| |
| |||||||
Log-Analyse und Auswertung: Advanced System Protector entfernen bei Windows 7Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
02.04.2014, 14:59
| #1 |
| |  Advanced System Protector entfernen bei Windows 7 Hallo, gestern habe ich leider durch einen Klick zuviel den Advanced System Protector runtergeladen. Eine Deinstallation über die Systemsteuerung funktioniert aber leider nicht (Win 7, 64 Bit); zwar hat mein Virenprogramm (avast) bei einer Schnellprüfung das Programm o.ä. nicht als Schädling erkannt (weil ich nur eine Schnellprüfung gemacht habe, gibts leider keinen Bericht), aber wenn man sich die ganzen Foren so durchschaut, scheint es ja recht übel zu sein. Die laut Checkliste benötigten Logfiles habe ich erstellt und unten alle außer GMER (da zu lang) eingefügt, aber alle auch noch mal inkl. GMER angehängt Hoffentlich kann mir jemand bei meinem Problem helfen?! Lg Melian Defogger: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 10:56 on 02/04/2014 (****)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by **** (administrator) on ****-HP on 02-04-2014 11:14:07
Running from C:\Users\****\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe
(McAfee, Inc.) c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
(AMD) C:\windows\system32\atiesrxx.exe
(IDT, Inc.) C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\STacSV64.exe
(AMD) C:\windows\system32\atieclxx.exe
(Hewlett-Packard Company) C:\windows\system32\Hpservice.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\windows\system32\WLANExt.exe
(ActivIdentity) C:\Program Files\Common Files\ActivIdentity\ac.sharedstore.exe
(ActivIdentity) C:\Program Files\ActivIdentity\ActivClient\acevents.exe
(DigitalPersona, Inc.) c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
(Andrea Electronics Corporation) C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\AESTSr64.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Hewlett-Packard Development Company, L.P) c:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe
(Hewlett-Packard Company) c:\Program Files\Hewlett-Packard\HP QuickLook\32-bit\HPDayStarterService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(McAfee, Inc.) c:\Program Files\Hewlett-Packard\Drive Encryption\SbHpAuthenticatorService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(DigitalPersona, Inc.) c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(ActivIdentity) C:\Program Files\ActivIdentity\ActivClient\acevents.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(ActivIdentity) C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(DigitalPersona, Inc.) c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\coreshredder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.0.313\SSScheduler.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winampa.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
(Adobe Systems) C:\Program Files (x86)\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Microsoft Corporation) C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
(Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
(Microsoft Corporation) C:\windows\splwow64.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [IAAnotif] - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2010-01-08] (Intel Corporation)
HKLM\...\Run: [HPPowerAssistant] - C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe [1691192 2010-04-05] (Hewlett-Packard)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2174760 2010-06-04] (Synaptics Incorporated)
HKLM\...\Run: [HPWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-04-05] (Hewlett-Packard)
HKLM\...\Run: [acevents] - C:\Program Files\ActivIdentity\ActivClient\acevents.exe [196648 2009-06-04] (ActivIdentity)
HKLM\...\Run: [] - [X]
HKLM\...\Run: [accrdsub] - C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe [483880 2009-06-04] (ActivIdentity)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [487424 2010-03-17] (IDT, Inc.)
HKLM\...\Run: [COMODO Internet Security] - C:\Program Files\COMODO\COMODO Internet Security\cfp.exe [9577680 2012-11-08] (COMODO)
HKLM-x32\...\Run: [QLBController] - C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe [256056 2010-03-01] (Hewlett-Packard Company)
HKLM-x32\...\Run: [File Sanitizer] - C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe [11266048 2010-01-19] (Hewlett-Packard)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-04-21] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [IMSS] - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [111640 2010-03-04] ()
HKLM-x32\...\Run: [NortonOnlineBackupReminder] - C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NOBuActivation.exe [3331944 2009-12-03] (Symantec Corporation)
HKLM-x32\...\Run: [WinampAgent] - C:\Program Files (x86)\Winamp\winampa.exe [74752 2011-03-22] (Nullsoft, Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeVersionCue] - C:\Program Files (x86)\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe [1732608 2004-03-25] (Adobe Systems)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [mobilegeni daemon] - C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3774312 2014-04-01] (AVAST Software)
HKLM-x32\...\Runonce: [removeSearchqudatamngr] - cmd.exe /c RD /S /Q "C:\Program Files (x86)\Windows Searchqu Toolbar" [X]
HKLM-x32\...\Runonce: [removeSearchqutoolbar] - cmd.exe /c RD /S /Q "C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\ToolBar" [X]
HKLM-x32\...\runonceex: [ContentMerger] - c:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\ContentMerger10.exe [19952 2009-11-23] (Sonic Solutions)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe,
Winlogon\Notify\DeviceNP-x32: DeviceNP.dll [X]
HKU\S-1-5-21-3883071668-826525904-3960972044-1002\...\Run: [HPAdvisorDock] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe [1712184 2010-02-10] ()
HKU\S-1-5-21-3883071668-826525904-3960972044-1002\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2010-02-22] (Hewlett-Packard Company)
HKU\S-1-5-21-3883071668-826525904-3960972044-1002\...\MountPoints2: {9fc2e364-6e07-11e2-b55b-6431508004c6} - H:\LaunchU3.exe -a
AppInit_DLLs: C:\windows\system32\guard64.dll => C:\windows\system32\guard64.dll [390392 2012-11-08] (COMODO)
AppInit_DLLs-x32: ,C:\PROGRA~2\Citrix\ICACLI~1\RSHook.dll => "C:\PROGRA~2\Citrix\ICACLI~1\RSHook.dll" File Not Found
AppInit_DLLs-x32: C:\windows\SysWOW64\guard32.dll => C:\windows\SysWOW64\guard32.dll [301264 2012-11-08] (COMODO)
Lsa: [Notification Packages] DPPassFilter scecli
Startup: C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lollipop.lnk
ShortcutTarget: lollipop.lnk -> C:\Users\****\AppData\Local\Lollipop\Lollipop.exe (No File)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.searchnu.com/410
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/10
URLSearchHook: HKLM-x32 - ZoneAlarm-Sicherheit Toolbar - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files (x86)\ZoneAlarm-Sicherheit\tbZone.dll No File
URLSearchHook: HKCU - ZoneAlarm-Sicherheit Toolbar - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files (x86)\ZoneAlarm-Sicherheit\tbZone.dll No File
SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=410&sr=0&q={searchTerms}
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=410&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=410&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=410&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2613550
SearchScopes: HKCU - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=410&sr=0&q={searchTerms}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&AF=119998&babsrc=SP_ss&mntrId=ecc6a129000000000000ac81122f2535
SearchScopes: HKCU - {313589CC-BE03-4CA1-94CB-0996CE686FE8} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=827316&p={searchTerms}
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=410&sr=0&q={searchTerms}
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2613550
SearchScopes: HKCU - {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://mystart.incredibar.com/mb123/?search={searchTerms}&loc=IB_DS&a=6R8kptMvih&i=26
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: HP ProtectTools Security Manager Extension - {395610AE-C624-4f58-B89E-23733EA00F9A} - c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpOtsPluginIe8.dll (DigitalPersona, Inc.)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO-x32: File Sanitizer for HP ProtectTools - {3134413B-49B4-425C-98A5-893C1F195601} - C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll (Hewlett-Packard)
BHO-x32: HP ProtectTools Security Manager Extension - {395610AE-C624-4f58-B89E-23733EA00F9A} - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpOtsPluginIe8.dll (DigitalPersona, Inc.)
BHO-x32: SwissAcademic.Citavi.Picker.IEPicker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll No File
BHO-x32: IMinent WebBooster (BHO) - {A09AB6EB-31B5-454C-97EC-9B294D92EE2A} - C:\Program Files (x86)\Iminent\Iminent.WebBooster.InternetExplorer.dll No File
BHO-x32: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
BHO-x32: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\Program Files (x86)\McAfee\SiteAdvisor Enterprise\McIEPlg.dll No File
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: ZoneAlarm-Sicherheit Toolbar - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files (x86)\ZoneAlarm-Sicherheit\tbZone.dll No File
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM - No Name - !{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor Enterprise\McIEPlg.dll No File
Toolbar: HKLM-x32 - ZoneAlarm-Sicherheit Toolbar - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files (x86)\ZoneAlarm-Sicherheit\tbZone.dll No File
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
Toolbar: HKLM-x32 - Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll No File
Toolbar: HKLM-x32 - No Name - !{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - No File
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - No File
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor Enterprise\McIEPlg.dll No File
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor Enterprise\McIEPlg.dll No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default
FF user.js: detected! => C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\user.js
FF DefaultSearchEngine: Google
FF SearchEngineOrder.1: Search Results
FF SelectedSearchEngine: Google
FF Homepage: https://www.google.de/search?q=imdb&ie=utf-8&oe=utf-8&aq=t&rls=net.gmx:de:official&client=firefox|hxxp://www.google.de/
FF Keyword.URL: hxxp://dts.search-results.com/sr?src=ffb&appid=0&systemid=410&sr=0&q=
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @checkpoint.com/FFApi - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll No File
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files (x86)\McAfee Security Scan\3.0.313\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101727.dll (Amazon.com, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll (Nullsoft, Inc.)
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\searchplugins\conduit.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\searchplugins\MyStart Search.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\searchplugins\Search_Results.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Yahoo! Toolbar - C:\Users\****l\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2014-03-27]
FF Extension: Ghostery - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\Extensions\firefox@ghostery.com.xpi [2014-01-22]
FF Extension: GMX MailCheck - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\Extensions\toolbar@gmx.net.xpi [2011-06-25]
FF HKLM-x32\...\Firefox\Extensions: [otis@digitalpersona.com] - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt\
FF Extension: No Name - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt\ []
FF HKLM-x32\...\Firefox\Extensions: [{B7082FAA-CB62-4872-9106-E42DD88EDE45}] - C:\Program Files (x86)\McAfee\SiteAdvisor Enterprise\
FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2011-08-25]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2011-06-01]
Chrome:
=======
CHR Extension: (Google Docs) - C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-16]
CHR Extension: (Google Drive) - C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-16]
CHR Extension: (YouTube) - C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-16]
CHR Extension: (Google-Suche) - C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-16]
CHR Extension: (Google Wallet) - C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-16]
CHR Extension: (Google Mail) - C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-16]
==================== Services (Whitelisted) =================
R2 ac.sharedstore; C:\Program Files\Common Files\ActivIdentity\ac.sharedstore.exe [277032 2009-06-04] (ActivIdentity)
S3 AdobeVersionCue; C:\Program Files (x86)\Adobe\Adobe Version Cue\service\VersionCue.exe [61440 2004-03-25] (Adobe Sytems)
R2 AESTFilters; C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\AESTSr64.exe [89600 2009-03-03] (Andrea Electronics Corporation)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-02-10] (AVAST Software)
R2 cmdagent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [2828408 2012-11-08] (COMODO)
R3 DEBridge; c:\Program Files\Hewlett-Packard\Drive Encryption\SbHpAuthenticatorService.exe [704512 2010-02-02] (McAfee, Inc.)
R2 DpHost; c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [462088 2010-03-31] (DigitalPersona, Inc.)
S3 FLCDLOCK; c:\Windows\SysWOW64\flcdlock.exe [362040 2009-12-07] (Hewlett-Packard Ltd)
R2 HP ProtectTools Service; c:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [36864 2010-03-17] (Hewlett-Packard Development Company, L.P)
R2 HpFkCryptService; c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [281192 2010-02-02] (McAfee, Inc.)
R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe [264248 2010-03-01] (Hewlett-Packard Company)
R2 STacSV; C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\STacSV64.exe [244736 2010-03-17] (IDT, Inc.)
S2 McAfee SiteAdvisor Enterprise Service; "C:\Program Files (x86)\McAfee\SiteAdvisor Enterprise\McSACore.exe" [X]
==================== Drivers (Whitelisted) ====================
R2 aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [78648 2014-02-10] (AVAST Software)
R1 aswRdr; C:\windows\system32\drivers\aswRdr2.sys [92544 2014-01-16] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-01-16] ()
R1 aswSnx; C:\windows\system32\drivers\aswSnx.sys [1038072 2014-02-10] (AVAST Software)
R1 aswSP; C:\windows\system32\drivers\aswSP.sys [421704 2014-02-10] (AVAST Software)
R3 aswStm; C:\windows\system32\drivers\aswStm.sys [80184 2014-02-10] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-12-19] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2014-01-16] ()
R1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [584056 2012-11-08] (COMODO)
R1 cmdHlp; C:\Windows\System32\DRIVERS\cmdhlp.sys [38144 2012-11-08] (COMODO)
S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv64.sys [40760 2009-10-21] (Hewlett-Packard Development Company L.P.)
R1 inspect; C:\Windows\System32\DRIVERS\inspect.sys [94288 2012-11-08] (COMODO)
R1 RsvLock; C:\Windows\System32\Drivers\RsvLock.sys [58184 2010-02-02] (McAfee, Inc.)
R1 RsvLock; C:\Windows\SysWow64\Drivers\RsvLock.sys [40088 2010-02-02] (McAfee, Inc.)
R0 SafeBoot; C:\Windows\System32\Drivers\SafeBoot.sys [56648 2010-02-02] ()
R0 SafeBoot; C:\Windows\SysWow64\Drivers\SafeBoot.sys [110520 2010-02-02] (McAfee, Inc.)
R0 SbAlg; C:\Windows\System32\Drivers\SbAlg.sys [60160 2009-06-04] (McAfee, Inc.)
R0 SbAlg; C:\Windows\SysWow64\Drivers\SbAlg.sys [51800 2010-02-02] (McAfee, Inc.)
R0 SbFsLock; C:\Windows\System32\Drivers\SbFsLock.sys [15688 2010-02-02] (McAfee, Inc.)
R0 SbFsLock; C:\Windows\SysWow64\Drivers\SbFsLock.sys [13256 2010-02-02] (McAfee, Inc.)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1803904 2010-01-19] ()
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-02 11:06 - 2014-04-02 11:13 - 00046028 _____ () C:\Users\****\Desktop\Addition.txt
2014-04-02 11:03 - 2014-04-02 11:14 - 00027604 _____ () C:\Users\****\Desktop\FRST.txt
2014-04-02 11:00 - 2014-04-02 11:14 - 00000000 ____D () C:\FRST
2014-04-02 10:54 - 2014-04-02 10:56 - 00000470 _____ () C:\Users\****\Desktop\defogger_disable.log
2014-04-02 10:54 - 2014-04-02 10:54 - 00000000 _____ () C:\Users\****\defogger_reenable
2014-04-02 04:41 - 2014-04-02 04:41 - 00906032 ____T () C:\Users\****\Desktop\troianer hilfe
2014-04-02 04:36 - 2014-04-02 04:36 - 00059918 _____ () C:\Users\****\Desktop\Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten - Trojaner-Board.htm
2014-04-02 04:36 - 2014-04-02 04:36 - 00000000 ____D () C:\Users\****\Desktop\Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten - Trojaner-Board-Dateien
2014-04-02 04:26 - 2014-04-02 04:26 - 00380416 _____ () C:\Users\****\Desktop\Gmer-19357.exe
2014-04-02 04:25 - 2014-04-02 04:25 - 02157056 _____ (Farbar) C:\Users\****\Desktop\FRST64.exe
2014-04-02 04:23 - 2014-04-02 04:24 - 00050477 _____ () C:\Users\****\Desktop\Defogger.exe
2014-04-02 03:43 - 2014-04-02 03:43 - 02107012 _____ () C:\Users\****\Desktop\Fundstellen_K-Pflanzen-LtCD final.ai
2014-04-02 03:32 - 2014-04-02 03:42 - 108877708 _____ () C:\Users\****\Desktop\Fundstellen_K-Pflanzen-LtCD final.tif
2014-04-02 01:06 - 2014-04-02 03:53 - 00003118 _____ () C:\windows\System32\Tasks\Advanced System Protector_startup
2014-04-02 00:44 - 2014-04-02 04:11 - 00000000 ____D () C:\Program Files (x86)\Advanced System Protector
2014-04-02 00:44 - 2014-04-02 00:44 - 00000000 ____D () C:\ProgramData\Systweak
2014-04-02 00:42 - 2012-07-25 12:03 - 00016896 _____ () C:\windows\system32\sasnative64.exe
2014-04-02 00:36 - 2014-04-02 00:36 - 00003314 _____ () C:\windows\System32\Tasks\Advanced System Protector
2014-04-02 00:29 - 2014-04-02 01:06 - 00000000 ____D () C:\Users\****\AppData\Roaming\systweak
2014-04-02 00:29 - 2014-01-03 13:16 - 00020312 _____ (Systweak Inc., (www.systweak.com)) C:\windows\system32\roboot64.exe
2014-04-02 00:21 - 2014-04-02 00:21 - 00000000 ____D () C:\ProgramData\HP
2014-04-01 01:44 - 2014-04-01 01:45 - 03875088 _____ (RadarSync Ltd ) C:\Users\****\Downloads\radarsyncrw2013.exe
2014-03-31 23:17 - 2014-04-01 01:52 - 00007974 _____ () C:\Users\****\Desktop\Vortrag Köln - Verknüpfung.lnk
2014-03-30 16:41 - 2014-03-30 16:41 - 00000000 ____D () C:\Users\****\Desktop\TEXT_29.03.14
2014-03-27 19:46 - 2014-03-27 19:46 - 03239936 _____ () C:\Users\****\Desktop\RGK_Zeitschriften.xls
2014-03-23 04:17 - 2014-03-31 22:00 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-03-23 00:39 - 2014-03-01 07:17 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-03-23 00:39 - 2014-03-01 07:16 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-03-23 00:39 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-03-23 00:39 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\windows\system32\iertutil(110).dll
2014-03-23 00:39 - 2014-03-01 06:51 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-03-23 00:39 - 2014-03-01 06:40 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-03-23 00:39 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-03-23 00:39 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-03-23 00:39 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2014-03-23 00:39 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-03-23 00:39 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil(116).dll
2014-03-23 00:39 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-03-23 00:39 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-03-23 00:39 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2014-03-23 00:39 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-03-23 00:39 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-03-23 00:39 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-03-23 00:39 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\windows\system32\urlmon(111).dll
2014-03-23 00:39 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2014-03-23 00:39 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon(117).dll
2014-03-23 00:39 - 2014-02-07 03:23 - 03156480 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2014-03-23 00:39 - 2014-01-29 04:32 - 00484864 _____ (Microsoft Corporation) C:\windows\system32\wer.dll
2014-03-23 00:39 - 2014-01-29 04:32 - 00484864 _____ (Microsoft Corporation) C:\windows\system32\wer(112).dll
2014-03-23 00:39 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\windows\SysWOW64\wer(118).dll
2014-03-23 00:39 - 2014-01-28 04:32 - 00228864 _____ (Microsoft Corporation) C:\windows\system32\wwansvc.dll
2014-03-23 00:38 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-03-23 00:38 - 2014-03-01 06:52 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-03-23 00:38 - 2014-03-01 06:42 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-03-23 00:38 - 2014-03-01 06:37 - 00574976 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2014-03-23 00:38 - 2014-03-01 06:33 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-03-23 00:38 - 2014-03-01 06:33 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-03-23 00:38 - 2014-03-01 06:32 - 00708608 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-03-23 00:38 - 2014-03-01 06:23 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2014-03-23 00:38 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-03-23 00:38 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-03-23 00:38 - 2014-03-01 06:02 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-03-23 00:38 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-03-23 00:38 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-03-23 00:38 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2014-03-23 00:38 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2014-03-23 00:38 - 2014-03-01 05:35 - 02041856 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-03-23 00:38 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-03-23 00:38 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-03-23 00:38 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-03-23 00:38 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-03-23 00:38 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\windows\system32\wininet(115).dll
2014-03-23 00:38 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-03-23 00:38 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-03-23 00:38 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet(119).dll
