-01-12 02:48 - 00374272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-11 01:21 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-11 01:21 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-11 01:21 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-11 01:21 - 2015-01-12 02:34 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-02-11 01:21 - 2015-01-12 02:30 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-02-11 01:21 - 2015-01-12 02:27 - 02865152 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2015-02-11 01:21 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-11 01:21 - 2015-01-12 02:25 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-02-11 01:21 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-11 01:21 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-11 01:21 - 2015-01-12 02:23 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-02-11 01:21 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-11 01:21 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-11 01:21 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-11 01:21 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-11 01:21 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-11 01:21 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-02-11 01:21 - 2015-01-10 09:22 - 04175872 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-11 01:21 - 2014-12-19 09:57 - 00788680 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-11 01:21 - 2014-12-19 09:25 - 00602776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-11 01:21 - 2014-12-09 00:12 - 00391526 _____ () C:\Windows\system32\ApnDatabase.xml
2015-02-08 10:25 - 2015-02-08 10:25 - 00001095 _____ () C:\Users\Public\Desktop\Mobile Partner.lnk
2015-02-08 10:25 - 2015-02-08 10:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mobile Partner
2015-02-08 10:24 - 2010-04-09 15:24 - 00079360 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ew_jucdcacm.sys
2015-02-08 10:24 - 2010-04-09 15:24 - 00076288 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ew_jubusenum.sys
2015-02-08 10:24 - 2010-04-09 15:24 - 00049664 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ew_jucdcecm.sys
2015-02-08 10:24 - 2010-04-09 15:24 - 00027136 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ew_juextctrl.sys
2015-02-08 10:24 - 2010-04-07 17:05 - 00250368 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ewusbnet.sys
2015-02-08 10:24 - 2010-03-25 10:08 - 00120704 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ewusbmdm.sys
2015-02-08 10:24 - 2010-03-20 12:06 - 00013952 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ew_usbenumfilter.sys
2015-02-08 10:24 - 2010-03-20 11:56 - 00114560 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ew_hwusbdev.sys
2015-02-08 10:24 - 2010-03-17 14:34 - 01001472 _____ (DiBcom SA) C:\Windows\system32\Drivers\mod7700.sys
2015-02-08 10:24 - 2010-01-18 18:48 - 00032768 _____ (Huawei Tech. Co., Ltd.) C:\Windows\system32\Drivers\ewdcsc.sys
2015-02-08 10:24 - 2009-07-14 14:21 - 01721576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfCoInstaller01009.dll
2015-02-08 10:23 - 2015-02-08 10:25 - 00000000 ____D () C:\Program Files (x86)\Mobile Partner
2015-02-08 10:22 - 2015-02-08 10:25 - 00000000 ____D () C:\ProgramData\DatacardService
2015-02-08 00:09 - 2015-02-12 11:24 - 00000000 ____D () C:\Users\Dörte_2\Documents\KV
2015-02-07 23:39 - 2015-02-07 23:39 - 00000000 ____D () C:\Users\Dörte_2\AppData\Roaming\Ashampoo
2015-02-02 00:03 - 2015-02-02 00:03 - 00000000 ____D () C:\Users\Dörte_2\Documents\Pferde
2015-01-29 23:05 - 2015-01-29 23:05 - 00001243 _____ () C:\Users\Dörte_2\Desktop\Amazon Music.lnk
2015-01-29 23:04 - 2015-01-29 23:04 - 39565896 _____ (Amazon) C:\Users\Dörte_2\Downloads\AmazonMusicInstaller.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-24 20:48 - 2014-11-23 20:51 - 01276449 _____ () C:\Windows\WindowsUpdate.log
2015-02-24 20:47 - 2014-07-09 12:34 - 00765582 _____ () C:\Windows\system32\perfh007.dat
2015-02-24 20:47 - 2014-07-09 12:34 - 00159366 _____ () C:\Windows\system32\perfc007.dat
2015-02-24 20:47 - 2014-03-18 16:26 - 01776918 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-24 20:46 - 2014-11-23 21:09 - 00003596 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1641478625-795509677-2549534948-1001
2015-02-24 20:44 - 2014-11-23 21:10 - 00000000 ____D () C:\Users\Dörte\OneDrive
2015-02-24 20:42 - 2014-11-23 21:05 - 00000000 ____D () C:\Users\Dörte\Documents\Youcam
2015-02-24 20:41 - 2014-12-25 03:36 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-02-24 20:41 - 2014-11-28 23:51 - 00000000 ____D () C:\Users\Dörte_2
2015-02-24 20:41 - 2014-11-23 21:47 - 00001126 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-24 20:41 - 2014-08-08 12:15 - 00000000 ____D () C:\Windows\System32\Tasks\Lenovo
2015-02-24 20:41 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-02-24 20:40 - 2013-08-22 15:46 - 00079134 _____ () C:\Windows\setupact.log
2015-02-24 20:40 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-23 22:15 - 2015-01-10 19:15 - 00000306 _____ () C:\Windows\Tasks\Price Fountain.job
2015-02-23 22:15 - 2014-11-28 23:56 - 00003596 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1641478625-795509677-2549534948-1002
2015-02-23 22:12 - 2014-12-01 00:22 - 00000000 ___RD () C:\Users\Dörte_2\Dropbox
2015-02-23 22:12 - 2014-12-01 00:18 - 00000000 ____D () C:\Users\Dörte_2\AppData\Roaming\Dropbox
2015-02-23 22:11 - 2014-12-09 21:37 - 00000000 ____D () C:\Users\Dörte_2\Documents\Youcam
2015-02-23 22:08 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru
2015-02-23 21:02 - 2014-11-23 21:47 - 00001130 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-20 23:38 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp
2015-02-20 23:15 - 2014-11-23 22:27 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-02-20 23:08 - 2014-11-23 21:48 - 00002199 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-02-20 22:46 - 2015-01-10 19:15 - 00000000 ____D () C:\Users\Dörte\AppData\Local\PriceFountain
2015-02-20 21:53 - 2015-01-19 19:28 - 00000000 ____D () C:\Program Files (x86)\XTab
2015-02-20 00:46 - 2015-01-07 23:02 - 00000000 ____D () C:\Users\Dörte_2\Documents\My Digital Editions
2015-02-18 00:18 - 2014-12-02 17:43 - 00000000 ____D () C:\Users\Dörte_2\Documents\Listen
2015-02-14 23:35 - 2013-08-22 14:25 - 00524288 ___SH () C:\Windows\system32\config\BBI
2015-02-13 03:16 - 2015-01-12 22:38 - 00000000 ____D () C:\Users\Dörte_2\Documents\Buero
2015-02-12 23:36 - 2013-08-22 15:44 - 00520480 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-12 23:35 - 2014-03-18 09:16 - 00029308 _____ () C:\Windows\PFRO.log
2015-02-12 15:42 - 2014-12-01 02:25 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-12 15:36 - 2014-04-24 17:12 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-12 10:37 - 2014-12-01 00:22 - 00001074 _____ () C:\Users\Dörte_2\Desktop\Dropbox.lnk
2015-02-12 10:37 - 2014-12-01 00:19 - 00000000 ____D () C:\Users\Dörte_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-02-08 00:16 - 2014-12-03 21:46 - 00000000 ____D () C:\Users\Dörte_2\Documents\Schillhorn
2015-02-06 22:57 - 2014-11-23 21:47 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-06 22:57 - 2014-11-23 21:47 - 00003866 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-03 20:31 - 2014-12-02 15:51 - 00106976 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-03 20:31 - 2014-12-02 15:50 - 00714720 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-02 01:16 - 2015-01-11 23:34 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-01-25 12:58 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM
==================== Files in the root of some directories =======
2015-01-12 00:15 - 2015-01-12 00:15 - 0000043 _____ () C:\Users\Dörte\AppData\Roaming\WB.CFG
2014-08-08 12:07 - 2014-08-08 12:07 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2014-07-09 12:41 - 2014-07-09 12:42 - 0000104 _____ () C:\ProgramData\{01FB4998-33C4-4431-85ED-079E3EEFE75D}.log
2014-07-09 12:42 - 2014-07-09 12:42 - 0000119 _____ () C:\ProgramData\{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}.log
2014-07-09 12:38 - 2014-07-09 12:39 - 0000106 _____ () C:\ProgramData\{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}.log
2014-07-09 12:41 - 2014-07-09 12:41 - 0000111 _____ () C:\ProgramData\{44510C84-AE2A-4079-A75B-D44E68D73B9A}.log
2014-07-09 12:40 - 2014-07-09 12:40 - 0000032 _____ () C:\ProgramData\{551F492A-01B0-4DC4-866F-875EC4EDC0A8}.log
2014-07-09 12:37 - 2014-07-09 12:37 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
2014-07-09 12:40 - 2014-07-09 12:41 - 0000108 _____ () C:\ProgramData\{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}.log
2014-07-09 12:37 - 2014-07-09 12:38 - 0000110 _____ () C:\ProgramData\{E3739848-5329-48E3-8D28-5BBD6E8BE384}.log
2014-07-09 12:39 - 2014-07-09 12:39 - 0000110 _____ () C:\ProgramData\{E3D04529-6EDB-11D8-A372-0050BAE317E1}.log
Some content of TEMP:
====================
C:\Users\Dörte\AppData\Local\Temp\20AD2477-C506-FD59-C9CD-5B540F00D6EF.dll
C:\Users\Dörte\AppData\Local\Temp\20AD2477-C506-FD59-C9CD-5B540F00D6EF.exe
C:\Users\Dörte\AppData\Local\Temp\BackupSetup.exe
C:\Users\Dörte\AppData\Local\Temp\optprosetup.exe
C:\Users\Dörte_2\AppData\Local\Temp\AppLauncher.exe
C:\Users\Dörte_2\AppData\Local\Temp\COMAP.EXE
C:\Users\Dörte_2\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp5lnoxb.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-02-20 23:35
==================== End Of Log ============================
--- --- ---
--- --- ---
--- --- ---
--- --- ---
Und Addition: Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23-02-2015
Ran by Dörte at 2015-02-24 20:50:06
Running from C:\Users\Dörte\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Digital Editions 4.0 (HKLM-x32\...\Adobe Digital Editions 4.0) (Version: 4.0.2 - Adobe Systems Incorporated)
Ashampoo AppLauncher (Medion) v.1.0.0 (HKLM-x32\...\Ashampoo AppLauncher (Medion)_is1) (Version: 1.0.0 - Ashampoo GmbH & Co. KG)
CyberLink Home Cinema 10 (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)
CyberLink PowerDirector 11 (Version: 11.0.0.3714 - CyberLink Corp.) Hidden
CyberLink PowerRecover (HKLM-x32\...\InstallShield_{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}) (Version: 5.7.0.3019 - CyberLink Corp.)
CyberLink PowerRecover (Version: 5.7.0.3019 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DisplayLink Core Software (HKLM\...\{C2FE0D6B-1304-4E02-ACEE-C96E9F4AEECA}) (Version: 7.6.56275.0 - DisplayLink Corp.)