2014-03-23 00:38 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-03-23 00:38 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2014-03-23 00:37 - 2014-02-04 04:32 - 00624128 _____ (Microsoft Corporation) C:\windows\system32\qedit.dll
2014-03-23 00:37 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\windows\SysWOW64\qedit.dll
2014-03-23 00:34 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs.dll
2014-03-23 00:34 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs(114).dll
2014-03-23 00:34 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\windows\SysWOW64\WindowsCodecs.dll
2014-03-22 16:21 - 2014-03-22 16:22 - 00000000 ____D () C:\Users\****\Desktop\friedrichshafen
2014-03-20 23:59 - 2014-03-31 21:56 - 00000000 ____D () C:\Users\****\Desktop\Diss_17_03_2013
2014-03-14 21:59 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\windows\SysWOW64\wer.dll
2014-03-11 03:51 - 2014-03-28 06:17 - 00000000 ____D () C:\Users\****\Desktop\TEXT_27.03.14
==================== One Month Modified Files and Folders =======
2014-04-02 11:14 - 2014-04-02 11:03 - 00027604 _____ () C:\Users\****\Desktop\FRST.txt
2014-04-02 11:14 - 2014-04-02 11:00 - 00000000 ____D () C:\FRST
2014-04-02 11:13 - 2014-04-02 11:06 - 00046028 _____ () C:\Users\****\Desktop\Addition.txt
2014-04-02 11:02 - 2010-09-12 22:06 - 00701576 _____ () C:\windows\system32\perfh007.dat
2014-04-02 11:02 - 2010-09-12 22:06 - 00150444 _____ () C:\windows\system32\perfc007.dat
2014-04-02 11:02 - 2009-07-14 07:13 - 01620684 _____ () C:\windows\system32\PerfStringBackup.INI
2014-04-02 11:01 - 2009-07-14 06:45 - 00020944 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-02 11:01 - 2009-07-14 06:45 - 00020944 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-02 11:00 - 2011-02-02 04:44 - 01665332 _____ () C:\windows\WindowsUpdate.log
2014-04-02 10:56 - 2014-04-02 10:54 - 00000470 _____ () C:\Users\****\Desktop\defogger_disable.log
2014-04-02 10:54 - 2014-04-02 10:54 - 00000000 _____ () C:\Users\****\defogger_reenable
2014-04-02 10:54 - 2011-02-17 14:54 - 00000000 ____D () C:\Users\****
2014-04-02 10:49 - 2011-11-17 01:20 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-02 10:48 - 2012-07-09 11:29 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-04-02 04:50 - 2013-02-15 02:27 - 00006585 _____ () C:\Users\****\Desktop\eigene Daten_Diss - Verknüpfung.lnk
2014-04-02 04:41 - 2014-04-02 04:41 - 00906032 ____T () C:\Users\****\Desktop\troianer hilfe
2014-04-02 04:36 - 2014-04-02 04:36 - 00059918 _____ () C:\Users\****\Desktop\Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten - Trojaner-Board.htm
2014-04-02 04:36 - 2014-04-02 04:36 - 00000000 ____D () C:\Users\****\Desktop\Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten - Trojaner-Board-Dateien
2014-04-02 04:26 - 2014-04-02 04:26 - 00380416 _____ () C:\Users\****\Desktop\Gmer-19357.exe
2014-04-02 04:25 - 2014-04-02 04:25 - 02157056 _____ (Farbar) C:\Users\****\Desktop\FRST64.exe
2014-04-02 04:24 - 2014-04-02 04:23 - 00050477 _____ () C:\Users\****\Desktop\Defogger.exe
2014-04-02 04:11 - 2014-04-02 00:44 - 00000000 ____D () C:\Program Files (x86)\Advanced System Protector
2014-04-02 03:53 - 2014-04-02 01:06 - 00003118 _____ () C:\windows\System32\Tasks\Advanced System Protector_startup
2014-04-02 03:50 - 2011-11-17 01:20 - 00001102 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-02 03:48 - 2010-09-12 22:05 - 00000000 ____D () C:\ProgramData\HPQLOG
2014-04-02 03:48 - 2009-07-14 07:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-04-02 03:48 - 2009-07-14 06:51 - 00133625 _____ () C:\windows\setupact.log
2014-04-02 03:45 - 2013-12-05 03:02 - 00112128 _____ () C:\Users\****\Desktop\Tanja **** Stundenabrechnung 2014.xls
2014-04-02 03:43 - 2014-04-02 03:43 - 02107012 _____ () C:\Users\****\Desktop\Fundstellen_K-Pflanzen-LtCD final.ai
2014-04-02 03:43 - 2011-05-29 23:19 - 00000000 ____D () C:\ProgramData\Adobe
2014-04-02 03:43 - 2011-02-17 18:32 - 00000000 ____D () C:\Users\****\AppData\Roaming\Adobe
2014-04-02 03:42 - 2014-04-02 03:32 - 108877708 _____ () C:\Users\****\Desktop\Fundstellen_K-Pflanzen-LtCD final.tif
2014-04-02 01:06 - 2014-04-02 00:29 - 00000000 ____D () C:\Users\****\AppData\Roaming\systweak
2014-04-02 00:44 - 2014-04-02 00:44 - 00000000 ____D () C:\ProgramData\Systweak
2014-04-02 00:36 - 2014-04-02 00:36 - 00003314 _____ () C:\windows\System32\Tasks\Advanced System Protector
2014-04-02 00:21 - 2014-04-02 00:21 - 00000000 ____D () C:\ProgramData\HP
2014-04-02 00:21 - 2009-07-27 18:14 - 00000000 ___HD () C:\SYSTEM.SAV
2014-04-01 23:42 - 2011-11-17 01:20 - 00004102 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-01 23:42 - 2011-11-17 01:20 - 00003850 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-04-01 23:28 - 2012-07-09 11:30 - 00004182 _____ () C:\windows\System32\Tasks\avast! Emergency Update
2014-04-01 23:28 - 2011-05-20 23:26 - 00000000 ____D () C:\Users\****\Documents\Tanja eigenes
2014-04-01 01:52 - 2014-03-31 23:17 - 00007974 _____ () C:\Users\****\Desktop\Vortrag Köln - Verknüpfung.lnk
2014-04-01 01:45 - 2014-04-01 01:44 - 03875088 _____ (RadarSync Ltd ) C:\Users\****\Downloads\radarsyncrw2013.exe
2014-03-31 22:01 - 2014-01-17 02:41 - 00000000 ____D () C:\Users\****\Desktop\Diss_16_01_2013
2014-03-31 22:01 - 2011-11-13 16:22 - 00000000 ____D () C:\windows\system32\Macromed
2014-03-31 22:01 - 2011-08-24 11:39 - 00000000 ____D () C:\Users\Administrator.****-HP
2014-03-31 22:01 - 2011-02-17 18:18 - 00000000 ____D () C:\Users\****\AppData\Roaming\Winamp
2014-03-31 22:00 - 2014-03-23 04:17 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-03-31 22:00 - 2012-12-03 00:31 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2014-03-31 22:00 - 2012-05-15 01:28 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-03-31 22:00 - 2012-05-15 01:28 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-03-31 22:00 - 2011-02-17 15:35 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-03-31 22:00 - 2011-02-02 04:56 - 00000000 ____D () C:\ProgramData\Skype
2014-03-31 21:59 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\registration
2014-03-31 21:56 - 2014-03-20 23:59 - 00000000 ____D () C:\Users\****\Desktop\Diss_17_03_2013
2014-03-31 03:06 - 2013-08-16 03:02 - 00000000 ____D () C:\windows\system32\MRT
2014-03-30 16:41 - 2014-03-30 16:41 - 00000000 ____D () C:\Users\****\Desktop\TEXT_29.03.14
2014-03-29 14:10 - 2009-07-14 07:38 - 00067584 ____S () C:\windows\bootstat(109).dat
2014-03-28 06:17 - 2014-03-11 03:51 - 00000000 ____D () C:\Users\****\Desktop\TEXT_27.03.14
2014-03-27 19:46 - 2014-03-27 19:46 - 03239936 _____ () C:\Users\****\Desktop\RGK_Zeitschriften.xls
2014-03-23 04:36 - 2009-07-14 06:45 - 00457784 _____ () C:\windows\system32\FNTCACHE.DAT
2014-03-23 04:11 - 2011-02-17 15:32 - 01598708 _____ () C:\windows\SysWOW64\PerfStringBackup.INI
2014-03-23 04:07 - 2011-02-17 19:12 - 90015360 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-03-23 01:05 - 2011-04-25 22:12 - 00003180 _____ () C:\windows\System32\Tasks\HPCeeScheduleFor****
2014-03-23 01:05 - 2011-04-25 22:12 - 00000328 _____ () C:\windows\Tasks\HPCeeScheduleFor****.job
2014-03-23 00:22 - 2012-07-09 11:29 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-03-23 00:22 - 2012-07-09 11:29 - 00003822 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2014-03-23 00:22 - 2011-05-27 15:37 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-23 00:07 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\L2Schemas
2014-03-22 16:22 - 2014-03-22 16:21 - 00000000 ____D () C:\Users\****\Desktop\friedrichshafen
2014-03-06 23:03 - 2011-10-10 23:58 - 00000000 ____D () C:\Users\****\Documents\Outlook-Dateien
2014-03-05 03:57 - 2014-03-02 20:08 - 00000000 ____D () C:\Users\****\Desktop\R_Jan_2014_2
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-02-22 20:49
==================== End Of Log ============================
Addition: [CODE] Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-03-2014 Ran by **** at 2014-04-02 11:14:51 Running from C:\Users\***\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: COMODO Defense+ (Enabled - Up to date) {FEEA52D5-051E-08DD-07EF-2F009097607D} AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736} FW: COMODO Firewall (Enabled) {7DB03214-694B-060B-1600-BD4715C36DBB} ==================== Installed Programs ====================== ActivClient x64 (HKLM\...\{86E45973-5352-439F-A115-2E8EE4D40140}) (Version: 6.2 - ActivIdentity) ActiveCheck component for HP Active Support Library (x32 Version: 3.0.0.3 - Hewlett-Packard) Hidden Adobe Creative Suite (HKLM-x32\...\{D52ECEBC-9B20-41A5-81C4-A62DE2367419}) (Version: 1.1.1 - Adobe Systems,Inc.) Adobe Flash Player 10 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 10.0.32.18 - Adobe Systems Incorporated) Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated) Adobe Reader X (10.1.9) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.9 - Adobe Systems Incorporated) Adobe SVG Viewer 3.0 (HKLM-x32\...\Adobe SVG Viewer) (Version: 3.0 - Adobe Systems, Inc.) Advanced System Protector (HKLM-x32\...\00212D92-C5D8-4ff4-AE50-B20F0F85C40A_Systweak_Ad~B9F029BF_is1) (Version: 2.1.1000.12594 - Systweak Software) <==== ATTENTION Amazon Kindle (HKCU\...\Amazon Kindle) (Version: - Amazon) Amazon MP3-Downloader 1.0.17 (HKLM-x32\...\Amazon MP3-Downloader) (Version: 1.0.17 - Amazon Services LLC) ATI Catalyst Install Manager (HKLM\...\{135B7CF6-E0A2-FD1D-9B4F-49F67140794B}) (Version: 3.0.750.0 - ATI Technologies, Inc.) Audiograbber 1.83 SE (HKLM-x32\...\Audiograbber) (Version: 1.83 SE - Audiograbber Deutschland) avast! Free Antivirus (HKLM-x32\...\avast) (Version: 9.0.2013 - Avast Software) Broadcom 2070 Bluetooth 2.1 + EDR (HKLM\...\{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}) (Version: 6.2.1.1100 - Broadcom Corporation) Broadcom 802.11 Wireless LAN Adapter (HKLM\...\Broadcom 802.11 Wireless LAN Adapter) (Version: 5.60.48.35 - Broadcom Corporation) calibre 64bit (HKLM\...\{D3CAAD6A-2A42-44A0-914D-94C22DBB4754}) (Version: 1.18.0 - Kovid Goyal) Canon MP280 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP280_series) (Version: - ) Canon MP550 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP550_series) (Version: - ) Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden Catalyst Control Center Core Implementation (x32 Version: 2010.0421.1244.20944 - ATI) Hidden Catalyst Control Center Graphics Full Existing (x32 Version: 2010.0421.1244.20944 - ATI) Hidden Catalyst Control Center Graphics Full New (x32 Version: 2010.0421.1244.20944 - ATI) Hidden Catalyst Control Center Graphics Light (x32 Version: 2010.0421.1244.20944 - ATI) Hidden Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0421.1244.20944 - ATI) Hidden Catalyst Control Center InstallProxy (x32 Version: 2010.0421.1244.20944 - ATI Technologies, Inc.) Hidden Catalyst Control Center Localization All (x32 Version: 2010.0421.1244.20944 - ATI) Hidden CCC Help Chinese Standard (x32 Version: 2010.0421.1243.20944 - ATI) Hidden CCC Help Chinese Traditional (x32 Version: 2010.0421.1243.20944 - ATI) Hidden CCC Help Czech (x32 Version: 2010.0421.1243.20944 - ATI) Hidden CCC Help Danish (x32 Version: 2010.0421.1243.20944 - ATI) Hidden CCC Help Dutch (x32 Version: 2010.0421.1243.20944 - ATI) Hidden CCC Help English (x32 Version: 2010.0421.1243.20944 - ATI) Hidden CCC Help Finnish (x32 Version: 2010.0421.1243.20944 - ATI) Hidden CCC Help French (x32 Version: 2010.0421.1243.20944 - ATI) Hidden CCC Help German (x32 Version: 2010.0421.1243.20944 - ATI) Hidden CCC Help Greek (x32 Version: 2010.0421.1243.20944 - ATI) Hidden CCC Help Hungarian (x32 Version: 2010.0421.1243.20944 - ATI) Hidden CCC Help Italian (x32 Version: 2010.0421.1243.20944 - ATI) Hidden CCC Help Japanese (x32 Version: 2010.0421.1243.20944 - ATI) Hidden CCC Help Korean (x32 Version: 2010.0421.1243.20944 - ATI) Hidden CCC Help Norwegian (x32 Version: 2010.0421.1243.20944 - ATI) Hidden CCC Help Polish (x32 Version: 2010.0421.1243.20944 - ATI) Hidden CCC Help Portuguese (x32 Version: 2010.0421.1243.20944 - ATI) Hidden CCC Help Russian (x32 Version: 2010.0421.1243.20944 - ATI) Hidden CCC Help Spanish (x32 Version: 2010.0421.1243.20944 - ATI) Hidden CCC Help Swedish (x32 Version: 2010.0421.1243.20944 - ATI) Hidden CCC Help Thai (x32 Version: 2010.0421.1243.20944 - ATI) Hidden CCC Help Turkish (x32 Version: 2010.0421.1243.20944 - ATI) Hidden ccc-core-static (x32 Version: 2010.0421.1244.20944 - ATI) Hidden ccc-utility64 (Version: 2010.0421.1244.20944 - ATI) Hidden Cisco AnyConnect VPN Client (HKLM-x32\...\{44257960-C5CC-45BA-8E83-524E4A0F3FD5}) (Version: 2.5.3054 - Cisco Systems, Inc.) Citavi (HKLM-x32\...\{E12C6653-1FF0-4686-ADB8-589C13AE761F}) (Version: 3.2.0.0 - Swiss Academic Software) COMODO Internet Security (HKLM\...\{FD8E178D-8B4E-42DA-B434-EFF270329B1C}) (Version: 5.4.57996.1354 - COMODO Security Solutions Inc.) Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{92C42EDD-6524-4577-B2EB-6C68C63B6D4A}) (Version: - Microsoft) Device Access Manager for HP ProtectTools (HKLM\...\{55B52830-024A-443E-AF61-61E1E71AFA1B}) (Version: 5.0.1.6 - Hewlett-Packard) DirectX 9 Runtime (x32 Version: 1.00.0000 - Sonic Solutions) Hidden Drive Encryption for HP ProtectTools (HKLM-x32\...\Drive Encryption) (Version: 5.0.6.0 - Hewlett-Packard) Drive Encryption for HP ProtectTools (Version: 5.0.6.0 - Hewlett-Packard) Hidden ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 15.0.13315 - Landesfinanzdirektion Thüringen) ElsterFormular-Upgrade (HKLM-x32\...\ElsterFormular für Privatanwender 12.2.2.6665p) (Version: 15.0.13315 - ) Energy Star Digital Logo (HKLM-x32\...\{BD1A34C9-4764-4F79-AE1F-112F8C89D3D4}) (Version: 1.0.1 - Hewlett-Packard) File Sanitizer For HP ProtectTools (HKLM-x32\...\{6D6ADF03-B257-4EA5-BBC1-1D145AF8D514}) (Version: 5.0.1.3 - Hewlett-Packard) Free M4a to MP3 Converter 6.2 (HKLM-x32\...\Free M4a to MP3 Converter_is1) (Version: - ManiacTools.com) Free Mp3 Wma Converter V 2.2 (HKLM-x32\...\Free Mp3 Wma Converter_is1) (Version: 2.2.0.0 - Koyote Soft) Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google) Google Update Helper (x32 Version: 1.3.23.9 - Google Inc.) Hidden HP 3D DriveGuard (HKLM\...\{299625B9-6C69-462C-9CEA-8E06D878B1C5}) (Version: 4.0.5.1 - Hewlett-Packard Company) HP Advisor (HKLM-x32\...\{40FB8D7C-6FF8-4AF2-BC8B-0B1DB32AF04B}) (Version: 3.4.10262.3295 - Hewlett-Packard) HP Customer Experience Enhancements (x32 Version: 6.0.1.4 - Hewlett-Packard) Hidden HP Documentation (HKLM-x32\...\{4054365C-8CD6-4F08-A2F9-44CADFD7A9D0}) (Version: 1.1.0.0 - Hewlett-Packard) HP ESU for Microsoft Windows 7 (HKLM-x32\...\{722A2876-B382-4AB5-8CC9-007FF5B28641}) (Version: 1.1.2.1 - Hewlett-Packard Company) HP HotKey Support (HKLM\...\{4BBA5224-C5B1-4B8C-AAA4-68DA6654B9C1}) (Version: 3.5.15.1 - Hewlett-Packard Company) HP Power Assistant (HKLM\...\{3C33FD2E-6B21-4CD3-B41A-A7331D467617}) (Version: 1.0.6.0 - Hewlett-Packard) HP Power Data (HKLM\...\{42DBA167-C25D-49CE-BBAF-DEC25E737DA8}) (Version: 1.0.21.158 - Hewlett-Packard) HP ProtectTools Security Manager (HKLM\...\HPProtectTools) (Version: 5.07.711 - Hewlett-Packard) HP ProtectTools Security Manager (Version: 5.07.711 - Hewlett-Packard) Hidden HP QuickLook (HKLM\...\{E6BEE2A9-04CF-42FF-B95B-BB70FAD2DC3E}) (Version: 3.3.1.4 - Hewlett-Packard Company) HP QuickWeb (HKLM-x32\...\{7861911B-4270-498A-8F7A-FCF0570F4877}) (Version: 1.0.1.62 - DeviceVM, Inc.) HP Setup (HKLM-x32\...\{96AC1B0B-02D1-4FAA-9C1E-C92ECA74921A}) (Version: 8.2.4130.3367 - Hewlett-Packard Company) HP SoftPaq Download Manager (HKLM-x32\...\{2DA697D7-FED3-4DE2-A174-92A2A12F9688}) (Version: 3.0.5.0 - Hewlett-Packard Company) HP Software Framework (HKLM-x32\...\{DA200FDD-DE3D-4958-8465-C4FBC869544B}) (Version: 3.5.20.1 - Hewlett-Packard Company) HP Software Setup (HKLM-x32\...\{04801E42-B1A6-4C52-9F3D-CADB5A050433}) (Version: 7.0.1.6 - Hewlett-Packard Company) HP Support Assistant (HKLM-x32\...\{08DB3902-2CE0-474D-BCE3-0177766CE9F1}) (Version: 5.1.10.7 - Hewlett-Packard Company) HP Web Camera (Version: 1.0.0 - Hewlett-Packard) Hidden HP Webcam (HKLM-x32\...\{1D61E881-43CD-447B-9E6B-D2C6138B2862}) (Version: 1.0.19.5 - Roxio) HP Webcam Driver (HKLM-x32\...\{399C37FB-08AF-493B-BFED-20FBD85EDF7F}) (Version: 5.8.50012.1 - Sonix) HP Wireless Assistant (HKLM\...\{EC720706-3F19-4B7F-BDDD-E31D9B3921D2}) (Version: 4.0.6.0 - Hewlett-Packard) HPAsset component for HP Active Support Library (x32 Version: 3.0.0.3 - Hewlett-Packard) Hidden IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6275.0 - IDT) Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation) Intel(R) Network Connections Drivers (HKLM\...\PROSet) (Version: 14.8 - Intel) Intel(R) Turbo Boost Technology Driver (HKLM-x32\...\{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}) (Version: 01.02.00.1002 - Intel Corporation) Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - Intel Corporation) Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.510 - Oracle) Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden Java Card Security for HP ProtectTools (HKLM\...\{F4477CC0-7293-414A-93BC-20EE897A80F0}) (Version: 5.0.4.1 - Hewlett-Packard) K-Lite Mega Codec Pack 9.7.5 (HKLM-x32\...\KLiteCodecPack_is1) (Version: 9.7.5 - ) LightScribe System Software (HKLM-x32\...\{6AFDE3BE-BC01-45A4-9D06-BBF5AD207313}) (Version: 1.18.12.1 - LightScribe) LSI HDA Modem (HKLM\...\LSI Soft Modem) (Version: 2.2.98 - LSI Corporation) McAfee Security Scan Plus (HKLM-x32\...\McAfee Security Scan) (Version: 3.0.313.1 - McAfee, Inc.) Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Professional 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation) Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation) Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation) Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (HKLM\...\{EE936C7A-EA40-31D5-9B65-8E3E089C3828}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Mozilla Firefox 27.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 27.0.1 (x86 de)) (Version: 27.0.1 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 12.0 - Mozilla) MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) Norton Online Backup (HKLM-x32\...\{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}) (Version: 2.0.0.34 - Symantec) ODBC (HKLM-x32\...\ODBC) (Version: - ) OptimizerPro1 (HKLM\...\OptimizerPro1) (Version: 1.0 - Premium) <==== ATTENTION Privacy Manager for HP ProtectTools (HKLM\...\{04255D34-6C6D-4F63-A218-EE8FD2D13AF0}) (Version: 5.10.796 - Hewlett-Packard) R for Windows 2.13.2 (HKLM\...\R for Windows 2.13.2_is1) (Version: 2.13.2 - R Development Core Team) RICOH Media Driver (HKLM-x32\...\{F5CC2EF8-20A4-4366-A681-3FE849E65809}) (Version: 2.14.00.05 - RICOH) Roxio Activation Module (x32 Version: 1.0 - Roxio) Hidden Roxio Creator Audio (x32 Version: 3.8.0 - Roxio) Hidden Roxio Creator Business (HKLM-x32\...\{537BF16E-7412-448C-95D8-846E85A1D817}) (Version: 10.3.56.20 - Roxio) Roxio Creator Business v10 (x32 Version: 3.8.0 - Roxio) Hidden Roxio Creator Copy (x32 Version: 3.8.0 - Roxio) Hidden Roxio Creator Data (x32 Version: 3.8.0 - Roxio) Hidden Roxio Creator Tools (x32 Version: 3.8.0 - Roxio) Hidden Roxio Express Labeler 3 (x32 Version: 3.2.2 - Roxio) Hidden Roxio MyDVD (x32 Version: 10.3.349 - Roxio) Hidden Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft) Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) Hidden Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.) Sonic CinePlayer Decoder Pack (x32 Version: 4.3.0 - Sonic Solutions) Hidden SSH Secure Shell (HKLM-x32\...\{74E2CD0C-D4A2-11D3-95A6-0000E86CFDE5}) (Version: - ) Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.24.0 - Synaptics Incorporated) Theft Recovery (HKLM-x32\...\InstallShield_{33C9F24B-1D92-4632-A915-81E3BB1D5D6B}) (Version: 5.1.0.21 - Hewlett-Packard) Theft Recovery (x32 Version: 5.1.0.21 - Hewlett-Packard) Hidden Tilia (HKLM-x32\...\{6FC35511-B32A-42C3-ABBC-8D87786F9256}) (Version: 1.7.16 - PahaSapa Software) TrueCrypt (HKLM-x32\...\TrueCrypt) (Version: 7.1a - TrueCrypt Foundation) Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version: - Microsoft) Update for Microsoft Filter Pack 2.0 (KB2837594) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{D3C85176-ACCC-4AF0-817D-1BC803303B74}) (Version: - Microsoft) Update for Microsoft Filter Pack 2.0 (KB2837594) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{D3C85176-ACCC-4AF0-817D-1BC803303B74}) (Version: - Microsoft) Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2494150) (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{3FCFD88F-4D13-4F38-8625-ABABEA7F61EA}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{C70D2038-A2C4-4A99-87DE-5272BB44F0CE}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2863818) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{83B1B530-7D9E-4C6A-907F-E979CEE9C295}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2878225) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{EFF5EBA3-40AD-4859-85E7-3C1CF4F297EB}) (Version: - Microsoft) Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft) Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft) Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version: - Microsoft) Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version: - Microsoft) Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{81812245-FC84-426A-BC02-6659C88CC7B2}) (Version: - Microsoft) Update for Microsoft PowerPoint 2010 (KB2775360) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{80F56E3F-1D47-4E45-B6E0-FEF4E919F4F9}) (Version: - Microsoft) Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft) Update for Microsoft Visio 2010 (KB2878227) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{5D357893-40BA-4323-86BA-D97C66CD72F4}) (Version: - Microsoft) Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{8C55AA83-54C2-4236-A622-78440A411DC5}) (Version: - Microsoft) Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{E78E2B68-8FD1-42EE-BB74-99A4D9E6222D}) (Version: - Microsoft) Validity Fingerprint Driver (HKLM\...\{DD966CEF-5EA9-4BA2-B210-490FEBC27EA7}) (Version: 4.0.15.0 - Validity Sensors, Inc.) VD64Inst (Version: 1.00.0000 - Roxio, Inc.) Hidden VLC media player 1.1.7 (HKLM-x32\...\VLC media player) (Version: 1.1.7 - VideoLAN) Winamp (HKLM-x32\...\Winamp) (Version: 5.61 - Nullsoft, Inc) Winamp Erkennungs-Plug-in (HKCU\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc) Windows 7 Default Setting (HKLM-x32\...\{5BF8E079-D6E2-4323-B794-75152371122A}) (Version: 1.0.1.6 - Hewlett-Packard Company) Windows Driver Package - Broadcom Bluetooth (07/30/2009 6.2.0.9405) (HKLM\...\6B6B5E96843E55CF5CF8C7E45FB457F1FE642FF1) (Version: 07/30/2009 6.2.0.9405 - Broadcom) Windows Driver Package - Broadcom Bluetooth (12/16/2009 6.2.0.9414) (HKLM\...\7E38E30BB92ED94B21CF062A7386554CBA991FEB) (Version: 12/16/2009 6.2.0.9414 - Broadcom) Windows Driver Package - Broadcom HIDClass (07/28/2009 6.2.0.9800) (HKLM\...\3BA80AB4C7E9F8497C115C844953A3D4BEB84D21) (Version: 07/28/2009 6.2.0.9800 - Broadcom) Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation) WinRAR 4.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.01.0 - win.rar GmbH) Yahoo! Detect (HKLM-x32\...\YTdetect) (Version: - ) ==================== Restore Points ========================= 23-03-2014 18:28:57 Windows-Sicherung 23-03-2014 18:38:00 Windows-Sicherung 29-03-2014 12:15:34 Windows Update 30-03-2014 16:54:58 Wiederherstellungsvorgang 30-03-2014 18:13:57 avast! antivirus system restore point 30-03-2014 18:19:25 Windows Update 30-03-2014 18:24:39 Windows-Sicherung 31-03-2014 01:00:17 Windows Update 31-03-2014 19:47:14 Wiederherstellungsvorgang 31-03-2014 21:05:35 avast! antivirus system restore point 31-03-2014 21:13:08 Windows Update 31-03-2014 21:15:50 Windows-Sicherung 01-04-2014 22:39:36 RegClean Pro Mi, Apr 02, 14 00:39 ==================== Hosts content: ========================== 2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {294F752F-2DE9-4CB8-8652-91ED25C7933C} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-02-10] (AVAST Software) Task: {421112A8-DCFB-42A2-BA12-C2F455FC8A51} - System32\Tasks\Advanced System Protector_startup => C:\Program Files (x86)\Advanced System Protector\AdvancedSystemProtector.exe [2014-02-28] (Systweak) <==== ATTENTION Task: {89A6869C-F8C8-43CB-9B34-3438B5B9B81F} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-23] (Adobe Systems Incorporated) Task: {B38113D7-5543-4A2F-91A6-7231B0A9DD21} - System32\Tasks\Advanced System Protector => C:\Program Files (x86)\RegClean Pro\SystweakASP.exe <==== ATTENTION Task: {B39E13FA-8E93-41C7-A3FD-1E39F6137481} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup Task: {C9D1798D-13BC-42AF-AB41-1829433976A9} - System32\Tasks\HPCeeScheduleFor**** => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-01-05] (Hewlett-Packard) Task: {E11FCD71-797B-4F4D-81BA-A79571222067} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-11-17] (Google Inc.) Task: {FC8CD364-3752-44C1-A744-B05A15EAF2CC} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-11-17] (Google Inc.) Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\windows\Tasks\HPCeeScheduleFor****.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe ==================== Loaded Modules (whitelisted) ============= 2010-04-20 17:10 - 2010-04-20 17:10 - 00100352 _____ () c:\Program Files\Hewlett-Packard\Pre-Boot Security for HP ProtectTools\BIOSDomainPlugin.dll 2009-12-30 00:19 - 2009-12-30 00:19 - 00173344 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll 2012-01-08 15:08 - 2011-05-28 23:05 - 00164864 _____ () C:\Program Files\WinRAR\rarext.dll 2010-04-05 20:15 - 2010-04-05 20:15 - 00052280 _____ () C:\Program Files\Hewlett-Packard\HP Power Assistant\HardwareAccess.dll 2010-04-05 20:15 - 2010-04-05 20:15 - 00267832 _____ () C:\Program Files\Hewlett-Packard\HP Power Assistant\HPCommon.XmlSerializers.dll 2010-04-05 20:15 - 2010-04-05 20:15 - 00055352 _____ () C:\Program Files\Hewlett-Packard\HP Power Assistant\Graphs.dll 2010-04-05 20:12 - 2010-04-05 20:12 - 00267832 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPCommon.XmlSerializers.dll 2010-04-13 02:59 - 2010-04-13 02:59 - 00098304 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll 2011-02-02 04:47 - 2011-02-02 04:47 - 00270336 _____ () C:\windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll 2010-04-05 20:11 - 2010-04-05 20:11 - 00030264 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_LogicLayer.dll 2010-04-05 20:12 - 2010-04-05 20:12 - 00052280 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HardwareAccess.dll 2014-04-01 23:29 - 2014-04-01 16:16 - 02189312 _____ () C:\Program Files\AVAST Software\Avast\defs\14040101\algo.dll 2010-02-22 20:19 - 2010-02-22 20:19 - 02121728 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll 2010-02-22 20:19 - 2010-02-22 20:19 - 07745536 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll 2010-02-22 20:19 - 2010-02-22 20:19 - 00135168 _____ () C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll 2014-01-16 00:46 - 2014-01-16 00:46 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll 2010-02-10 03:58 - 2010-02-10 03:58 - 00061440 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Pillars\PCAlerts\PCAlertsPillar.dll 2010-02-10 03:58 - 2010-02-10 03:58 - 00131072 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Pillars\ECenter\ECLibrary.dll 2010-02-10 03:58 - 2010-02-10 03:58 - 00040960 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingServer.dll 2010-02-10 03:58 - 2010-02-10 03:58 - 00005632 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingInterface.dll 2010-02-10 03:58 - 2010-02-10 03:58 - 00018944 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingMessages.dll 2010-02-10 03:58 - 2010-02-10 03:58 - 00036864 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingClients.dll 2010-02-10 03:58 - 2010-02-10 03:58 - 00028672 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.Logging.dll 2010-02-10 03:58 - 2010-02-10 03:58 - 00007680 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\RemotingClient.dll 2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\office14\Cultures\office.odf ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vsmon => ""="Service" ==================== Disabled items from MSCONFIG ============== ==================== Faulty Device Manager Devices ============= Name: Cisco AnyConnect VPN Virtual Miniport Adapter for Windows x64 Description: Cisco AnyConnect VPN Virtual Miniport Adapter for Windows x64 Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: Cisco Systems Service: vpnva Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. ==================== Event log errors: ========================= Application errors: ================== Error: (04/02/2014 10:57:38 AM) (Source: Application Hang) (User: ) Description: Programm FRST64.exe, Version 3.3.10.2 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 11d4 Startzeit: 01cf4e517f2470a9 Endzeit: 0 Anwendungspfad: C:\Users\****\Desktop\FRST64.exe Berichts-ID: d227f19f-ba44-11e3-a677-6431508004c6 Error: (04/02/2014 03:11:07 AM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 27.0.1.5156, Zeitstempel: 0x52fc0faa Name des fehlerhaften Moduls: datamngr.dll, Version: 1.0.0.1, Zeitstempel: 0x5043401e Ausnahmecode: 0xc0000005 Fehleroffset: 0x0008d13b ID des fehlerhaften Prozesses: 0xd54 Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0 Pfad der fehlerhaften Anwendung: firefox.exe1 Pfad des fehlerhaften Moduls: firefox.exe2 Berichtskennung: firefox.exe3 Error: (04/02/2014 01:20:14 AM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 27.0.1.5156, Zeitstempel: 0x52fc0faa Name des fehlerhaften Moduls: datamngr.dll, Version: 1.0.0.1, Zeitstempel: 0x5043401e Ausnahmecode: 0xc0000005 Fehleroffset: 0x0008d13b ID des fehlerhaften Prozesses: 0x12e0 Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0 Pfad der fehlerhaften Anwendung: firefox.exe1 Pfad des fehlerhaften Moduls: firefox.exe2 Berichtskennung: firefox.exe3 Error: (04/02/2014 00:41:27 AM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.16521, Zeitstempel: 0x53114399 Name des fehlerhaften Moduls: guard32.dll, Version: 5.12.59641.2599, Zeitstempel: 0x509ad88a Ausnahmecode: 0xc00000fd Fehleroffset: 0x0001d25f ID des fehlerhaften Prozesses: 0x594 Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0 Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1 Pfad des fehlerhaften Moduls: IEXPLORE.EXE2 Berichtskennung: IEXPLORE.EXE3 Error: (04/02/2014 00:23:19 AM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.16521, Zeitstempel: 0x53114399 Name des fehlerhaften Moduls: guard32.dll, Version: 5.12.59641.2599, Zeitstempel: 0x509ad88a Ausnahmecode: 0xc00000fd Fehleroffset: 0x0001d240 ID des fehlerhaften Prozesses: 0x1b80 Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0 Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1 Pfad des fehlerhaften Moduls: IEXPLORE.EXE2 Berichtskennung: IEXPLORE.EXE3 Error: (04/02/2014 00:20:34 AM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 27.0.1.5156, Zeitstempel: 0x52fc0faa Name des fehlerhaften Moduls: datamngr.dll, Version: 1.0.0.1, Zeitstempel: 0x5043401e Ausnahmecode: 0xc0000005 Fehleroffset: 0x0008d13b ID des fehlerhaften Prozesses: 0x1ac4 Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0 Pfad der fehlerhaften Anwendung: firefox.exe1 Pfad des fehlerhaften Moduls: firefox.exe2 Berichtskennung: firefox.exe3 Error: (04/01/2014 01:52:34 AM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.16521, Zeitstempel: 0x53114399 Name des fehlerhaften Moduls: guard32.dll, Version: 5.12.59641.2599, Zeitstempel: 0x509ad88a Ausnahmecode: 0xc00000fd Fehleroffset: 0x0001d240 ID des fehlerhaften Prozesses: 0x1238 Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0 Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1 Pfad des fehlerhaften Moduls: IEXPLORE.EXE2 Berichtskennung: IEXPLORE.EXE3 Error: (04/01/2014 01:52:34 AM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.16521, Zeitstempel: 0x53114399 Name des fehlerhaften Moduls: guard32.dll, Version: 5.12.59641.2599, Zeitstempel: 0x509ad88a Ausnahmecode: 0xc00000fd Fehleroffset: 0x0001d25f ID des fehlerhaften Prozesses: 0x1d4c Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0 Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1 Pfad des fehlerhaften Moduls: IEXPLORE.EXE2 Berichtskennung: IEXPLORE.EXE3 Error: (04/01/2014 01:52:34 AM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.16521, Zeitstempel: 0x53114399 Name des fehlerhaften Moduls: guard32.dll, Version: 5.12.59641.2599, Zeitstempel: 0x509ad88a Ausnahmecode: 0xc00000fd Fehleroffset: 0x0001d240 ID des fehlerhaften Prozesses: 0xc98 Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0 Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1 Pfad des fehlerhaften Moduls: IEXPLORE.EXE2 Berichtskennung: IEXPLORE.EXE3 Error: (04/01/2014 01:52:34 AM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.16521, Zeitstempel: 0x53114399 Name des fehlerhaften Moduls: guard32.dll, Version: 5.12.59641.2599, Zeitstempel: 0x509ad88a Ausnahmecode: 0xc00000fd Fehleroffset: 0x0001d240 ID des fehlerhaften Prozesses: 0x5c0 Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0 Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1 Pfad des fehlerhaften Moduls: IEXPLORE.EXE2 Berichtskennung: IEXPLORE.EXE3 System errors: ============= Error: (04/02/2014 03:48:27 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "McAfee SiteAdvisor Enterprise Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (04/02/2014 00:41:23 AM) (Source: DCOM) (User: ****-HP) Description: ComputerstandardLokalAktivierung{000C101C-0000-0000-C000-000000000046}{000C101C-0000-0000-C000-000000000046}****-HP****S-1-5-21-3883071668-826525904-3960972044-1002LocalHost (unter Verwendung von LRPC) Error: (04/02/2014 00:41:22 AM) (Source: DCOM) (User: ****-HP) Description: ComputerstandardLokalAktivierung{000C101C-0000-0000-C000-000000000046}{000C101C-0000-0000-C000-000000000046}****-HP****S-1-5-21-3883071668-826525904-3960972044-1002LocalHost (unter Verwendung von LRPC) Error: (04/02/2014 00:23:09 AM) (Source: DCOM) (User: ****-HP) Description: ComputerstandardLokalAktivierung{000C101C-0000-0000-C000-000000000046}{000C101C-0000-0000-C000-000000000046}****-HP****S-1-5-21-3883071668-826525904-3960972044-1002LocalHost (unter Verwendung von LRPC) Error: (04/02/2014 00:23:04 AM) (Source: DCOM) (User: ****-HP) Description: ComputerstandardLokalAktivierung{000C101C-0000-0000-C000-000000000046}{000C101C-0000-0000-C000-000000000046}****-HP****S-1-5-21-3883071668-826525904-3960972044-1002LocalHost (unter Verwendung von LRPC) Error: (04/01/2014 11:26:15 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "McAfee SiteAdvisor Enterprise Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (04/01/2014 01:48:56 AM) (Source: DCOM) (User: ****-HP) Description: ComputerstandardLokalAktivierung{000C101C-0000-0000-C000-000000000046}{000C101C-0000-0000-C000-000000000046}****-HP****S-1-5-21-3883071668-826525904-3960972044-1002LocalHost (unter Verwendung von LRPC) Error: (04/01/2014 01:48:51 AM) (Source: DCOM) (User: ****-HP) Description: ComputerstandardLokalAktivierung{000C101C-0000-0000-C000-000000000046}{000C101C-0000-0000-C000-000000000046}z****-HP****lS-1-5-21-3883071668-826525904-3960972044-1002LocalHost (unter Verwendung von LRPC) Error: (04/01/2014 01:45:32 AM) (Source: DCOM) (User: ****-HP) Description: ComputerstandardLokalAktivierung{000C101C-0000-0000-C000-000000000046}{000C101C-0000-0000-C000-000000000046}****-HP****S-1-5-21-3883071668-826525904-3960972044-1002LocalHost (unter Verwendung von LRPC) Error: (04/01/2014 01:45:31 AM) (Source: DCOM) (User: ****-HP) Description: ComputerstandardLokalAktivierung{000C101C-0000-0000-C000-000000000046}{000C101C-0000-0000-C000-000000000046}****-HP****S-1-5-21-3883071668-826525904-3960972044-1002LocalHost (unter Verwendung von LRPC) Microsoft Office Sessions: ========================= Error: (04/02/2014 10:57:38 AM) (Source: Application Hang)(User: ) Description: FRST64.exe3.3.10.211d401cf4e517f2470a90C:\Users\****\Desktop\FRST64.exed227f19f-ba44-11e3-a677-6431508004c6 Error: (04/02/2014 03:11:07 AM) (Source: Application Error)(User: ) Description: firefox.exe27.0.1.515652fc0faadatamngr.dll1.0.0.15043401ec00000050008d13bd5401cf4e00f65da917C:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\PROGRA~2\WIA6EB~1\Datamngr\datamngr.dllaae6f100-ba03-11e3-a208-6431508004c6 Error: (04/02/2014 01:20:14 AM) (Source: Application Error)(User: ) Description: firefox.exe27.0.1.515652fc0faadatamngr.dll1.0.0.15043401ec00000050008d13b12e001cf4df8e745032fC:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\PROGRA~2\WIA6EB~1\Datamngr\datamngr.dll2d19c4fd-b9f4-11e3-a208-6431508004c6 Error: (04/02/2014 00:41:27 AM) (Source: Application Error)(User: ) Description: IEXPLORE.EXE11.0.9600.1652153114399guard32.dll5.12.59641.2599509ad88ac00000fd0001d25f59401cf4dfb7ff13512C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\windows\SysWOW64\guard32.dllc262e1df-b9ee-11e3-a208-6431508004c6 Error: (04/02/2014 00:23:19 AM) (Source: Application Error)(User: ) Description: IEXPLORE.EXE11.0.9600.1652153114399guard32.dll5.12.59641.2599509ad88ac00000fd0001d2401b8001cf4df8eff46f80C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\windows\SysWOW64\guard32.dll39e25009-b9ec-11e3-a208-6431508004c6 Error: (04/02/2014 00:20:34 AM) (Source: Application Error)(User: ) Description: firefox.exe27.0.1.515652fc0faadatamngr.dll1.0.0.15043401ec00000050008d13b1ac401cf4df1b2a8fd5dC:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\PROGRA~2\WIA6EB~1\Datamngr\datamngr.dlld7ac434a-b9eb-11e3-a208-6431508004c6 Error: (04/01/2014 01:52:34 AM) (Source: Application Error)(User: ) Description: IEXPLORE.EXE11.0.9600.1652153114399guard32.dll5.12.59641.2599509ad88ac00000fd0001d240123801cf4d3b107a36a9C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\windows\SysWOW64\guard32.dll8788f5f3-b92f-11e3-88f5-6431508004c6 Error: (04/01/2014 01:52:34 AM) (Source: Application Error)(User: ) Description: IEXPLORE.EXE11.0.9600.1652153114399guard32.dll5.12.59641.2599509ad88ac00000fd0001d25f1d4c01cf4d3b3d4b9f52C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\windows\SysWOW64\guard32.dll87843333-b92f-11e3-88f5-6431508004c6 Error: (04/01/2014 01:52:34 AM) (Source: Application Error)(User: ) Description: IEXPLORE.EXE11.0.9600.1652153114399guard32.dll5.12.59641.2599509ad88ac00000fd0001d240c9801cf4d3a996bbc64C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\windows\SysWOW64\guard32.dll877d0f12-b92f-11e3-88f5-6431508004c6 Error: (04/01/2014 01:52:34 AM) (Source: Application Error)(User: ) Description: IEXPLORE.EXE11.0.9600.1652153114399guard32.dll5.12.59641.2599509ad88ac00000fd0001d2405c001cf4d3a83b32de4C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\windows\SysWOW64\guard32.dll877f7072-b92f-11e3-88f5-6431508004c6 CodeIntegrity Errors: =================================== Date: 2013-05-15 00:05:42.415 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\guard64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2011-07-11 17:44:39.790 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\guard64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2011-05-31 20:15:44.612 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2011-05-31 19:59:36.892 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2011-05-31 00:09:23.924 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2011-05-30 09:57:55.734 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2011-05-30 09:07:03.609 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2011-05-30 04:16:04.365 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2011-05-29 23:37:57.592 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2011-05-29 23:19:54.684 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. ==================== Memory info =========================== Percentage of memory in use: 51% Total physical RAM: 3951.43 MB Available physical RAM: 1898.4 MB Total Pagefile: 4237.61 MB Available Pagefile: 1684.05 MB Total Virtual: 8192 MB Available Virtual: 8191.82 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:448.47 GB) (Free:234.02 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Drive f: (HP_TOOLS) (Fixed) (Total:1.99 GB) (Free:1.48 GB) FAT32 ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 8C949010) Partition 1: (Not Active) - (Size=300 MB) - (Type=07 NTFS) Partition 2: (Active) - (Size=448 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=15 GB) - (Type=07 NTFS) Partition 4: (Not Active) - (Size=2 GB) - (Type=0C) ==================== End Of Log ============================ |
|
02.04.2014, 15:38
| #2 |
| /// TB-Ausbilder   | Advanced System Protector entfernen bei Windows 7 Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen. Bitte beachte folgende Hinweise:
Wir beginnen so: Schritt 1 Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Schritt 2 Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Schritt 3 Downloade Dir bitte  Malwarebytes Anti-Malware
Schritt 4 Bitte lade dir zoek.exe von hier: http://hijackthis.nl/smeenk/
Bitte poste mit deiner nächsten Antwort
__________________ |
|
02.04.2014, 20:25
| #3 |
| | Advanced System Protector entfernen bei Windows 7 Hallo Matthias,
__________________danke für Deine schnelle Antwort und Hilfestellung. Die Schritte habe ich wie beschrieben durchgeführt; anbei die Logfiles: AdwCleaner: Code:
ATTFilter # AdwCleaner v3.023 - Bericht erstellt am 02/04/2014 um 18:24:42
# Aktualisiert 01/04/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : **** - ****-HP
# Gestartet von : C:\Users\****\Desktop\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\boost_interprocess
Ordner Gelöscht : C:\ProgramData\Premium
Ordner Gelöscht : C:\ProgramData\Systweak
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced System Protector
Ordner Gelöscht : C:\Program Files (x86)\Advanced System Protector
Ordner Gelöscht : C:\Program Files (x86)\Conduit
Ordner Gelöscht : C:\Program Files (x86)\Iminent
Ordner Gelöscht : C:\Users\****\AppData\Local\Babylon
Ordner Gelöscht : C:\Users\****\AppData\Local\genienext
Ordner Gelöscht : C:\Users\****\AppData\Local\Mobogenie
Ordner Gelöscht : C:\Users\****\AppData\Local\TempDir
Ordner Gelöscht : C:\Users\****\AppData\LocalLow\BabylonToolbar
Ordner Gelöscht : C:\Users\****\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\****\AppData\LocalLow\Minibar
Ordner Gelöscht : C:\Users\****\AppData\LocalLow\searchquband
Ordner Gelöscht : C:\Users\****\AppData\LocalLow\ZoneAlarm-Sicherheit
Ordner Gelöscht : C:\Users\****\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\****\AppData\Roaming\Iminent
Ordner Gelöscht : C:\Users\****\AppData\Roaming\newnext.me
Ordner Gelöscht : C:\Users\****\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\****\Documents\Mobogenie
Ordner Gelöscht : C:\Users\Administrator.****-HP\AppData\LocalLow\pdfforge
Ordner Gelöscht : C:\Users\Administrator.****-HP\AppData\LocalLow\Search Settings
Ordner Gelöscht : C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\Conduit
Ordner Gelöscht : C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\ConduitCommon
Ordner Gelöscht : C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
Datei Gelöscht : C:\windows\System32\roboot64.exe
Datei Gelöscht : C:\Users\****\AppData\Local\Temp\searchqutoolbar-manifest.xml
Datei Gelöscht : C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\lollipop.lnk
Datei Gelöscht : C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lollipop.lnk
Datei Gelöscht : C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\searchplugins\Conduit.xml
Datei Gelöscht : C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\searchplugins\MyStart Search.xml
Datei Gelöscht : C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\searchplugins\Search_Results.xml
Datei Gelöscht : C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\user.js
Datei Gelöscht : C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage
Datei Gelöscht : C:\windows\System32\Tasks\Advanced System Protector
Datei Gelöscht : C:\windows\System32\Tasks\Advanced System Protector_startup
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKCU\Software\Classes\Applications\lollipop.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\Iminent.WebBooster.InternetExplorer.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IminentWebBooster.ActiveContentHandle.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IminentWebBooster.ActiveContentHandler
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IminentWebBooster.BrowserHelperObject
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IminentWebBooster.BrowserHelperObject.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IminentWebBooster.ScriptExtender
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IminentWebBooster.ScriptExtender.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IminentWebBooster.TinyUrlHandler
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IminentWebBooster.TinyUrlHandler.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Incredibar.IncredibarHlpr
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Incredibar.IncredibarHlpr.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\speedupmypc