dm-Fotowelt (HKLM-x32\...\dm-Fotowelt) (Version: 5.1.7 - CEWE Stiftung u Co. KGaA)
Dolby Digital Plus Home Theater (HKLM\...\{7E3D8FA1-6092-469A-955B-68FC4A2C67CA}) (Version: 7.5.1.1 - Dolby Laboratories Inc)
File Opener Packages (HKU\S-1-5-21-1641478625-795509677-2549534948-1001\...\File Opener Packages) (Version: - ) <==== ATTENTION
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.115 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3366 - Intel Corporation)
Intel(R) Trusted Execution Engine (HKLM\...\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 1.0.0.1050 - Intel Corporation)
Intel(R) Virtual Buttons (HKLM-x32\...\1992736F-C90A-481C-B21B-EE34CAD07387) (Version: 1.0.0.14 - Intel Corporation)
Intel(R) Wireless Bluetooth(R)(patch version 17.0.1427.2) (HKLM\...\{302600C1-6BDF-4FD1-1406-148929CC1385}) (Version: 17.1.1406.0472 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{85b9d34f-7397-4e39-8600-07942ef6ca04}) (Version: 17.0.5 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{8ED07EBD-22AD-415A-B71E-C1AD86862C2E}) (Version: 15.0.1.415 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 15.0.1.415 - Kaspersky Lab) Hidden
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mobile Partner (HKLM-x32\...\Mobile Partner) (Version: 11.302.09.04.382 - Huawei Technologies Co.,Ltd)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 34.0.5 - Mozilla)
OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
PHotkey (HKLM-x32\...\{E50C224A-BBF2-428D-9DCF-DBF9DF85C40E}) (Version: 1.00.0102 - Pegatron Corporation)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9600.39053 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7188 - Realtek Semiconductor Corp.)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-1641478625-795509677-2549534948-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Dörte_2\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1641478625-795509677-2549534948-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Dörte_2\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1641478625-795509677-2549534948-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Dörte_2\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1641478625-795509677-2549534948-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Dörte_2\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1641478625-795509677-2549534948-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Dörte_2\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1641478625-795509677-2549534948-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Dörte_2\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1641478625-795509677-2549534948-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Dörte_2\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1641478625-795509677-2549534948-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Dörte_2\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1641478625-795509677-2549534948-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Dörte_2\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
==================== Restore Points =========================
20-02-2015 23:35:16 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {027413DA-EC93-46B3-9E03-0DE0943BF92D} - \Price Fountain No Task File <==== ATTENTION
Task: {1EED5A42-18B7-495F-B183-2FE7E7E760D3} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-02-12] (Microsoft Corporation)
Task: {3F57C09F-4F1C-46A9-916C-3C28C38B4D85} - System32\Tasks\Abelssoft\Updater scan_0 => C:\Program Files (x86)\CHIP Updater\CHIPUpdater.exe
Task: {4119D720-F6EB-4C61-9E6D-6CC2EF54006D} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-1641478625-795509677-2549534948-1002 => %localappdata%\Microsoft\SkyDrive\SkyDrive.exe
Task: {61E47474-B2C4-4C7C-83FA-BADB0166596A} - System32\Tasks\DolbySelectorTask => C:\Program Files\Dolby Digital Plus\ddp.exe [2013-09-09] (Dolby Laboratories Inc.)
Task: {6E928A4C-984F-4032-A38D-DDCCA7E1023B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-23] (Google Inc.)
Task: {7282B01B-BC8A-4AA1-BDA4-691202BDCB13} - System32\Tasks\Abelssoft\Updater scan => C:\Program Files (x86)\CHIP Updater\CHIPUpdater.exe
Task: {99BA9037-F68F-4B8B-B21F-4C8B74B80E54} - System32\Tasks\LaunchSignup => C:\Program Files (x86)\MyPC Backup\Signup Wizard.exe <==== ATTENTION
Task: {F9FBC7D9-82E5-4041-88C2-DCA22BB492B4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-23] (Google Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Price Fountain.job => C:\Users\DRTE~1\AppData\Roaming\PRICEF~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
==================== Loaded Modules (whitelisted) ==============
2014-08-08 12:15 - 2014-03-04 16:58 - 00136192 _____ () C:\Program Files (x86)\PHotkey\PGFNEXSrv.exe
2010-05-08 12:48 - 2010-05-08 12:48 - 00229376 _____ () C:\ProgramData\DatacardService\DCService.exe
2014-07-09 12:40 - 2013-03-06 14:42 - 00389896 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2014-08-08 12:15 - 2014-03-14 16:41 - 02219520 _____ () C:\Program Files (x86)\PHotkey\PHotkey.exe
2014-08-08 12:15 - 2010-01-12 17:36 - 00117256 _____ () C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
2014-08-08 12:15 - 2010-01-12 17:36 - 00121864 _____ () C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
2014-08-08 12:15 - 2010-12-17 14:04 - 00449032 _____ () C:\Program Files (x86)\PHotkey\ATouch64.exe
2014-08-08 12:15 - 2014-02-21 17:19 - 08857088 _____ () C:\Program Files (x86)\PHotkey\GPMTray.exe
2014-08-08 12:15 - 2014-03-31 17:47 - 03006464 _____ () C:\Program Files (x86)\PHotkey\KeyboardMonitorTool.exe
2013-09-09 13:13 - 2013-09-09 13:13 - 00050904 _____ () C:\Program Files\Dolby Digital Plus\Dolby.DDP.Controls_Desktop.dll
2014-08-08 12:15 - 2014-03-18 21:54 - 05644800 _____ () C:\Program Files (x86)\PHotkey\Dolbyosd.exe
2014-08-30 17:12 - 2014-08-30 17:12 - 01269952 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\kpcengine.2.3.dll
2014-08-08 12:15 - 2009-12-18 15:36 - 00973432 _____ () C:\Program Files (x86)\PHotkey\acAuth.dll
2014-08-08 12:15 - 2013-09-17 23:23 - 00108032 _____ () C:\Program Files (x86)\PHotkey\PGFNEX.dll
2014-07-09 12:39 - 2013-08-05 08:49 - 00627672 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2013-08-05 15:48 - 2013-08-05 15:48 - 00016856 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2015-01-10 19:15 - 2014-12-07 09:24 - 00641024 _____ () C:\Users\Dörte\AppData\Local\PriceFountain\prfo.dll
2015-02-20 23:08 - 2015-02-17 23:44 - 01117512 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\libglesv2.dll
2015-02-20 23:08 - 2015-02-17 23:44 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\libegl.dll
2015-02-20 23:08 - 2015-02-17 23:44 - 09171272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\pdf.dll
2015-02-20 23:08 - 2015-02-17 23:44 - 14965064 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\PepperFlash\pepflashplayer.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Users\Dörte\OneDrive:ms-properties
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1641478625-795509677-2549534948-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\MEDION\wallpaper.jpg
DNS Servers: 192.168.2.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== Accounts: =============================
Administrator (S-1-5-21-1641478625-795509677-2549534948-500 - Administrator - Disabled)
Dörte (S-1-5-21-1641478625-795509677-2549534948-1001 - Administrator - Enabled) => C:\Users\Dörte
Dörte_2 (S-1-5-21-1641478625-795509677-2549534948-1002 - Limited - Enabled) => C:\Users\Dörte_2
Gast (S-1-5-21-1641478625-795509677-2549534948-501 - Limited - Disabled)
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (02/23/2015 10:15:36 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Tabby)
Description: Bei der Aktivierung der App „Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe!App“ ist folgender Fehler aufgetreten: -2144927142. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (02/23/2015 10:15:36 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Solitaire.exe, Version 1.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: b4
Startzeit: 01d04fadce2be3d3
Endzeit: 4294967295
Anwendungspfad: C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_2.5.1411.701_x86__8wekyb3d8bbwe\Solitaire.exe
Berichts-ID: 162b1dc0-bba1-11e4-8294-ca8be3387a80
Vollständiger Name des fehlerhaften Pakets: Microsoft.MicrosoftSolitaireCollection_2.5.1411.701_x86__8wekyb3d8bbwe
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App
Error: (02/23/2015 10:15:26 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: Tabby)
Description: Die App „Microsoft.MicrosoftSolitaireCollection_2.5.1411.701_x86__8wekyb3d8bbwe+App“ wurde nicht innerhalb der vorgesehenen Zeit gestartet.
Error: (02/23/2015 09:34:39 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 40.0.2214.115, Zeitstempel: 0x54e3aecf
Name des fehlerhaften Moduls: chrome.dll, Version: 40.0.2214.115, Zeitstempel: 0x54e3aaab
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00003a23
ID des fehlerhaften Prozesses: 0xc2c
Startzeit der fehlerhaften Anwendung: 0xchrome.exe0
Pfad der fehlerhaften Anwendung: chrome.exe1
Pfad des fehlerhaften Moduls: chrome.exe2
Berichtskennung: chrome.exe3
Vollständiger Name des fehlerhaften Pakets: chrome.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: chrome.exe5
Error: (02/23/2015 09:33:35 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: delegate_execute.exe, Version: 40.0.2214.115, Zeitstempel: 0x54e3a9c8
Name des fehlerhaften Moduls: delegate_execute.exe, Version: 40.0.2214.115, Zeitstempel: 0x54e3a9c8
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002bdab
ID des fehlerhaften Prozesses: 0x233c
Startzeit der fehlerhaften Anwendung: 0xdelegate_execute.exe0
Pfad der fehlerhaften Anwendung: delegate_execute.exe1
Pfad des fehlerhaften Moduls: delegate_execute.exe2
Berichtskennung: delegate_execute.exe3
Vollständiger Name des fehlerhaften Pakets: delegate_execute.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: delegate_execute.exe5
Error: (02/21/2015 00:36:52 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Solitaire.exe, Version 1.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: ba8
Startzeit: 01d04dca9dad4afd
Endzeit: 4294967295
Anwendungspfad: C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_2.5.1411.701_x86__8wekyb3d8bbwe\Solitaire.exe
Berichts-ID: e5192815-b9bd-11e4-8294-ca8be3387a80
Vollständiger Name des fehlerhaften Pakets: Microsoft.MicrosoftSolitaireCollection_2.5.1411.701_x86__8wekyb3d8bbwe
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App
Error: (02/21/2015 00:36:37 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: Tabby)
Description: Die App „Microsoft.MicrosoftSolitaireCollection_2.5.1411.701_x86__8wekyb3d8bbwe+App“ wurde nicht innerhalb der vorgesehenen Zeit gestartet.
Error: (02/20/2015 11:59:02 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: delegate_execute.exe, Version: 40.0.2214.115, Zeitstempel: 0x54e3a9c8
Name des fehlerhaften Moduls: delegate_execute.exe, Version: 40.0.2214.115, Zeitstempel: 0x54e3a9c8
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002bdab
ID des fehlerhaften Prozesses: 0x150c
Startzeit der fehlerhaften Anwendung: 0xdelegate_execute.exe0
Pfad der fehlerhaften Anwendung: delegate_execute.exe1
Pfad des fehlerhaften Moduls: delegate_execute.exe2
Berichtskennung: delegate_execute.exe3
Vollständiger Name des fehlerhaften Pakets: delegate_execute.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: delegate_execute.exe5
Error: (02/20/2015 11:08:52 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: delegate_execute.exe, Version: 40.0.2214.115, Zeitstempel: 0x54e3a9c8
Name des fehlerhaften Moduls: delegate_execute.exe, Version: 40.0.2214.115, Zeitstempel: 0x54e3a9c8
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002bdab
ID des fehlerhaften Prozesses: 0xa1c
Startzeit der fehlerhaften Anwendung: 0xdelegate_execute.exe0
Pfad der fehlerhaften Anwendung: delegate_execute.exe1
Pfad des fehlerhaften Moduls: delegate_execute.exe2
Berichtskennung: delegate_execute.exe3
Vollständiger Name des fehlerhaften Pakets: delegate_execute.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: delegate_execute.exe5
Error: (02/20/2015 11:04:11 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: delegate_execute.exe, Version: 40.0.2214.111, Zeitstempel: 0x54d1c63a
Name des fehlerhaften Moduls: delegate_execute.exe, Version: 40.0.2214.111, Zeitstempel: 0x54d1c63a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002c546
ID des fehlerhaften Prozesses: 0x1470
Startzeit der fehlerhaften Anwendung: 0xdelegate_execute.exe0
Pfad der fehlerhaften Anwendung: delegate_execute.exe1
Pfad des fehlerhaften Moduls: delegate_execute.exe2
Berichtskennung: delegate_execute.exe3
Vollständiger Name des fehlerhaften Pakets: delegate_execute.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: delegate_execute.exe5
System errors:
=============
Error: (02/24/2015 08:40:55 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (02/24/2015 08:40:52 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 23.02.2015 um 22:17:15 unerwartet heruntergefahren.
Error: (02/20/2015 11:16:09 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (02/20/2015 11:16:07 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 20.02.2015 um 23:03:36 unerwartet heruntergefahren.