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker-1_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker-1_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\incredibar_install_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\incredibar_install_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [mobilegeni daemon]
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@checkpoint.com/FFApi
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2613550
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_nitro-pdf-reader_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_nitro-pdf-reader_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{01994268-3C10-4044-A1EA-7A9C1B739A11}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{26C9BBE4-6D45-4AB6-A5B4-E068C9F5EF6D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5C176BA0-6FC0-4EBD-8ACF-24AC592506B6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{67C71B35-A416-4A54-BD1D-15965A4FE41C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D8F01233-2DE6-4EE7-8988-37263F00651B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FC2B76FC-2132-4D80-A9A3-1F5C6E49066B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DB082D2C-47A8-43A8-AD22-27BB96CCF1F9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ACA608DB-A210-4253-B799-3FD24E9A7BF5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C58D664A-3DBC-4925-AE74-0382007DF113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C776D7F4-BA85-4B75-AAFC-3A0A11FE6E36}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{A9CAF365-EA35-45DA-BD8B-2EFA09D374AC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FC2B76FC-2132-4D80-A9A3-1F5C6E49066B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FC2B76FC-2132-4D80-A9A3-1F5C6E49066B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{60EACC1A-33FA-443D-9846-17B28E2C9BDB}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FC2B76FC-2132-4D80-A9A3-1F5C6E49066B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DB082D2C-47A8-43A8-AD22-27BB96CCF1F9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2410}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2410}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{99079A25-328F-4BD4-BE04-00955ACAA0A7}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{FC2B76FC-2132-4D80-A9A3-1F5C6E49066B}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{FC2B76FC-2132-4D80-A9A3-1F5C6E49066B}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{FC2B76FC-2132-4D80-A9A3-1F5C6E49066B}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ACA608DB-A210-4253-B799-3FD24E9A7BF5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C58D664A-3DBC-4925-AE74-0382007DF113}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C776D7F4-BA85-4B75-AAFC-3A0A11FE6E36}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2410}
Schlüssel Gelöscht : HKCU\Software\DataMngr
Schlüssel Gelöscht : HKCU\Software\IM
Schlüssel Gelöscht : HKCU\Software\Iminent
Schlüssel Gelöscht : HKCU\Software\ImInstaller
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\lollipop
Schlüssel Gelöscht : HKCU\Software\Optimizer Pro
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\systweak
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Crossrider
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\searchqutoolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\ZoneAlarm-Sicherheit
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\DeviceVM
Schlüssel Gelöscht : HKLM\Software\Iminent
Schlüssel Gelöscht : HKLM\Software\nationzoomSoftware
Schlüssel Gelöscht : HKLM\Software\systweak
Schlüssel Gelöscht : HKLM\Software\Uniblue
Schlüssel Gelöscht : HKLM\Software\ZoneAlarm-Sicherheit
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\00212D92-C5D8-4ff4-AE50-B20F0F85C40A_Systweak_Ad~B9F029BF_is1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\DataMngr
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\DeviceVM
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\DomaIQ
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16521
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
-\\ Mozilla Firefox v27.0.1 (de)
[ Datei : C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\prefs.js ]
Zeile gelöscht : user_pref("CT2613550..clientLogIsEnabled", false);
Zeile gelöscht : user_pref("CT2613550..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asmx/ReportDiagnosticsEvent");
Zeile gelöscht : user_pref("CT2613550..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/RegisterToolbarUninstallation");
Zeile gelöscht : user_pref("CT2613550.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);
Zeile gelöscht : user_pref("CT2613550.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Zeile gelöscht : user_pref("CT2613550.CTID", "CT2613550");
Zeile gelöscht : user_pref("CT2613550.CurrentServerDate", "30-7-2012");
Zeile gelöscht : user_pref("CT2613550.DSInstall", true);
Zeile gelöscht : user_pref("CT2613550.DialogsAlignMode", "LTR");
Zeile gelöscht : user_pref("CT2613550.DialogsGetterLastCheckTime", "Sun Jul 29 2012 22:50:15 GMT+0200");
Zeile gelöscht : user_pref("CT2613550.DownloadReferralCookieData", "");
Zeile gelöscht : user_pref("CT2613550.FirstServerDate", "25-4-2012");
Zeile gelöscht : user_pref("CT2613550.FirstTime", true);
Zeile gelöscht : user_pref("CT2613550.FirstTimeFF3", true);
Zeile gelöscht : user_pref("CT2613550.FirstTimeHiddenVer", true);
Zeile gelöscht : user_pref("CT2613550.FirstTimeSettingsDone", true);
Zeile gelöscht : user_pref("CT2613550.FixPageNotFoundErrors", true);
Zeile gelöscht : user_pref("CT2613550.GroupingServerCheckInterval", 1440);
Zeile gelöscht : user_pref("CT2613550.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Zeile gelöscht : user_pref("CT2613550.HPInstall", true);
Zeile gelöscht : user_pref("CT2613550.HasUserGlobalKeys", true);
Zeile gelöscht : user_pref("CT2613550.Initialize", true);
Zeile gelöscht : user_pref("CT2613550.InitializeCommonPrefs", true);
Zeile gelöscht : user_pref("CT2613550.InstallationAndCookieDataSentCount", 3);
Zeile gelöscht : user_pref("CT2613550.InstallationType", "Unknown");
Zeile gelöscht : user_pref("CT2613550.InstalledDate", "Wed Apr 25 2012 10:58:23 GMT+0200");
Zeile gelöscht : user_pref("CT2613550.IsGrouping", false);
Zeile gelöscht : user_pref("CT2613550.IsInitSetupIni", true);
Zeile gelöscht : user_pref("CT2613550.IsMulticommunity", false);
Zeile gelöscht : user_pref("CT2613550.IsOpenThankYouPage", true);
Zeile gelöscht : user_pref("CT2613550.IsOpenUninstallPage", true);
Zeile gelöscht : user_pref("CT2613550.LanguagePackLastCheckTime", "Mon Jul 30 2012 19:57:31 GMT+0200");
Zeile gelöscht : user_pref("CT2613550.LanguagePackReloadIntervalMM", 1440);
Zeile gelöscht : user_pref("CT2613550.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx");
Zeile gelöscht : user_pref("CT2613550.LastLogin_3.12.2.3", "Wed May 30 2012 21:19:23 GMT+0200");
Zeile gelöscht : user_pref("CT2613550.LastLogin_3.13.0.6", "Sun Jul 15 2012 22:49:51 GMT+0200");
Zeile gelöscht : user_pref("CT2613550.LastLogin_3.14.1.0", "Mon Jul 30 2012 19:57:31 GMT+0200");
Zeile gelöscht : user_pref("CT2613550.LatestVersion", "3.14.1.0");
Zeile gelöscht : user_pref("CT2613550.Locale", "de-de");
Zeile gelöscht : user_pref("CT2613550.MCDetectTooltipHeight", "83");
Zeile gelöscht : user_pref("CT2613550.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Zeile gelöscht : user_pref("CT2613550.MCDetectTooltipWidth", "295");
Zeile gelöscht : user_pref("CT2613550.MyStuffEnabledAtInstallation", true);
Zeile gelöscht : user_pref("CT2613550.OriginalFirstVersion", "3.12.2.3");
Zeile gelöscht : user_pref("CT2613550.SavedHomepage", "hxxp://www.gmx.de/");
Zeile gelöscht : user_pref("CT2613550.SearchCaption", "ZoneAlarm-Sicherheit Customized Web Search");
Zeile gelöscht : user_pref("CT2613550.SearchFromAddressBarIsInit", true);
Zeile gelöscht : user_pref("CT2613550.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2613550&SearchSource=2&q=");
Zeile gelöscht : user_pref("CT2613550.SearchInNewTabEnabled", true);
Zeile gelöscht : user_pref("CT2613550.SearchInNewTabIntervalMM", 1440);
Zeile gelöscht : user_pref("CT2613550.SearchInNewTabLastCheckTime", "Mon Jul 30 2012 19:57:30 GMT+0200");
Zeile gelöscht : user_pref("CT2613550.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_TOOLBAR_ID");
Zeile gelöscht : user_pref("CT2613550.SendProtectorDataViaLogin", true);
Zeile gelöscht : user_pref("CT2613550.ServiceMapLastCheckTime", "Mon Jul 30 2012 19:57:30 GMT+0200");
Zeile gelöscht : user_pref("CT2613550.SettingsLastCheckTime", "Mon Jul 30 2012 19:57:30 GMT+0200");
Zeile gelöscht : user_pref("CT2613550.SettingsLastUpdate", "1342352981");
Zeile gelöscht : user_pref("CT2613550.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT2613550&SearchSource=13");
Zeile gelöscht : user_pref("CT2613550.ThirdPartyComponentsLastCheck", "Mon Feb 21 2011 20:41:36 GMT+0100");
Zeile gelöscht : user_pref("CT2613550.ToolbarShrinkedFromSetup", false);
Zeile gelöscht : user_pref("CT2613550.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2613550");
Zeile gelöscht : user_pref("CT2613550.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,client.conduit-storage.com,OurToolbar.com,CommunityToolbars.com,ForumToolbar.com,MyBlogToolbar.com,MyCity[...]
Zeile gelöscht : user_pref("CT2613550.UserID", "UN89211938289962422");
Zeile gelöscht : user_pref("CT2613550.alertChannelId", "1006347");
Zeile gelöscht : user_pref("CT2613550.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.conduit.com;apps.conduit.com;services.apps.conduit.com\",\"AppsDetectionUrlPattern\":\"hxxp://appdown[...]
Zeile gelöscht : user_pref("CT2613550.homepageProtectorEnableByLogin", true);
Zeile gelöscht : user_pref("CT2613550.initDone", true);
Zeile gelöscht : user_pref("CT2613550.myStuffEnabled", true);
Zeile gelöscht : user_pref("CT2613550.myStuffPublihserMinWidth", 400);
Zeile gelöscht : user_pref("CT2613550.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOrigin=29&ctid=EB_TOOLBAR_ID&octid=EB_ORIGINAL_CTID");
Zeile gelöscht : user_pref("CT2613550.myStuffServiceIntervalMM", 1440);
Zeile gelöscht : user_pref("CT2613550.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?ComponentId=EB_MY_STUFF_INSTANCE_GUID&lut=EB_MY_STUFF_LUT");
Zeile gelöscht : user_pref("CT2613550.navigateToUrlOnSearch", false);
Zeile gelöscht : user_pref("CT2613550.revertSettingsEnabled", true);
Zeile gelöscht : user_pref("CT2613550.searchProtectorDialogDelayInSec", 10);
Zeile gelöscht : user_pref("CT2613550.searchProtectorEnableByLogin", true);
Zeile gelöscht : user_pref("CT2613550.testingCtid", "");
Zeile gelöscht : user_pref("CT2613550.toolbarAppMetaDataLastCheckTime", "Mon Jul 30 2012 19:57:31 GMT+0200");
Zeile gelöscht : user_pref("CommunityToolbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT2613550&SearchSource=13,hxxp://search.conduit.com/?ctid=CT2613550&SearchSource=13,hxxp://search.conduit.com/?ctid=[...]
Zeile gelöscht : user_pref("CommunityToolbar.ConduitSearchList", "ZoneAlarm-Sicherheit Customized Web Search,ZoneAlarm-Sicherheit Customized Web Search,ZoneAlarm-Sicherheit Customized Web Search,ZoneAlarm-Sicherheit C[...]
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2613550/CT2613550", "\"2531bc660a866172364526ea2512a7b92\"");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2613550", "\"0\"");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12.0.7", "\"4ead38b3e6bcd1:0\"");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12.2.3", "\"4ead38b3e6bcd1:0\"");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.13.0.6", "\"0d648794549cd1:0\"");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.14.1.0", "\"80b45d28468cd1:0\"");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2613550", "\"c912886ea3ba021d3a9ef2d6ad700899\"");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/50/261/CT2613550/Images/634084971246361250.png", "\"462e8b16c4eaca1:0\"");
Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=de-de", "\"a6324eb9dbc5a6c57adae34acff115a3\"");
Zeile gelöscht : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "hxxp://mystart.incredibar.com/mb123/?loc=IB_DS&a=6R8kptMvih&&i=26&search=");
Zeile gelöscht : user_pref("CommunityToolbar.ToolbarsList", "CT2613550");
Zeile gelöscht : user_pref("CommunityToolbar.ToolbarsList2", "CT2613550");
Zeile gelöscht : user_pref("CommunityToolbar.ToolbarsList4", "CT2613550");
Zeile gelöscht : user_pref("CommunityToolbar.globalUserId", "f2db8c84-ad60-42dc-8c27-45a75feb2e8d");
Zeile gelöscht : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2613550");
Zeile gelöscht : user_pref("CommunityToolbar.originalHomepage", "hxxp://www.gmx.de/");
Zeile gelöscht : user_pref("CommunityToolbar.originalSearchEngine", "Google");
Zeile gelöscht : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com");
Zeile gelöscht : user_pref("browser.search.defaultthis.engineName", "ZoneAlarm-Sicherheit Customized Web Search");
Zeile gelöscht : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2613550&SearchSource=3&q={searchTerms}");
Zeile gelöscht : user_pref("browser.search.order.1", "Search Results");
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.aflt", "babsst");
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.babExt", "");
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=119998");
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.hardId", "ecc6a129000000000000ac81122f2535");
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.id", "ecc6a129000000000000ac81122f2535");
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.instlDay", "15389");
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.instlRef", "sst");
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.newTab", true);
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?AF=119998&babsrc=NT_ss&mntrId=ecc6a129000000000000ac81122f2535");
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.tlbrId", "tb9");
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1714:40:35");
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");
Zeile gelöscht : user_pref("extensions.crossrider.bic", "143537d9cbc89f11507e0940d2333517");
Zeile gelöscht : user_pref("extensions.incredibar_i.aflt", "orgnl");
Zeile gelöscht : user_pref("extensions.incredibar_i.dfltLng", "");
Zeile gelöscht : user_pref("extensions.incredibar_i.did", "10616");
Zeile gelöscht : user_pref("extensions.incredibar_i.excTlbr", "false");
Zeile gelöscht : user_pref("extensions.incredibar_i.hardId", "ecc6a129000000000000ac81122f2535");
Zeile gelöscht : user_pref("extensions.incredibar_i.id", "ecc6a129000000000000ac81122f2535");
Zeile gelöscht : user_pref("extensions.incredibar_i.installerproductid", "26");
Zeile gelöscht : user_pref("extensions.incredibar_i.instlDay", "15389");
Zeile gelöscht : user_pref("extensions.incredibar_i.instlRef", "");
Zeile gelöscht : user_pref("extensions.incredibar_i.ms_url_id", "");
Zeile gelöscht : user_pref("extensions.incredibar_i.newTab", false);
Zeile gelöscht : user_pref("extensions.incredibar_i.ppd", "70");
Zeile gelöscht : user_pref("extensions.incredibar_i.prdct", "incredibar");
Zeile gelöscht : user_pref("extensions.incredibar_i.productid", "26");
Zeile gelöscht : user_pref("extensions.incredibar_i.prtnrId", "Incredibar");
Zeile gelöscht : user_pref("extensions.incredibar_i.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.incredibar_i.tlbrId", "base");
Zeile gelöscht : user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6R8kptMvih&loc=IB_TB&i=26&search=");
Zeile gelöscht : user_pref("extensions.incredibar_i.upn2", "6R8kptMvih");
Zeile gelöscht : user_pref("extensions.incredibar_i.upn2n", "92823877138536729");
Zeile gelöscht : user_pref("extensions.incredibar_i.vrsn", "1.5.3.27");
Zeile gelöscht : user_pref("extensions.incredibar_i.vrsnTs", "1.5.3.2714:43:10");
Zeile gelöscht : user_pref("extensions.incredibar_i.vrsni", "1.5.3.27");
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.ask.com.style", ".WRCN {display:none} #yui-main .tsrc_vnru .title + .WRCN, #yui-main #teoma-results .title + .WRCN {display:inline !important; background: url(\"I[...]
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.ask.com.url", "^hxxp(s)?\\:\\/\\/(.+\\.)?ask\\.com\\/.*");
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.rambler.ru.style", ".WRCN {display:none} .search-results .title + .WRCN {display:inline !important; background: url(\"IMAGE\") right no-repeat}");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.minibar.ROOTEXTENSION", "chrome://iminentwebbooster/content/minibar");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.minibar.Services.BHPCode", "01");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.minibar.Services.DefaultEvent", "000");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.minibar.Services.DefaultWebSite", "000");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.minibar.Services.IminentClientCode", "11");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.minibar.Services.SmartFavCode", "02");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.minibar.ShowThankyouPixel", "0");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.minibar.displayFavLinks", "0");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent101", "1387820024491");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent102", "1386622997601");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent109", "1375818787551");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent111", "1375818787557");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent122", "1375818787561");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent134", "1388062444086");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent140", "1388613172687");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.sslminibar.ROOTEXTENSION", "chrome://iminentwebbooster/content/minibar");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.sslminibar.Services.BHPCode", "01");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.sslminibar.Services.DefaultEvent", "000");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.sslminibar.Services.DefaultWebSite", "000");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.sslminibar.Services.IminentClientCode", "11");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.sslminibar.Services.SmartFavCode", "02");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.sslminibar.ShowThankyouPixel", "0");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.sslminibar.displayFavLinks", "0");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.sslminibar.registerToolbarEvent102", "1386623000856");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.sslminibar.registerToolbarEvent109", "1387815555268");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.sslminibar.registerToolbarEvent110", "1384635533913");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.sslminibar.registerToolbarEvent111", "1387815555275");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.sslminibar.registerToolbarEvent112", "1387815556144");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.sslminibar.registerToolbarEvent122", "1387815555282");
Zeile gelöscht : user_pref("keyword.URL", "hxxp://dts.search-results.com/sr?src=ffb&appid=0&systemid=410&sr=0&q=");
[ Datei : C:\Users\Administrator.****-HP\AppData\Roaming\Mozilla\Firefox\Profiles\r2edbjxf.default\prefs.js ]
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.ask.com.style", ".WRCN {display:none} #yui-main .tsrc_vnru .title + .WRCN, #yui-main #teoma-results .title + .WRCN {display:inline !important; background: url(\"I[...]
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.ask.com.url", "^hxxp(s)?\\:\\/\\/(.+\\.)?ask\\.com\\/.*");
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.rambler.ru.style", ".WRCN {display:none} .search-results .title + .WRCN {display:inline !important; background: url(\"IMAGE\") right no-repeat}");
-\\ Google Chrome v
[ Datei : C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [41155 octets] - [02/04/2014 18:17:11]
AdwCleaner[S0].txt - [39881 octets] - [02/04/2014 18:24:42]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [39942 octets] ##########
JRT: Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.3 (03.23.2014:1)
OS: Windows 7 Professional x64
Ran by zerl on 02.04.2014 at 18:33:56,48
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ FireFox
Successfully deleted: [File] C:\user.js
Emptied folder: C:\Users\****\AppData\Roaming\mozilla\firefox\profiles\uttrjezt.default\minidumps [90 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 02.04.2014 at 18:48:15,64
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
MBAM: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 02.04.2014 Suchlauf-Zeit: 20:15:50 Logdatei: mbam.txt Administrator: Ja Version: 2.00.0.1000 Malware Datenbank: v2014.04.02.05 Rootkit Datenbank: v2014.03.27.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Chameleon: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: **** Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 297114 Verstrichene Zeit: 1 Std, 2 Min, 9 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Shuriken: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 6 PUP.Optional.SearchQu, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{99079A25-328F-4BD4-BE04-00955ACAA0A7}, In Quarantäne, [b54bd030ec14dd2385867994c1419d63], PUP.Optional.SearchQu, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{99079A25-328F-4BD4-BE04-00955ACAA0A7}, In Quarantäne, [b54bd030ec14dd2385867994c1419d63], PUP.Optional.Iminent.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}, In Quarantäne, [13ed52ae03fd956b22f45ae521e1946c], PUP.Optional.Iminent.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}, In Quarantäne, [13ed52ae03fd956b22f45ae521e1946c], PUP.Optional.Feven.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Feven 1.5, In Quarantäne, [56aaba46c63a966ae66c5a0ce61cf40c], PUP.Optional.DataMngr.A, HKU\S-1-5-21-3883071668-826525904-3960972044-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Datamngr, In Quarantäne, [fd0334ccfa0651aff82bd1b026dd16ea], Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 0 (No malicious items detected) Physische Sektoren: 0 (No malicious items detected) (end) und zoeg: Code:
ATTFilter Zoek.exe v5.0.0.0 Updated 07-March-2014
Tool run by **** on 02.04.2014 at 20:24:25,05.
Microsoft Windows 7 Professional 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\****\Desktop\zoek.exe [Scan all users] [Script inserted]
==== System Restore Info ======================
02.04.2014 20:28:35 Zoek.exe System Restore Point Created Succesfully.