Error: (02/20/2015 00:58:02 AM) (Source: DCOM) (EventID: 10016) (User: Tabby)
Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}TabbyDörte_2S-1-5-21-1641478625-795509677-2549534948-1002LocalHost (unter Verwendung von LRPC)Microsoft.MicrosoftSolitaireCollection_2.5.1411.701_x86__8wekyb3d8bbweS-1-15-2-1985198343-3186790915-4047221937-1969271670-3792558349-1325541827-400269725
Error: (02/20/2015 00:58:02 AM) (Source: DCOM) (EventID: 10016) (User: Tabby)
Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}TabbyDörte_2S-1-5-21-1641478625-795509677-2549534948-1002LocalHost (unter Verwendung von LRPC)Microsoft.MicrosoftSolitaireCollection_2.5.1411.701_x86__8wekyb3d8bbweS-1-15-2-1985198343-3186790915-4047221937-1969271670-3792558349-1325541827-400269725
Error: (02/14/2015 11:56:42 PM) (Source: DCOM) (EventID: 10010) (User: Tabby)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (02/14/2015 11:35:48 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (02/13/2015 00:01:59 AM) (Source: DCOM) (EventID: 10010) (User: Tabby)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (02/12/2015 11:55:25 PM) (Source: DCOM) (EventID: 10010) (User: Tabby)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Microsoft Office Sessions:
=========================
==================== Memory info ===========================
Processor: Intel(R) Pentium(R) CPU N3540 @ 2.16GHz
Percentage of memory in use: 43%
Total physical RAM: 3986.59 MB
Available physical RAM: 2239.52 MB
Total Pagefile: 4882.59 MB
Available Pagefile: 2922.8 MB
Total Virtual: 131072 MB
Available Virtual: 131071.85 MB
==================== Drives ================================
Drive c: (Boot) (Fixed) (Total:56.53 GB) (Free:9.19 GB) NTFS
Drive e: (Data) (Fixed) (Total:405.76 GB) (Free:387.59 GB) NTFS
Drive f: (Recover) (Fixed) (Total:60 GB) (Free:45.3 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: C726855F)
Partition 1: (Not Active) - (Size=405.8 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=60 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (Size: 58.3 GB) (Disk ID: C1DA9865)
Partition: GPT Partition Type.
==================== End Of Log ============================
Ich mach dann mal mit dem Befolgen der weiteren Anweisungen weiter, solange das Notebook auf Tasten, Maus und Touchscreen reagiert und keine Fenster wild aufpoppen.
Hier ist die mbam.txt: Code:
Malwarebytes Anti-Malware
www.malwarebytes.org
Suchlauf Datum: 24.02.2015
Suchlauf-Zeit: 21:07:54
Logdatei: mbam.txt
Administrator: Ja
Version: 2.00.4.1028
Malware Datenbank: v2015.02.24.06
Rootkit Datenbank: v2015.02.22.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Selbstschutz: Deaktiviert
Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Dörte
Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 382462
Verstrichene Zeit: 16 Min, 53 Sek
Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert
Prozesse: 2
PUP.Optional.PriceFountain.A, C:\Users\Dörte\AppData\Local\PriceFountain\pricefountain.exe, 5452, Löschen bei Neustart, [5bebcd55cdbdd95d7681008161a28977]
PUP.Optional.PriceFountain.A, C:\Users\Dörte\AppData\Local\PriceFountain\pricefountainw.exe, 3552, Löschen bei Neustart, [5bebcd55cdbdd95d7681008161a28977]
Module: 1
PUP.Optional.PriceFountain.A, C:\Users\Dörte\AppData\Local\PriceFountain\prfo.dll, Löschen bei Neustart, [5bebcd55cdbdd95d7681008161a28977],
Registrierungsschlüssel: 19
PUP.Optional.PriceFountain.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{b608cc98-54de-4775-96c9-097de398500c}, In Quarantäne, [cc7a849ec0cae452f8510f3fca3915eb],
PUP.Optional.PriceFountain.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{B608CC98-54DE-4775-96C9-097DE398500C}, In Quarantäne, [cc7a849ec0cae452f8510f3fca3915eb],
PUP.Optional.PriceFountain.A, HKU\S-1-5-21-1641478625-795509677-2549534948-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{B608CC98-54DE-4775-96C9-097DE398500C}, In Quarantäne, [cc7a849ec0cae452f8510f3fca3915eb],
PUP.Optional.PriceFountain.A, HKU\S-1-5-21-1641478625-795509677-2549534948-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{B608CC98-54DE-4775-96C9-097DE398500C}, In Quarantäne, [cc7a849ec0cae452f8510f3fca3915eb],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, In Quarantäne, [1036a87a64265dd98b5b5cb816edf907],
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, In Quarantäne, [73d30d15e8a255e18bdc16f02fd60ef2],
PUP.Optional.GamesDesktop.A, HKLM\SOFTWARE\WOW6432NODE\GAMESDESKTOP, In Quarantäne, [1b2b4dd5dcae2b0b399d2f75729148b8],
PUP.Optional.IHProtect.A, HKLM\SOFTWARE\WOW6432NODE\IHProtect, In Quarantäne, [9fa74fd32268ce68eb9f960a3fc4946c],
PUP.Optional.ISearch.A, HKLM\SOFTWARE\WOW6432NODE\omiga-plusSoftware, In Quarantäne, [ed5938ea9feb0630a4162ee4ca3be41c],
PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, In Quarantäne, [4402a47edeac43f3b8affb0b3acb36ca],
PUP.Optional.Booster.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{1146AC44-2F03-4431-B4FD-889BC837521F}{d924d8dc}, In Quarantäne, [5cea210197f38da9bd82b60bb64d48b8],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPTAB, In Quarantäne, [182e7ba74149cc6af458f0c649bad32d],
PUP.Optional.Tuto4Pc.A, HKLM\SOFTWARE\WOW6432NODE\TUTORIALS, In Quarantäne, [1e2867bb1e6c74c263df70b7d233629e],
PUP.Optional.StormWatchApp.A, HKU\S-1-5-21-1641478625-795509677-2549534948-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\StormWatchApp, In Quarantäne, [d76f59c9e0aa8fa70dc1a408dd26649c],
PUP.Optional.Tuto4PC.A, HKU\S-1-5-21-1641478625-795509677-2549534948-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\TutoTag, In Quarantäne, [6ed862c0f4963afc820f5ac39174f907],
PUP.Optional.InstallCore.A, HKU\S-1-5-21-1641478625-795509677-2549534948-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, In Quarantäne, [271fcc56ef9bdf5721dc2db74cb754ac],
PUP.Optional.InstallCore.A, HKU\S-1-5-21-1641478625-795509677-2549534948-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, In Quarantäne, [a3a3061c820859dd1fbf1bdfbd479d63],
PUP.Optional.Qone8, HKU\S-1-5-21-1641478625-795509677-2549534948-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, In Quarantäne, [e165061c1f6bd56106609c6a5aab758b],
PUP.Optional.StormWatchApp.A, HKU\S-1-5-21-1641478625-795509677-2549534948-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\StormWatchApp, In Quarantäne, [ed597da5c5c5e155ece23379758e8f71],
Registrierungswerte: 5
PUP.Optional.GamesDesktop.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|gmsd_de_115, In Quarantäne, [4df9a47eef9be551fc4fd3d201024cb4],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPTAB|ptid, tugs, In Quarantäne, [182e7ba74149cc6af458f0c649bad32d]
PUP.Optional.Tuto4Pc.A, HKLM\SOFTWARE\WOW6432NODE\TUTORIALS|HostGUID, AE4EBACB-B44C-48EB-A42A-74961439D7FF, In Quarantäne, [1e2867bb1e6c74c263df70b7d233629e]
PUP.Optional.InstallCore.A, HKU\S-1-5-21-1641478625-795509677-2549534948-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 1W2Z1U1P1Jzr1O1B1U1C1M, In Quarantäne, [a3a3061c820859dd1fbf1bdfbd479d63]
PUP.Optional.PriceFountain.A, HKU\S-1-5-21-1641478625-795509677-2549534948-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|pricefountainw.exe, C:\Users\Dörte\AppData\Local\PriceFountain\pricefountainw.exe HKEY_CURRENT_USER Software\PriceFountain, In Quarantäne, [5bebcd55cdbdd95d7681008161a28977]
Registrierungsdaten: 14
PUP.Optional.OmigaPlus.A, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe hxxp://isearch.omiga-plus.com/?type=sc&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B, Gut: (iexplore.exe), Schlecht: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://isearch.omiga-plus.com/?type=sc&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B),Ersetzt,[67dfcf53b4d62313f0d2b11f1ce99c64]
PUP.Optional.OmigaPlus.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B&q={searchTerms}),Ersetzt,[ad991a084842d2647d49e1efdb2a38c8]
PUP.Optional.OmigaPlus.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://isearch.omiga-plus.com/?type=hp&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B, Gut: (www.google.com), Schlecht: (hxxp://isearch.omiga-plus.com/?type=hp&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B),Ersetzt,[02448d95701aea4c6e576868a65fbb45]
PUP.Optional.OmigaPlus.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://isearch.omiga-plus.com/?type=hp&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B, Gut: (www.google.com), Schlecht: (hxxp://isearch.omiga-plus.com/?type=hp&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B),Ersetzt,[85c10c16494150e68542844c19ec9a66]
PUP.Optional.OmigaPlus.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B&q={searchTerms}),Ersetzt,[d6708e948cfe36008d3d26aafd087987]
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[a99d1b079befcf671ed78b4334d1f10f]
PUP.Optional.OmigaPlus.A, HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe hxxp://isearch.omiga-plus.com/?type=sc&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B, Gut: (iexplore.exe), Schlecht: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://isearch.omiga-plus.com/?type=sc&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B),Ersetzt,[4600fb27b1d9b97d388ae3eded18bc44]
PUP.Optional.OmigaPlus.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B&q={searchTerms}),Ersetzt,[cf77bf6392f874c2f5d1dcf433d20bf5]
PUP.Optional.OmigaPlus.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://isearch.omiga-plus.com/?type=hp&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B, Gut: (www.google.com), Schlecht: (hxxp://isearch.omiga-plus.com/?type=hp&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B),Ersetzt,[3b0b73af13770f27863fb31dd62ffa06]
PUP.Optional.OmigaPlus.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://isearch.omiga-plus.com/?type=hp&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B, Gut: (www.google.com), Schlecht: (hxxp://isearch.omiga-plus.com/?type=hp&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B),Ersetzt,[9aac0e14a3e752e402c500d0c243738d]
PUP.Optional.OmigaPlus.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B&q={searchTerms}),Ersetzt,[8cba8f93ee9c87af29a1d8f83bca4bb5]
PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[f65065bd1476db5b738205c958ad8d73]