==== Deleting CLSID Registry Keys ======================
HKEY_USERS\S-1-5-21-3883071668-826525904-3960972044-1002\Software\Microsoft\Internet Explorer\SearchScopes\{313589CC-BE03-4CA1-94CB-0996CE686FE8} deleted successfully
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} deleted successfully
HKEY_USERS\S-1-5-21-3883071668-826525904-3960972044-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} deleted successfully
HKEY_USERS\S-1-5-21-3883071668-826525904-3960972044-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} deleted successfully
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B164E929-A1B6-4A06-B104-2CD0E90A88FF} deleted successfully
HKEY_USERS\S-1-5-21-3883071668-826525904-3960972044-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B164E929-A1B6-4A06-B104-2CD0E90A88FF} deleted successfully
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{B164E929-A1B6-4A06-B104-2CD0E90A88FF} deleted successfully
HKEY_USERS\S-1-5-21-3883071668-826525904-3960972044-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{B164E929-A1B6-4A06-B104-2CD0E90A88FF} deleted successfully
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FC2B76FC-2132-4D80-A9A3-1F5C6E49066B} deleted successfully
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FC2B76FC-2132-4D80-A9A3-1F5C6E49066B} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{B164E929-A1B6-4A06-B104-2CD0E90A88FF} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B164E929-A1B6-4A06-B104-2CD0E90A88FF} deleted successfully
==== Deleting CLSID Registry Values ======================
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Approved Extensions\{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} deleted successfully
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Approved Extensions\{B164E929-A1B6-4A06-B104-2CD0E90A88FF} deleted successfully
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Approved Extensions\{FC2B76FC-2132-4D80-A9A3-1F5C6E49066B} deleted successfully
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Approved Extensions\{99079A25-328F-4BD4-BE04-00955ACAA0A7} deleted successfully
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Approved Extensions\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} deleted successfully
HKEY_LOCAL_MACHINE\software\Wow6432Node\mozilla\Firefox\extensions\{B7082FAA-CB62-4872-9106-E42DD88EDE45} deleted successfully
HKEY_LOCAL_MACHINE\software\Wow6432Node\mozilla\Firefox\extensions\{FFB96CC1-7EB3-449D-B827-DB661701C6BB} deleted successfully
==== Deleting Services ======================
==== FireFox Fix ======================
Deleted from C:\Users\ADMINI~1.ZER\AppData\Roaming\Mozilla\Firefox\Profiles\r2edbjxf.default\prefs.js:
Added to C:\Users\ADMINI~1.ZER\AppData\Roaming\Mozilla\Firefox\Profiles\r2edbjxf.default\prefs.js:
user_pref("browser.startup.homepage", "hxxp://www.google.com");
user_pref("browser.search.defaulturl", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "hxxp://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);
Deleted from C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\prefs.js:
user_pref("browser.startup.homepage", "https://www.google.de/search?q=imdb&ie=utf-8&oe=utf-8&aq=t&rls=net.gmx:de:official&client=firefox|hxxp://www.google.de/");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.useDBForOrder", "false");
Added to C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\prefs.js:
ProfilePath: C:\Users\ADMINI~1.ZER\AppData\Roaming\Mozilla\Firefox\Profiles\r2edbjxf.default
user.js not found
---- Lines spigot modified from prefs.js ----
user_pref("extensions.installCache", "[{\"name\":\"winreg-app-global\",\"addons\":{\"otis@digitalpersona.com\":{\"descriptor\":\"c:\\\\Program Files (
---- Lines Search modified from prefs.js ----
user_pref("extensions.installCache", "[{\"name\":\"winreg-app-global\",\"addons\":{\"otis@digitalpersona.com\":{\"descriptor\":\"c:\\\\Program Files (
---- Lines mybrowserbar modified from prefs.js ----
user_pref("extensions.enabledAddons", "pdfforge@mybrowserbar.com:4.5,wtxpcom@mybrowserbar.com:4.5,{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22,{CAFEE
user_pref("extensions.installCache", "[{\"name\":\"winreg-app-global\",\"addons\":{\"otis@digitalpersona.com\":{\"descriptor\":\"c:\\\\Program Files (
---- FireFox user.js and prefs.js backups ----
prefs__2045_.backup
ProfilePath: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default
user.js not found
---- FireFox user.js and prefs.js backups ----
prefs__2045_.backup
==== Deleting Files \ Folders ======================
C:\Program Files (x86)\Common Files\Spigot\wtxpcom not found
C:\Users\****\.android deleted
C:\PROGRA~2\GUMEB67.tmp deleted
C:\PROGRA~3\InstallMate deleted
C:\Users\****\AppData\Local\cache deleted
C:\windows\SysNative\sasnative64.exe deleted
C:\windows\sysWoW64\config\systemprofile\AppData\LocalLow\pdfforge deleted
C:\windows\sysWoW64\config\systemprofile\AppData\LocalLow\searchquband deleted
C:\windows\sysWoW64\config\systemprofile\AppData\LocalLow\searchqutoolbar deleted
C:\windows\sysWoW64\config\systemprofile\AppData\LocalLow\Application Updater deleted
C:\windows\Syswow64\InstallUtil.InstallLog deleted
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\extensions\firefox@ghostery.com.xpi deleted
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\jetpack deleted
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\CT2613550 deleted
"C:\Users\****\AppData\Roaming\WEBDE" deleted
==== Firefox Extensions Registry ======================
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"wrc@avast.com"="C:\Program Files\AVAST Software\Avast\WebRep\FF" [31.03.2014 23:07]
==== Firefox Extensions ======================
ProfilePath: C:\Users\ADMINI~1.ZER\AppData\Roaming\Mozilla\Firefox\Profiles\r2edbjxf.default
- Undetermined - C:\Program Files (x86)\pdfforge Toolbar\FF
- Undetermined - C:\Program Files (x86)\Common Files\Spigot\wtxpcom
- Undetermined - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
- Undetermined - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
- avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF
- GMX Toolbar - %ProfilePath%\extensions\toolbar@gmx.net
ProfilePath: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default
- GMX MailCheck - %ProfilePath%\extensions\toolbar@gmx.net.xpi
AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
==== Firefox Plugins ======================
Profilepath: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default
95812430959AE88CDD0301AB3A71913B - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll - Shockwave Flash
==== Chrome Look ======================
==== Set IE to Default ======================
Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://www.google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU
New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://www.google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"
==== All HKCU SearchScopes ======================
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"
{72EFFCD5-7C96-4B9A-A7D2-4C3C08E9FE8D} Bing Url="hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox"
==== Reset Google Chrome ======================
C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\preferences was reset successfully
C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
==== Deleting Registry Keys ======================
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\OptimizerPro1 deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{38017202-060F-8357-D993-43F86E7AAEB6} deleted successfully
==== Empty IE Cache ======================
C:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Administrator.****-HP\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\****\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\****\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\****\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
==== Empty FireFox Cache ======================
C:\Users\Administrator.****-HP\AppData\Local\Mozilla\Firefox\Profiles\r2edbjxf.default\Cache emptied successfully
C:\Users\****\AppData\Local\Mozilla\Firefox\Profiles\uttrjezt.default\Cache emptied successfully
==== Empty Chrome Cache ======================
C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully
==== Empty All Flash Cache ======================
Flash Cache is not empty, a reboot is needed
==== Empty All Java Cache ======================
Java Cache cleared successfully
==== C:\zoek_backup content ======================
C:\zoek_backup (files=160 folders=68 4784718 bytes)
==== Empty Temp Folders ======================
C:\Users\Administrator.****-HP\AppData\Local\Temp emptied successfully
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\****\AppData\Local\Temp will be emptied at reboot
C:\windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\windows\Temp will be emptied at reboot
==== After Reboot ======================
==== Empty Temp Folders ======================
C:\windows\Temp successfully emptied
C:\Users\****\AppData\Local\Temp successfully emptied
==== Empty Recycle Bin ======================
C:\$RECYCLE.BIN successfully emptied
==== Deleting Files / Folders ======================
"C:\Users\****\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\4WEGMRKQ\cdn.static.nuffnang.com.my" not found
"C:\Users\****\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\4WEGMRKQ\media.mtvnservices.com" not found
==== EOF on 02.04.2014 at 21:15:18,77 ======================
Und nun? Lg Melian |
|
03.04.2014, 15:46
| #4 |
| /// TB-Ausbilder | Advanced System Protector entfernen bei Windows 7 Servus, sieht schon mal gut aus, da wurde jede Menge entfernt.  Wir spüren die letzten Reste auf, damit wir sie später entfernen können: Schritt 1 Kontrollscan mit FRST Führe wie zuvor beschrieben einen Scan mit FRST aus. Setze dazu einen Haken bei Addition.txt rechts unten und klicke auf Scan. Es werden zwei Logdateien erzeugt. Poste mir diese. Schritt 2 Lade dir die passende Version von SystemLook vom folgenden Spiegel herunter und speichere das Tool auf dem Desktop: SystemLook (32 bit) | SystemLook (64 bit)
Gibt es noch Probleme mit Advanced System Protector? Wenn ja, welche? Wie läuft der Rechner derzeit? Bitte poste mit deiner nächsten Antwort
__________________ Bitte beachten: Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten? |
|
04.04.2014, 00:54
| #5 |
| | Advanced System Protector entfernen bei Windows 7 Hallo M-K-D-B, zunächst einmal: der Rechner läuft schneller! Bisher keine Probleme und der Advanced System Protector ist auch nicht mehr bei den Programmen/Systemsteuerung gelistet. Jay!  so, nun die Logfiles..... FRTS: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by **** (administrator) on ****-HP on 04-04-2014 00:57:32
Running from C:\Users\****\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe
(McAfee, Inc.) c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
(AMD) C:\windows\system32\atiesrxx.exe
(IDT, Inc.) C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\STacSV64.exe
(Hewlett-Packard Company) C:\windows\system32\Hpservice.exe
(AMD) C:\windows\system32\atieclxx.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\windows\system32\WLANExt.exe
(ActivIdentity) C:\Program Files\Common Files\ActivIdentity\ac.sharedstore.exe
(ActivIdentity) C:\Program Files\ActivIdentity\ActivClient\acevents.exe
(DigitalPersona, Inc.) c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
(Andrea Electronics Corporation) C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\AESTSr64.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Hewlett-Packard Development Company, L.P) c:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe
(Hewlett-Packard Company) c:\Program Files\Hewlett-Packard\HP QuickLook\32-bit\HPDayStarterService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(McAfee, Inc.) c:\Program Files\Hewlett-Packard\Drive Encryption\SbHpAuthenticatorService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(DigitalPersona, Inc.) c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(ActivIdentity) C:\Program Files\ActivIdentity\ActivClient\acevents.exe
(ActivIdentity) C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(Microsoft Corporation) C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(DigitalPersona, Inc.) c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\coreshredder.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winampa.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.0.313\SSScheduler.exe
(Adobe Systems) C:\Program Files (x86)\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
(Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe
(Adobe Systems, Inc.) C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe
(Adobe Systems, Inc.) C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [IAAnotif] - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2010-01-08] (Intel Corporation)
HKLM\...\Run: [HPPowerAssistant] - C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe [1691192 2010-04-05] (Hewlett-Packard)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2174760 2010-06-04] (Synaptics Incorporated)
HKLM\...\Run: [HPWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-04-05] (Hewlett-Packard)
HKLM\...\Run: [acevents] - C:\Program Files\ActivIdentity\ActivClient\acevents.exe [196648 2009-06-04] (ActivIdentity)
HKLM\...\Run: [] - [X]
HKLM\...\Run: [accrdsub] - C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe [483880 2009-06-04] (ActivIdentity)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [487424 2010-03-17] (IDT, Inc.)
HKLM\...\Run: [COMODO Internet Security] - C:\Program Files\COMODO\COMODO Internet Security\cfp.exe [9577680 2012-11-08] (COMODO)
HKLM-x32\...\Run: [QLBController] - C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe [256056 2010-03-01] (Hewlett-Packard Company)
HKLM-x32\...\Run: [File Sanitizer] - C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe [11266048 2010-01-19] (Hewlett-Packard)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-04-21] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [IMSS] - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [111640 2010-03-04] ()
HKLM-x32\...\Run: [NortonOnlineBackupReminder] - C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NOBuActivation.exe [3331944 2009-12-03] (Symantec Corporation)
HKLM-x32\...\Run: [WinampAgent] - C:\Program Files (x86)\Winamp\winampa.exe [74752 2011-03-22] (Nullsoft, Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeVersionCue] - C:\Program Files (x86)\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe [1732608 2004-03-25] (Adobe Systems)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3774312 2014-04-01] (AVAST Software)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe,
Winlogon\Notify\DeviceNP-x32: DeviceNP.dll [X]
HKU\S-1-5-21-3883071668-826525904-3960972044-1002\...\Run: [HPAdvisorDock] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe [1712184 2010-02-10] ()
HKU\S-1-5-21-3883071668-826525904-3960972044-1002\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2010-02-22] (Hewlett-Packard Company)
HKU\S-1-5-21-3883071668-826525904-3960972044-1002\...\MountPoints2: {9fc2e364-6e07-11e2-b55b-6431508004c6} - H:\LaunchU3.exe -a
HKU\S-1-5-21-3883071668-826525904-3960972044-1002\...\MountPoints2: {9fd785d9-2e75-11e0-aba7-806e6f6e6963} - G:\Setup.exe
AppInit_DLLs: C:\windows\system32\guard64.dll => C:\windows\system32\guard64.dll [390392 2012-11-08] (COMODO)
AppInit_DLLs-x32: C:\PROGRA~2\Citrix\ICACLI~1\RSHook.dll => "C:\PROGRA~2\Citrix\ICACLI~1\RSHook.dll" File Not Found
AppInit_DLLs-x32: C:\windows\SysWOW64\guard32.dll => C:\windows\SysWOW64\guard32.dll [301264 2012-11-08] (COMODO)
Lsa: [Notification Packages] DPPassFilter scecli
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/10
SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} URL =
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: HP ProtectTools Security Manager Extension - {395610AE-C624-4f58-B89E-23733EA00F9A} - c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpOtsPluginIe8.dll (DigitalPersona, Inc.)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO-x32: File Sanitizer for HP ProtectTools - {3134413B-49B4-425C-98A5-893C1F195601} - C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll (Hewlett-Packard)
BHO-x32: HP ProtectTools Security Manager Extension - {395610AE-C624-4f58-B89E-23733EA00F9A} - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpOtsPluginIe8.dll (DigitalPersona, Inc.)
BHO-x32: SwissAcademic.Citavi.Picker.IEPicker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM - No Name - !{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
Toolbar: HKLM-x32 - No Name - !{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - No File
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - No File
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor Enterprise\McIEPlg.dll No File
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor Enterprise\McIEPlg.dll No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default
FF DefaultSearchEngine: Google
FF SelectedSearchEngine: Google
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files (x86)\McAfee Security Scan\3.0.313\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101727.dll (Amazon.com, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll (Nullsoft, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: GMX MailCheck - C:\Users\****l\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\Extensions\toolbar@gmx.net.xpi [2011-06-25]
FF HKLM-x32\...\Firefox\Extensions: [otis@digitalpersona.com] - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt\
FF Extension: No Name - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt\ []
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2011-08-25]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2011-06-01]
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (Google Docs) - C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-16]
CHR Extension: (Google Drive) - C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-16]
CHR Extension: (YouTube) - C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-16]
CHR Extension: (Google Search) - C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-16]
CHR Extension: (Google Wallet) - C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-16]
CHR Extension: (Gmail) - C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-16]
==================== Services (Whitelisted) =================
R2 ac.sharedstore; C:\Program Files\Common Files\ActivIdentity\ac.sharedstore.exe [277032 2009-06-04] (ActivIdentity)
S3 AdobeVersionCue; C:\Program Files (x86)\Adobe\Adobe Version Cue\service\VersionCue.exe [61440 2004-03-25] (Adobe Sytems)
R2 AESTFilters; C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\AESTSr64.exe [89600 2009-03-03] (Andrea Electronics Corporation)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-02-10] (AVAST Software)
R2 cmdagent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [2828408 2012-11-08] (COMODO)
R3 DEBridge; c:\Program Files\Hewlett-Packard\Drive Encryption\SbHpAuthenticatorService.exe [704512 2010-02-02] (McAfee, Inc.)
R2 DpHost; c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [462088 2010-03-31] (DigitalPersona, Inc.)
S3 FLCDLOCK; c:\Windows\SysWOW64\flcdlock.exe [362040 2009-12-07] (Hewlett-Packard Ltd)
R2 HP ProtectTools Service; c:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [36864 2010-03-17] (Hewlett-Packard Development Company, L.P)
R2 HpFkCryptService; c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [281192 2010-02-02] (McAfee, Inc.)
R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe [264248 2010-03-01] (Hewlett-Packard Company)
R2 STacSV; C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\STacSV64.exe [244736 2010-03-17] (IDT, Inc.)
S2 McAfee SiteAdvisor Enterprise Service; "C:\Program Files (x86)\McAfee\SiteAdvisor Enterprise\McSACore.exe" [X]
==================== Drivers (Whitelisted) ====================
R2 aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [78648 2014-02-10] (AVAST Software)
R1 aswRdr; C:\windows\system32\drivers\aswRdr2.sys [92544 2014-01-16] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-01-16] ()
R1 aswSnx; C:\windows\system32\drivers\aswSnx.sys [1038072 2014-02-10] (AVAST Software)
R1 aswSP; C:\windows\system32\drivers\aswSP.sys [421704 2014-02-10] (AVAST Software)
R3 aswStm; C:\windows\system32\drivers\aswStm.sys [80184 2014-02-10] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-12-19] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2014-01-16] ()
R1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [584056 2012-11-08] (COMODO)
R1 cmdHlp; C:\Windows\System32\DRIVERS\cmdhlp.sys [38144 2012-11-08] (COMODO)
S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv64.sys [40760 2009-10-21] (Hewlett-Packard Development Company L.P.)
R1 inspect; C:\Windows\System32\DRIVERS\inspect.sys [94288 2012-11-08] (COMODO)
R1 RsvLock; C:\Windows\System32\Drivers\RsvLock.sys [58184 2010-02-02] (McAfee, Inc.)
R1 RsvLock; C:\Windows\SysWow64\Drivers\RsvLock.sys [40088 2010-02-02] (McAfee, Inc.)
R0 SafeBoot; C:\Windows\System32\Drivers\SafeBoot.sys [56648 2010-02-02] ()
R0 SafeBoot; C:\Windows\SysWow64\Drivers\SafeBoot.sys [110520 2010-02-02] (McAfee, Inc.)
R0 SbAlg; C:\Windows\System32\Drivers\SbAlg.sys [60160 2009-06-04] (McAfee, Inc.)
R0 SbAlg; C:\Windows\SysWow64\Drivers\SbAlg.sys [51800 2010-02-02] (McAfee, Inc.)
R0 SbFsLock; C:\Windows\System32\Drivers\SbFsLock.sys [15688 2010-02-02] (McAfee, Inc.)
R0 SbFsLock; C:\Windows\SysWow64\Drivers\SbFsLock.sys [13256 2010-02-02] (McAfee, Inc.)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1803904 2010-01-19] ()
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-04 00:57 - 2014-04-04 00:59 - 00022768 _____ () C:\Users\****\Desktop\FRST.txt
2014-04-03 15:42 - 2014-04-03 15:49 - 00000072 _____ () C:\Users\Public\LMDebug.log
2014-04-03 15:39 - 2014-04-03 15:39 - 00000000 ____D () C:\ProgramData\Samsung
2014-04-02 20:55 - 2014-04-02 20:23 - 00024064 _____ () C:\windows\zoek-delete.exe
2014-04-02 20:27 - 2014-04-02 21:15 - 00013654 _____ () C:\zoek-results.log
2014-04-02 20:23 - 2014-04-02 20:46 - 00000000 ____D () C:\zoek_backup
2014-04-02 20:23 - 2014-04-02 19:23 - 01285120 _____ () C:\Users\****\Desktop\zoek.exe
2014-04-02 20:21 - 2014-04-02 20:22 - 00002374 _____ () C:\Users\****\Desktop\mbam.txt
2014-04-02 18:58 - 2014-04-02 20:20 - 00119512 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-02 18:57 - 2014-04-02 18:57 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-02 18:57 - 2014-04-02 18:57 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-02 18:57 - 2014-04-02 18:57 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-02 18:57 - 2014-03-05 09:26 - 00088280 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-04-02 18:57 - 2014-03-05 09:26 - 00063192 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-04-02 18:57 - 2014-03-05 09:26 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-04-02 18:48 - 2014-04-02 18:51 - 00000796 _____ () C:\Users\****\Desktop\JRT.txt
2014-04-02 18:33 - 2014-04-02 18:33 - 00000000 ____D () C:\windows\ERUNT
2014-04-02 18:33 - 2014-04-02 18:17 - 01038974 _____ (Thisisu) C:\Users\****\Desktop\JRT.exe
2014-04-02 18:29 - 2014-04-02 18:31 - 00040235 _____ () C:\Users\****\Desktop\AdwCleaner[S0].txt
2014-04-02 18:16 - 2014-04-02 18:24 - 00000000 ____D () C:\AdwCleaner
2014-04-02 18:12 - 2014-04-02 18:12 - 01426178 _____ () C:\Users\****\Desktop\adwcleaner.exe
2014-04-02 16:50 - 2014-04-02 16:50 - 00000000 ____D () C:\Program Files (x86)\7-Zip
2014-04-02 11:00 - 2014-04-04 00:57 - 00000000 ____D () C:\FRST
2014-04-02 10:54 - 2014-04-02 10:54 - 00000000 _____ () C:\Users\****\defogger_reenable
2014-04-02 04:26 - 2014-04-02 04:26 - 00380416 _____ () C:\Users\****\Desktop\Gmer-19357.exe
2014-04-02 04:25 - 2014-04-02 04:25 - 02157056 _____ (Farbar) C:\Users\****\Desktop\FRST64.exe
2014-04-02 04:23 - 2014-04-02 04:24 - 00050477 _____ () C:\Users\****\Desktop\Defogger.exe
2014-04-02 00:21 - 2014-04-02 00:21 - 00000000 ____D () C:\ProgramData\HP
2014-03-31 23:17 - 2014-04-01 01:52 - 00007974 _____ () C:\Users\****\Desktop\Vortrag Köln - Verknüpfung.lnk
2014-03-30 16:41 - 2014-04-03 17:57 - 00000000 ____D () C:\Users\*****\Desktop\TEXT_29.03.14
2014-03-27 19:46 - 2014-03-27 19:46 - 03239936 _____ () C:\Users\*****\Desktop\RGK_Zeitschriften.xls
2014-03-23 04:17 - 2014-03-31 22:00 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-03-23 00:39 - 2014-03-01 07:17 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-03-23 00:39 - 2014-03-01 07:16 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-03-23 00:39 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-03-23 00:39 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\windows\system32\iertutil(110).dll
2014-03-23 00:39 - 2014-03-01 06:51 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-03-23 00:39 - 2014-03-01 06:40 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-03-23 00:39 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-03-23 00:39 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-03-23 00:39 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2014-03-23 00:39 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-03-23 00:39 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil(116).dll
2014-03-23 00:39 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-03-23 00:39 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-03-23 00:39 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2014-03-23 00:39 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-03-23 00:39 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-03-23 00:39 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-03-23 00:39 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\windows\system32\urlmon(111).dll
2014-03-23 00:39 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2014-03-23 00:39 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon(117).dll
2014-03-23 00:39 - 2014-02-07 03:23 - 03156480 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2014-03-23 00:39 - 2014-01-29 04:32 - 00484864 _____ (Microsoft Corporation) C:\windows\system32\wer.dll
2014-03-23 00:39 - 2014-01-29 04:32 - 00484864 _____ (Microsoft Corporation) C:\windows\system32\wer(112).dll
2014-03-23 00:39 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\windows\SysWOW64\wer(118).dll
2014-03-23 00:39 - 2014-01-28 04:32 - 00228864 _____ (Microsoft Corporation) C:\windows\system32\wwansvc.dll
2014-03-23 00:38 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-03-23 00:38 - 2014-03-01 06:52 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-03-23 00:38 - 2014-03-01 06:42 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-03-23 00:38 - 2014-03-01 06:37 - 00574976 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2014-03-23 00:38 - 2014-03-01 06:33 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-03-23 00:38 - 2014-03-01 06:33 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-03-23 00:38 - 2014-03-01 06:32 - 00708608 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-03-23 00:38 - 2014-03-01 06:23 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2014-03-23 00:38 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-03-23 00:38 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-03-23 00:38 - 2014-03-01 06:02 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-03-23 00:38 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-03-23 00:38 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-03-23 00:38 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2014-03-23 00:38 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2014-03-23 00:38 - 2014-03-01 05:35 - 02041856 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-03-23 00:38 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-03-23 00:38 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-03-23 00:38 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-03-23 00:38 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-03-23 00:38 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\windows\system32\wininet(115).dll
2014-03-23 00:38 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-03-23 00:38 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-03-23 00:38 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet(119).dll
2014-03-23 00:38 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-03-23 00:38 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2014-03-23 00:37 - 2014-02-04 04:32 - 00624128 _____ (Microsoft Corporation) C:\windows\system32\qedit.dll
2014-03-23 00:37 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\windows\SysWOW64\qedit.dll
2014-03-23 00:34 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs.dll
2014-03-23 00:34 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs(114).dll
2014-03-23 00:34 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\windows\SysWOW64\WindowsCodecs.dll
2014-03-22 16:21 - 2014-03-22 16:22 - 00000000 ____D () C:\Users\****\Desktop\friedrichshafen
2014-03-20 23:59 - 2014-03-31 21:56 - 00000000 ____D () C:\Users\****\Desktop\Diss_17_03_2013
2014-03-14 21:59 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\windows\SysWOW64\wer.dll
2014-03-11 03:51 - 2014-03-28 06:17 - 00000000 ____D () C:\Users\*****\Desktop\TEXT_27.03.14
==================== One Month Modified Files and Folders =======
2014-04-04 00:59 - 2014-04-04 00:57 - 00022768 _____ () C:\Users\*****\Desktop\FRST.txt
2014-04-04 00:57 - 2014-04-02 11:00 - 00000000 ____D () C:\FRST
2014-04-04 00:55 - 2011-02-02 04:44 - 01760785 _____ () C:\windows\WindowsUpdate.log
2014-04-04 00:50 - 2011-11-17 01:20 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-04 00:34 - 2010-09-12 22:06 - 00701576 _____ () C:\windows\system32\perfh007.dat
2014-04-04 00:34 - 2010-09-12 22:06 - 00150444 _____ () C:\windows\system32\perfc007.dat
2014-04-04 00:34 - 2009-07-14 07:13 - 01620684 _____ () C:\windows\system32\PerfStringBackup.INI
2014-04-04 00:22 - 2012-07-09 11:29 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-04-04 00:13 - 2011-11-17 01:20 - 00001102 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-03 23:40 - 2009-07-14 06:45 - 00020944 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-03 23:40 - 2009-07-14 06:45 - 00020944 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-03 23:33 - 2010-09-12 22:05 - 00000000 ____D () C:\ProgramData\HPQLOG
2014-04-03 23:32 - 2009-07-14 07:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-04-03 23:32 - 2009-07-14 06:51 - 00134064 _____ () C:\windows\setupact.log
2014-04-03 18:02 - 2011-05-29 23:19 - 00000000 ____D () C:\ProgramData\Adobe
2014-04-03 18:02 - 2011-02-17 18:32 - 00000000 ____D () C:\Users\****\AppData\Roaming\Adobe
2014-04-03 17:57 - 2014-03-30 16:41 - 00000000 ____D () C:\Users\****\Desktop\TEXT_29.03.14
2014-04-03 15:49 - 2014-04-03 15:42 - 00000072 _____ () C:\Users\Public\LMDebug.log
2014-04-03 15:39 - 2014-04-03 15:39 - 00000000 ____D () C:\ProgramData\Samsung
2014-04-03 14:27 - 2011-02-17 18:49 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-04-02 22:44 - 2011-02-17 18:18 - 00000000 ____D () C:\Users\****\AppData\Roaming\Winamp
2014-04-02 21:15 - 2014-04-02 20:27 - 00013654 _____ () C:\zoek-results.log
2014-04-02 21:10 - 2010-09-12 22:43 - 00563528 _____ () C:\windows\PFRO.log
2014-04-02 20:46 - 2014-04-02 20:23 - 00000000 ____D () C:\zoek_backup
2014-04-02 20:46 - 2011-02-17 14:54 - 00000000 ____D () C:\Users\****
2014-04-02 20:23 - 2014-04-02 20:55 - 00024064 _____ () C:\windows\zoek-delete.exe
2014-04-02 20:22 - 2014-04-02 20:21 - 00002374 _____ () C:\Users\****\Desktop\mbam.txt
2014-04-02 20:20 - 2014-04-02 18:58 - 00119512 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-02 19:23 - 2014-04-02 20:23 - 01285120 _____ () C:\Users\****\Desktop\zoek.exe
2014-04-02 18:57 - 2014-04-02 18:57 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-02 18:57 - 2014-04-02 18:57 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-02 18:57 - 2014-04-02 18:57 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-02 18:51 - 2014-04-02 18:48 - 00000796 _____ () C:\Users\****\Desktop\JRT.txt
2014-04-02 18:33 - 2014-04-02 18:33 - 00000000 ____D () C:\windows\ERUNT
2014-04-02 18:31 - 2014-04-02 18:29 - 00040235 _____ () C:\Users\****\Desktop\AdwCleaner[S0].txt
2014-04-02 18:29 - 2012-07-09 11:30 - 00004182 _____ () C:\windows\System32\Tasks\avast! Emergency Update
2014-04-02 18:24 - 2014-04-02 18:16 - 00000000 ____D () C:\AdwCleaner
2014-04-02 18:24 - 2011-02-17 15:07 - 00000000 ___RD () C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-02 18:17 - 2014-04-02 18:33 - 01038974 _____ (Thisisu) C:\Users\****\Desktop\JRT.exe
2014-04-02 18:12 - 2014-04-02 18:12 - 01426178 _____ () C:\Users\****\Desktop\adwcleaner.exe
2014-04-02 17:01 - 2011-10-10 23:58 - 00000000 ____D () C:\Users\****\Documents\Outlook-Dateien
2014-04-02 16:50 - 2014-04-02 16:50 - 00000000 ____D () C:\Program Files (x86)\7-Zip
2014-04-02 10:54 - 2014-04-02 10:54 - 00000000 _____ () C:\Users\****\defogger_reenable
2014-04-02 04:50 - 2013-02-15 02:27 - 00006585 _____ () C:\Users\****\Desktop\eigene Daten_Diss - Verknüpfung.lnk
2014-04-02 04:26 - 2014-04-02 04:26 - 00380416 _____ () C:\Users\****\Desktop\Gmer-19357.exe
2014-04-02 04:25 - 2014-04-02 04:25 - 02157056 _____ (Farbar) C:\Users\****\Desktop\FRST64.exe
2014-04-02 04:24 - 2014-04-02 04:23 - 00050477 _____ () C:\Users\****\Desktop\Defogger.exe
2014-04-02 03:45 - 2013-12-05 03:02 - 00112128 _____ () C:\Users\****\Desktop\Tanja **** Stundenabrechnung 2014.xls
2014-04-02 00:21 - 2014-04-02 00:21 - 00000000 ____D () C:\ProgramData\HP
2014-04-02 00:21 - 2009-07-27 18:14 - 00000000 ___HD () C:\SYSTEM.SAV
2014-04-01 23:42 - 2011-11-17 01:20 - 00004102 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-01 23:42 - 2011-11-17 01:20 - 00003850 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-04-01 23:28 - 2011-05-20 23:26 - 00000000 ____D () C:\Users\****\Documents\Tanja eigenes
2014-04-01 01:52 - 2014-03-31 23:17 - 00007974 _____ () C:\Users\****\Desktop\Vortrag Köln - Verknüpfung.lnk
2014-03-31 22:01 - 2014-01-17 02:41 - 00000000 ____D () C:\Users\****\Desktop\Diss_16_01_2013
2014-03-31 22:01 - 2011-11-13 16:22 - 00000000 ____D () C:\windows\system32\Macromed
2014-03-31 22:01 - 2011-08-24 11:39 - 00000000 ____D () C:\Users\Administrator.****-HP
2014-03-31 22:00 - 2014-03-23 04:17 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-03-31 22:00 - 2012-12-03 00:31 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2014-03-31 22:00 - 2012-05-15 01:28 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-03-31 22:00 - 2012-05-15 01:28 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-03-31 22:00 - 2011-02-17 15:35 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-03-31 22:00 - 2011-02-02 04:56 - 00000000 ____D () C:\ProgramData\Skype
2014-03-31 21:59 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\registration
2014-03-31 21:56 - 2014-03-20 23:59 - 00000000 ____D () C:\Users\****\Desktop\Diss_17_03_2013
2014-03-31 03:06 - 2013-08-16 03:02 - 00000000 ____D () C:\windows\system32\MRT
2014-03-29 14:10 - 2009-07-14 07:38 - 00067584 ____S () C:\windows\bootstat(109).dat
2014-03-28 06:17 - 2014-03-11 03:51 - 00000000 ____D () C:\Users\****\Desktop\TEXT_27.03.14
2014-03-27 19:46 - 2014-03-27 19:46 - 03239936 _____ () C:\Users\****\Desktop\RGK_Zeitschriften.xls
2014-03-23 04:36 - 2009-07-14 06:45 - 00457784 _____ () C:\windows\system32\FNTCACHE.DAT
2014-03-23 04:11 - 2011-02-17 15:32 - 01598708 _____ () C:\windows\SysWOW64\PerfStringBackup.INI
2014-03-23 04:07 - 2011-02-17 19:12 - 90015360 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-03-23 01:05 - 2011-04-25 22:12 - 00003180 _____ () C:\windows\System32\Tasks\HPCeeScheduleFor****
2014-03-23 01:05 - 2011-04-25 22:12 - 00000328 _____ () C:\windows\Tasks\HPCeeScheduleFor****.job
2014-03-23 00:22 - 2012-07-09 11:29 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-03-23 00:22 - 2012-07-09 11:29 - 00003822 _____ () C:\windows
2014-03-23 00:22 - 2011-05-27 15:37 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-23 00:07 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\L2Schemas
2014-03-22 16:22 - 2014-03-22 16:21 - 00000000 ____D () C:\Users\****\Desktop\friedrichshafen
2014-03-05 09:26 - 2014-04-02 18:57 - 00088280 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-03-05 09:26 - 2014-04-02 18:57 - 00063192 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-03-05 09:26 - 2014-04-02 18:57 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-03-05 03:57 - 2014-03-02 20:08 - 00000000 ____D () C:\Users\****\Desktop\R_Jan_2014_2
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-02-22 20:49
==================== End Of Log ============================
--- --- --- Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-03-2014
Ran by **** at 2014-04-04 01:00:02
Running from C:\Users\****\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: COMODO Defense+ (Enabled - Up to date) {FEEA52D5-051E-08DD-07EF-2F009097607D}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
FW: COMODO Firewall (Enabled) {7DB03214-694B-060B-1600-BD4715C36DBB}
==================== Installed Programs ======================
7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version: - )
ActivClient x64 (HKLM\...\{86E45973-5352-439F-A115-2E8EE4D40140}) (Version: 6.2 - ActivIdentity)
ActiveCheck component for HP Active Support Library (x32 Version: 3.0.0.3 - Hewlett-Packard) Hidden
Adobe Creative Suite (HKLM-x32\...\{D52ECEBC-9B20-41A5-81C4-A62DE2367419}) (Version: 1.1.1 - Adobe Systems,Inc.)
Adobe Flash Player 10 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 10.0.32.18 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Reader X (10.1.9) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.9 - Adobe Systems Incorporated)
Adobe SVG Viewer 3.0 (HKLM-x32\...\Adobe SVG Viewer) (Version: 3.0 - Adobe Systems, Inc.)
Amazon Kindle (HKCU\...\Amazon Kindle) (Version: - Amazon)
Amazon MP3-Downloader 1.0.17 (HKLM-x32\...\Amazon MP3-Downloader) (Version: 1.0.17 - Amazon Services LLC)
ATI Catalyst Install Manager (HKLM\...\{135B7CF6-E0A2-FD1D-9B4F-49F67140794B}) (Version: 3.0.750.0 - ATI Technologies, Inc.)
Audiograbber 1.83 SE (HKLM-x32\...\Audiograbber) (Version: 1.83 SE - Audiograbber Deutschland)
avast! Free Antivirus (HKLM-x32\...\avast) (Version: 9.0.2013 - Avast Software)
Broadcom 2070 Bluetooth 2.1 + EDR (HKLM\...\{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}) (Version: 6.2.1.1100 - Broadcom Corporation)
Broadcom 802.11 Wireless LAN Adapter (HKLM\...\Broadcom 802.11 Wireless LAN Adapter) (Version: 5.60.48.35 - Broadcom Corporation)
calibre 64bit (HKLM\...\{D3CAAD6A-2A42-44A0-914D-94C22DBB4754}) (Version: 1.18.0 - Kovid Goyal)
Canon MP280 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP280_series) (Version: - )
Canon MP550 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP550_series) (Version: - )
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center Core Implementation (x32 Version: 2010.0421.1244.20944 - ATI) Hidden
Catalyst Control Center Graphics Full Existing (x32 Version: 2010.0421.1244.20944 - ATI) Hidden
Catalyst Control Center Graphics Full New (x32 Version: 2010.0421.1244.20944 - ATI) Hidden
Catalyst Control Center Graphics Light (x32 Version: 2010.0421.1244.20944 - ATI) Hidden
Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0421.1244.20944 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2010.0421.1244.20944 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2010.0421.1244.20944 - ATI) Hidden
CCC Help Chinese Standard (x32 Version: 2010.0421.1243.20944 - ATI) Hidden
CCC Help Chinese Traditional (x32 Version: 2010.0421.1243.20944 - ATI) Hidden
CCC Help Czech (x32 Version: 2010.0421.1243.20944 - ATI) Hidden
CCC Help Danish (x32 Version: 2010.0421.1243.20944 - ATI) Hidden
CCC Help Dutch (x32 Version: 2010.0421.1243.20944 - ATI) Hidden
CCC Help English (x32 Version: 2010.0421.1243.20944 - ATI) Hidden
CCC Help Finnish (x32 Version: 2010.0421.1243.20944 - ATI) Hidden
CCC Help French (x32 Version: 2010.0421.1243.20944 - ATI) Hidden
CCC Help German (x32 Version: 2010.0421.1243.20944 - ATI) Hidden
CCC Help Greek (x32 Version: 2010.0421.1243.20944 - ATI) Hidden
CCC Help Hungarian (x32 Version: 2010.0421.1243.20944 - ATI) Hidden
CCC Help Italian (x32 Version: 2010.0421.1243.20944 - ATI) Hidden
CCC Help Japanese (x32 Version: 2010.0421.1243.20944 - ATI) Hidden
CCC Help Korean (x32 Version: 2010.0421.1243.20944 - ATI) Hidden
CCC Help Norwegian (x32 Version: 2010.0421.1243.20944 - ATI) Hidden
CCC Help Polish (x32 Version: 2010.0421.1243.20944 - ATI) Hidden
CCC Help Portuguese (x32 Version: 2010.0421.1243.20944 - ATI) Hidden
CCC Help Russian (x32 Version: 2010.0421.1243.20944 - ATI) Hidden
CCC Help Spanish (x32 Version: 2010.0421.1243.20944 - ATI) Hidden
CCC Help Swedish (x32 Version: 2010.0421.1243.20944 - ATI) Hidden
CCC Help Thai (x32 Version: 2010.0421.1243.20944 - ATI) Hidden
CCC Help Turkish (x32 Version: 2010.0421.1243.20944 - ATI) Hidden
ccc-core-static (x32 Version: 2010.0421.1244.20944 - ATI) Hidden
ccc-utility64 (Version: 2010.0421.1244.20944 - ATI) Hidden
Cisco AnyConnect VPN Client (HKLM-x32\...\{44257960-C5CC-45BA-8E83-524E4A0F3FD5}) (Version: 2.5.3054 - Cisco Systems, Inc.)
Citavi (HKLM-x32\...\{E12C6653-1FF0-4686-ADB8-589C13AE761F}) (Version: 3.2.0.0 - Swiss Academic Software)
COMODO Internet Security (HKLM\...\{FD8E178D-8B4E-42DA-B434-EFF270329B1C}) (Version: 5.4.57996.1354 - COMODO Security Solutions Inc.)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{92C42EDD-6524-4577-B2EB-6C68C63B6D4A}) (Version: - Microsoft)
Device Access Manager for HP ProtectTools (HKLM\...\{55B52830-024A-443E-AF61-61E1E71AFA1B}) (Version: 5.0.1.6 - Hewlett-Packard)
DirectX 9 Runtime (x32 Version: 1.00.0000 - Sonic Solutions) Hidden
Drive Encryption for HP ProtectTools (HKLM-x32\...\Drive Encryption) (Version: 5.0.6.0 - Hewlett-Packard)
Drive Encryption for HP ProtectTools (Version: 5.0.6.0 - Hewlett-Packard) Hidden
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 15.0.13315 - Landesfinanzdirektion Thüringen)
ElsterFormular-Upgrade (HKLM-x32\...\ElsterFormular für Privatanwender 12.2.2.6665p) (Version: 15.0.13315 - )
Energy Star Digital Logo (HKLM-x32\...\{BD1A34C9-4764-4F79-AE1F-112F8C89D3D4}) (Version: 1.0.1 - Hewlett-Packard)
File Sanitizer For HP ProtectTools (HKLM-x32\...\{6D6ADF03-B257-4EA5-BBC1-1D145AF8D514}) (Version: 5.0.1.3 - Hewlett-Packard)
Free M4a to MP3 Converter 6.2 (HKLM-x32\...\Free M4a to MP3 Converter_is1) (Version: - ManiacTools.com)
Free Mp3 Wma Converter V 2.2 (HKLM-x32\...\Free Mp3 Wma Converter_is1) (Version: 2.2.0.0 - Koyote Soft)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.23.9 - Google Inc.) Hidden
HP 3D DriveGuard (HKLM\...\{299625B9-6C69-462C-9CEA-8E06D878B1C5}) (Version: 4.0.5.1 - Hewlett-Packard Company)
HP Advisor (HKLM-x32\...\{40FB8D7C-6FF8-4AF2-BC8B-0B1DB32AF04B}) (Version: 3.4.10262.3295 - Hewlett-Packard)
HP Customer Experience Enhancements (x32 Version: 6.0.1.4 - Hewlett-Packard) Hidden
HP Documentation (HKLM-x32\...\{4054365C-8CD6-4F08-A2F9-44CADFD7A9D0}) (Version: 1.1.0.0 - Hewlett-Packard)
HP ESU for Microsoft Windows 7 (HKLM-x32\...\{722A2876-B382-4AB5-8CC9-007FF5B28641}) (Version: 1.1.2.1 - Hewlett-Packard Company)
HP HotKey Support (HKLM\...\{4BBA5224-C5B1-4B8C-AAA4-68DA6654B9C1}) (Version: 3.5.15.1 - Hewlett-Packard Company)
HP Power Assistant (HKLM\...\{3C33FD2E-6B21-4CD3-B41A-A7331D467617}) (Version: 1.0.6.0 - Hewlett-Packard)
HP Power Data (HKLM\...\{42DBA167-C25D-49CE-BBAF-DEC25E737DA8}) (Version: 1.0.21.158 - Hewlett-Packard)
HP ProtectTools Security Manager (HKLM\...\HPProtectTools) (Version: 5.07.711 - Hewlett-Packard)
HP ProtectTools Security Manager (Version: 5.07.711 - Hewlett-Packard) Hidden
HP QuickLook (HKLM\...\{E6BEE2A9-04CF-42FF-B95B-BB70FAD2DC3E}) (Version: 3.3.1.4 - Hewlett-Packard Company)
HP QuickWeb (HKLM-x32\...\{7861911B-4270-498A-8F7A-FCF0570F4877}) (Version: 1.0.1.62 - DeviceVM, Inc.)
HP Setup (HKLM-x32\...\{96AC1B0B-02D1-4FAA-9C1E-C92ECA74921A}) (Version: 8.2.4130.3367 - Hewlett-Packard Company)
HP SoftPaq Download Manager (HKLM-x32\...\{2DA697D7-FED3-4DE2-A174-92A2A12F9688}) (Version: 3.0.5.0 - Hewlett-Packard Company)
HP Software Framework (HKLM-x32\...\{DA200FDD-DE3D-4958-8465-C4FBC869544B}) (Version: 3.5.20.1 - Hewlett-Packard Company)
HP Software Setup (HKLM-x32\...\{04801E42-B1A6-4C52-9F3D-CADB5A050433}) (Version: 7.0.1.6 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{08DB3902-2CE0-474D-BCE3-0177766CE9F1}) (Version: 5.1.10.7 - Hewlett-Packard Company)
HP Web Camera (Version: 1.0.0 - Hewlett-Packard) Hidden
HP Webcam (HKLM-x32\...\{1D61E881-43CD-447B-9E6B-D2C6138B2862}) (Version: 1.0.19.5 - Roxio)
HP Webcam Driver (HKLM-x32\...\{399C37FB-08AF-493B-BFED-20FBD85EDF7F}) (Version: 5.8.50012.1 - Sonix)
HP Wireless Assistant (HKLM\...\{EC720706-3F19-4B7F-BDDD-E31D9B3921D2}) (Version: 4.0.6.0 - Hewlett-Packard)
HPAsset component for HP Active Support Library (x32 Version: 3.0.0.3 - Hewlett-Packard) Hidden
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6275.0 - IDT)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel(R) Network Connections Drivers (HKLM\...\PROSet) (Version: 14.8 - Intel)
Intel(R) Turbo Boost Technology Driver (HKLM-x32\...\{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}) (Version: 01.02.00.1002 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - Intel Corporation)
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Java Card Security for HP ProtectTools (HKLM\...\{F4477CC0-7293-414A-93BC-20EE897A80F0}) (Version: 5.0.4.1 - Hewlett-Packard)
K-Lite Mega Codec Pack 9.7.5 (HKLM-x32\...\KLiteCodecPack_is1) (Version: 9.7.5 - )
LightScribe System Software (HKLM-x32\...\{6AFDE3BE-BC01-45A4-9D06-BBF5AD207313}) (Version: 1.18.12.1 - LightScribe)
LSI HDA Modem (HKLM\...\LSI Soft Modem) (Version: 2.2.98 - LSI Corporation)
Malwarebytes Anti-Malware Version 2.00.0.1000 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.00.0.1000 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM-x32\...\McAfee Security Scan) (Version: 3.0.313.1 - McAfee, Inc.)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (HKLM\...\{EE936C7A-EA40-31D5-9B65-8E3E089C3828}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Mozilla Firefox 28.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 12.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Norton Online Backup (HKLM-x32\...\{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}) (Version: 2.0.0.34 - Symantec)
ODBC (HKLM-x32\...\ODBC) (Version: - )
Privacy Manager for HP ProtectTools (HKLM\...\{04255D34-6C6D-4F63-A218-EE8FD2D13AF0}) (Version: 5.10.796 - Hewlett-Packard)
R for Windows 2.13.2 (HKLM\...\R for Windows 2.13.2_is1) (Version: 2.13.2 - R Development Core Team)
RICOH Media Driver (HKLM-x32\...\{F5CC2EF8-20A4-4366-A681-3FE849E65809}) (Version: 2.14.00.05 - RICOH)
Roxio Activation Module (x32 Version: 1.0 - Roxio) Hidden
Roxio Creator Audio (x32 Version: 3.8.0 - Roxio) Hidden
Roxio Creator Business (HKLM-x32\...\{537BF16E-7412-448C-95D8-846E85A1D817}) (Version: 10.3.56.20 - Roxio)
Roxio Creator Business v10 (x32 Version: 3.8.0 - Roxio) Hidden
Roxio Creator Copy (x32 Version: 3.8.0 - Roxio) Hidden
Roxio Creator Data (x32 Version: 3.8.0 - Roxio) Hidden
Roxio Creator Tools (x32 Version: 3.8.0 - Roxio) Hidden
Roxio Express Labeler 3 (x32 Version: 3.2.2 - Roxio) Hidden
Roxio MyDVD (x32 Version: 10.3.349 - Roxio) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) Hidden
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Sonic CinePlayer Decoder Pack (x32 Version: 4.3.0 - Sonic Solutions) Hidden
SSH Secure Shell (HKLM-x32\...\{74E2CD0C-D4A2-11D3-95A6-0000E86CFDE5}) (Version: - )
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.24.0 - Synaptics Incorporated)
Theft Recovery (HKLM-x32\...\InstallShield_{33C9F24B-1D92-4632-A915-81E3BB1D5D6B}) (Version: 5.1.0.21 - Hewlett-Packard)
Theft Recovery (x32 Version: 5.1.0.21 - Hewlett-Packard) Hidden
Tilia (HKLM-x32\...\{6FC35511-B32A-42C3-ABBC-8D87786F9256}) (Version: 1.7.16 - PahaSapa Software)
TrueCrypt (HKLM-x32\...\TrueCrypt) (Version: 7.1a - TrueCrypt Foundation)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2837594) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{D3C85176-ACCC-4AF0-817D-1BC803303B74}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2837594) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{D3C85176-ACCC-4AF0-817D-1BC803303B74}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2494150) (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{3FCFD88F-4D13-4F38-8625-ABABEA7F61EA}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{C70D2038-A2C4-4A99-87DE-5272BB44F0CE}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2863818) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{83B1B530-7D9E-4C6A-907F-E979CEE9C295}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2878225) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{EFF5EBA3-40AD-4859-85E7-3C1CF4F297EB}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{81812245-FC84-426A-BC02-6659C88CC7B2}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2775360) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{80F56E3F-1D47-4E45-B6E0-FEF4E919F4F9}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft)
Update for Microsoft Visio 2010 (KB2878227) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{5D357893-40BA-4323-86BA-D97C66CD72F4}) (Version: - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{8C55AA83-54C2-4236-A622-78440A411DC5}) (Version: - Microsoft)
Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{E78E2B68-8FD1-42EE-BB74-99A4D9E6222D}) (Version: - Microsoft)
Validity Fingerprint Driver (HKLM\...\{DD966CEF-5EA9-4BA2-B210-490FEBC27EA7}) (Version: 4.0.15.0 - Validity Sensors, Inc.)
VD64Inst (Version: 1.00.0000 - Roxio, Inc.) Hidden
VLC media player 1.1.7 (HKLM-x32\...\VLC media player) (Version: 1.1.7 - VideoLAN)
Winamp (HKLM-x32\...\Winamp) (Version: 5.61 - Nullsoft, Inc)
Winamp Erkennungs-Plug-in (HKCU\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc)
Windows 7 Default Setting (HKLM-x32\...\{5BF8E079-D6E2-4323-B794-75152371122A}) (Version: 1.0.1.6 - Hewlett-Packard Company)
Windows Driver Package - Broadcom Bluetooth (07/30/2009 6.2.0.9405) (HKLM\...\6B6B5E96843E55CF5CF8C7E45FB457F1FE642FF1) (Version: 07/30/2009 6.2.0.9405 - Broadcom)
Windows Driver Package - Broadcom Bluetooth (12/16/2009 6.2.0.9414) (HKLM\...\7E38E30BB92ED94B21CF062A7386554CBA991FEB) (Version: 12/16/2009 6.2.0.9414 - Broadcom)
Windows Driver Package - Broadcom HIDClass (07/28/2009 6.2.0.9800) (HKLM\...\3BA80AB4C7E9F8497C115C844953A3D4BEB84D21) (Version: 07/28/2009 6.2.0.9800 - Broadcom)
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
WinRAR 4.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.01.0 - win.rar GmbH)
Yahoo! Detect (HKLM-x32\...\YTdetect) (Version: - )
==================== Restore Points =========================
29-03-2014 12:15:34 Windows Update
30-03-2014 16:54:58 Wiederherstellungsvorgang
30-03-2014 18:13:57 avast! antivirus system restore point
30-03-2014 18:19:25 Windows Update
30-03-2014 18:24:39 Windows-Sicherung
31-03-2014 01:00:17 Windows Update
31-03-2014 19:47:14 Wiederherstellungsvorgang
31-03-2014 21:05:35 avast! antivirus system restore point
31-03-2014 21:13:08 Windows Update
31-03-2014 21:15:50 Windows-Sicherung
01-04-2014 22:39:36 RegClean Pro Mi, Apr 02, 14 00:39
02-04-2014 18:28:04 zoek.exe restore point
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {294F752F-2DE9-4CB8-8652-91ED25C7933C} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-02-10] (AVAST Software)
Task: {4D1883FA-CDF8-4302-9533-CE4DAD64F20C} - \Advanced System Protector_startup No Task File
Task: {89A6869C-F8C8-43CB-9B34-3438B5B9B81F} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-23] (Adobe Systems Incorporated)
Task: {B38113D7-5543-4A2F-91A6-7231B0A9DD21} - \Advanced System Protector No Task File
Task: {B39E13FA-8E93-41C7-A3FD-1E39F6137481} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {C9D1798D-13BC-42AF-AB41-1829433976A9} - System32\Tasks\HPCeeScheduleFor**** => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-01-05] (Hewlett-Packard)
Task: {E11FCD71-797B-4F4D-81BA-A79571222067} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-11-17] (Google Inc.)
Task: {FC8CD364-3752-44C1-A744-B05A15EAF2CC} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-11-17] (Google Inc.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\HPCeeScheduleFor****.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
==================== Loaded Modules (whitelisted) =============
2014-02-04 12:02 - 2014-02-04 12:02 - 00034304 _____ () C:\windows\System32\ssj2mlm.dll
2010-04-20 17:10 - 2010-04-20 17:10 - 00100352 _____ () c:\Program Files\Hewlett-Packard\Pre-Boot Security for HP ProtectTools\BIOSDomainPlugin.dll
2010-04-05 20:15 - 2010-04-05 20:15 - 00267832 _____ () C:\Program Files\Hewlett-Packard\HP Power Assistant\HPCommon.XmlSerializers.dll
2010-04-05 20:12 - 2010-04-05 20:12 - 00267832 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPCommon.XmlSerializers.dll
2009-12-30 00:19 - 2009-12-30 00:19 - 00173344 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll
2012-01-08 15:08 - 2011-05-28 23:05 - 00164864 _____ () C:\Program Files\WinRAR\rarext.dll
2010-04-05 20:15 - 2010-04-05 20:15 - 00052280 _____ () C:\Program Files\Hewlett-Packard\HP Power Assistant\HardwareAccess.dll
2010-04-05 20:15 - 2010-04-05 20:15 - 00055352 _____ () C:\Program Files\Hewlett-Packard\HP Power Assistant\Graphs.dll
2010-04-13 02:59 - 2010-04-13 02:59 - 00098304 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2011-02-02 04:47 - 2011-02-02 04:47 - 00270336 _____ () C:\windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2010-04-05 20:11 - 2010-04-05 20:11 - 00030264 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_LogicLayer.dll
2010-04-05 20:12 - 2010-04-05 20:12 - 00052280 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HardwareAccess.dll
2014-04-02 20:18 - 2014-04-02 16:11 - 02189312 _____ () C:\Program Files\AVAST Software\Avast\defs\14040204\algo.dll
2010-02-22 20:19 - 2010-02-22 20:19 - 02121728 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll
2010-02-22 20:19 - 2010-02-22 20:19 - 07745536 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll
2010-02-22 20:19 - 2010-02-22 20:19 - 00135168 _____ () C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll
2014-01-16 00:46 - 2014-01-16 00:46 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2011-04-25 23:10 - 2014-04-03 14:27 - 03642480 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2010-02-10 03:58 - 2010-02-10 03:58 - 00061440 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Pillars\PCAlerts\PCAlertsPillar.dll
2010-02-10 03:58 - 2010-02-10 03:58 - 00131072 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Pillars\ECenter\ECLibrary.dll
2010-02-10 03:58 - 2010-02-10 03:58 - 00040960 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingServer.dll
2010-02-10 03:58 - 2010-02-10 03:58 - 00005632 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingInterface.dll
2010-02-10 03:58 - 2010-02-10 03:58 - 00018944 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingMessages.dll
2010-02-10 03:58 - 2010-02-10 03:58 - 00036864 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingClients.dll
2010-02-10 03:58 - 2010-02-10 03:58 - 00028672 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.Logging.dll
2010-02-10 03:58 - 2010-02-10 03:58 - 00007680 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\RemotingClient.dll
2014-03-23 00:22 - 2014-03-23 00:22 - 16276872 _____ () C:\windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vsmon => ""="Service"
==================== Disabled items from MSCONFIG ==============
==================== Faulty Device Manager Devices =============
Name: Cisco AnyConnect VPN Virtual Miniport Adapter for Windows x64
Description: Cisco AnyConnect VPN Virtual Miniport Adapter for Windows x64
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Unknown Device
Description: Unknown Device
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: (Standard-USB-Hostcontroller)
Service:
Problem: : Windows has stopped this device because it has reported problems. (Code 43)
Resolution: One of the drivers controlling the device notified the operating system that the device failed in some manner. For more information about how to diagnose the problem, see the hardware documentation.
==================== Event log errors: =========================
Application errors:
==================
System errors:
=============
Error: (04/04/2014 00:12:26 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst lmhosts erreicht.
Error: (04/03/2014 11:33:11 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst avast! Antivirus erreicht.
Error: (04/03/2014 11:33:09 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (04/03/2014 11:33:09 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht.
Error: (04/03/2014 11:33:09 PM) (Source: DCOM) (User: )
Description: 1053WSearch{9E175B6D-F52A-11D8-B9A5-505054503030}
Error: (04/03/2014 11:32:33 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "McAfee SiteAdvisor Enterprise Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (04/03/2014 02:06:54 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "McAfee SiteAdvisor Enterprise Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (04/02/2014 09:10:58 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "McAfee SiteAdvisor Enterprise Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (04/02/2014 08:45:52 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error: (04/02/2014 08:45:51 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Microsoft Office Sessions:
=========================
CodeIntegrity Errors:
===================================
Date: 2013-05-15 00:05:42.415
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\guard64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-07-11 17:44:39.790
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\guard64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-05-31 20:15:44.612
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-05-31 19:59:36.892
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-05-31 00:09:23.924
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-05-30 09:57:55.734
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-05-30 09:07:03.609
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-05-30 04:16:04.365
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-05-29 23:37:57.592
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-05-29 23:19:54.684
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 49%
Total physical RAM: 3951.43 MB
Available physical RAM: 1997.19 MB
Total Pagefile: 4237.61 MB
Available Pagefile: 1647.83 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:448.47 GB) (Free:234.07 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (Expansion Drive) (Fixed) (Total:465.76 GB) (Free:33.44 GB) NTFS
Drive f: (HP_TOOLS) (Fixed) (Total:1.99 GB) (Free:1.48 GB) FAT32
Drive g: (SAMSUNG_LBP) (CDROM) (Total:0.28 GB) (Free:0 GB) CDFS
Drive i: (32_00_00) (Fixed) (Total:232.88 GB) (Free:35.34 GB) NTFS
Drive k: (8ER) (Removable) (Total:7.46 GB) (Free:0.18 GB) FAT32
Drive m: () (Removable) (Total:1.97 GB) (Free:0.93 GB) FAT
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 8C949010)
Partition 1: (Not Active) - (Size=300 MB) - (Type=07 NTFS)
Partition 2: (Active) - (Size=448 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=2 GB) - (Type=0C)
========================================================
Disk: 1 (Size: 2 GB) (Disk ID: 00145022)
Partition 1: (Active) - (Size=2 GB) - (Type=06)
========================================================
Disk: 2 (Size: 7 GB) (Disk ID: 00000000)
Partition: GPT Partition Type.
========================================================
Disk: 3 (Size: 466 GB) (Disk ID: 009B0398)
Partition 1: (Active) - (Size=466 GB) - (Type=07 NTFS)
========================================================
Disk: 4 (MBR Code: Windows XP) (Size: 233 GB) (Disk ID: 92708B0E)
Partition 1: (Active) - (Size=233 GB) - (Type=07 NTFS)
==================== End Of Log ============================
System Look: Code:
ATTFilter SystemLook 30.07.11 by jpshortstuff
Log created at 01:10 on 04/04/2014 by ****
Administrator - Elevation successful
========== filefind ==========
Searching for "*Advanced System Protector*"
C:\AdwCleaner\Quarantine\C\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced System Protector\Advanced System Protector entfernen.lnk.vir --a---- 1144 bytes [22:44 01/04/2014] [22:44 01/04/2014] F0633E2935FE01CB20C2392B32195F8B
C:\AdwCleaner\Quarantine\C\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced System Protector\Advanced System Protector Trouble Shooter.lnk.vir --a---- 1367 bytes [22:44 01/04/2014] [22:44 01/04/2014] C85D24A3888254AA526F1D68B86939A2
C:\AdwCleaner\Quarantine\C\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced System Protector\Advanced System Protector.lnk.vir --a---- 1219 bytes [22:44 01/04/2014] [22:44 01/04/2014] 814ECB3664986CCA422090036885AE26
C:\AdwCleaner\Quarantine\C\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced System Protector\Register Advanced System Protector.lnk.vir --a---- 1245 bytes [22:44 01/04/2014] [22:44 01/04/2014] 296DB4DC134F95545BE596237A7D4AB2
C:\AdwCleaner\Quarantine\C\windows\System32\Tasks\Advanced System Protector.vir --a---- 3314 bytes [22:36 01/04/2014] [22:36 01/04/2014] 48D23B3D1A4F2B1A05899D01E18AE696
C:\AdwCleaner\Quarantine\C\windows\System32\Tasks\Advanced System Protector_startup.vir --a---- 3120 bytes [23:06 01/04/2014] [13:51 02/04/2014] 98342549CD0966FC7C44185DB67F883C
Searching for "*Iminent*"
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Iminent\Iminent.crx.vir --a---- 694817 bytes [15:41 29/04/2013] [10:51 25/04/2013] B5838A8FFFBEE52D66D78EE90DCFDDFE
Searching for "*Conduit*"
C:\AdwCleaner\Quarantine\C\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\Conduit\cachedIcons\http___storage_conduit_com_50_261_CT2613550_Images_634084971246361250.png.vir --a---- 1526 bytes [20:00 24/02/2011] [20:00 24/02/2011] 7BA55E9BB92E4627EA667C7E8787B35C
C:\AdwCleaner\Quarantine\C\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\ConduitCommon\cachedIcons\http___storage_conduit_com_50_261_CT2613550_Images_634084971246361250.png.vir --a---- 1526 bytes [22:35 17/04/2012] [22:35 17/04/2012] 7BA55E9BB92E4627EA667C7E8787B35C
C:\AdwCleaner\Quarantine\C\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\searchplugins\Conduit.xml.vir --a---- 943 bytes [20:00 24/02/2011] [20:23 24/04/2012] 3AC23F4D45FFDC9477BD14ADCEB81CA0
Searching for "*Mobogenie*"
C:\AdwCleaner\Quarantine\C\Users\****\AppData\Local\Mobogenie\Data\mobogenie_u_user_dl.mg.vir --a---- 3072 bytes [14:45 02/01/2014] [14:45 02/01/2014] EBEE736AEC90A4F5D1E115F145FD8956
Searching for "*searchqu*"
C:\AdwCleaner\Quarantine\C\Users\****\AppData\Local\Temp\searchqutoolbar-manifest.xml.vir --a---- 9422 bytes [08:42 27/02/2012] [08:42 27/02/2012] B4CF632013D5A08B137DB737D2825F12
Searching for "*lollipop*"
C:\AdwCleaner\Quarantine\C\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\lollipop.lnk.vir --a---- 1956 bytes [21:58 28/10/2013] [22:15 28/10/2013] 82F93C12D75040799E1BC456DBC6C0B5
C:\AdwCleaner\Quarantine\C\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lollipop.lnk.vir --a---- 1253 bytes [21:58 28/10/2013] [22:15 28/10/2013] 124777E1620DC9A7BC37BE7C5DCB5427
C:\Program Files\R\R-2.13.2\library\rgl\demo\lollipop3d.R --a---- 4768 bytes [00:49 10/10/2011] [00:42 10/10/2011] E0359E5A9FEA398708925A890A856138
C:\Users\****\Documents\Tanja eigenes\Bücher\Calibre Bibliothek\Rivers\Lollipop Lick (6418) d------ [03:46 07/02/2014]
========== folderfind ==========
Searching for "*Advanced System Protector*"
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Advanced System Protector d------ [16:24 02/04/2014]
C:\AdwCleaner\Quarantine\C\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced System Protector d------ [16:24 02/04/2014]
C:\AdwCleaner\Quarantine\C\ProgramData\Systweak\Advanced System Protector d------ [16:24 02/04/2014]
C:\AdwCleaner\Quarantine\C\Users\****\AppData\Roaming\Systweak\Advanced System Protector d------ [16:24 02/04/2014]
Searching for "*Iminent*"
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Iminent d------ [16:24 02/04/2014]
C:\AdwCleaner\Quarantine\C\Users\****\AppData\Roaming\Iminent d------ [16:24 02/04/2014]
Searching for "*Conduit*"
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Conduit d------ [16:24 02/04/2014]
C:\AdwCleaner\Quarantine\C\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\Conduit d------ [16:24 02/04/2014]
C:\AdwCleaner\Quarantine\C\Users\zerl\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\ConduitCommon d------ [16:24 02/04/2014]
C:\Users\AppData\LocalLow\Conduit d------ [17:04 17/02/2011]
Searching for "*Mobogenie*"
C:\AdwCleaner\Quarantine\C\Users\****\AppData\Local\Mobogenie d------ [16:24 02/04/2014]
Searching for "*searchqu*"
C:\zoek_backup\C_windows_sysWoW64_config_systemprofile_AppData_LocalLow_searchquband d-a---- [18:46 02/04/2014]
C:\zoek_backup\C_windows_sysWoW64_config_systemprofile_AppData_LocalLow_searchqutoolbar d-a---- [18:46 02/04/2014]
Searching for "*lollipop*"
C:\Users\zerl\Documents\Tanja eigenes\Bücher\Calibre Bibliothek\Rivers\Lollipop Lick (6418) d------ [03:46 07/02/2014]
========== regfind ==========
Searching for "Advanced System Protector"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\command]
@="C:\Program Files (x86)\Advanced System Protector\filetypehelper.exe -scanunknown "%1""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\command]
"Advanced System Protector.bak"="C:\windows\SysWow64\rundll32.exe C:\windows\system32\shell32.dll,OpenAs_RunDLL %1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\opendlg\command]
@="C:\Program Files (x86)\Advanced System Protector\filetypehelper.exe -scanunknown "%1""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\opendlg\command]
"Advanced System Protector.bak"="C:\windows\SysWow64\rundll32.exe C:\windows\system32\shell32.dll,OpenAs_RunDLL %1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4D1883FA-CDF8-4302-9533-CE4DAD64F20C}]
"Path"="\Advanced System Protector_startup"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B38113D7-5543-4A2F-91A6-7231B0A9DD21}]
"Path"="\Advanced System Protector"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Advanced System Protector]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Advanced System Protector_startup]
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\Firewall\Policy\3]
"Filename"="C:\Program Files (x86)\Advanced System Protector\AdvancedSystemProtector.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\Firewall\Policy\3]
"DeviceName"="C:\Program Files (x86)\Advanced System Protector\AdvancedSystemProtector.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\Firewall\Policy\64]
"Filename"="C:\Program Files (x86)\Advanced System Protector\clamunpack\clamscan.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\Firewall\Policy\64]
"DeviceName"="C:\Program Files (x86)\Advanced System Protector\clamunpack\clamscan.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\1\Rules\0\Allowed\4]
"Filename"="C:\Program Files (x86)\Advanced System Protector\AdvancedSystemProtector.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\1\Rules\0\Allowed\4]
"DeviceName"="C:\Program Files (x86)\Advanced System Protector\AdvancedSystemProtector.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\10]
"Filename"="C:\Users\****\AppData\Roaming\Advanced System Protector\aspsetup.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\10]
"DeviceName"="C:\Users\****\AppData\Roaming\Advanced System Protector\aspsetup.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\11\Rules\0\Allowed\0]
"Filename"="C:\Users\****\AppData\Roaming\Advanced System Protector\aspsetup.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\11\Rules\0\Allowed\0]
"DeviceName"="C:\Users\****\AppData\Roaming\Advanced System Protector\aspsetup.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\11\Rules\4\Allowed\2]
"Filename"="C:\Users\****\AppData\Roaming\Advanced System Protector\aspsetup.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\11\Rules\4\Allowed\2]
"DeviceName"="C:\Users\****\AppData\Roaming\Advanced System Protector\aspsetup.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\262\Rules\0\Allowed\12]
"Filename"="C:\Program Files (x86)\Advanced System Protector\unins000.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\262\Rules\0\Allowed\12]
"DeviceName"="C:\Program Files (x86)\Advanced System Protector\unins000.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\288]
"Filename"="C:\Program Files (x86)\Advanced System Protector\clamunpack\clamscan.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\288]
"DeviceName"="C:\Program Files (x86)\Advanced System Protector\clamunpack\clamscan.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\7]
"Filename"="C:\Program Files (x86)\Advanced System Protector\unins000.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\7]
"DeviceName"="C:\Program Files (x86)\Advanced System Protector\unins000.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\8]
"Filename"="C:\Program Files (x86)\Advanced System Protector\AdvancedSystemProtector.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\8]
"DeviceName"="C:\Program Files (x86)\Advanced System Protector\AdvancedSystemProtector.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\8\Rules\0\Allowed\0]
"Filename"="C:\Program Files (x86)\Advanced System Protector\clamunpack\clamscan.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\8\Rules\0\Allowed\0]
"DeviceName"="C:\Program Files (x86)\Advanced System Protector\clamunpack\clamscan.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\9\Rules\2\Allowed\0]
"Filename"="HKUS\S-1-5-21-3883071668-826525904-3960972044-1002\Software\Microsoft\Windows\CurrentVersion\Run\Advanced System Protector"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\9\Rules\2\Allowed\0]
"DeviceName"="HKUS\S-1-5-21-3883071668-826525904-3960972044-1002\Software\Microsoft\Windows\CurrentVersion\Run\Advanced System Protector"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\9\Rules\2\Allowed\1]
"Filename"="HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Advanced System Protector"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\9\Rules\2\Allowed\1]
"DeviceName"="HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Advanced System Protector"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\9\Rules\2\Allowed\2]
"Filename"="HKUS\S-1-5-21-3883071668-826525904-3960972044-1002\Software\Microsoft\Windows\CurrentVersion\Run\Advanced System Protector_startup"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\9\Rules\2\Allowed\2]
"DeviceName"="HKUS\S-1-5-21-3883071668-826525904-3960972044-1002\Software\Microsoft\Windows\CurrentVersion\Run\Advanced System Protector_startup"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\9\Rules\2\Allowed\3]
"Filename"="HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Advanced System Protector_startup"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\9\Rules\2\Allowed\3]
"DeviceName"="HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Advanced System Protector_startup"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\9\Rules\4\Allowed\2]
"Filename"="C:\Program Files (x86)\Advanced System Protector\AdvancedSystemProtector.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\9\Rules\4\Allowed\2]
"DeviceName"="C:\Program Files (x86)\Advanced System Protector\AdvancedSystemProtector.exe"
Searching for "Iminent"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\Iminent.Messengers.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Iminent\inst\Bootstrapper\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Iminent\inst\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Iminent\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5]
"00000000000000000000000000000000"="C:\Program Files (x86)\Iminent\inst\Bootstrapper\Bootstrapper.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375]
"00000000000000000000000000000000"="02:\SOFTWARE\Iminent\AppInstanceUid"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\43C098337DB065A49B665D4EA7F16D1C]
"00000000000000000000000000000000"="C:\Program Files (x86)\Iminent\StartWeb.xml"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A71991503412AEB42838B02C5ED9F9CD]
"00000000000000000000000000000000"="C:\Program Files (x86)\Iminent\UniverselyWeb.xml"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F7652513C62FF63448CFF05163719DB7]
"00000000000000000000000000000000"="C:\Program Files (x86)\Iminent\SearchTheWeb.xml"
Searching for "Conduit"
No data found.
Searching for "Mobogenie"
[HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.8\com.trolltech.Qt.QImageIOHandlerFactoryInterface:\C:\Program Files (x86)\Mobogenie]
[HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.8\com.trolltech.Qt.QSqlDriverFactoryInterface:\C:\Program Files (x86)\Mobogenie]
[HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Plugin Cache 4.8.false\C:\Program Files (x86)\Mobogenie]
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\38\Rules\0\Allowed\2]
"Filename"="C:\Users\****\AppData\Local\Temp\a22c0080-c097-45b5-be0c-5395d0ca4b360\software\Mobogenie_Setup_2.1.35_602.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\38\Rules\0\Allowed\2]
"DeviceName"="C:\Users\****\AppData\Local\Temp\a22c0080-c097-45b5-be0c-5395d0ca4b360\software\Mobogenie_Setup_2.1.35_602.exe"
[HKEY_USERS\S-1-5-21-3883071668-826525904-3960972044-1002\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.8\com.trolltech.Qt.QImageIOHandlerFactoryInterface:\C:\Program Files (x86)\Mobogenie]
[HKEY_USERS\S-1-5-21-3883071668-826525904-3960972044-1002\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.8\com.trolltech.Qt.QSqlDriverFactoryInterface:\C:\Program Files (x86)\Mobogenie]
[HKEY_USERS\S-1-5-21-3883071668-826525904-3960972044-1002\Software\Trolltech\OrganizationDefaults\Qt Plugin Cache 4.8.false\C:\Program Files (x86)\Mobogenie]
Searching for "searchqu"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}]
@="ISearchQueryHelper"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}]
@="ISearchQueryHelper"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}]
@="ISearchQueryHelper"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\260\Rules\14\Allowed\11]
"Filename"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\ToolBar\Uninstall.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\260\Rules\14\Allowed\11]
"DeviceName"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\ToolBar\Uninstall.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\260\Rules\14\Allowed\12]
"Filename"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\IEBHO.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\260\Rules\14\Allowed\12]
"DeviceName"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\IEBHO.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\260\Rules\14\Allowed\13]
"Filename"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\BrowserConnection.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\260\Rules\14\Allowed\13]
"DeviceName"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\BrowserConnection.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\260\Rules\14\Allowed\14]
"Filename"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\DnsBHO.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\260\Rules\14\Allowed\14]
"DeviceName"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\DnsBHO.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\260\Rules\14\Allowed\15]
"Filename"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\x64\IEBHO.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\260\Rules\14\Allowed\15]
"DeviceName"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\x64\IEBHO.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\260\Rules\14\Allowed\16]
"Filename"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\x64\BrowserConnection.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\260\Rules\14\Allowed\16]
"DeviceName"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\x64\BrowserConnection.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\260\Rules\14\Allowed\17]
"Filename"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\x64\DnsBHO.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\260\Rules\14\Allowed\17]
"DeviceName"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\x64\DnsBHO.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\260\Rules\14\Allowed\9]
"Filename"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\installhelper.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\260\Rules\14\Allowed\9]
"DeviceName"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\installhelper.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\262\Rules\0\Allowed\14]
"Filename"="C:\Program Files (x86)\Windows Searchqu Toolbar\uninstall.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\262\Rules\0\Allowed\14]
"DeviceName"="C:\Program Files (x86)\Windows Searchqu Toolbar\uninstall.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\271\Rules\0\Allowed\8]
"Filename"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\datamngrUI.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\271\Rules\0\Allowed\8]
"DeviceName"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\datamngrUI.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\292]
"Filename"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\datamngrUI.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\292]
"DeviceName"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\datamngrUI.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\322]
"Filename"="C:\Program Files (x86)\Windows Searchqu Toolbar\uninstall.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\322]
"DeviceName"="C:\Program Files (x86)\Windows Searchqu Toolbar\uninstall.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\323]
"Filename"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\installhelper.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\323]
"DeviceName"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\installhelper.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\324]
"Filename"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\ToolBar\uninstall.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\324]
"DeviceName"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\ToolBar\uninstall.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\325\Rules\0\Allowed\0]
"Filename"="C:\Users\****\AppData\Local\Temp\nsm8DEE.tmp\Searchqu Toolbar uninstall.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\325\Rules\0\Allowed\0]
"DeviceName"="C:\Users\****\AppData\Local\Temp\nsm8DEE.tmp\Searchqu Toolbar uninstall.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\326]
"Filename"="C:\Users\****\AppData\Local\Temp\nsm8DEE.tmp\Searchqu Toolbar uninstall.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\326]
"DeviceName"="C:\Users\****\AppData\Local\Temp\nsm8DEE.tmp\Searchqu Toolbar uninstall.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\91]
"Filename"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\x64\BrowserConnection.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\91]
"DeviceName"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\x64\BrowserConnection.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\92]
"Filename"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\x64\DnsBHO.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\92]
"DeviceName"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\x64\DnsBHO.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\93]
"Filename"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\x64\IEBHO.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\93]
"DeviceName"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\x64\IEBHO.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\94]
"Filename"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\BrowserConnection.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\94]
"DeviceName"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\BrowserConnection.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\95]
"Filename"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\DnsBHO.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\95]
"DeviceName"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\DnsBHO.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\96]
"Filename"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\IEBHO.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\96]
"DeviceName"="C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\IEBHO.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\98]
"Filename"="C:\Users\****\AppData\Local\Temp\SetupDataMngr_Searchqu.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\98]
"DeviceName"="C:\Users\****\AppData\Local\Temp\SetupDataMngr_Searchqu.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\99\Rules\4\Allowed\3]
"Filename"="C:\Users\****\AppData\Local\Temp\SetupDataMngr_Searchqu.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\HIPS\Policy\99\Rules\4\Allowed\3]
"DeviceName"="C:\Users\****\AppData\Local\Temp\SetupDataMngr_Searchqu.exe"
[HKEY_USERS\.DEFAULT\Software\AppDataLow\Software\searchqutoolbar]
[HKEY_USERS\S-1-5-18\Software\AppDataLow\Software\searchqutoolbar]
Searching for "lollipop"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\Firewall\Policy\17]
"Filename"="C:\Users\****\AppData\Local\Lollipop\Lollipop.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro\Configurations\2\Firewall\Policy\17]
"DeviceName"="C:\Users\****\AppData\Local\Lollipop\Lollipop.exe"
Searching for " "
[HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Users\****\Desktop\mbam-setup-2.0.0.1000.exe"=" Malwarebytes Anti-Malware "
[HKEY_LOCAL_MACHINE\SOFTWARE\Canon\WIA\Devices\MP280 series]
"ProductId"="MP280 "
[HKEY_LOCAL_MACHINE\SOFTWARE\Canon\WIA\Devices\MP550 series]
"ProductId"="MP550 "
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\Microsoft.PowerShell]
"ConfigXML"=" <PlugInConfiguration xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Name="microsoft.powershell" Filename="%windir%\system32\pwrshplugin.dll" SDKVersion="1" XmlRenderingType="text" > <InitializationParameters> <Param Name="PSVersion" Value="2.0"/> </InitializationParameters> <Resources> <Resource ResourceUri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell" SupportsOptions="true" ExactMatch="true"> <Security xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Uri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell" ExactMatch="true" Sddl="O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)"/> <Capability Type="Shell"/> </Resource> </Res
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\Microsoft.PowerShell32]
"ConfigXML"="<PlugInConfiguration xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Name="microsoft.powershell32" Filename="%windir%\system32\pwrshplugin.dll" SDKVersion="1" XmlRenderingType="text" Architecture="32" > <InitializationParameters> <Param Name="PSVersion" Value="2.0"/> </InitializationParameters> <Resources> <Resource ResourceUri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell32" SupportsOptions="true" ExactMatch="true"> <Security xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Uri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell32" ExactMatch="true" Sddl="O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)"/>
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_EASY&PROD_DISK&REV_1100#AA04012900007454&0#]
"DeviceDesc"="Disk "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_MATSHITA&PROD_DMC-FX8&REV_0100#7&1A901AB0&0#]
"DeviceDesc"="DMC-FX8 "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_MATSHITA&PROD_DMC-FX8&REV_0100#7&468B1F3&0#]
"DeviceDesc"="DMC-FX8 "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_SANDISK&PROD_CRUZER&REV_8.01#17380011D30232F1&0#]
"DeviceDesc"="Cruzer "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_SIGMATEL&PROD_MSCN&REV_0001#012345678901&0#]
"DeviceDesc"="MSCN "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_EASY&PROD_DISK&REV_1100#AA04012900007454&0#]
"DeviceDesc"="Disk "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_MATSHITA&PROD_DMC-FX8&REV_0100#7&1A901AB0&0#]
"DeviceDesc"="DMC-FX8 "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_MATSHITA&PROD_DMC-FX8&REV_0100#7&468B1F3&0#]
"DeviceDesc"="DMC-FX8 "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_SANDISK&PROD_CRUZER&REV_8.01#17380011D30232F1&0#]
"DeviceDesc"="Cruzer "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_SIGMATEL&PROD_MSCN&REV_0001#012345678901&0#]
"DeviceDesc"="MSCN "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_EASY&PROD_DISK&REV_1100#AA04012900007454&0#]
"DeviceDesc"="Disk "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_MATSHITA&PROD_DMC-FX8&REV_0100#7&1A901AB0&0#]
"DeviceDesc"="DMC-FX8 "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_MATSHITA&PROD_DMC-FX8&REV_0100#7&468B1F3&0#]
"DeviceDesc"="DMC-FX8 "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_SANDISK&PROD_CRUZER&REV_8.01#17380011D30232F1&0#]
"DeviceDesc"="Cruzer "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_SIGMATEL&PROD_MSCN&REV_0001#012345678901&0#]
"DeviceDesc"="MSCN "
[HKEY_USERS\S-1-5-21-3883071668-826525904-3960972044-1002\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Users\****\Desktop\mbam-setup-2.0.0.1000.exe"=" Malwarebytes Anti-Malware "
[HKEY_USERS\S-1-5-21-3883071668-826525904-3960972044-1002_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Users\****\Desktop\mbam-setup-2.0.0.1000.exe"=" Malwarebytes Anti-Malware "
-= EOF =-
LG Melian |
|
04.04.2014, 17:52
| #6 | |
| /// TB-Ausbilder | Advanced System Protector entfernen bei Windows 7 Servus, Zitat:
Wir entfernen die letzten Reste und kontrollieren nochmal alles. ESET kann länger (> 2 h) dauern. Im Anschluss daran räumen wir auf und ich gebe dir noch ein paar Tipps mit auf den Weg. Schritt 1 Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter start
SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} URL =
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
Toolbar: HKLM - No Name - !{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Toolbar: HKLM-x32 - No Name - !{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
C:\Users\AppData\LocalLow\Conduit
Task: {4D1883FA-CDF8-4302-9533-CE4DAD64F20C} - \Advanced System Protector_startup No Task File
Task: {B38113D7-5543-4A2F-91A6-7231B0A9DD21} - \Advanced System Protector No Task File
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\Iminent.Messengers.exe" /f
Reg: reg delete "HKEY_CURRENT_USER\Software\Trolltech" /f
end
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Schritt 2 Downloade dir die passende Version von HitmanPro auf deinen Desktop: HitmanPro - 32 Bit | HitmanPro - 64 Bit.
Schritt 3 ESET Online Scanner
Schritt 4 Downloade Dir bitte  SecurityCheck und:
Bitte poste mit deiner nächsten Antwort
__________________ --> Advanced System Protector entfernen bei Windows 7 |
|
04.04.2014, 19:04
| #7 |
| | Advanced System Protector entfernen bei Windows 7 Hallo M-K-D-B, nur ne kurze Frage: Bei HitmanPro steht, bevor Scan startet auf, "warte auf Internetverbindung" - die aber besteht.... Sollen denn bei unter "Einstellungen" die Häkchen zum Hochladen der Dateien in die Scan-Cloud entfernt werden? Lg Melian |
|
05.04.2014, 10:41
| #8 | ||
| /// TB-Ausbilder | Advanced System Protector entfernen bei Windows 7Zitat:
Zitat:
__________________ Bitte beachten: Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten? |
|
05.04.2014, 17:19
| #9 |
| | Advanced System Protector entfernen bei Windows 7 Hallo M-K-D-B, musste bei HitmanPro die Firewall deaktivieren.... Wow, endlich alles durchgelaufen, hat ja schon lange gedauert. Hier die logfiles: Fixlog von FRTS: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-03-2014
Ran by **** at 2014-04-04 19:50:33 Run:1
Running from C:\Users\****\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
start
SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} URL =
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
Toolbar: HKLM - No Name - !{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Toolbar: HKLM-x32 - No Name - !{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
C:\Users\AppData\LocalLow\Conduit
Task: {4D1883FA-CDF8-4302-9533-CE4DAD64F20C} - \Advanced System Protector_startup No Task File
Task: {B38113D7-5543-4A2F-91A6-7231B0A9DD21} - \Advanced System Protector No Task File
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\Iminent.Messengers.exe" /f
Reg: reg delete "HKEY_CURRENT_USER\Software\Trolltech" /f
end
*****************
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key deleted successfully.
HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\!{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} => Value deleted successfully.
HKCR\CLSID\!{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\!{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} => Value deleted successfully.
HKCR\Wow6432Node\CLSID\!{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} => Key not found.
C:\Users\AppData\LocalLow\Conduit => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{4D1883FA-CDF8-4302-9533-CE4DAD64F20C} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4D1883FA-CDF8-4302-9533-CE4DAD64F20C} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Advanced System Protector_startup => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{B38113D7-5543-4A2F-91A6-7231B0A9DD21} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B38113D7-5543-4A2F-91A6-7231B0A9DD21} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Advanced System Protector => Key deleted successfully.
========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\Iminent.Messengers.exe" /f =========
Der Vorgang wurde erfolgreich beendet.
========= End of Reg: =========
========= reg delete "HKEY_CURRENT_USER\Software\Trolltech" /f =========
Der Vorgang wurde erfolgreich beendet.
========= End of Reg: =========
==== End of Fixlog ====
Code:
ATTFilter HitmanPro 3.7.9.216
www.hitmanpro.com
Computer name . . . . : ****-HP
Windows . . . . . . . : 6.1.1.7601.X64/4
User name . . . . . . : ****-HP\****
UAC . . . . . . . . . : Enabled
License . . . . . . . : Trial (30 days left)
Scan date . . . . . . : 2014-04-04 20:08:49
Scan mode . . . . . . : Normal
Scan duration . . . . : 9m 24s
Disk access mode . . : Direct disk access (SRB)
Cloud . . . . . . . . : Internet
Reboot . . . . . . . : No
Threats . . . . . . . : 0
Traces . . . . . . . : 85
Objects scanned . . . : 2.458.570
Files scanned . . . . : 173.342
Remnants scanned . . : 823.456 files / 1.461.772 keys
Potential Unwanted Programs _________________________________________________
HKLM\SOFTWARE\Classes\Unknown\shell\openas\command\Advanced System Protector.bak (AdvSysProtector) -> Deleted
HKLM\SOFTWARE\Classes\Unknown\shell\opendlg\command\Advanced System Protector.bak (AdvSysProtector) -> Deleted
HKU\S-1-5-21-3883071668-826525904-3960972044-1002\Software\Microsoft\Internet Explorer\Approved Extensions\{9D717F81-9148-4F12-8568-69135F087DB0} (SearchQU) -> Deleted
HKU\S-1-5-21-3883071668-826525904-3960972044-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9D717F81-9148-4f12-8568-69135F087DB0},\ (SearchQU) -> Deleted
Cookies _____________________________________________________________________
C:\Users\Administrator.****-HP\AppData\Roaming\Mozilla\Firefox\Profiles\r2edbjxf.default\cookies.sqlite:apmebf.com
C:\Users\Administrator.****-HP\AppData\Roaming\Mozilla\Firefox\Profiles\r2edbjxf.default\cookies.sqlite:doubleclick.net
C:\Users\Administrator.****-HP\AppData\Roaming\Mozilla\Firefox\Profiles\r2edbjxf.default\cookies.sqlite:mediaplex.com
C:\Users\Administrator.****-HP\AppData\Roaming\Mozilla\Firefox\Profiles\r2edbjxf.default\cookies.sqlite:www.googleadservices.com
C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Cookies:doubleclick.net
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:247realmedia.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:2o7.net
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:3276817.fls.doubleclick.net
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:ad-emea.doubleclick.net
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:ad.123-template.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:ad.360yield.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:ad.ad-srv.net
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:ad.adc-serv.net
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:ad.adnet.de
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:ad.dyntracker.de
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:ad.movad.net
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:ad.torrentus.to
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:ad.yieldmanager.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:ads.betweendigital.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:ads.creative-serving.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:ads.dk-online.de
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:ads.escinteractive.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:ads.p161.net
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:ads.pubmatic.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:ads.stickyadstv.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:ads.yahoo.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:adtech.de
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:adtechus.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:advertising.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:adviva.net
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:apmebf.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:ar.atwola.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:at.atwola.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:atdmt.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:bs.serving-sys.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:burstnet.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:casalemedia.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:conrad.122.2o7.net
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:cunda.122.2o7.net
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:de.sitestat.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:doubleclick.net
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:eas.apm.emediate.eu
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:emjcd.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:fastclick.net
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:googleads.g.doubleclick.net
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:in.getclicky.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:invitemedia.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:loyaltypartner.122.2o7.net
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:media6degrees.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:mediaplex.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:overture.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:paypal.112.2o7.net
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:pool-eu-ie.creative-serving.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:realmedia.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:revsci.net
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:ru4.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:serving-sys.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:smartadserver.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:specificclick.net
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:stat.dealtime.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:statcounter.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:stats.paypal.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:stats.webstarts.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:statse.webtrendslive.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:tacoda.at.atwola.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:track.adform.net
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:track.effiliation.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:track.hubrus.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:track.tnm.de
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:track.zalando.de
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:tradedoubler.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:tribalfusion.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:uk.at.atwola.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:ww251.smartadserver.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:www.etracker.de
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:www.googleadservices.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:www4.smartadserver.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:xiti.com
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:yadro.ru
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:yieldmanager.net
C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\uttrjezt.default\cookies.sqlite:zedo.com
ESET: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=50d4b86b7283a345b2fb7198feaa51bf
# engine=17760
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-04-04 11:16:44
# local_time=2014-04-05 01:16:44 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=774 16777213 85 77 0 4669194 0 0
# compatibility_mode=3074 16777213 100 100 28020058 98969386 0 0
# compatibility_mode=5893 16776573 100 94 42514 148283254 0 0
# scanned=153630
# found=0
# cleaned=0
# scan_time=17351
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=50d4b86b7283a345b2fb7198feaa51bf
# engine=17763
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-04-05 09:33:06
# local_time=2014-04-05 11:33:06 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=774 16777213 85 77 0 4706176 0 0
# compatibility_mode=3074 16777213 100 100 28057040 99006368 0 0
# compatibility_mode=5893 16776573 100 94 79496 148320236 0 0
# scanned=450034
# found=0
# cleaned=0
# scan_time=34198
und SecurityCheck: Code:
ATTFilter Results of screen317's Security Check version 0.99.80
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
avast! Antivirus
Antivirus out of date!
`````````Anti-malware/Other Utilities Check:`````````
Java 7 Update 51
Adobe Flash Player 10 Flash Player out of Date!
Adobe Flash Player 12.0.0.77
Adobe Reader 10.1.9 Adobe Reader out of Date!
Mozilla Firefox (28.0)
````````Process Check: objlist.exe by Laurent````````
Comodo Firewall cmdagent.exe
Comodo Firewall cfp.exe
AVAST Software Avast AvastSvc.exe
AVAST Software Avast avastui.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
Lg Melian |
|
05.04.2014, 18:20
| #10 | |
| /// TB-Ausbilder | Advanced System Protector entfernen bei Windows 7 Servus, Zitat:
Wenn du keine Probleme mehr hast, dann sind wir hier fertig. Deine Logdateien sind sauber.  Zum Schluss müssen wir noch ein paar abschließende Schritte unternehmen, um deinen Pc aufzuräumen und abzusichern. Schritt 4
Schritt 5 Die Reihenfolge ist hier entscheidend.
Schritt 6 Abschließend habe ich noch ein paar Tipps zur Absicherung deines Systems. Ich kann gar nicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti-Viren-Programm und zusätzlicher Schutz
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden. Mozilla Firefox
Performance
Was du vermeiden solltest:
Nun bleibt mir nur noch dir viel Spaß beim sicheren Surfen zu wünschen... ... und vielleicht möchtest du ja das Trojaner-Board unterstützen? Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann.
__________________ Bitte beachten: Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten? |
|
07.04.2014, 18:09
| #11 |
| | Advanced System Protector entfernen bei Windows 7 Hallo M-K-D-B, so, habe - den Adobe Flash Player 10 Active X deinstalliert - Defogger re-enabled - DelFix runtergeladen - bei Windows waren die automatischen Updates aktiv - Secunia hab ich runtergeladen, macht aber Probleme (angeblich kann es nicht aufs netzt zugreifen, ffg. wegen Firewall? Will die aber nicht hunterfahren!) Gibt es eine Programmalternative? - MalwareBytes Anti Malware ist da - AdwCleaner auch - SpywareBlaster auch - die Adds WOT, NoSkropt und AdBlockPlus check - TFC runtergeladen - werde versuchen, mich im Netz zurückzuhalten! Vielen, vielen Dank! Lg Melian |
|
08.04.2014, 19:51
| #12 | |
| /// TB-Ausbilder | Advanced System Protector entfernen bei Windows 7Zitat:
 Ich bin froh, dass wir helfen konnten  In diesem Forum kannst du eine kurze Rückmeldung zur Bereinigung abgeben, sofern du das möchtest: Lob, Kritik und Wünsche Klicke dazu auf den Button "NEUES THEMA" und poste ein kleines Feedback. Vielen Dank! Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Solltest Du das Thema erneut brauchen, schicke mir bitte eine PM. Jeder andere bitte hier klicken und einen eigenen Thread erstellen.
__________________ Bitte beachten: Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten? |
|
| Themen zu Advanced System Protector entfernen bei Windows 7 |
| 4d36e972-e325-11ce-bfc1-08002be10318, advanced system protector, antivirus, branding, checkliste, converter, device driver, excel, flash player, homepage, iexplore.exe, koyote, programm, pup.optional.datamngr.a, pup.optional.feven.a, pup.optional.iminent.a, pup.optional.searchqu, schädling, services.exe, siteadvisor, svchost.exe, symantec, vista, windows |
und 
und speichere die Logdatei auf Deinem Desktop.
Linear-Darstellung