PUP.Optional.OmigaPlus.A, HKU\S-1-5-21-1641478625-795509677-2549534948-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://isearch.omiga-plus.com/?type=hp&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B, Gut: (www.google.com), Schlecht: (hxxp://isearch.omiga-plus.com/?type=hp&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B),Ersetzt,[da6c2101bbcff73fcff1d8f8dc290bf5]
PUP.Optional.OmigaPlus.A, HKU\S-1-5-21-1641478625-795509677-2549534948-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://isearch.omiga-plus.com/?type=hp&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B, Gut: (www.google.com), Schlecht: (hxxp://isearch.omiga-plus.com/?type=hp&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B),Ersetzt,[3115051df793a98df6c9a62afc095fa1]
Ordner: 12
PUP.Optional.StormWatch.A, C:\Users\Dörte_2\AppData\Local\StormWatch, In Quarantäne, [6dd99d858dfd6bcbe5d51b890300f010],
Rogue.Multiple, C:\ProgramData\2355320829, In Quarantäne, [75d126fcec9ec76f144e292535ce1be5],
PUP.Optional.PriceFountain.A, C:\Users\Dörte\AppData\Local\PriceFountain, Löschen bei Neustart, [5bebcd55cdbdd95d7681008161a28977],
PUP.Optional.PriceFountain.A, C:\Users\Dörte\AppData\Local\PriceFountain\logs, Löschen bei Neustart, [5bebcd55cdbdd95d7681008161a28977],
PUP.Optional.PriceFountain.A, C:\Users\Dörte\AppData\Local\PriceFountain\logs\col, In Quarantäne, [5bebcd55cdbdd95d7681008161a28977],
PUP.Optional.GamesDesktop.A, C:\Users\Dörte_2\AppData\Local\gmsd_de_115, In Quarantäne, [f84e45dd781238fe3fc6e1ac7291c63a],
PUP.Optional.GamesDesktop.A, C:\Users\Dörte_2\AppData\Local\gmsd_de_115\gmsd_de_115, In Quarantäne, [f84e45dd781238fe3fc6e1ac7291c63a],
PUP.Optional.GamesDesktop.A, C:\Users\Dörte_2\AppData\Local\gmsd_de_115\gmsd_de_115\1.20, In Quarantäne, [f84e45dd781238fe3fc6e1ac7291c63a],
PUP.Optional.FastPlayer.A, C:\Users\Dörte\AppData\Local\com\FastPlayer.exe_Url_ypw5ldaz5xtubzl3ykl5vaw3nmhswq1q, In Quarantäne, [341282a0f49676c0dc4bb4dde023d32d],
PUP.Optional.FastPlayer.A, C:\Users\Dörte\AppData\Local\com\FastPlayer.exe_Url_ypw5ldaz5xtubzl3ykl5vaw3nmhswq1q\1.0.0.5, In Quarantäne, [341282a0f49676c0dc4bb4dde023d32d],
PUP.Optional.IHProtectUpDate.A, C:\ProgramData\IHProtectUpDate, In Quarantäne, [4006cd55345672c4f7c0672a729114ec],
PUP.Optional.IHProtectUpDate.A, C:\ProgramData\IHProtectUpDate\update, In Quarantäne, [4006cd55345672c4f7c0672a729114ec],
Dateien: 34
PUP.Optional.PriceFountain.A, C:\Users\Dörte\AppData\Local\PriceFountain\PriceFountainIE.dll, In Quarantäne, [cc7a849ec0cae452f8510f3fca3915eb],
PUP.Optional.InstallCore, C:\Users\Dörte\AppData\Roaming\1H1Q1V1N1N1O1R\File Opener Packages\uninstaller.exe, In Quarantäne, [90b62002afdb52e4191ccf5f13efdd23],
PUP.Optional.FastPlayer.A, C:\Users\Dörte\AppData\Local\Temp\423bea7b-ca4d-42c4-bc33-5ccd98e4535a\fastplayersetup.exe, In Quarantäne, [c185dd458406a690593ee58133cd926e],
Trojan.Dropper.NS, C:\Users\Dörte\AppData\Local\Temp\is765589038\52614A36_stp.EXE, In Quarantäne, [e561a47e52386ec860b90bb2778e2ed2],
PUP.Optional.InstallCore, C:\Users\Dörte\AppData\Local\Temp\is765589038\5D4B7A38_stp\uninstaller.exe, In Quarantäne, [410547db4149112548ed2707e81a9967],
PUP.Optional.StormWatch.A, C:\Users\Dörte\AppData\Local\Temp\a32df3c0-26d6-4ca0-aa3b-a56d0d5058b5\setup.exe, In Quarantäne, [b393a67c4941f93d3c8d074ef010e41c],
PUP.Optional.Patsearch.A, C:\Windows\patsearch.bin, In Quarantäne, [0145fe247515989e9c1e930b60a3e21e],
PUP.Optional.WebInstr.A, C:\Windows\System32\drivers\Msft_Kernel_webinstrNHKT_01009.Wdf, In Quarantäne, [c58135edcbbfc3739749ffa0dd26c838],
PUP.Optional.StormWatch.A, C:\Users\Dörte_2\AppData\Local\StormWatch\StormWatchApp.dat, In Quarantäne, [6dd99d858dfd6bcbe5d51b890300f010],
PUP.Optional.OmigaPlus.A, C:\Users\Dörte\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_isearch.omiga-plus.com_0.localstorage, In Quarantäne, [5ee88b97e8a27bbbf8271d8906fdce32],
PUP.Optional.OmigaPlus.A, C:\Users\Dörte\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_isearch.omiga-plus.com_0.localstorage-journal, In Quarantäne, [ff4727fbd3b7d561e03f1294fc0727d9],
PUP.Optional.PriceFountain.A, C:\Windows\Tasks\Price Fountain.job, In Quarantäne, [cc7a53cff595af87d7b3485e689bcb35],
PUP.Optional.ReMarkable.A, C:\Users\Dörte\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.re-markable00.re-markable.net_0.localstorage, In Quarantäne, [271fc0626e1c290d1d5758c751b4cf31],
PUP.Optional.ReMarkable.A, C:\Users\Dörte\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.re-markable00.re-markable.net_0.localstorage-journal, In Quarantäne, [74d20d15850592a483f1160931d48878],
PUP.Optional.PriceFountain.A, C:\Users\Dörte\AppData\Local\PriceFountain\prfo.dll, Löschen bei Neustart, [5bebcd55cdbdd95d7681008161a28977],
PUP.Optional.PriceFountain.A, C:\Users\Dörte\AppData\Local\PriceFountain\pricefountain.exe, Löschen bei Neustart, [5bebcd55cdbdd95d7681008161a28977],
PUP.Optional.PriceFountain.A, C:\Users\Dörte\AppData\Local\PriceFountain\PriceFountainFirefox.xpi, In Quarantäne, [5bebcd55cdbdd95d7681008161a28977],
PUP.Optional.PriceFountain.A, C:\Users\Dörte\AppData\Local\PriceFountain\pricefountainw.exe, Löschen bei Neustart, [5bebcd55cdbdd95d7681008161a28977],
PUP.Optional.PriceFountain.A, C:\Users\Dörte\AppData\Local\PriceFountain\sfx.exe, In Quarantäne, [5bebcd55cdbdd95d7681008161a28977],
PUP.Optional.PriceFountain.A, C:\Users\Dörte\AppData\Local\PriceFountain\logs\dlllog.log, Löschen bei Neustart, [5bebcd55cdbdd95d7681008161a28977],
PUP.Optional.PriceFountain.A, C:\Users\Dörte\AppData\Local\PriceFountain\logs\installation.log, In Quarantäne, [5bebcd55cdbdd95d7681008161a28977],
PUP.Optional.PriceFountain.A, C:\Users\Dörte\AppData\Local\PriceFountain\logs\main.log, Löschen bei Neustart, [5bebcd55cdbdd95d7681008161a28977],
PUP.Optional.PriceFountain.A, C:\Users\Dörte\AppData\Local\PriceFountain\logs\wd.log, Löschen bei Neustart, [5bebcd55cdbdd95d7681008161a28977],
PUP.Optional.PriceFountain.A, C:\Users\Dörte\AppData\Local\PriceFountain\logs\col\dlllog.log, In Quarantäne, [5bebcd55cdbdd95d7681008161a28977],
PUP.Optional.PriceFountain.A, C:\Users\Dörte\AppData\Local\PriceFountain\logs\col\installation.log, In Quarantäne, [5bebcd55cdbdd95d7681008161a28977],
PUP.Optional.PriceFountain.A, C:\Users\Dörte\AppData\Local\PriceFountain\logs\col\main.log, In Quarantäne, [5bebcd55cdbdd95d7681008161a28977],
PUP.Optional.PriceFountain.A, C:\Users\Dörte\AppData\Local\PriceFountain\logs\col\PriceFountain_1.0.8.6_Logs_4874747053657373696f6e2e6370702837333429.zip, In Quarantäne, [5bebcd55cdbdd95d7681008161a28977],
PUP.Optional.PriceFountain.A, C:\Users\Dörte\AppData\Local\PriceFountain\logs\col\PriceFountain_1.0.8.6_Logs_646c6c496e6a4661696c.zip, In Quarantäne, [5bebcd55cdbdd95d7681008161a28977],
PUP.Optional.PriceFountain.A, C:\Users\Dörte\AppData\Local\PriceFountain\logs\col\PriceFountain_1.0.8.6_Logs_696e6a656374696f6e4661696c6564.zip, In Quarantäne, [5bebcd55cdbdd95d7681008161a28977],
PUP.Optional.PriceFountain.A, C:\Users\Dörte\AppData\Local\PriceFountain\logs\col\PriceFountain_1.0.8.6_Logs_696e6a656374696f6e4661696c65645045524d414e454e54.zip, In Quarantäne, [5bebcd55cdbdd95d7681008161a28977],
PUP.Optional.PriceFountain.A, C:\Users\Dörte\AppData\Local\PriceFountain\logs\col\wd.log, In Quarantäne, [5bebcd55cdbdd95d7681008161a28977],
PUP.Optional.GamesDesktop.A, C:\Users\Dörte_2\AppData\Local\gmsd_de_115\gmsd_de_115\1.20\cnf.cyl, In Quarantäne, [f84e45dd781238fe3fc6e1ac7291c63a],
PUP.Optional.FastPlayer.A, C:\Users\Dörte\AppData\Local\com\FastPlayer.exe_Url_ypw5ldaz5xtubzl3ykl5vaw3nmhswq1q\1.0.0.5\user.config, In Quarantäne, [341282a0f49676c0dc4bb4dde023d32d],
PUP.Optional.OmigaPlus.A, C:\Users\Dörte\AppData\Roaming\Mozilla\Firefox\Profiles\er81bz40.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "hxxp://isearch.omiga-plus.com/newtab/?type=nt&ts=1421691973&from=tugs&uid=3219913727_198264_D6AB162B");), Ersetzt,[d86e3de5fa903402238bda336b9b8d73]
Physische Sektoren: 0
(Keine schädliche Elemente erkannt)
(end)
Logdatei AdwCleaner: Code:
# AdwCleaner v4.111 - Bericht erstellt 24/02/2015 um 21:44:28
# Aktualisiert 18/02/2015 von Xplode
# Datenbank : 2015-02-18.3 [Server]
# Betriebssystem : Windows 8.1 (x64)
# Benutzername : Dörte - TABBY
# Gestarted von : C:\Users\Dörte\Desktop\AdwCleaner_4.111.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\4cf43eb200007443
Ordner Gelöscht : C:\Program Files (x86)\XTab
Ordner Gelöscht : C:\Users\Dörte\AppData\Local\PriceFountain
Ordner Gelöscht : C:\Users\Dörte\AppData\Roaming\1H1Q1V1N1N1O1R
Datei Gelöscht : C:\Users\Dörte\AppData\Roaming\Mozilla\Firefox\Profiles\er81bz40.default\Extensions\{b6a94784-0ffb-4121-88c6-435139067ee2}.xpi
Datei Gelöscht : C:\Users\Public\Desktop\eBay.lnk
Datei Gelöscht : C:\Users\Dörte\AppData\Roaming\Mozilla\Firefox\Profiles\er81bz40.default\user.js
Datei Gelöscht : C:\Users\Dörte_2\AppData\Roaming\Mozilla\Firefox\Profiles\292449nh.default\user.js
***** [ Geplante Tasks ] *****
Task Gelöscht : LaunchSignup
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0A6D4F05-2404-46E2-A546-992154CF925C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\Optimizer Pro
Schlüssel Gelöscht : HKCU\Software\PriceFountain
Schlüssel Gelöscht : HKCU\Software\Wnkey
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gelöscht : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Schlüssel Gelöscht : HKLM\SOFTWARE\SupDp
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\File Opener Packages
***** [ Internetbrowser ] *****
-\\ Internet Explorer v11.0.9600.17416
-\\ Mozilla Firefox v35.0.1 (x86 de)
[er81bz40.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.selectedEngine", "omiga-plus");
-\\ Google Chrome v40.0.2214.115
[C:\Users\Dörte\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://de.ask.com/web?q={searchTerms}
[C:\Users\Dörte_2\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://de.ask.com/web?q={searchTerms}
*************************
AdwCleaner[R0].txt - [3629 Bytes] - [24/02/2015 21:40:31]
AdwCleaner[S0].txt - [2866 Bytes] - [24/02/2015 21:44:28]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2925 Bytes] ##########
Und nun die jrt.txt: Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.2 (02.02.2015:1)
OS: Windows 8.1 x64
Ran by D”rte on 24.02.2015 at 21:54:08,62
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 24.02.2015 at 22:04:39,81
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
FRST 32-Bit | FRST 64-Bit
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
SecurityCheck und:
