| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Pup.Optional.BloackAndSurf.AWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
22.05.2014, 09:58
| #1 |
 |  Pup.Optional.BloackAndSurf.A findet m alware bei mir im Win 7 64 bit System 20 x oder so ich habe irgendwie was installiert und dann war das, da, auch ist es noch immer beim Start da und in der Systemsteuerung nicht zu finden, Bloack and Surf steht im Tasktray rechts unten. Code:
ATTFilter Malwarebytes Anti-Malware (PRO) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.05.21.07 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.17107 Ich :: ICH-PC [Administrator] Schutz: Deaktiviert 22.05.2014 08:02:45 MBAM-log-2014-05-22 (10-55-31).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|K:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 1350218 Laufzeit: 2 Stunde(n), 48 Minute(n), 8 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 7 HKCU\Software\TowerTilt (PUP.Optional.TowerTilt.A) -> Keine Aktion durchgeführt. HKCU\Software\Distromatic\Toolbars (PUP.Optional.AlexaTB.A) -> Keine Aktion durchgeführt. HKLM\Software\TowerTilt (PUP.Optional.TowerTilt.A) -> Keine Aktion durchgeführt. HKCR\CLSID\{937A1B1A-CEF1-66D2-1282-9A748A6657D3} (PUP.Optional.BlockAndSurf.A) -> Keine Aktion durchgeführt. HKCR\TypeLib\{1749DEB8-DAD3-F97F-C90B-714083E4171C} (PUP.Optional.BlockAndSurf.A) -> Keine Aktion durchgeführt. HKCR\Interface\{3EEBC721-2F8F-34D8-0B7D-DB7AFE03ABE7} (PUP.Optional.BlockAndSurf.A) -> Keine Aktion durchgeführt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{937A1B1A-CEF1-66D2-1282-9A748A6657D3} (PUP.Optional.BlockAndSurf.A) -> Keine Aktion durchgeführt. Infizierte Registrierungswerte: 1 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|BlockNSurf (PUP.Optional.BlockAndSurf.A) -> Daten: C:\Program Files (x86)\BlockAndSurf-soft\BlockNSurf.exe -> Keine Aktion durchgeführt. Infizierte Dateiobjekte der Registrierung: 1 HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (Hijack.StartPage) -> Bösartig: (http://www.buenosearch.com/?babsrc=HP_ss&mntrId=56852208CAE4DF32&affID=128235&tsp=5254) Gut: (http://www.google.com) -> Keine Aktion durchgeführt. Infizierte Verzeichnisse: 1 C:\Program Files (x86)\BlockAndSurf-soft (PUP.Optional.BlockAndSurf.A) -> Keine Aktion durchgeführt. Infizierte Dateien: 10 C:\Program Files (x86)\BlockAndSurf-soft\170.crx (PUP.Optional.BlockAndSurf.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\BlockAndSurf-soft\170.dll (PUP.Optional.BlockAndSurf.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\BlockAndSurf-soft\170.xpi (PUP.Optional.BlockAndSurf.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\BlockAndSurf-soft\a.db (PUP.Optional.BlockAndSurf.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\BlockAndSurf-soft\b.db (PUP.Optional.BlockAndSurf.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\BlockAndSurf-soft\BlockAndSurfr04.exe (PUP.Optional.BlockAndSurf.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\BlockAndSurf-soft\BlockAndSurfZA170.bin (PUP.Optional.BlockAndSurf.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\BlockAndSurf-soft\BlockNSurf.exe (PUP.Optional.BlockAndSurf.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\BlockAndSurf-soft\Sqlite3.dll (PUP.Optional.BlockAndSurf.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\BlockAndSurf-soft\Uninstall.exe (PUP.Optional.BlockAndSurf.A) -> Keine Aktion durchgeführt. (Ende) ach ja udn das bild kommt dauernd oder öfters in letzter Zeit  |
|
22.05.2014, 10:14
| #2 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Pup.Optional.BloackAndSurf.AZitat:
  Ich versteh sowas nicht, warum nennst du das nicht, oder hast du es vergessen weil du aus Langeweile deinen Rechner zugemüllt und dir daher den Programmnamen nicht gemerkt hast? Mal davon abgesehen hast du noch die alte Version von Malwarebytes und Logs von FRST fehlen.
__________________ |
|
22.05.2014, 10:53
| #3 |
| | Pup.Optional.BloackAndSurf.A nein ich habe was gesucht habe den Card Reader oder so installiert so ein programm wo man bilder von einer speicherkarte retten kann, habe die vollversion gesucht die da stand udn installiert und dann waren da einige Dinger da die ich versucht ahbe zu löschen sowas wie Tower kit usw. und dass gelang mir nicht, über geblieben ist ds dauernd sich öffnende Block Dings da.
__________________von malware antimalwarebytes habe ich die Version 1.75.0.1300 schätze dass ist die alte oder? also ich guck mal und installier gleich die neue Jetzt mache ich mal das mit der neuen- wußte gar icht dass es die gibt - Malwarebytes Anti-Malware (Premium) 2.0.2.1012 und mache dass mit dem DrohSuchlauf - der stärkste suchlauf was da steht und wieder wird was gefunden, ich packs nicht ds gibts ja nicht so dss ist das log vom neuen malware Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 22.05.2014 Suchlauf-Zeit: 11:28:51 Logdatei: log.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.05.22.04 Rootkit Datenbank: v2014.05.21.01 Lizenz: Premium Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Ich Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 381145 Verstrichene Zeit: 4 Min, 19 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Warnen PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 3 PUP.Optional.BrowseFox.A, HKLM\SOFTWARE\CLASSES\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}, , [d69652028fec5adcb9c7570a7b87817f], PUP.Optional.GetNow.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{237FDFDB-3722-470E-8BA8-90196DABE967}, , [b9b3fa5afd7ef5413f3bc9654ab82bd5], PUP.Optional.GetNow.A, HKLM\SOFTWARE\CLASSES\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}, , [bab2134193e8f244d4a672bc35cd06fa], Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 7 PUP.Optional.HelperBar.A, HKU\S-1-5-21-653767932-1258093497-3206199211-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Bar, http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=AT&userid=4fc45845-3624-4b3e-8449-1c1099b79c3a&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}, Gut: (www.google.com), Schlecht: (http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=AT&userid=4fc45845-3624-4b3e-8449-1c1099b79c3a&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}),,[a2ca074d96e550e693cc0346e420cd33] PUP.Optional.HelperBar.A, HKU\S-1-5-21-653767932-1258093497-3206199211-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Bar, http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=AT&userid=4fc45845-3624-4b3e-8449-1c1099b79c3a&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}, Gut: (http://www.google.com), Schlecht: (http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=AT&userid=4fc45845-3624-4b3e-8449-1c1099b79c3a&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}),,[74f89fb53d3e63d39fa9f65d37cdbb45] PUP.Optional.HelperBar.A, HKU\S-1-5-21-653767932-1258093497-3206199211-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Default_Search_URL, http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=AT&userid=4fc45845-3624-4b3e-8449-1c1099b79c3a&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}, Gut: (www.google.com), Schlecht: (http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=AT&userid=4fc45845-3624-4b3e-8449-1c1099b79c3a&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}),,[204c32222a512511d38f2b1e8282f40c] PUP.Optional.HelperBar.A, HKU\S-1-5-21-653767932-1258093497-3206199211-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Default_Search_URL, http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=AT&userid=4fc45845-3624-4b3e-8449-1c1099b79c3a&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}, Gut: (http://www.google.com), Schlecht: (http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=AT&userid=4fc45845-3624-4b3e-8449-1c1099b79c3a&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}),,[521a015397e4df5797b480d3887cb749] PUP.Optional.HelperBar.A, HKU\S-1-5-21-653767932-1258093497-3206199211-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|SearchAssistant, http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=AT&userid=4fc45845-3624-4b3e-8449-1c1099b79c3a&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}, Gut: (www.google.com), Schlecht: (http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=AT&userid=4fc45845-3624-4b3e-8449-1c1099b79c3a&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}),,[a8c444108fec3cfa075c4ffa64a0857b] PUP.Optional.HelperBar.A, HKU\S-1-5-21-653767932-1258093497-3206199211-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|SearchAssistant, http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=AT&userid=4fc45845-3624-4b3e-8449-1c1099b79c3a&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}, Gut: (http://www.google.com), Schlecht: (http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=AT&userid=4fc45845-3624-4b3e-8449-1c1099b79c3a&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}),,[690390c4a4d786b087c57fd48e76ae52] PUP.Optional.HelperBar.A, HKU\S-1-5-21-653767932-1258093497-3206199211-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=AT&userid=4fc45845-3624-4b3e-8449-1c1099b79c3a&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}, Gut: (www.google.com), Schlecht: (http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=AT&userid=4fc45845-3624-4b3e-8449-1c1099b79c3a&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}),,[0e5e1c3836456dc9124c2128bf45f808] Ordner: 3 PUP.Optional.AmazonTB.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\jetpack\abb@amazon.com, , [97d596be5d1ef93df3e04c2d986abf41], PUP.Optional.AmazonTB.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\jetpack\abb@amazon.com\simple-storage, , [97d596be5d1ef93df3e04c2d986abf41], PUP.Optional.Conduit.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\CT3289847, , [89e3f4606d0ebc7a35adc6b3ad5527d9], Dateien: 101 PUP.Optional.SweetIM.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\searchplugins\sweetim.xml, , [0765272d99e224121fc7800a6e94d62a], PUP.Optional.TowerTilt.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\extensions\{587cb346-a3d8-4884-b39b-f0ed918b6f96}.xpi, , [fb71b1a394e74fe77a946431679b9a66], PUP.Optional.TowerTilt.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\e03ctse8.default-1386090037992\extensions\{587cb346-a3d8-4884-b39b-f0ed918b6f96}.xpi, , [eb812430324960d6f41a6d288d75c43c], PUP.Optional.TowerTilt.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\mData\extensions\{587cb346-a3d8-4884-b39b-f0ed918b6f96}.xpi, , [acc09fb5f48783b31af4d0c539c959a7], PUP.Optional.Babylon.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\searchplugins\babylon.xml, , [87e5fb590f6c013563340097d42e847c], PUP.Optional.BuenoSearch.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\searchplugins\buenosearch.xml, , [7def64f02d4ea98dd9de8d0aa65c56aa], PUP.Optional.BuenoSearch.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\searchplugins\buenosearch.xml, , [0e5ef65e601b6acc2e896433ba4812ee], PUP.Optional.Conduit.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\searchplugins\conduit.xml, , [d09c4f0592e9e65023a0752224deb947], PUP.Optional.Conduit.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\searchplugins\conduit-search.xml, , [7def3024b7c4bb7b6262c6d139c96997], PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\searchplugins\delta.xml, , [caa2e56fdaa1d462666af0a7956d639d], PUP.Optional.MegaBrowse.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\extensions\{29b136c9-938d-4d3d-8df8-d649d9b74d02}.xpi, , [412b0c488eed5dd9e752f5a307fb8a76], PUP.Optional.MegaBrowse.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\e03ctse8.default-1386090037992\extensions\{29b136c9-938d-4d3d-8df8-d649d9b74d02}.xpi, , [80ec73e11c5f6ec8ff3a494f7290d42c], PUP.Optional.MegaBrowse.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\mData\extensions\{29b136c9-938d-4d3d-8df8-d649d9b74d02}.xpi, , [83e969eba5d6e155b782f4a4917122de], PUP.Optional.MixiDJ.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\searchplugins\mixidj.xml, , [561682d2de9d261039064a4e689a34cc], PUP.Optional.PCPerformer.A, C:\Windows\System32\roboot64.exe, , [1a52272db6c5c373147b7a22976b867a], PUP.Optional.AmazonTB.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\jetpack\abb@amazon.com\simple-storage\store.json, , [97d596be5d1ef93df3e04c2d986abf41], PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.admin", false);), ,[0468fb59c2b938fe3eb590efcf35ef11] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.aflt", "babsst");), ,[115bf361700b6bcb1ed5eb9423e1db25] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");), ,[f4786ce8fb80cd6962915b24a95bff01] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.autoRvrt", "false");), ,[59130054f18a0d29e90ad6a9808417e9] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.dfltLng", "de");), ,[78f4312399e2181ef300a4db4bb942be] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.excTlbr", false);), ,[6309351f67147abc6192522d976d936d] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.ffxUnstlRst", true);), ,[4a22cf855526fd392cc73b447391b14f] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.id", "56852f7f0000000000002208cae4df32");), ,[8ddfe66ee59682b4ea09a9d6f80ca55b] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.instlDay", "15922");), ,[5c10a5af0972ed49bb38bec1a262ae52] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.instlRef", "sst");), ,[f676cd876f0c191d747faad5976d2cd4] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.newTab", false);), ,[b8b40d472259bd799e55ef9032d29868] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.prdct", "delta");), ,[1b5188cc1269290de40f334ca16356aa] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.prtnrId", "delta");), ,[92da83d14b3042f42cc794ebc93be917] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.rvrt", "false");), ,[c5a72d273645211505eeed92ec18956b] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.smplGrp", "none");), ,[8ce002528dee1521599a057acc38ae52] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.tlbrId", "base");), ,[3c3014401d5e1026ba39fb84758f8c74] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.tlbrSrchUrl", "");), ,[9ad273e1750645f16e85fa85966e31cf] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.vrsn", "1.8.22.0");), ,[6dff92c2b6c5e94d45aeec9309fbc43c] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.vrsnTs", "1.8.22.07:52:11");), ,[1a521044d8a32016767d5e213fc531cf] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.vrsni", "1.8.22.0");), ,[c7a55ef6d4a73303658ed7a8788ca55b] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta_i.babExt", "");), ,[f17b88cc16654bebb1423649c63efc04] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta_i.babTrack", "affID=123639&tsp=4965");), ,[8ae2de7638430b2b4da6572816ee4bb5] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta_i.srcExt", "ss");), ,[6b0168ec3f3caa8c27ccb2cd1ce89f61] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.admin", false);), ,[7bf1074dd9a27eb8a24cb9c737cda759] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.aflt", "babsst");), ,[2e3e97bdcbb0d66037b7b3cd669e8a76] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.appId", "{37EB75F2-7392-4DBE-B5AD-147EC6D7BF5F}");), ,[beae81d30c6fa88e2dc1c8b80df7847c] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.autoRvrt", "false");), ,[d597233134471422bb33c9b739cb629e] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.dfltLng", "de");), ,[2f3de3712c4fda5cc12dd6aad72d29d7] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.excTlbr", false);), ,[254764f0d1aaf83e5e9081ff6c98fc04] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.ffxUnstlRst", true);), ,[7fedd97ba4d751e538b6aed2f60ea858] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.id", "56852f7f0000000000002208cae4df32");), ,[da925400304b78be34baff81cf35f30d] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.instlDay", "16211");), ,[323acb89ee8d46f0608e176915eff50b] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.instlRef", "sst");), ,[5d0f2c28ceadb97d26c8e79927ddae52] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.newTab", false);), ,[56162e26007b2f07ba34206043c1aa56] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.prdct", "buenosearch");), ,[422a22327efd6ec8d01e4b3547bdb44c] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.prtnrId", "buenosearch");), ,[6a02aba935462c0a7876245c92722fd1] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.rvrt", "false");), ,[600c94c0502b56e07a74037dc73df808] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.smplGrp", "none");), ,[aac274e00774fb3b5f8f8cf4d33116ea] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.tb_url", "http://www.buenosearch.com/?q={searchTerms}&babsrc=TB_ss&mntrId=56852208CAE4DF32&affID=128235&tsp=5254");), ,[80ece0748deeaf87f6f89ee21aea827e] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.tlbrId", "base");), ,[a5c788cc403bd16509e55b25fe06936d] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.tlbrSrchUrl", "http://www.buenosearch.com/?q={searchTerms}&babsrc=TB_ss&mntrId=56852208CAE4DF32&affID=128235&tsp=5254");), ,[82ea9db7700bb284c02eacd437cd9769] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.vrsn", "1.8.28.7");), ,[5418b1a32c4f50e6d618e29e7193d030] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.vrsnTs", "1.8.28.719:03:30");), ,[026a81d3f28966d09c52017f5ea660a0] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.vrsni", "1.8.28.7");), ,[f07cd381a2d9ed4906e83a4691733fc1] PUP.Optional.BuenoSearch.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.tlbrSrchUrl", "http://www.buenosearch.com/?q={searchTerms}&babsrc=TB_ss&mntrId=56852208CAE4DF32&affID=128235&tsp=5254");), ,[bab26ce835468ea808e7dea126dea957] PUP.Optional.BuenoSearch.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.tb_url", "http://www.buenosearch.com/?q={searchTerms}&babsrc=TB_ss&mntrId=56852208CAE4DF32&affID=128235&tsp=5254");), ,[73f93d172556b28436b9bdc2b054f709] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.id", "56852f7f0000000000002208cae4df32");), ,[3c30f65ec2b9a19521cc5d235aaa03fd] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.appId", "{37EB75F2-7392-4DBE-B5AD-147EC6D7BF5F}");), ,[016b65ef89f285b1df0e156b30d47090] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.instlDay", "16211");), ,[4b21aba92f4c181e5499651bbe46c23e] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.vrsn", "1.8.28.7");), ,[fa72450fa8d3d46217d689f7669eff01] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.vrsni", "1.8.28.7");), ,[6705f95b6e0deb4b8b62334dc34115eb] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.vrsnTs", "1.8.28.719:03:30");), ,[35378bc9661556e0628b1e62dc287987] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.prtnrId", "buenosearch");), ,[9ad2332166153bfbffee6e12976d02fe] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.prdct", "buenosearch");), ,[1953ef658deed264ea038000f11354ac] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.aflt", "babsst");), ,[77f5aca89fdce94de904324eef1535cb] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.smplGrp", "none");), ,[c4a8f36186f5da5c519c0b75d72d936d] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.tlbrId", "base");), ,[95d7e173502b88ae8e5f4e32e91b41bf] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.instlRef", "sst");), ,[b9b332221a61b383a449f38d3fc56a96] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.dfltLng", "de");), ,[5c10ea6afc7fe94d727b037d927228d8] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.excTlbr", false);), ,[b8b4b59f5526b581ae3f0d73f3116b95] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.ffxUnstlRst", true);), ,[f17b5afa13680e28eeff2957ff0539c7] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.admin", false);), ,[bcb0f163e19a8ea8f8f5b6cab2528080] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.autoRvrt", "false");), ,[f775fb59fa819e9808e5027e41c36799] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.rvrt", "false");), ,[c1aba5aff586072f23caff81ce3638c8] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.newTab", false);), ,[37353f15eb90b87eda134f311be910f0] PUP.Optional.BuenoSearch.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.tb_url", "http://www.buenosearch.com/?q={searchTerms}&babsrc=TB_ss&mntrId=56852208CAE4DF32&affID=128235&tsp=5254");), ,[cf9ddb799fdc36006f80c5bacb399868] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.id", "56852f7f0000000000002208cae4df32");), ,[016b4b090c6f89ad27c67d03ff05718f] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.appId", "{37EB75F2-7392-4DBE-B5AD-147EC6D7BF5F}");), ,[97d5e96bb2c9cb6bd81599e77f85619f] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.instlDay", "16211");), ,[fe6e5df70972b97dbf2e552bef15ab55] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.vrsn", "1.8.28.7");), ,[2f3daca855261f17a746156b36ceaa56] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.vrsni", "1.8.28.7");), ,[98d48fc55a213105806d532d0301b14f] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.vrsnTs", "1.8.28.719:03:31");), ,[8fddec68067544f2c5281a6690741de3] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.prtnrId", "buenosearch");), ,[482456fe5b203afc628b1f61cd377d83] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.prdct", "buenosearch");), ,[c5a769eb1d5ebd79bc318af67f852cd4] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.aflt", "babsst");), ,[9ece282cdaa13006fdf0c7b9679d619f] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.smplGrp", "none");), ,[e38995bf047744f208e5008054b0ba46] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.tlbrId", "base");), ,[8ce0163ef08b49edd7167c049074d828] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.instlRef", "sst");), ,[303c9fb5730802346d80e29e94704bb5] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.dfltLng", "de");), ,[660624302a510333c12cc5bb828223dd] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.excTlbr", false);), ,[422a3b19cfac191daa431e62df25946c] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.ffxUnstlRst", true);), ,[2b41d97b3c3f3501dd10d0b0cf35946c] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.admin", false);), ,[ef7dbd97c3b8cd698a631967749009f7] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.autoRvrt", "false");), ,[77f5f75db9c29f9734b998e8689c02fe] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.rvrt", "false");), ,[82ea82d2116a77bf7d70681815ef9967] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.newTab", false);), ,[53195afaa2d94cea0edf0a76c143936d] Physische Sektoren: 0 (No malicious items detected) (end) Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 22.05.2014 Suchlauf-Zeit: 11:28:51 Logdatei: log2.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.05.22.04 Rootkit Datenbank: v2014.05.21.01 Lizenz: Premium Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Ich Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 381145 Verstrichene Zeit: 4 Min, 19 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Warnen PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 3 PUP.Optional.BrowseFox.A, HKLM\SOFTWARE\CLASSES\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}, Keine Aktion durch Benutzer, [d69652028fec5adcb9c7570a7b87817f], PUP.Optional.GetNow.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{237FDFDB-3722-470E-8BA8-90196DABE967}, Keine Aktion durch Benutzer, [b9b3fa5afd7ef5413f3bc9654ab82bd5], PUP.Optional.GetNow.A, HKLM\SOFTWARE\CLASSES\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}, Keine Aktion durch Benutzer, [bab2134193e8f244d4a672bc35cd06fa], Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 7 PUP.Optional.HelperBar.A, HKU\S-1-5-21-653767932-1258093497-3206199211-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Bar, http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=AT&userid=4fc45845-3624-4b3e-8449-1c1099b79c3a&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}, Gut: (www.google.com), Schlecht: (http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=AT&userid=4fc45845-3624-4b3e-8449-1c1099b79c3a&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}),Keine Aktion durch Benutzer,[a2ca074d96e550e693cc0346e420cd33] PUP.Optional.HelperBar.A, HKU\S-1-5-21-653767932-1258093497-3206199211-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Bar, http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=AT&userid=4fc45845-3624-4b3e-8449-1c1099b79c3a&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}, Gut: (http://www.google.com), Schlecht: (http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=AT&userid=4fc45845-3624-4b3e-8449-1c1099b79c3a&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}),Keine Aktion durch Benutzer,[74f89fb53d3e63d39fa9f65d37cdbb45] PUP.Optional.HelperBar.A, HKU\S-1-5-21-653767932-1258093497-3206199211-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Default_Search_URL, http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=AT&userid=4fc45845-3624-4b3e-8449-1c1099b79c3a&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}, Gut: (www.google.com), Schlecht: (http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=AT&userid=4fc45845-3624-4b3e-8449-1c1099b79c3a&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}),Keine Aktion durch Benutzer,[204c32222a512511d38f2b1e8282f40c] PUP.Optional.HelperBar.A, HKU\S-1-5-21-653767932-1258093497-3206199211-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Default_Search_URL, http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=AT&userid=4fc45845-3624-4b3e-8449-1c1099b79c3a&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}, Gut: (http://www.google.com), Schlecht: (http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=AT&userid=4fc45845-3624-4b3e-8449-1c1099b79c3a&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}),Keine Aktion durch Benutzer,[521a015397e4df5797b480d3887cb749] PUP.Optional.HelperBar.A, HKU\S-1-5-21-653767932-1258093497-3206199211-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|SearchAssistant, http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=AT&userid=4fc45845-3624-4b3e-8449-1c1099b79c3a&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}, Gut: (www.google.com), Schlecht: (http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=AT&userid=4fc45845-3624-4b3e-8449-1c1099b79c3a&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}),Keine Aktion durch Benutzer,[a8c444108fec3cfa075c4ffa64a0857b] PUP.Optional.HelperBar.A, HKU\S-1-5-21-653767932-1258093497-3206199211-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|SearchAssistant, http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=AT&userid=4fc45845-3624-4b3e-8449-1c1099b79c3a&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}, Gut: (http://www.google.com), Schlecht: (http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=AT&userid=4fc45845-3624-4b3e-8449-1c1099b79c3a&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}),Keine Aktion durch Benutzer,[690390c4a4d786b087c57fd48e76ae52] PUP.Optional.HelperBar.A, HKU\S-1-5-21-653767932-1258093497-3206199211-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=AT&userid=4fc45845-3624-4b3e-8449-1c1099b79c3a&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}, Gut: (www.google.com), Schlecht: (http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=AT&userid=4fc45845-3624-4b3e-8449-1c1099b79c3a&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}),Keine Aktion durch Benutzer,[0e5e1c3836456dc9124c2128bf45f808] Ordner: 3 PUP.Optional.AmazonTB.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\jetpack\abb@amazon.com, Keine Aktion durch Benutzer, [97d596be5d1ef93df3e04c2d986abf41], PUP.Optional.AmazonTB.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\jetpack\abb@amazon.com\simple-storage, Keine Aktion durch Benutzer, [97d596be5d1ef93df3e04c2d986abf41], PUP.Optional.Conduit.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\CT3289847, Keine Aktion durch Benutzer, [89e3f4606d0ebc7a35adc6b3ad5527d9], Dateien: 101 PUP.Optional.SweetIM.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\searchplugins\sweetim.xml, Keine Aktion durch Benutzer, [0765272d99e224121fc7800a6e94d62a], PUP.Optional.TowerTilt.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\extensions\{587cb346-a3d8-4884-b39b-f0ed918b6f96}.xpi, Keine Aktion durch Benutzer, [fb71b1a394e74fe77a946431679b9a66], PUP.Optional.TowerTilt.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\e03ctse8.default-1386090037992\extensions\{587cb346-a3d8-4884-b39b-f0ed918b6f96}.xpi, Keine Aktion durch Benutzer, [eb812430324960d6f41a6d288d75c43c], PUP.Optional.TowerTilt.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\mData\extensions\{587cb346-a3d8-4884-b39b-f0ed918b6f96}.xpi, Keine Aktion durch Benutzer, [acc09fb5f48783b31af4d0c539c959a7], PUP.Optional.Babylon.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\searchplugins\babylon.xml, Keine Aktion durch Benutzer, [87e5fb590f6c013563340097d42e847c], PUP.Optional.BuenoSearch.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\searchplugins\buenosearch.xml, Keine Aktion durch Benutzer, [7def64f02d4ea98dd9de8d0aa65c56aa], PUP.Optional.BuenoSearch.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\searchplugins\buenosearch.xml, Keine Aktion durch Benutzer, [0e5ef65e601b6acc2e896433ba4812ee], PUP.Optional.Conduit.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\searchplugins\conduit.xml, Keine Aktion durch Benutzer, [d09c4f0592e9e65023a0752224deb947], PUP.Optional.Conduit.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\searchplugins\conduit-search.xml, Keine Aktion durch Benutzer, [7def3024b7c4bb7b6262c6d139c96997], PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\searchplugins\delta.xml, Keine Aktion durch Benutzer, [caa2e56fdaa1d462666af0a7956d639d], PUP.Optional.MegaBrowse.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\extensions\{29b136c9-938d-4d3d-8df8-d649d9b74d02}.xpi, Keine Aktion durch Benutzer, [412b0c488eed5dd9e752f5a307fb8a76], PUP.Optional.MegaBrowse.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\e03ctse8.default-1386090037992\extensions\{29b136c9-938d-4d3d-8df8-d649d9b74d02}.xpi, Keine Aktion durch Benutzer, [80ec73e11c5f6ec8ff3a494f7290d42c], PUP.Optional.MegaBrowse.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\mData\extensions\{29b136c9-938d-4d3d-8df8-d649d9b74d02}.xpi, Keine Aktion durch Benutzer, [83e969eba5d6e155b782f4a4917122de], PUP.Optional.MixiDJ.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\searchplugins\mixidj.xml, Keine Aktion durch Benutzer, [561682d2de9d261039064a4e689a34cc], PUP.Optional.PCPerformer.A, C:\Windows\System32\roboot64.exe, Keine Aktion durch Benutzer, [1a52272db6c5c373147b7a22976b867a], PUP.Optional.AmazonTB.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\jetpack\abb@amazon.com\simple-storage\store.json, Keine Aktion durch Benutzer, [97d596be5d1ef93df3e04c2d986abf41], PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.admin", false);), Keine Aktion durch Benutzer,[0468fb59c2b938fe3eb590efcf35ef11] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.aflt", "babsst");), Keine Aktion durch Benutzer,[115bf361700b6bcb1ed5eb9423e1db25] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");), Keine Aktion durch Benutzer,[f4786ce8fb80cd6962915b24a95bff01] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.autoRvrt", "false");), Keine Aktion durch Benutzer,[59130054f18a0d29e90ad6a9808417e9] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.dfltLng", "de");), Keine Aktion durch Benutzer,[78f4312399e2181ef300a4db4bb942be] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.excTlbr", false);), Keine Aktion durch Benutzer,[6309351f67147abc6192522d976d936d] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.ffxUnstlRst", true);), Keine Aktion durch Benutzer,[4a22cf855526fd392cc73b447391b14f] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.id", "56852f7f0000000000002208cae4df32");), Keine Aktion durch Benutzer,[8ddfe66ee59682b4ea09a9d6f80ca55b] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.instlDay", "15922");), Keine Aktion durch Benutzer,[5c10a5af0972ed49bb38bec1a262ae52] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.instlRef", "sst");), Keine Aktion durch Benutzer,[f676cd876f0c191d747faad5976d2cd4] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.newTab", false);), Keine Aktion durch Benutzer,[b8b40d472259bd799e55ef9032d29868] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.prdct", "delta");), Keine Aktion durch Benutzer,[1b5188cc1269290de40f334ca16356aa] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.prtnrId", "delta");), Keine Aktion durch Benutzer,[92da83d14b3042f42cc794ebc93be917] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.rvrt", "false");), Keine Aktion durch Benutzer,[c5a72d273645211505eeed92ec18956b] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.smplGrp", "none");), Keine Aktion durch Benutzer,[8ce002528dee1521599a057acc38ae52] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.tlbrId", "base");), Keine Aktion durch Benutzer,[3c3014401d5e1026ba39fb84758f8c74] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.tlbrSrchUrl", "");), Keine Aktion durch Benutzer,[9ad273e1750645f16e85fa85966e31cf] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.vrsn", "1.8.22.0");), Keine Aktion durch Benutzer,[6dff92c2b6c5e94d45aeec9309fbc43c] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.vrsnTs", "1.8.22.07:52:11");), Keine Aktion durch Benutzer,[1a521044d8a32016767d5e213fc531cf] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.vrsni", "1.8.22.0");), Keine Aktion durch Benutzer,[c7a55ef6d4a73303658ed7a8788ca55b] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta_i.babExt", "");), Keine Aktion durch Benutzer,[f17b88cc16654bebb1423649c63efc04] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta_i.babTrack", "affID=123639&tsp=4965");), Keine Aktion durch Benutzer,[8ae2de7638430b2b4da6572816ee4bb5] PUP.Optional.Delta.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta_i.srcExt", "ss");), Keine Aktion durch Benutzer,[6b0168ec3f3caa8c27ccb2cd1ce89f61] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.admin", false);), Keine Aktion durch Benutzer,[7bf1074dd9a27eb8a24cb9c737cda759] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.aflt", "babsst");), Keine Aktion durch Benutzer,[2e3e97bdcbb0d66037b7b3cd669e8a76] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.appId", "{37EB75F2-7392-4DBE-B5AD-147EC6D7BF5F}");), Keine Aktion durch Benutzer,[beae81d30c6fa88e2dc1c8b80df7847c] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.autoRvrt", "false");), Keine Aktion durch Benutzer,[d597233134471422bb33c9b739cb629e] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.dfltLng", "de");), Keine Aktion durch Benutzer,[2f3de3712c4fda5cc12dd6aad72d29d7] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.excTlbr", false);), Keine Aktion durch Benutzer,[254764f0d1aaf83e5e9081ff6c98fc04] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.ffxUnstlRst", true);), Keine Aktion durch Benutzer,[7fedd97ba4d751e538b6aed2f60ea858] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.id", "56852f7f0000000000002208cae4df32");), Keine Aktion durch Benutzer,[da925400304b78be34baff81cf35f30d] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.instlDay", "16211");), Keine Aktion durch Benutzer,[323acb89ee8d46f0608e176915eff50b] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.instlRef", "sst");), Keine Aktion durch Benutzer,[5d0f2c28ceadb97d26c8e79927ddae52] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.newTab", false);), Keine Aktion durch Benutzer,[56162e26007b2f07ba34206043c1aa56] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.prdct", "buenosearch");), Keine Aktion durch Benutzer,[422a22327efd6ec8d01e4b3547bdb44c] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.prtnrId", "buenosearch");), Keine Aktion durch Benutzer,[6a02aba935462c0a7876245c92722fd1] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.rvrt", "false");), Keine Aktion durch Benutzer,[600c94c0502b56e07a74037dc73df808] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.smplGrp", "none");), Keine Aktion durch Benutzer,[aac274e00774fb3b5f8f8cf4d33116ea] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.tb_url", "http://www.buenosearch.com/?q={searchTerms}&babsrc=TB_ss&mntrId=56852208CAE4DF32&affID=128235&tsp=5254");), Keine Aktion durch Benutzer,[80ece0748deeaf87f6f89ee21aea827e] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.tlbrId", "base");), Keine Aktion durch Benutzer,[a5c788cc403bd16509e55b25fe06936d] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.tlbrSrchUrl", "http://www.buenosearch.com/?q={searchTerms}&babsrc=TB_ss&mntrId=56852208CAE4DF32&affID=128235&tsp=5254");), Keine Aktion durch Benutzer,[82ea9db7700bb284c02eacd437cd9769] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.vrsn", "1.8.28.7");), Keine Aktion durch Benutzer,[5418b1a32c4f50e6d618e29e7193d030] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.vrsnTs", "1.8.28.719:03:30");), Keine Aktion durch Benutzer,[026a81d3f28966d09c52017f5ea660a0] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.vrsni", "1.8.28.7");), Keine Aktion durch Benutzer,[f07cd381a2d9ed4906e83a4691733fc1] PUP.Optional.BuenoSearch.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.tlbrSrchUrl", "http://www.buenosearch.com/?q={searchTerms}&babsrc=TB_ss&mntrId=56852208CAE4DF32&affID=128235&tsp=5254");), Keine Aktion durch Benutzer,[bab26ce835468ea808e7dea126dea957] PUP.Optional.BuenoSearch.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.tb_url", "http://www.buenosearch.com/?q={searchTerms}&babsrc=TB_ss&mntrId=56852208CAE4DF32&affID=128235&tsp=5254");), Keine Aktion durch Benutzer,[73f93d172556b28436b9bdc2b054f709] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.id", "56852f7f0000000000002208cae4df32");), Keine Aktion durch Benutzer,[3c30f65ec2b9a19521cc5d235aaa03fd] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.appId", "{37EB75F2-7392-4DBE-B5AD-147EC6D7BF5F}");), Keine Aktion durch Benutzer,[016b65ef89f285b1df0e156b30d47090] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.instlDay", "16211");), Keine Aktion durch Benutzer,[4b21aba92f4c181e5499651bbe46c23e] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.vrsn", "1.8.28.7");), Keine Aktion durch Benutzer,[fa72450fa8d3d46217d689f7669eff01] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.vrsni", "1.8.28.7");), Keine Aktion durch Benutzer,[6705f95b6e0deb4b8b62334dc34115eb] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.vrsnTs", "1.8.28.719:03:30");), Keine Aktion durch Benutzer,[35378bc9661556e0628b1e62dc287987] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.prtnrId", "buenosearch");), Keine Aktion durch Benutzer,[9ad2332166153bfbffee6e12976d02fe] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.prdct", "buenosearch");), Keine Aktion durch Benutzer,[1953ef658deed264ea038000f11354ac] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.aflt", "babsst");), Keine Aktion durch Benutzer,[77f5aca89fdce94de904324eef1535cb] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.smplGrp", "none");), Keine Aktion durch Benutzer,[c4a8f36186f5da5c519c0b75d72d936d] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.tlbrId", "base");), Keine Aktion durch Benutzer,[95d7e173502b88ae8e5f4e32e91b41bf] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.instlRef", "sst");), Keine Aktion durch Benutzer,[b9b332221a61b383a449f38d3fc56a96] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.dfltLng", "de");), Keine Aktion durch Benutzer,[5c10ea6afc7fe94d727b037d927228d8] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.excTlbr", false);), Keine Aktion durch Benutzer,[b8b4b59f5526b581ae3f0d73f3116b95] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.ffxUnstlRst", true);), Keine Aktion durch Benutzer,[f17b5afa13680e28eeff2957ff0539c7] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.admin", false);), Keine Aktion durch Benutzer,[bcb0f163e19a8ea8f8f5b6cab2528080] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.autoRvrt", "false");), Keine Aktion durch Benutzer,[f775fb59fa819e9808e5027e41c36799] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.rvrt", "false");), Keine Aktion durch Benutzer,[c1aba5aff586072f23caff81ce3638c8] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.newTab", false);), Keine Aktion durch Benutzer,[37353f15eb90b87eda134f311be910f0] PUP.Optional.BuenoSearch.A, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.tb_url", "http://www.buenosearch.com/?q={searchTerms}&babsrc=TB_ss&mntrId=56852208CAE4DF32&affID=128235&tsp=5254");), Keine Aktion durch Benutzer,[cf9ddb799fdc36006f80c5bacb399868] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.id", "56852f7f0000000000002208cae4df32");), Keine Aktion durch Benutzer,[016b4b090c6f89ad27c67d03ff05718f] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.appId", "{37EB75F2-7392-4DBE-B5AD-147EC6D7BF5F}");), Keine Aktion durch Benutzer,[97d5e96bb2c9cb6bd81599e77f85619f] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.instlDay", "16211");), Keine Aktion durch Benutzer,[fe6e5df70972b97dbf2e552bef15ab55] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.vrsn", "1.8.28.7");), Keine Aktion durch Benutzer,[2f3daca855261f17a746156b36ceaa56] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.vrsni", "1.8.28.7");), Keine Aktion durch Benutzer,[98d48fc55a213105806d532d0301b14f] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.vrsnTs", "1.8.28.719:03:31");), Keine Aktion durch Benutzer,[8fddec68067544f2c5281a6690741de3] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.prtnrId", "buenosearch");), Keine Aktion durch Benutzer,[482456fe5b203afc628b1f61cd377d83] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.prdct", "buenosearch");), Keine Aktion durch Benutzer,[c5a769eb1d5ebd79bc318af67f852cd4] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.aflt", "babsst");), Keine Aktion durch Benutzer,[9ece282cdaa13006fdf0c7b9679d619f] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.smplGrp", "none");), Keine Aktion durch Benutzer,[e38995bf047744f208e5008054b0ba46] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.tlbrId", "base");), Keine Aktion durch Benutzer,[8ce0163ef08b49edd7167c049074d828] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.instlRef", "sst");), Keine Aktion durch Benutzer,[303c9fb5730802346d80e29e94704bb5] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.dfltLng", "de");), Keine Aktion durch Benutzer,[660624302a510333c12cc5bb828223dd] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.excTlbr", false);), Keine Aktion durch Benutzer,[422a3b19cfac191daa431e62df25946c] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.ffxUnstlRst", true);), Keine Aktion durch Benutzer,[2b41d97b3c3f3501dd10d0b0cf35946c] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.admin", false);), Keine Aktion durch Benutzer,[ef7dbd97c3b8cd698a631967749009f7] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.autoRvrt", "false");), Keine Aktion durch Benutzer,[77f5f75db9c29f9734b998e8689c02fe] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.rvrt", "false");), Keine Aktion durch Benutzer,[82ea82d2116a77bf7d70681815ef9967] PUP.Optional.BuenoSearch, C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js, Gut: (), Schlecht: (user_pref("extensions.buenosearch.newTab", false);), Keine Aktion durch Benutzer,[53195afaa2d94cea0edf0a76c143936d] Physische Sektoren: 0 (No malicious items detected) (end) |
|
22.05.2014, 11:17
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Pup.Optional.BloackAndSurf.A Scan mit Farbar's Recovery Scan Tool (FRST) Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
22.05.2014, 13:56
| #5 |
| | Pup.Optional.BloackAndSurf.A ich habe mir wegen win 7 prof 64 bit die 64 er version runtergeladen Ich habe sie installiert und gestartet wie du gesagt hast, habe ich keine Einstellung verändert sondern nur auf Scan gedrückt Hier ist dass Log der Farbar Recovery Scan Tools, Addition.txt log FRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-05-2014
Ran by Ich at 2014-05-22 14:51:51
Running from C:\Users\Ich\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
==================== Installed Programs ======================
7-Zip 9.22 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0922-000001000000}) (Version: 9.22.00.0 - Igor Pavlov)
ACDSee Pro 6 (HKLM\...\{CAF674E0-808C-4CF4-8868-A755EBABA228}) (Version: 6.0.171 - ACD Systems International Inc.)
Acronis True Image Home 2011 (HKLM-x32\...\{04A3A6B0-8E19-49BB-82FF-65C5A55F917D}) (Version: 14.0.6942 - Acronis)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.4.0.2710 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.4.0.2710 - Adobe Systems Incorporated) Hidden
Adobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.5.23 - Adobe Systems Incorporated.)
Adobe Community Help (x32 Version: 3.5.23 - Adobe Systems Incorporated.) Hidden
Adobe Flash Player 11 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 11.5.502.135 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Photoshop Elements 10 (HKLM-x32\...\Adobe Photoshop Elements 10) (Version: 10.0 - Adobe Systems Incorporated)
Adobe Photoshop Elements 10 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
AIDA64 Extreme Edition v2.85 (HKLM-x32\...\AIDA64 Extreme Edition_is1) (Version: 2.85 - FinalWire Ltd.)
Aimersoft Video Converter Ultimate(Build 5.5.0.3) (HKLM-x32\...\Aimersoft Video Converter Ultimate_is1) (Version: 5.5.0.3 - Aimersoft Software)
Anti-Twin (Installation 01.08.2013) (HKLM-x32\...\Anti-Twin 2013-08-01 21.53.39) (Version: - Joerg Rosenthal, Germany)
Any Video Converter 5.5.9 (HKLM-x32\...\Any Video Converter_is1) (Version: - Any-Video-Converter.com)
AnyDVD (HKLM-x32\...\AnyDVD) (Version: 6.8.9.0 - SlySoft)
Apple Application Support (HKLM-x32\...\{D9DAD0FF-495A-472B-9F10-BAE430A26682}) (Version: 3.0.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Ashampoo Burning Studio 14 v.14.0.3 (HKLM-x32\...\{91B33C97-7BCF-CDFE-4321-58EBF3E8641C}_is1) (Version: 14.0.3 - Ashampoo GmbH & Co. KG)
Asmedia ASM104x USB 3.0 Host Controller Driver (HKLM-x32\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.14.3.0 - Asmedia Technology)
Asmedia ASM106x SATA Host Controller Driver (HKLM-x32\...\{61942EF5-2CD8-47D4-869C-2E9A8BB085F1}) (Version: 1.3.4.000 - Asmedia Technology)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Canon Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version: - )
Canon Easy-WebPrint EX (HKLM-x32\...\Easy-WebPrint EX) (Version: - )
Canon Inkjet Printer Driver Add-On Module V2.00 (HKLM\...\CANONIJINBOXADDON200) (Version: - )
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM-x32\...\CANONIJPLM100) (Version: - )
Canon MG5200 series Benutzerregistrierung (HKLM-x32\...\Canon MG5200 series Benutzerregistrierung) (Version: - )
Canon MG5200 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5200_series) (Version: - )
Canon MP Navigator EX 4.0 (HKLM-x32\...\MP Navigator EX 4.0) (Version: - )
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: - )
Canon Solution Menu EX (HKLM-x32\...\CanonSolutionMenuEX) (Version: - )
CCleaner (HKLM\...\CCleaner) (Version: 4.13 - Piriform)
CDisplay 1.8 (HKLM-x32\...\CDisplay_is1) (Version: - dvd8n)
CD-LabelPrint (HKLM-x32\...\MediaNavigation.CDLabelPrint) (Version: - )
CloneDVD2 (HKLM-x32\...\CloneDVD2) (Version: 2.9.3.0 - Elaborate Bytes)
CrystalDiskInfo 5.6.2 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 5.6.2 - Crystal Dew World)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{349F73CA-653A-43A6-AE77-970B07D6EDA0}) (Version: - Microsoft)
Dir-It! (HKLM-x32\...\{DDA7571B-C75B-4034-AF96-0128FBF27D7B}) (Version: 4.03.0200 - Wirth IT Design)
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.90 - DivX, LLC)
dreamboxEDIT -- The one and only settings editor for your Dreambox (HKLM-x32\...\dreamboxEDIT) (Version: - )
DVD Profiler Version 3.8.2 (HKLM-x32\...\InvelosDVDProfiler_is1) (Version: - )
Elements 10 Organizer (x32 Version: 10.0 - Ihr Firmenname) Hidden
Emsisoft HiJackFree 4.5 (HKLM-x32\...\Emsisoft HiJackFree_is1) (Version: 4.5 - Emsi Software GmbH)
eReg (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
EVEREST Home Edition v2.20 (HKLM-x32\...\EVEREST Home Edition_is1) (Version: 2.20 - Lavalys Inc)
Extract DBX (HKLM-x32\...\Extract DBX (Professional Edition) - Trial v6.5_is1) (Version: - )
ffdshow v1.2.4422 [2012-04-09] (HKLM-x32\...\ffdshow_is1) (Version: 1.2.4422.0 - )
File Scavenger 3.2 (de) (HKLM-x32\...\QueTek File Scavenger 3.2 (de)) (Version: 3.2.24.0 - QueTek Consulting Corporation)
FileZilla Client 3.8.0 (HKLM-x32\...\FileZilla Client) (Version: 3.8.0 - Tim Kosse)
Flickr Uploadr 3.2.1 (HKLM-x32\...\Flickr Uploadr) (Version: - )
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Haali Media Splitter (HKLM-x32\...\HaaliMkx) (Version: - )
Intel(R) Network Connections 16.8.46.0 (HKLM\...\PROSetDX) (Version: 16.8.46.0 - Intel)
Intel(R) Network Connections 16.8.46.0 (Version: 16.8.46.0 - Intel) Hidden
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.0.0.1032 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.5.235 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.32 - Irfan Skiljan)
iSongText Version 1.6.2 (HKLM-x32\...\{435D7375-2D4D-4037-8791-DF851A3EC986}_is1) (Version: 1.6.2 - Filip Lipski)
iTunes (HKLM\...\{1CF5754A-545B-4360-BFDE-2847BC728DFC}) (Version: 11.2.0.115 - Apple Inc.)
Java 7 Update 9 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417009FF}) (Version: 7.0.90 - Oracle)
Java Auto Updater (x32 Version: 2.1.6.0 - Sun Microsystems, Inc.) Hidden
Java(TM) 7 Update 4 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217004FF}) (Version: 7.0.40 - Oracle)
JavaFX 2.1.0 (HKLM-x32\...\{1111706F-666A-4037-7777-210328764D10}) (Version: 2.1.0 - Oracle Corporation)
JDownloader 0.9 (HKLM-x32\...\5513-1208-7298-9440) (Version: 0.9 - AppWork GmbH)
Karen's Directory Printer (HKLM-x32\...\Karen's Directory Printer) (Version: 5.3.0.2 - Karen Kenworthy)
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{6F6873E3-5C92-4049-B511-231A138DD090}) (Version: 14.0.0.4651 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 14.0.0.4651 - Kaspersky Lab) Hidden
Kits Configuration Installer (x32 Version: 8.59.25584 - Microsoft) Hidden
K-Lite Codec Pack 9.6.5 (Basic) (HKLM-x32\...\KLiteCodecPack_is1) (Version: 9.6.5 - )
Last.fm Scrobbler 2.1.36 (HKLM-x32\...\LastFM_is1) (Version: - Last.fm)
Logitech SetPoint 6.61 (HKLM\...\sp6) (Version: 6.61.15 - Logitech)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Business 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft_VC100_CRT_SP1_x64 (Version: 10.0.40219.1 - Nokia) Hidden
Microsoft_VC100_CRT_SP1_x86 (x32 Version: 10.0.40219.1 - Nokia) Hidden
MKVToolNix 6.7.0 [20140102-565] (HKLM-x32\...\MKVToolNix) (Version: 6.7.0 - Moritz Bunkus)
Mozilla Firefox 29.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
Mp3tag v2.59a (HKLM-x32\...\Mp3tag) (Version: v2.59a - Florian Heidenreich)
MSVC80_x64_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC80_x86_v2 (x32 Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden
MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Need for Speed Rivals Version 1.0 (HKLM-x32\...\Need for Speed Rivals_is1) (Version: 1.0 - EA Games)
Nero 8 (HKLM-x32\...\{D6C9AF27-9414-46C8-B9D8-D878BA041031}) (Version: 8.3.312 - Nero AG)
neroxml (x32 Version: 1.0.0 - Nero AG) Hidden
Nokia Connectivity Cable Driver (HKLM-x32\...\{A57025CC-5F2E-4D01-B387-06DB10500D43}) (Version: 7.1.78.0 - Nokia)
Nokia PC Suite (HKLM-x32\...\Nokia PC Suite) (Version: 7.1.180.94 - Nokia)
Nokia PC Suite (x32 Version: 7.1.180.94 - Nokia) Hidden
Nokia Software Updater (HKLM-x32\...\{7130468A-F53F-4698-8C09-A339EA3B05E6}) (Version: 3.0.655 - Nokia Corporation)
NVIDIA 3D Vision Controller-Treiber 331.82 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 331.82 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 335.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 335.23 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.7.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.7.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 335.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 335.23 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.145.1024 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.0725 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.0725 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA ShadowPlay 9.3.21 (Version: 9.3.21 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3523 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 335.23 (Version: 335.23 - NVIDIA Corporation) Hidden
NVIDIA Update 10.4.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 10.4.0 - NVIDIA Corporation)
NVIDIA Update Components (Version: 9.3.21 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.9 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.9 - NVIDIA Corporation)
Origin (HKLM-x32\...\Origin) (Version: 9.3.11.2762 - Electronic Arts, Inc.)
PC Connectivity Solution (HKLM-x32\...\{644F4910-E812-49AD-93EC-86828CB81A0D}) (Version: 12.0.27.0 - Nokia)
Plus Pack für Acronis True Image Home 2011 (HKLM-x32\...\{2CAB55FA-A147-4215-81A6-E9A9038B7970}) (Version: 14.0.6942 - Acronis)
PSE10 STI Installer (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
Qualcomm Atheros WiFi Driver Installation (HKLM-x32\...\{7D916FA5-DAE9-4A25-B089-655C70EAF607}) (Version: 9.2 - Qualcomm Atheros)
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Recover My Files (HKLM-x32\...\Recover My Files_is1) (Version: 4.9.4.1343 - GetData Pty Ltd)
Recuva (HKLM\...\Recuva) (Version: 1.48 - Piriform)
Remote Control USB Driver (HKLM-x32\...\{8471021C-F529-43DE-84DF-3612E10F58C4}) (Version: 2.3.2.317 - )
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.3.2.12064_10 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.3.2.12064_10 - Samsung Electronics Co., Ltd.) Hidden
Samsung New PC Studio (HKLM-x32\...\InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}) (Version: 1.00.0000 - Samsung Electronics Co., Ltd.)
Samsung New PC Studio (x32 Version: 1.00.0000 - Samsung Electronics Co., Ltd.) Hidden
SDK Debuggers (x32 Version: 8.59.29746 - Microsoft Corporation) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) Hidden
SHIELD Streaming (Version: 1.6.53 - NVIDIA Corporation) Hidden
Skype Click to Call (HKLM-x32\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 5.11.9874 - Skype Technologies S.A.)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Sony Ericsson PC Suite 6.011.00 (HKLM-x32\...\{2FFE93F0-BB72-4E52-8761-354D1AAA9387}) (Version: 6.011.00 - Sony Ericsson)
Sony PC Companion 2.10.136 (HKLM-x32\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.136 - Sony)
SUPER © +Recorder.2013.55 (Mar 7, 2013) Version +Recorder.2013. (HKLM-x32\...\{8F3A1F92-C29F-4DF9-8459-B739A4831C69}_is1) (Version: +Recorder.2013.55 - eRightSoft)
SysTools DBX Converter (HKLM-x32\...\SysTools DBX Converter v3.2 DEMO Version_is1) (Version: - )
Total Commander (Remove or Repair) (HKLM-x32\...\Totalcmd) (Version: 7.50a - Ghisler Software GmbH)
TSDoctor (HKLM-x32\...\{A4B3A0BD-9149-40D3-B139-D5E0C9B761CC}) (Version: 1.1.7 - Cypheros)
TV-Browser 3.3.1 (HKLM-x32\...\tvbrowser) (Version: 3.3.1 - TV-Browser Team)
UBitMenuDE (HKLM-x32\...\{CBCFD97D-FE82-43F4-A978-996CACF71E6B}_is1) (Version: 01.04 - UBit Schweiz AG)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2825635) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{F1A20C69-9FE5-40FD-9CD5-84EABC2EF64A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2863818) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{C70D2038-A2C4-4A99-87DE-5272BB44F0CE}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2863818) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2878225) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{EFF5EBA3-40AD-4859-85E7-3C1CF4F297EB}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{40EC8FB1-5202-469D-9232-C28FB1C6FC64}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2BA40F82-F3A4-441C-BF1A-ED4C42FF4872}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft)
Update for Microsoft Visio 2010 (KB2880526) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{7B29D8B8-6A87-496C-A65E-B935E740448A}) (Version: - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2837587) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{38CF30E4-3348-4BD1-A859-B630C355A56F}) (Version: - Microsoft)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VG JPEG-Repair Online (HKLM-x32\...\{43F714FC-FEBB-4695-B706-70E9534FFB4D}) (Version: 1.7.0 - VG Solutions)
VirtualDub Filter Pack 2011 Version 1.0 (HKLM-x32\...\{FCB7D55C-B9B6-43E4-A692-FB0561F87000}_is1) (Version: 1.0 - CodecPack.co)
VLC media player 2.1.4 (HKLM\...\VLC media player) (Version: 2.1.4 - VideoLAN)
VSO ConvertXToDVD (HKLM-x32\...\{CE1F93C0-4353-4C9D-84DA-AB4E7C63ED32}_is1) (Version: 5.0.0.45 - VSO-Software SARL)
Win7codecs (HKLM-x32\...\{8C0CAA7A-3272-4991-A808-2C7559DE3409}) (Version: 3.6.9 - Shark007)
Winamp (HKLM-x32\...\Winamp) (Version: 5.623 - Nullsoft, Inc)
Winamp Erkennungs-Plug-in (HKCU\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc)
Windows Software Development Kit (HKLM-x32\...\{363a2c1e-637f-45ce-933b-5a5463efd945}) (Version: 8.59.29750 - Microsoft Corporation)
Windows Software Development Kit EULA (x32 Version: 8.59.25584 - Microsoft Corporations) Hidden
Windows-Treiberpaket - Nokia Modem (02/25/2011 4.7) (HKLM\...\E0AC723A3DE3A04256288CADBBB011B112AED454) (Version: 02/25/2011 4.7 - Nokia)
Windows-Treiberpaket - Nokia Modem (02/25/2011 7.01.0.9) (HKLM\...\72A50F48CC5601190B9C4E74D81161693133E7F7) (Version: 02/25/2011 7.01.0.9 - Nokia)
Windows-Treiberpaket - Nokia pccsmcfd LegacyDriver (05/31/2012 7.1.2.0) (HKLM\...\62BBD193ADFDBB228C7E1ADB56463F5732FF7F6F) (Version: 05/31/2012 7.1.2.0 - Nokia)
WinRAR 5.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
WinX DVD Ripper Platinum 7.3.0 (HKLM-x32\...\WinX DVD Ripper Platinum_is1) (Version: - Digiarty Software, Inc.)
Wise Registry Cleaner 7.62 (HKLM-x32\...\Wise Registry Cleaner_is1) (Version: - WiseCleaner.com, Inc.)
XMedia Recode Version 3.1.7.6 (HKLM-x32\...\{DDA3C325-47B2-4730-9672-BF3771C08799}_is1) (Version: 3.1.7.6 - XMedia Recode)
==================== Restore Points =========================
15-05-2014 05:59:27 Windows Update
21-05-2014 11:57:51 Windows Update
==================== Hosts content: ==========================
2009-07-14 04:34 - 2012-06-23 21:28 - 00000854 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 activate.adobe.com
==================== Scheduled Tasks (whitelisted) =============
Task: {1AB9AA28-9530-4E97-AFA4-6D16362030F3} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-04-17] (Piriform Ltd)
Task: {1DCDF806-921E-470F-93E5-D0678371DF42} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-21] (Adobe Systems Incorporated)
Task: {3D4E4AEA-C731-4E4A-A917-10D856BE80CD} - System32\Tasks\YourFile DownloaderUpdate => C:\Program Files (x86)\YourFileDownloader Updater\YourFileUpdater.exe <==== ATTENTION
Task: {42611E9B-FF33-4308-947B-5154CAC383DA} - \Escolade No Task File <==== ATTENTION
Task: {51E061C8-7994-416C-BF7B-0D171F73FD76} - \Express FilesUpdate No Task File <==== ATTENTION
Task: {6A912693-94EB-4654-83CC-884ED0BD880F} - System32\Tasks\SidebarExecute => C:\Program Files (x86)\Windows Sidebar\sidebar.exe [2010-11-21] (Microsoft Corporation)
Task: {C285A4DF-4089-4C47-892A-CC23EE1FFA38} - System32\Tasks\{AB188D85-B222-455E-857E-471ACF292444} => C:\Program Files (x86)\Rebellion\SniperEliteV2\bin\SniperEliteV2.exe
Task: {E70683C2-1AFC-40C3-B91F-BB55C586BFCE} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {ED539030-E935-4235-B593-48982858235A} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2012-06-05 16:59 - 2014-03-04 15:05 - 00116056 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2010-01-02 16:42 - 2010-01-02 16:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2014-01-20 14:17 - 2014-01-20 14:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-01-20 14:16 - 2014-01-20 14:16 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-06-17 12:35 - 2013-06-17 12:35 - 00478400 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\dblite.dll
2013-05-08 14:52 - 2013-05-08 14:52 - 01270464 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\kpcengine.2.3.dll
2014-05-09 21:20 - 2014-05-09 21:20 - 03839088 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-05-21 19:07 - 2014-05-21 19:07 - 16361136 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\CLDShowX.ini:Update.CL
AlternateDataStreams: C:\ProgramData\Temp:16B78C39
AlternateDataStreams: C:\ProgramData\Temp:F7F48F12
==================== Safe Mode (whitelisted) ===================
==================== EXE Association (whitelisted) =============
==================== Disabled items from MSCONFIG ==============
MSCONFIG\Services: AcrSch2Svc => 2
MSCONFIG\Services: AdobeActiveFileMonitor10.0 => 2
MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: afcdpsrv => 2
MSCONFIG\Services: Apple Mobile Device => 2
MSCONFIG\Services: Bonjour Service => 2
MSCONFIG\Services: bthserv => 3
MSCONFIG\Services: DTSAudioSvc => 2
MSCONFIG\Services: FLEXnet Licensing Service => 3
MSCONFIG\Services: Giraffic => 2
MSCONFIG\Services: IAStorDataMgrSvc => 2
MSCONFIG\Services: IJPLMSVC => 2
MSCONFIG\Services: Intel(R) PROSet Monitoring Service => 2
MSCONFIG\Services: IPBusEnum => 3
MSCONFIG\Services: iPod Service => 3
MSCONFIG\Services: KtmRm => 3
MSCONFIG\Services: LBTServ => 3
MSCONFIG\Services: lltdsvc => 3
MSCONFIG\Services: MBAMScheduler => 2
MSCONFIG\Services: MBAMService => 2
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: MSDTC => 3
MSCONFIG\Services: MSiSCSI => 3
MSCONFIG\Services: msiserver => 3
MSCONFIG\Services: napagent => 3
MSCONFIG\Services: Nero BackItUp Scheduler 3 => 2
MSCONFIG\Services: Netlogon => 3
MSCONFIG\Services: NMIndexingService => 3
MSCONFIG\Services: nvsvc => 2
MSCONFIG\Services: nvUpdatusService => 2
MSCONFIG\Services: OMSI download service => 2
MSCONFIG\Services: PeerDistSvc => 3
MSCONFIG\Services: PerfHost => 3
MSCONFIG\Services: pla => 3
MSCONFIG\Services: PLFlash DeviceIoControl Service => 2
MSCONFIG\Services: PNRPAutoReg => 3
MSCONFIG\Services: ProtectedStorage => 3
MSCONFIG\Services: QWAVE => 3
MSCONFIG\Services: SCardSvr => 3
MSCONFIG\Services: SCPolicySvc => 3
MSCONFIG\Services: ServiceLayer => 3
MSCONFIG\Services: SharedAccess => 3
MSCONFIG\Services: SkypeUpdate => 2
MSCONFIG\Services: SNMPTRAP => 3
MSCONFIG\Services: Sony PC Companion => 3
MSCONFIG\Services: Stereo Service => 2
MSCONFIG\Services: SysMain => 3
MSCONFIG\Services: TapiSrv => 3
MSCONFIG\Services: TBS => 3
MSCONFIG\Services: THREADORDER => 3
MSCONFIG\Services: TrustedInstaller => 3
MSCONFIG\Services: UMVPFSrv => 2
MSCONFIG\Services: WPCSvc => 3
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^YouTube To MP3.lnk => C:\Windows\pss\YouTube To MP3.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Ich^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Logitech . Produktregistrierung.lnk => C:\Windows\pss\Logitech . Produktregistrierung.lnk.Startup
MSCONFIG\startupreg: ACPW05DE => "C:\Program Files (x86)\ACD Systems\ACDSee Pro\5.0\ACDSeeProInTouch2.exe" /pid ACPW05DE
MSCONFIG\startupreg: ACPW06DE => "C:\Program Files\ACD Systems\ACDSee Pro\6.0\ACDSeePro6InTouch2.exe" /pid ACPW06DE
MSCONFIG\startupreg: Acronis Scheduler2 Service => "C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe"
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
MSCONFIG\startupreg: Aimersoft Helper Compact.exe => C:\Program Files (x86)\Common Files\Aimersoft\Aimersoft Helper Compact\ASHelper.exe
MSCONFIG\startupreg: Anti-phishing Domain Advisor => "C:\ProgramData\Anti-phishing Domain Advisor\visicom_antiphishing.exe"
MSCONFIG\startupreg: AnyDVD => C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: AutoStartNPSAgent => C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe
MSCONFIG\startupreg: BDRegion => C:\Program Files (x86)\Cyberlink\Shared files\brs.exe
MSCONFIG\startupreg: BrowserPlugInHelper => C:\Program Files (x86)\Aimersoft\Video Converter Ultimate\BrowserPlugInHelper.exe
MSCONFIG\startupreg: CanonMyPrinter => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
MSCONFIG\startupreg: CanonSolutionMenuEx => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE /logon
MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: DAEMON Tools Pro Agent => "C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe" -autorun
MSCONFIG\startupreg: DivXMediaServer => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
MSCONFIG\startupreg: DivXUpdate => "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
MSCONFIG\startupreg: EADM => "C:\Program Files (x86)\Origin\Origin.exe" -AutoStart
MSCONFIG\startupreg: EvtMgr6 => C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming
MSCONFIG\startupreg: IAStorIcon => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
MSCONFIG\startupreg: IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} => "C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: KiesAirMessage => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
MSCONFIG\startupreg: KiesPDLR => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
MSCONFIG\startupreg: KiesPreload => C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload
MSCONFIG\startupreg: KiesTrayAgent => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
MSCONFIG\startupreg: LightScribe Control Panel => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
MSCONFIG\startupreg: Logitech Download Assistant => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
MSCONFIG\startupreg: Malwarebytes' Anti-Malware => "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
MSCONFIG\startupreg: NBKeyScan => "C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
MSCONFIG\startupreg: NeroFilterCheck => C:\Windows\system32\NeroCheck.exe
MSCONFIG\startupreg: NokiaSuite.exe => C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe -tray
MSCONFIG\startupreg: NSU_agent => "C:\Program Files (x86)\Nokia\Nokia Software Updater\nsu3ui_agent.exe"
MSCONFIG\startupreg: Nvtmru => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
MSCONFIG\startupreg: Optimizer Pro => C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe
MSCONFIG\startupreg: PC Suite Tray => "C:\Program Files (x86)\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
MSCONFIG\startupreg: PowerDVD12Agent => "C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe"
MSCONFIG\startupreg: PowerDVD12DMREngine => "C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe"
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: RemoteControl10 => "C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe"
MSCONFIG\startupreg: RtHDVBg_DTS => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /DTSU2P
MSCONFIG\startupreg: RTHDVCPL => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s
MSCONFIG\startupreg: SAOB Monitor => C:\Program Files (x86)\Acronis\TrueImageHome\OnlineBackupStandalone\TrueImageMonitor.exe
MSCONFIG\startupreg: ShadowPlay => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: Sony PC Companion => "C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe" /Background
MSCONFIG\startupreg: Steam => "C:\Program Files (x86)\Steam\Steam.exe" -silent
MSCONFIG\startupreg: StereoLinksInstall => "C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvstlink.exe" /install1
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: TrueImageMonitor.exe => "C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe"
MSCONFIG\startupreg: USB3MON => "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
MSCONFIG\startupreg: VeohPlugin => "C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\veohwebplayer.exe"
MSCONFIG\startupreg: WinampAgent => "C:\Program Files (x86)\Winamp\winampa.exe"
==================== Faulty Device Manager Devices =============
Name: A2 Direct Disk Access Support Driver
Description: A2 Direct Disk Access Support Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: A2DDA
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Event log errors: =========================
Application errors:
==================
Error: (05/22/2014 02:42:56 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm mbam.exe, Version 1.0.0.532 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1554
Startzeit: 01cf75a3b3a97b2c
Endzeit: 0
Anwendungspfad: C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
Berichts-ID: 96a5279f-e1ae-11e3-b010-c860008a7293
Error: (05/22/2014 11:54:24 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/22/2014 11:28:19 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm mbam.exe, Version 1.0.0.532 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1550
Startzeit: 01cf75a01092fee1
Endzeit: 0
Anwendungspfad: C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
Berichts-ID: 666160e8-e193-11e3-a7cf-0011f6045345
Error: (05/22/2014 11:09:53 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/22/2014 07:08:04 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/21/2014 08:44:26 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Kies.exe, Version: 1.0.0.1821, Zeitstempel: 0x5357afa9
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x06d124c0
ID des fehlerhaften Prozesses: 0x1414
Startzeit der fehlerhaften Anwendung: 0xKies.exe0
Pfad der fehlerhaften Anwendung: Kies.exe1
Pfad des fehlerhaften Moduls: Kies.exe2
Berichtskennung: Kies.exe3
Error: (05/21/2014 08:44:24 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: Kies.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: System.NullReferenceException
Stapel:
bei MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
bei System.Windows.Threading.DispatcherOperation.InvokeImpl()
bei System.Windows.Threading.DispatcherOperation.InvokeInSecurityContext(System.Object)
bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
bei System.Windows.Threading.DispatcherOperation.Invoke()
bei System.Windows.Threading.Dispatcher.ProcessQueue()
bei System.Windows.Threading.Dispatcher.WndProcHook(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
bei MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
bei MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
bei MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
bei System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
bei MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
bei MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)
bei System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)
bei System.Windows.Threading.Dispatcher.PushFrame(System.Windows.Threading.DispatcherFrame)
bei System.Windows.Threading.Dispatcher.Run()
bei System.Windows.Application.RunDispatcher(System.Object)
bei System.Windows.Application.RunInternal(System.Windows.Window)
bei System.Windows.Application.Run(System.Windows.Window)
bei Kies.App.Main()
Error: (05/21/2014 08:42:03 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Kies.exe, Version 1.0.0.1821 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: d8
Startzeit: 01cf75239be6c6cb
Endzeit: 119
Anwendungspfad: C:\Program Files (x86)\Samsung\Kies\Kies.exe
Berichts-ID: 9795ee1d-e117-11e3-b1b1-c860008a7293
Error: (05/21/2014 08:31:46 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/21/2014 07:34:36 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (05/22/2014 11:54:46 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "RAS-Verbindungsverwaltung" ist vom Dienst "Telefonie" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1058
Error: (05/22/2014 11:52:53 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "RAS-Verbindungsverwaltung" ist vom Dienst "Telefonie" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1058
Error: (05/22/2014 11:52:53 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "RAS-Verbindungsverwaltung" ist vom Dienst "Telefonie" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1058
Error: (05/22/2014 11:52:53 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "RAS-Verbindungsverwaltung" ist vom Dienst "Telefonie" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1058
Error: (05/22/2014 11:52:53 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "RAS-Verbindungsverwaltung" ist vom Dienst "Telefonie" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1058
Error: (05/22/2014 11:52:48 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "RAS-Verbindungsverwaltung" ist vom Dienst "Telefonie" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1058
Error: (05/22/2014 11:52:48 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "RAS-Verbindungsverwaltung" ist vom Dienst "Telefonie" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1058
Error: (05/22/2014 11:52:48 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "RAS-Verbindungsverwaltung" ist vom Dienst "Telefonie" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1058
Error: (05/22/2014 11:10:15 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "RAS-Verbindungsverwaltung" ist vom Dienst "Telefonie" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1058
Error: (05/22/2014 11:10:15 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "RAS-Verbindungsverwaltung" ist vom Dienst "Telefonie" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1058
Microsoft Office Sessions:
=========================
Error: (05/22/2014 02:42:56 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: mbam.exe1.0.0.532155401cf75a3b3a97b2c0C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe96a5279f-e1ae-11e3-b010-c860008a7293
Error: (05/22/2014 11:54:24 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/22/2014 11:28:19 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: mbam.exe1.0.0.532155001cf75a01092fee10C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe666160e8-e193-11e3-a7cf-0011f6045345
Error: (05/22/2014 11:09:53 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/22/2014 07:08:04 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/21/2014 08:44:26 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Kies.exe1.0.0.18215357afa9unknown0.0.0.000000000c000000506d124c0141401cf7524745b1b87C:\Program Files (x86)\Samsung\Kies\Kies.exeunknownee938f64-e117-11e3-b1b1-c860008a7293
Error: (05/21/2014 08:44:24 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: Kies.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: System.NullReferenceException
Stapel:
bei MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
bei System.Windows.Threading.DispatcherOperation.InvokeImpl()
bei System.Windows.Threading.DispatcherOperation.InvokeInSecurityContext(System.Object)
bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
bei System.Windows.Threading.DispatcherOperation.Invoke()
bei System.Windows.Threading.Dispatcher.ProcessQueue()
bei System.Windows.Threading.Dispatcher.WndProcHook(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
bei MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
bei MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
bei MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
bei System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
bei MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
bei MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)
bei System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)
bei System.Windows.Threading.Dispatcher.PushFrame(System.Windows.Threading.DispatcherFrame)
bei System.Windows.Threading.Dispatcher.Run()
bei System.Windows.Application.RunDispatcher(System.Object)
bei System.Windows.Application.RunInternal(System.Windows.Window)
bei System.Windows.Application.Run(System.Windows.Window)
bei Kies.App.Main()
Error: (05/21/2014 08:42:03 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Kies.exe1.0.0.1821d801cf75239be6c6cb119C:\Program Files (x86)\Samsung\Kies\Kies.exe9795ee1d-e117-11e3-b1b1-c860008a7293
Error: (05/21/2014 08:31:46 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/21/2014 07:34:36 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
CodeIntegrity Errors:
===================================
Date: 2014-05-22 12:36:33.331
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-22 12:36:33.330
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-22 12:36:33.329
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-22 12:07:17.016
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-22 12:07:17.015
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-22 12:07:17.015
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-22 08:19:12.445
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-22 08:19:12.445
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-22 08:19:12.445
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-22 08:10:30.658
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 23%
Total physical RAM: 16339.18 MB
Available physical RAM: 12422.12 MB
Total Pagefile: 32676.53 MB
Available Pagefile: 28898.32 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:238.37 GB) (Free:49.71 GB) NTFS
Drive d: (Volume) (Fixed) (Total:931.51 GB) (Free:733.33 GB) NTFS
Drive e: (Volume) (Fixed) (Total:931.51 GB) (Free:672.51 GB) NTFS
Drive f: (Volume) (Fixed) (Total:1863.01 GB) (Free:968.69 GB) NTFS
Drive g: () (Fixed) (Total:1863.01 GB) (Free:1422.81 GB) NTFS
Drive k: (Volume) (Fixed) (Total:1863.01 GB) (Free:1302.03 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 238 GB) (Disk ID: 24D4B602)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=238 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 1863 GB) (Disk ID: C948D365)
Partition 1: (Not Active) - (Size=-198626508800) - (Type=07 NTFS)
========================================================
Disk: 2 (Size: 932 GB) (Disk ID: A221A221)
Partition 1: (Not Active) - (Size=932 GB) - (Type=07 NTFS)
========================================================
Disk: 3 (MBR Code: Windows XP) (Size: 1863 GB) (Disk ID: D74A58F5)
Partition 1: (Not Active) - (Size=-198626966528) - (Type=07 NTFS)
========================================================
Disk: 4 (MBR Code: Windows XP) (Size: 1863 GB) (Disk ID: C948D364)
Partition 1: (Not Active) - (Size=-198626508800) - (Type=07 NTFS)
========================================================
Disk: 5 (Size: 932 GB) (Disk ID: A221A222)
Partition 1: (Not Active) - (Size=932 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Und jetzt daas FRST.txt log FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-05-2014 Ran by Ich (administrator) on ICH-PC on 22-05-2014 14:44:01 Running from C:\Users\Ich\Downloads Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (WIBU-SYSTEMS AG) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Nokia) C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe (Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe (Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (VSO Software SARL) C:\Program Files (x86)\VSO\ConvertX\5\ConvertXtoDvd.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe ==================== Registry (Whitelisted) ================== HKLM-x32\...\Run: [NPSStartup] => [X] HKLM-x32\...\Run: [NSU_agent] => C:\Program Files (x86)\Nokia\Nokia Software Updater\nsu3ui_agent.exe [190768 2012-02-28] () Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.) HKU\.DEFAULT\...\RunOnce: [SpUninstallDeleteDir] - rmdir /s /q "\SearchProtect" HKU\S-1-5-21-653767932-1258093497-3206199211-1001\...\Run: [PC Suite Tray] => C:\Program Files (x86)\Nokia\Nokia PC Suite 7\PCSuite.exe [1516632 2012-06-26] (Nokia) HKU\S-1-5-21-653767932-1258093497-3206199211-1001\...\MountPoints2: {6458225e-2a76-11e2-b097-c860008a7293} - O:\setup\rsrc\Autorun.exe HKU\S-1-5-21-653767932-1258093497-3206199211-1001\...\MountPoints2: {6ccde770-c52a-11e1-820b-c860008a7293} - I:\OriginInstaller.exe HKU\S-1-5-21-653767932-1258093497-3206199211-1001\...\MountPoints2: {9f44160e-29e5-11e2-82cc-c860008a7293} - N:\setup.exe HKU\S-1-5-21-653767932-1258093497-3206199211-1001\...\MountPoints2: {bd5c79d4-b4af-11e1-aaf7-c860008a7293} - H:\OriginInstaller.exe GroupPolicy: Group Policy on Chrome detected <======= ATTENTION ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://at.msn.com/?ocid=iehp HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x4F606FF5A73DCD01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-AT URLSearchHook: HKLM-x32 - Default Value = {74198672-5F7D-4FE9-A611-4AC1D5A66A15} SearchScopes: HKLM-x32 - DefaultScope {D26A34AF-2086-4657-92CF-1FD005A3F8EF} URL = SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www.buenosearch.com/?q={searchTerms}&babsrc=SP_ss&mntrId=56852208CAE4DF32&affID=128235&tsp=5254 SearchScopes: HKCU - {AD4DB906-4F2D-4958-B850-F4824CD76F92} URL = http://start.funmoods.com/results.php?f=4&a=ddrnw&q={searchTerms} SearchScopes: HKCU - {D26A34AF-2086-4657-92CF-1FD005A3F8EF} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1561552&CUI=UN31052588031662318&UM=2 BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO) BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO) BHO: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll (Logitech, Inc.) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO) BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.) BHO-x32: YouTube To MP3 - {43e8d393-3036-4f25-a522-d0ac693d3a68} - C:\Program Files (x86)\YouTube To MP3\YouTube To MP3.dll (SoundFrost Company) BHO-x32: Aimersoft Video Converter Ultimate - {54F73992-6549-4369-9A0D-84FD310A464A} - C:\Program Files (x86)\Aimersoft\Video Converter Ultimate\SVRIEPlugin.dll (Aimersoft Software Co., Ltd.) BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO) BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation) BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO) BHO-x32: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll (Logitech, Inc.) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO) Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.) DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Hosts: 127.0.0.1 activate.adobe.com Tcpip\Parameters: [DhcpNameServer] 195.34.133.21 212.186.211.21 FireFox: ======== FF ProfilePath: C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich FF user.js: detected! => C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js FF Homepage: user_pref("browser.startup.homepage", ); FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll () FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @java.com/DTPlugin,version=10.9.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin: @videolan.org/vlc,version=2.0.1 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: @videolan.org/vlc,version=2.0.2 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: @videolan.org/vlc,version=2.0.7 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: @videolan.org/vlc,version=2.0.8 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: @videolan.org/vlc,version=2.1.1 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: @videolan.org/vlc,version=2.1.2 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: @videolan.org/vlc,version=2.1.3 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: @videolan.org/vlc,version=2.1.4 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC) FF Plugin-x32: @java.com/DTPlugin,version=10.4.1 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.4.1 - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll (Nullsoft, Inc.) FF Plugin ProgramFiles/Appdata: C:\Users\Ich\AppData\Roaming\mozilla\plugins\np-mswmp.dll (Microsoft Corporation) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF HKLM-x32\...\Firefox\Extensions: [{CF13FA66-1F4F-426d-BB1B-E07A13BFF2C8}] - C:\Program Files (x86)\Aimersoft\Video Converter Ultimate\SVRFirefoxExt\ FF Extension: Aimersoft Video Converter Ultimate - C:\Program Files (x86)\Aimersoft\Video Converter Ultimate\SVRFirefoxExt\ [] FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com FF Extension: Chặn quảng cáo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2013-09-25] FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2014-05-06] FF HKCU\...\Firefox\Extensions: [YouTube To MP3@helper.com] - C:\PROGRA~2\YOUTUB~1\YOUTUB~1.XPI FF Extension: YouTube To MP3 - C:\PROGRA~2\YOUTUB~1\YOUTUB~1.XPI [2013-01-15] FF HKCU\...\Firefox\Extensions: [{CF13FA66-1F4F-426d-BB1B-E07A13BFF2C8}] - C:\Program Files (x86)\Aimersoft\Video Converter Ultimate\SVRFirefoxExt\ FF Extension: Aimersoft Video Converter Ultimate - C:\Program Files (x86)\Aimersoft\Video Converter Ultimate\SVRFirefoxExt\ [] FF HKCU\...\Firefox\Extensions: [{640B3CAE-8E84-33CB-6BF8-C1424043D58A}] - C:\Program Files (x86)\BlockAndSurf-soft\170.xpi Chrome: ======= Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION CHR Extension: (No Name) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\dnpicgdnjfnbkibnicdnnpkkpklkjkki [2013-04-12] CHR Extension: (BlockAndSurf) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmjanljkmdghannnegcfcggmldgnddii [2014-05-21] CHR HKLM-x32\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - https://chrome.google.com/webstore/detail/blbkdnmdcafmfhinpmnlhhddbepgkeaa [2014-05-21] CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2013-08-14] CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2013-08-14] CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2013-08-14] CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2013-08-14] CHR HKLM-x32\...\Chrome\Extension: [mapcejffhcbidcjmomhalabpcbaeimcb] - C:\Program Files (x86)\Aimersoft\Video Converter Ultimate\SVRChromePlugin.crx [2013-09-23] CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2013-08-14] CHR HKLM-x32\...\Chrome\Extension: [pkijdmeepjhpenmighhaodgfoogncnlk] - C:\Program Files (x86)\Offline Explorer\mpoe.crx [2013-08-14] CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Services (Whitelisted) ================= S4 AdobeActiveFileMonitor10.0; C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe [169624 2011-09-01] (Adobe Systems Incorporated) R2 avp; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2013-10-01] (Kaspersky Lab ZAO) S4 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [116104 2010-04-05] () R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) S4 Nero BackItUp Scheduler 3; C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe [877864 2008-06-08] (Nero AG) S4 NMIndexingService; C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe [537896 2008-06-24] (Nero AG) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15125280 2013-11-14] (NVIDIA Corporation) S4 OMSI download service; C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [90112 2009-04-30] () S4 PLFlash DeviceIoControl Service; C:\Windows\SysWOW64\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.) ==================== Drivers (Whitelisted) ==================== R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [138872 2011-12-04] (SlySoft, Inc.) R3 AnyDVD; C:\Windows\SysWOW64\Drivers\AnyDVD.sys [138872 2011-12-04] (SlySoft, Inc.) R0 asahci64; C:\Windows\System32\DRIVERS\asahci64.sys [49760 2012-01-06] (Asmedia Technology) S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-12-30] () R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2013-11-06] (Kaspersky Lab ZAO) S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [115296 2014-03-20] (Kaspersky Lab ZAO) R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [625248 2014-03-20] (Kaspersky Lab ZAO) R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2013-10-01] (Kaspersky Lab ZAO) R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2014-02-17] (Kaspersky Lab ZAO) R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-10-01] (Kaspersky Lab ZAO) R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO) R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2013-05-14] (Kaspersky Lab ZAO) R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178272 2013-12-18] (Kaspersky Lab ZAO) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-05-22] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-11-14] (NVIDIA Corporation) S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.) R0 SI3132; C:\Windows\System32\DRIVERS\SI3132.sys [90664 2012-05-26] (Silicon Image, Inc) R0 Si3132r5; C:\Windows\System32\DRIVERS\Si3132r5.sys [337960 2007-12-26] (Silicon Image, Inc) R0 SiFilter; C:\Windows\System32\DRIVERS\SiWinAcc.sys [22056 2012-05-26] (Silicon Image, Inc) R0 SiRemFil; C:\Windows\System32\DRIVERS\SiRemFil.sys [17448 2012-05-26] (Silicon Image, Inc) R0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2012-11-08] () S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-10-16] (Anchorfree Inc.) U3 af8zha20; C:\Windows\System32\Drivers\af8zha20.sys [0 ] (Microsoft Corporation) S1 A2DDA; \??\C:\Users\Ich\AppData\Local\Temp\Rar$EXa0.301\Run\a2ddax64.sys [X] S3 dgderdrv; System32\drivers\dgderdrv.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-05-22 14:44 - 2014-05-22 14:44 - 00021285 _____ () C:\Users\Ich\Downloads\FRST.txt 2014-05-22 14:43 - 2014-05-22 14:44 - 00000000 ____D () C:\FRST 2014-05-22 14:43 - 2014-05-22 14:43 - 02067456 _____ (Farbar) C:\Users\Ich\Downloads\FRST64.exe 2014-05-22 11:52 - 2014-05-22 11:52 - 00000000 ____H () C:\ProgramData\cm-lock 2014-05-22 11:27 - 2014-05-22 11:55 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-05-22 11:27 - 2014-05-22 11:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-05-22 11:27 - 2014-05-22 11:27 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-05-22 11:27 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-05-22 11:27 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-05-22 11:26 - 2014-05-22 11:26 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Ich\Downloads\mbam-setup-2.0.2.1012.exe 2014-05-22 11:08 - 2014-05-22 11:08 - 50286352 _____ () C:\Users\Ich\Downloads\NokiaSoftwareUpdaterSetup_DE.exe 2014-05-21 19:03 - 2014-05-21 19:10 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Systweak 2014-05-21 19:03 - 2014-05-21 19:05 - 00000000 ____D () C:\Program Files (x86)\Advanced System Protector 2014-05-21 19:03 - 2014-05-21 19:03 - 00003140 _____ () C:\Windows\System32\Tasks\YourFile DownloaderUpdate 2014-05-21 19:03 - 2014-05-21 19:03 - 00000512 __RSH () C:\ProgramData\ntuser.pol 2014-05-21 19:03 - 2014-05-21 19:03 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\YourFileDownloader 2014-05-21 18:27 - 2014-05-21 18:55 - 00000000 ____D () C:\Program Files (x86)\CardRecovery 2014-05-19 17:44 - 2014-05-19 17:44 - 00000000 ____D () C:\Users\Mama\AppData\Local\Macromedia 2014-05-19 17:43 - 2014-05-19 17:43 - 00000000 ____D () C:\Users\Mama\AppData\Roaming\Mozilla 2014-05-19 17:43 - 2014-05-19 17:43 - 00000000 ____D () C:\Users\Mama\AppData\Local\Mozilla 2014-05-19 17:10 - 2014-05-19 17:10 - 00000000 ____D () C:\Users\Mama\AppData\Roaming\Winamp 2014-05-19 16:13 - 2014-05-19 16:13 - 00000508 _____ () C:\Users\Mama\Desktop\Volume (F) - Verknüpfung.lnk 2014-05-19 16:13 - 2014-05-19 16:13 - 00000494 _____ () C:\Users\Mama\Desktop\Lokaler Datenträger (G) - Verknüpfung.lnk 2014-05-19 16:13 - 2014-05-19 16:13 - 00000472 _____ () C:\Users\Mama\Desktop\Volume (K) - Verknüpfung.lnk 2014-05-19 16:13 - 2014-05-19 16:13 - 00000340 _____ () C:\Users\Mama\Desktop\DVD H oben.lnk 2014-05-19 16:13 - 2014-05-19 16:13 - 00000336 _____ () C:\Users\Mama\Desktop\DVD I unten.lnk 2014-05-19 16:12 - 2014-05-19 16:12 - 00000512 _____ () C:\Users\Mama\Desktop\Lokaler Datenträger (C) - Verknüpfung.lnk 2014-05-19 16:12 - 2014-05-19 16:12 - 00000472 _____ () C:\Users\Mama\Desktop\Volume (E) - Verknüpfung.lnk 2014-05-19 16:12 - 2014-05-19 16:12 - 00000472 _____ () C:\Users\Mama\Desktop\Volume (D) - Verknüpfung.lnk 2014-05-19 16:08 - 2014-05-19 17:48 - 00000000 ____D () C:\Users\Mama\AppData\Roaming\Apple Computer 2014-05-19 16:08 - 2014-05-19 16:08 - 00288752 _____ () C:\Users\Mama\AppData\Local\GDIPFONTCACHEV1.DAT 2014-05-19 16:08 - 2014-05-19 16:08 - 00000000 ____D () C:\Users\Mama\AppData\Local\Apple Computer 2014-05-19 16:08 - 2014-05-19 16:08 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2014-05-19 16:07 - 2014-05-19 16:07 - 00002290 _____ () C:\Users\Mama\Desktop\Sicherer Zahlungsverkehr.lnk 2014-05-19 16:07 - 2014-05-19 16:07 - 00001421 _____ () C:\Users\Mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-05-19 16:07 - 2014-05-19 16:07 - 00000020 ___SH () C:\Users\Mama\ntuser.ini 2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Vorlagen 2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Startmenü 2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Netzwerkumgebung 2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Lokale Einstellungen 2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Eigene Dateien 2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Druckumgebung 2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Documents\Eigene Musik 2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Documents\Eigene Bilder 2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\AppData\Local\Verlauf 2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\AppData\Local\Anwendungsdaten 2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Anwendungsdaten 2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 ___RD () C:\Users\Mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 ___RD () C:\Users\Mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 ____D () C:\Users\Mama\AppData\Roaming\Adobe 2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 ____D () C:\Users\Mama 2014-05-19 16:07 - 2012-06-23 21:31 - 00000000 ____D () C:\Users\Mama\AppData\Roaming\Macromedia 2014-05-19 16:07 - 2012-05-29 18:12 - 00000000 ____D () C:\Users\Mama\AppData\Local\Microsoft Help 2014-05-19 16:07 - 2009-07-14 06:54 - 00000000 ___RD () C:\Users\Mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2014-05-19 16:07 - 2009-07-14 06:49 - 00000000 ___RD () C:\Users\Mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance 2014-05-18 18:44 - 2014-05-21 18:54 - 00000000 ____D () C:\Program Files (x86)\MyFree Codec 2014-05-18 18:42 - 2013-12-30 03:54 - 00233472 _____ (Teruten) C:\Windows\SysWOW64\FsUsbExService.Exe 2014-05-18 18:42 - 2013-12-30 03:54 - 00037344 _____ () C:\Windows\SysWOW64\FsUsbExDisk.Sys 2014-05-18 18:42 - 2012-06-26 16:03 - 00110592 _____ () C:\Windows\SysWOW64\FsUsbExDevice.Dll 2014-05-18 18:41 - 2014-05-18 18:41 - 00000000 ____D () C:\Users\Public\Documents\CrashDump 2014-05-16 21:02 - 2014-05-16 21:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2014-05-16 21:02 - 2014-05-16 21:02 - 00000000 ____D () C:\Program Files\iTunes 2014-05-16 21:02 - 2014-05-16 21:02 - 00000000 ____D () C:\Program Files\iPod 2014-05-15 08:01 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-05-15 08:01 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-05-15 08:01 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-05-15 08:01 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-05-15 08:01 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-05-15 08:01 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-05-15 07:08 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-05-15 07:08 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-05-15 07:08 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2014-05-15 07:08 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2014-05-15 07:08 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-05-15 07:08 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2014-05-15 07:08 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2014-05-15 07:08 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2014-05-15 07:08 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2014-05-15 07:08 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2014-05-15 07:08 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2014-05-15 07:08 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-05-15 07:08 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2014-05-15 07:08 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2014-05-15 07:08 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-05-15 07:08 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll 2014-05-15 07:08 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll 2014-05-15 07:08 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2014-05-15 07:08 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2014-05-15 07:08 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2014-05-15 07:08 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2014-05-15 07:08 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll 2014-05-15 07:08 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe 2014-05-15 07:08 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll 2014-05-15 07:08 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll 2014-05-15 07:08 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll 2014-05-15 07:08 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll 2014-05-15 07:08 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll 2014-05-15 07:08 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2014-05-15 07:08 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2014-05-15 07:08 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2014-05-15 07:08 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2014-05-15 07:08 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll 2014-05-15 07:08 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2014-05-15 07:08 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2014-05-15 07:08 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2014-05-15 07:08 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2014-05-15 07:08 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll 2014-05-15 07:08 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll 2014-05-15 07:08 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll 2014-05-15 07:08 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll 2014-05-15 07:08 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll 2014-05-15 07:08 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll 2014-05-15 07:08 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2014-05-15 07:08 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll 2014-05-13 17:15 - 2014-05-13 17:15 - 00001159 _____ () C:\Users\Ich\Desktop\Any Video Converter.lnk 2014-05-13 17:15 - 2014-05-13 17:15 - 00000000 ____D () C:\Users\Ich\Documents\Any Video Converter 2014-05-13 17:15 - 2014-05-13 17:15 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\AnvSoft 2014-05-13 17:15 - 2014-05-13 17:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AnvSoft 2014-05-13 17:14 - 2014-05-13 17:14 - 00000000 ____D () C:\Program Files (x86)\AnvSoft 2014-05-12 12:04 - 2014-05-12 12:04 - 00001221 _____ () C:\Users\Ich\Desktop\Eigene Downloads.lnk 2014-05-12 09:15 - 2014-05-12 09:15 - 00000000 __SHD () C:\Users\Ich\AppData\Local\EmieUserList 2014-05-12 09:15 - 2014-05-12 09:15 - 00000000 __SHD () C:\Users\Ich\AppData\Local\EmieSiteList 2014-05-10 07:35 - 2014-05-22 11:52 - 00035796 _____ () C:\Windows\PFRO.log 2014-05-09 21:20 - 2014-05-10 08:10 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-05-08 07:34 - 2014-05-22 11:52 - 00015259 _____ () C:\Windows\setupact.log 2014-05-08 07:34 - 2014-05-08 07:34 - 00000000 _____ () C:\Windows\setuperr.log 2014-05-06 23:26 - 2014-05-15 08:07 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-05-06 15:10 - 2014-05-06 15:10 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR 2014-05-06 15:10 - 2014-05-06 15:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR 2014-05-02 20:11 - 2014-05-02 20:11 - 00016896 _____ (ASUS) C:\Windows\AsTaskSched.dll 2014-05-02 20:11 - 2014-05-02 20:11 - 00000000 ____D () C:\Windows\Intel_Chipset_V9301019_XPWin7 2014-05-02 20:11 - 2011-02-25 08:25 - 00296320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys 2014-05-02 14:10 - 2012-05-21 00:25 - 00789824 _____ (Intel Corporation) C:\Windows\system32\Drivers\iusb3xhc.sys 2014-05-02 14:10 - 2012-05-21 00:25 - 00357184 _____ (Intel Corporation) C:\Windows\system32\Drivers\iusb3hub.sys 2014-05-02 14:10 - 2012-05-21 00:25 - 00019264 _____ (Intel Corporation) C:\Windows\system32\Drivers\iusb3hcs.sys 2014-04-29 14:56 - 2014-04-29 14:56 - 00002776 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC 2014-04-29 14:56 - 2014-04-29 14:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner 2014-04-22 18:14 - 2014-04-22 18:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mp3tag 2014-04-22 16:37 - 2014-04-22 16:37 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_ccdcmbx64_01009.Wdf ==================== One Month Modified Files and Folders ======= 2014-05-22 14:44 - 2014-05-22 14:44 - 00021285 _____ () C:\Users\Ich\Downloads\FRST.txt 2014-05-22 14:44 - 2014-05-22 14:43 - 00000000 ____D () C:\FRST 2014-05-22 14:43 - 2014-05-22 14:43 - 02067456 _____ (Farbar) C:\Users\Ich\Downloads\FRST64.exe 2014-05-22 14:16 - 2012-06-06 21:05 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-05-22 13:25 - 2012-09-13 17:09 - 00000000 ____D () C:\ProgramData\Kaspersky Lab 2014-05-22 12:59 - 2012-07-18 13:30 - 00000000 ____D () C:\Users\Ich\Documents\ConvertXToDVD 2014-05-22 11:59 - 2009-07-14 06:45 - 00021920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-05-22 11:59 - 2009-07-14 06:45 - 00021920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-05-22 11:57 - 2011-04-12 09:43 - 00702942 _____ () C:\Windows\system32\perfh007.dat 2014-05-22 11:57 - 2011-04-12 09:43 - 00150582 _____ () C:\Windows\system32\perfc007.dat 2014-05-22 11:57 - 2009-07-14 07:13 - 01629348 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-05-22 11:56 - 2012-11-18 09:36 - 01480589 _____ () C:\Windows\WindowsUpdate.log 2014-05-22 11:55 - 2014-05-22 11:27 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-05-22 11:52 - 2014-05-22 11:52 - 00000000 ____H () C:\ProgramData\cm-lock 2014-05-22 11:52 - 2014-05-10 07:35 - 00035796 _____ () C:\Windows\PFRO.log 2014-05-22 11:52 - 2014-05-08 07:34 - 00015259 _____ () C:\Windows\setupact.log 2014-05-22 11:52 - 2012-06-05 16:49 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-05-22 11:52 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-05-22 11:45 - 2012-07-15 20:52 - 00000000 ____D () C:\Users\Ich\Documents\Outlook-Dateien 2014-05-22 11:27 - 2014-05-22 11:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-05-22 11:27 - 2014-05-22 11:27 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-05-22 11:27 - 2012-07-24 06:54 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Malwarebytes 2014-05-22 11:27 - 2012-07-24 06:54 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-05-22 11:26 - 2014-05-22 11:26 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Ich\Downloads\mbam-setup-2.0.2.1012.exe 2014-05-22 11:08 - 2014-05-22 11:08 - 50286352 _____ () C:\Users\Ich\Downloads\NokiaSoftwareUpdaterSetup_DE.exe 2014-05-22 08:31 - 2012-05-29 19:07 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\vlc 2014-05-21 19:10 - 2014-05-21 19:03 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Systweak 2014-05-21 19:07 - 2012-06-06 21:05 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-05-21 19:07 - 2012-06-06 21:05 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-05-21 19:07 - 2012-06-06 21:05 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-05-21 19:06 - 2012-05-29 16:32 - 00000000 ___RD () C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-05-21 19:05 - 2014-05-21 19:03 - 00000000 ____D () C:\Program Files (x86)\Advanced System Protector 2014-05-21 19:03 - 2014-05-21 19:03 - 00003140 _____ () C:\Windows\System32\Tasks\YourFile DownloaderUpdate 2014-05-21 19:03 - 2014-05-21 19:03 - 00000512 __RSH () C:\ProgramData\ntuser.pol 2014-05-21 19:03 - 2014-05-21 19:03 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\YourFileDownloader 2014-05-21 19:03 - 2009-07-14 05:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy 2014-05-21 19:03 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy 2014-05-21 18:55 - 2014-05-21 18:27 - 00000000 ____D () C:\Program Files (x86)\CardRecovery 2014-05-21 18:54 - 2014-05-18 18:44 - 00000000 ____D () C:\Program Files (x86)\MyFree Codec 2014-05-21 18:22 - 2012-10-23 20:29 - 00000069 _____ () C:\Windows\NeroDigital.ini 2014-05-21 18:22 - 2012-10-23 20:29 - 00000069 _____ () C:\Users\Ich\AppData\Roaming\default.pls 2014-05-21 18:18 - 2012-06-01 14:49 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Mp3tag 2014-05-21 14:11 - 2012-05-29 18:02 - 00000000 ____D () C:\Program Files (x86)\JDownloader 2014-05-19 17:48 - 2014-05-19 16:08 - 00000000 ____D () C:\Users\Mama\AppData\Roaming\Apple Computer 2014-05-19 17:44 - 2014-05-19 17:44 - 00000000 ____D () C:\Users\Mama\AppData\Local\Macromedia 2014-05-19 17:43 - 2014-05-19 17:43 - 00000000 ____D () C:\Users\Mama\AppData\Roaming\Mozilla 2014-05-19 17:43 - 2014-05-19 17:43 - 00000000 ____D () C:\Users\Mama\AppData\Local\Mozilla 2014-05-19 17:10 - 2014-05-19 17:10 - 00000000 ____D () C:\Users\Mama\AppData\Roaming\Winamp 2014-05-19 16:13 - 2014-05-19 16:13 - 00000508 _____ () C:\Users\Mama\Desktop\Volume (F) - Verknüpfung.lnk 2014-05-19 16:13 - 2014-05-19 16:13 - 00000494 _____ () C:\Users\Mama\Desktop\Lokaler Datenträger (G) - Verknüpfung.lnk 2014-05-19 16:13 - 2014-05-19 16:13 - 00000472 _____ () C:\Users\Mama\Desktop\Volume (K) - Verknüpfung.lnk 2014-05-19 16:13 - 2014-05-19 16:13 - 00000340 _____ () C:\Users\Mama\Desktop\DVD H oben.lnk 2014-05-19 16:13 - 2014-05-19 16:13 - 00000336 _____ () C:\Users\Mama\Desktop\DVD I unten.lnk 2014-05-19 16:12 - 2014-05-19 16:12 - 00000512 _____ () C:\Users\Mama\Desktop\Lokaler Datenträger (C) - Verknüpfung.lnk 2014-05-19 16:12 - 2014-05-19 16:12 - 00000472 _____ () C:\Users\Mama\Desktop\Volume (E) - Verknüpfung.lnk 2014-05-19 16:12 - 2014-05-19 16:12 - 00000472 _____ () C:\Users\Mama\Desktop\Volume (D) - Verknüpfung.lnk 2014-05-19 16:08 - 2014-05-19 16:08 - 00288752 _____ () C:\Users\Mama\AppData\Local\GDIPFONTCACHEV1.DAT 2014-05-19 16:08 - 2014-05-19 16:08 - 00000000 ____D () C:\Users\Mama\AppData\Local\Apple Computer 2014-05-19 16:08 - 2014-05-19 16:08 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2014-05-19 16:07 - 2014-05-19 16:07 - 00002290 _____ () C:\Users\Mama\Desktop\Sicherer Zahlungsverkehr.lnk 2014-05-19 16:07 - 2014-05-19 16:07 - 00001421 _____ () C:\Users\Mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-05-19 16:07 - 2014-05-19 16:07 - 00000020 ___SH () C:\Users\Mama\ntuser.ini 2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Vorlagen 2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Startmenü 2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Netzwerkumgebung 2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Lokale Einstellungen 2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Eigene Dateien 2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Druckumgebung 2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Documents\Eigene Musik 2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Documents\Eigene Bilder 2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\AppData\Local\Verlauf 2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\AppData\Local\Anwendungsdaten 2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Anwendungsdaten 2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 ___RD () C:\Users\Mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 ___RD () C:\Users\Mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 ____D () C:\Users\Mama\AppData\Roaming\Adobe 2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 ____D () C:\Users\Mama 2014-05-19 16:07 - 2009-07-14 06:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk 2014-05-18 18:46 - 2013-03-21 18:37 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\TV-Browser 2014-05-18 18:41 - 2014-05-18 18:41 - 00000000 ____D () C:\Users\Public\Documents\CrashDump 2014-05-18 18:41 - 2013-10-24 19:02 - 00000000 ____D () C:\Users\Ich\Documents\SelfMV 2014-05-17 20:01 - 2013-04-20 16:53 - 00000000 ____D () C:\Users\Ich\AppData\Local\Last.fm 2014-05-16 21:02 - 2014-05-16 21:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2014-05-16 21:02 - 2014-05-16 21:02 - 00000000 ____D () C:\Program Files\iTunes 2014-05-16 21:02 - 2014-05-16 21:02 - 00000000 ____D () C:\Program Files\iPod 2014-05-16 21:02 - 2013-10-25 21:50 - 00001743 _____ () C:\Users\Public\Desktop\iTunes.lnk 2014-05-16 21:02 - 2013-02-27 17:38 - 00000000 ____D () C:\Program Files (x86)\iTunes 2014-05-16 18:38 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache 2014-05-16 17:25 - 2013-11-18 19:03 - 00019456 ___SH () C:\Users\Ich\Thumbs.db 2014-05-15 08:08 - 2012-05-29 16:32 - 00000000 ___RD () C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-05-15 08:07 - 2014-05-06 23:26 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-05-15 08:07 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-05-15 08:02 - 2012-05-26 13:57 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-05-15 08:01 - 2013-08-14 23:34 - 00000000 ____D () C:\Windows\system32\MRT 2014-05-15 07:59 - 2012-05-26 13:16 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-05-14 19:09 - 2013-09-15 08:23 - 00000000 ____D () C:\ProgramData\Aimersoft Video Converter Ultimate 2014-05-14 15:08 - 2012-05-29 18:10 - 00000000 ____D () C:\Users\Ich\AppData\Local\DVD Profiler 2014-05-13 17:15 - 2014-05-13 17:15 - 00001159 _____ () C:\Users\Ich\Desktop\Any Video Converter.lnk 2014-05-13 17:15 - 2014-05-13 17:15 - 00000000 ____D () C:\Users\Ich\Documents\Any Video Converter 2014-05-13 17:15 - 2014-05-13 17:15 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\AnvSoft 2014-05-13 17:15 - 2014-05-13 17:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AnvSoft 2014-05-13 17:14 - 2014-05-13 17:14 - 00000000 ____D () C:\Program Files (x86)\AnvSoft 2014-05-12 21:50 - 2012-07-02 20:52 - 00000000 ____D () C:\Users\Ich\AppData\Local\Canon Easy-PhotoPrint EX 2014-05-12 21:35 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp 2014-05-12 12:04 - 2014-05-12 12:04 - 00001221 _____ () C:\Users\Ich\Desktop\Eigene Downloads.lnk 2014-05-12 09:15 - 2014-05-12 09:15 - 00000000 __SHD () C:\Users\Ich\AppData\Local\EmieUserList 2014-05-12 09:15 - 2014-05-12 09:15 - 00000000 __SHD () C:\Users\Ich\AppData\Local\EmieSiteList 2014-05-12 08:28 - 2012-07-02 20:45 - 00000000 ____D () C:\ProgramData\CanonIJPLM 2014-05-12 07:26 - 2014-05-22 11:27 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-05-12 07:26 - 2014-05-22 11:27 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-05-12 07:25 - 2012-07-24 06:54 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-05-10 08:10 - 2014-05-09 21:20 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-05-09 10:23 - 2013-05-22 19:48 - 00000000 ____D () C:\ProgramData\VSO 2014-05-09 08:14 - 2014-05-15 07:08 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-05-09 08:11 - 2014-05-15 07:08 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-05-08 18:10 - 2013-06-12 18:36 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\FileZilla 2014-05-08 18:03 - 2012-08-01 21:55 - 00019968 _____ () C:\Users\Ich\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2014-05-08 07:34 - 2014-05-08 07:34 - 00000000 _____ () C:\Windows\setuperr.log 2014-05-06 15:13 - 2013-12-06 20:38 - 00000000 ____D () C:\Program Files (x86)\Origin 2014-05-06 15:13 - 2013-12-06 20:23 - 00000000 ____D () C:\ProgramData\Origin 2014-05-06 15:12 - 2013-12-06 21:36 - 00000000 ____D () C:\Program Files (x86)\Need for Speed Rivals 2014-05-06 15:10 - 2014-05-06 15:10 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR 2014-05-06 15:10 - 2014-05-06 15:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR 2014-05-06 15:10 - 2012-05-29 18:38 - 00000000 ____D () C:\Program Files\WinRAR 2014-05-06 15:03 - 2012-05-29 17:04 - 00018960 _____ (Logitech, Inc.) C:\Windows\system32\Drivers\LNonPnP.sys 2014-05-06 15:03 - 2012-05-29 17:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech 2014-05-06 15:03 - 2012-05-29 16:43 - 00000000 ____D () C:\Program Files\Common Files\logishrd 2014-05-06 15:02 - 2012-05-29 17:04 - 00000000 ____D () C:\ProgramData\Logitech 2014-05-06 15:02 - 2012-05-29 17:03 - 00000000 ____D () C:\ProgramData\Logishrd 2014-05-06 06:40 - 2014-05-15 08:01 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-05-06 06:17 - 2014-05-15 08:01 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-05-06 05:25 - 2014-05-15 08:01 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-05-06 05:07 - 2014-05-15 08:01 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-05-06 05:00 - 2014-05-15 08:01 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-05-06 04:10 - 2014-05-15 08:01 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-05-02 20:11 - 2014-05-02 20:11 - 00016896 _____ (ASUS) C:\Windows\AsTaskSched.dll 2014-05-02 20:11 - 2014-05-02 20:11 - 00000000 ____D () C:\Windows\Intel_Chipset_V9301019_XPWin7 2014-05-01 19:49 - 2012-06-17 17:07 - 00000000 ____D () C:\Program Files (x86)\Flickr Uploadr 2014-04-29 21:35 - 2013-05-20 23:02 - 00000000 ____D () C:\Program Files\Recuva 2014-04-29 14:56 - 2014-04-29 14:56 - 00002776 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC 2014-04-29 14:56 - 2014-04-29 14:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner 2014-04-29 14:56 - 2012-07-21 18:38 - 00000000 ____D () C:\Program Files\CCleaner 2014-04-25 17:31 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-04-22 19:20 - 2012-06-01 15:31 - 00000000 ____D () C:\Users\Ich\AppData\Local\Adobe 2014-04-22 18:14 - 2014-04-22 18:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mp3tag 2014-04-22 18:14 - 2012-08-02 18:29 - 00000939 _____ () C:\Users\Public\Desktop\Mp3tag.lnk 2014-04-22 18:14 - 2012-06-01 14:49 - 00000000 ____D () C:\Program Files (x86)\Mp3tag 2014-04-22 16:37 - 2014-04-22 16:37 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_ccdcmbx64_01009.Wdf Files to move or delete: ==================== C:\ProgramData\hpe3371.dll Some content of TEMP: ==================== C:\Users\Ich\AppData\Local\Temp\BackupSetup.exe C:\Users\Ich\AppData\Local\Temp\htmlayout.dll C:\Users\Ich\AppData\Local\Temp\toolbar18559124.exe C:\Users\Ich\AppData\Local\Temp\toolbar18559664.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-05-19 19:41 ==================== End Of Log ============================ --- --- --- malware bytes hat nix gefunden 114 dinger sind dort in quarantäne |
|
22.05.2014, 14:27
| #6 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Pup.Optional.BloackAndSurf.AZitat:
__________________ --> Pup.Optional.BloackAndSurf.A |
|
22.05.2014, 15:46
| #7 |
| | Pup.Optional.BloackAndSurf.A ja die freeware was man so runterladen kann die installiert sich alle 2 woche oder so bei mir |
|
22.05.2014, 22:33
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Pup.Optional.BloackAndSurf.A Und warum hast du einen derartigen Eintrag in der Hosts-Datei? Die Freeware setzt den da nicht rein.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
23.05.2014, 06:17
| #9 |
| | Pup.Optional.BloackAndSurf.A ja gute Frage, das kann ich dir auch nicht sagen, soll ich das löschen und noch mal neu installieren? dass ganze dings? ich weiß nicht mal was dss ist, ich habe den adobe zum dokumente lesen und soll ich die 114 dinger im Malwarebytes in der quarantäne löschen?  so sieht das aus |
|
23.05.2014, 11:30
| #10 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Pup.Optional.BloackAndSurf.AZitat:
Adware/Junkware/Toolbars entfernen 1. Schritt: adwCleaner Downloade Dir bitte  AdwCleaner auf deinen Desktop.
2. Schritt: JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
3. Schritt: Frisches Log mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ Logfiles bitte immer in CODE-Tags posten |
|
23.05.2014, 18:36
| #11 |
| | Pup.Optional.BloackAndSurf.A jawohl mache ich hier ist das log vom adw cleaner das komische ist, da steht abwählen was man nicht entfernen will ich habe einfach in den Tabs überall alle Haken weg gegeben was ich nicht entfernen wollte, wiel überall haken waren hier das log fals ich was falsch gemacht habe bitte sagne AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.015 - Bericht erstellt am 21/12/2013 um 22:16:35
# Updated 10/12/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Ich - ICH-PC
# Gestartet von : C:\Users\Ich\Downloads\adwcleaner_3.0.1.5.exe
# Option : Suchen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Datei Gefunden : C:\END
Datei Gefunden : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\invalidprefs.js
Datei Gefunden : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\searchplugins\Babylon.xml
Datei Gefunden : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\searchplugins\Conduit.xml
Datei Gefunden : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\searchplugins\conduit-search.xml
Datei Gefunden : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\searchplugins\delta.xml
Datei Gefunden : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\searchplugins\mixidj.xml
Datei Gefunden : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\searchplugins\SweetIm.xml
Datei Gefunden : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js
Datei Gefunden : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\mData\user.js
Datei Gefunden : C:\Windows\System32\roboot64.exe
Datei Gefunden : C:\Windows\System32\Tasks\Escolade
Datei Gefunden : C:\Windows\System32\Tasks\Express FilesUpdate
Ordner Gefunden : C:\Program Files (x86)\Mozilla Firefox\Extensions\ffxtlbr@babylon.com
Ordner Gefunden C:\Program Files (x86)\Conduit
Ordner Gefunden C:\Program Files (x86)\driver-soft
Ordner Gefunden C:\Program Files (x86)\myfree codec
Ordner Gefunden C:\Program Files (x86)\optimizer pro
Ordner Gefunden C:\Program Files (x86)\SimilarSites
Ordner Gefunden C:\Program Files (x86)\WebSearch
Ordner Gefunden C:\Program Files (x86)\yolobartb
Ordner Gefunden C:\ProgramData\Anti-phishing Domain Advisor
Ordner Gefunden C:\ProgramData\Babylon
Ordner Gefunden C:\ProgramData\boost_interprocess
Ordner Gefunden C:\ProgramData\StarApp
Ordner Gefunden C:\Users\Ich\AppData\Local\Conduit
Ordner Gefunden C:\Users\Ich\AppData\Local\SwvUpdater
Ordner Gefunden C:\Users\Ich\AppData\Local\Wajam
Ordner Gefunden C:\Users\Ich\AppData\Local\yolobartb
Ordner Gefunden C:\Users\Ich\AppData\LocalLow\boost_interprocess
Ordner Gefunden C:\Users\Ich\AppData\LocalLow\Conduit
Ordner Gefunden C:\Users\Ich\AppData\Roaming\eIntaller
Ordner Gefunden C:\Users\Ich\AppData\Roaming\ExpressFiles
Ordner Gefunden C:\Users\Ich\AppData\Roaming\iPumper
Ordner Gefunden C:\Users\Ich\AppData\Roaming\PerformerSoft
Ordner Gefunden C:\Users\Ich\AppData\Roaming\SimilarSites
Ordner Gefunden C:\Users\Ich\AppData\Roaming\Systweak
***** [ Verknüpfungen ] *****
Verknüpfung Gefunden : C:\Users\Ich\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\qvo6.lnk ( hxxp://www.qvo6.com/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=SAMSUNGXSSDX830XSeries_S0Z4NYAC300237&ts=1375722987 )
***** [ Registrierungsdatenbank ] *****
Schlüssel Gefunden : HKCU\Software\5e0d6dcb66aeb17
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\Crossrider
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\findlyrics
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\XingHaoLyrics
Schlüssel Gefunden : HKCU\Software\BabSolution
Schlüssel Gefunden : HKCU\Software\BI
Schlüssel Gefunden : HKCU\Software\Classes\pokki
Schlüssel Gefunden : HKCU\Software\Conduit
Schlüssel Gefunden : HKCU\Software\Delta
Schlüssel Gefunden : HKCU\Software\Escolade
Schlüssel Gefunden : HKCU\Software\ExpressFiles
Schlüssel Gefunden : HKCU\Software\filescout
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AD22EBAF-0D18-4FC7-90CC-5EA0ABBE9EB8}
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{32099AAC-C132-4136-9E9A-4E364A424E17}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{32099AAC-C132-4136-9E9A-4E364A424E17}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gefunden : HKCU\Software\Myfree Codec
Schlüssel Gefunden : HKCU\Software\SmartBar
Schlüssel Gefunden : HKCU\Software\Softonic
Schlüssel Gefunden : HKCU\Software\systweak
Schlüssel Gefunden : [x64] HKCU\Software\BabSolution
Schlüssel Gefunden : [x64] HKCU\Software\BI
Schlüssel Gefunden : [x64] HKCU\Software\Conduit
Schlüssel Gefunden : [x64] HKCU\Software\Delta
Schlüssel Gefunden : [x64] HKCU\Software\Escolade
Schlüssel Gefunden : [x64] HKCU\Software\ExpressFiles
Schlüssel Gefunden : [x64] HKCU\Software\filescout
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AD22EBAF-0D18-4FC7-90CC-5EA0ABBE9EB8}
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
Schlüssel Gefunden : [x64] HKCU\Software\Myfree Codec
Schlüssel Gefunden : [x64] HKCU\Software\SmartBar
Schlüssel Gefunden : [x64] HKCU\Software\Softonic
Schlüssel Gefunden : [x64] HKCU\Software\systweak
Schlüssel Gefunden : HKLM\SOFTWARE\14919ea49a8f3b4aa3cf1058d9a64cec
Schlüssel Gefunden : HKLM\SOFTWARE\5e0d6dcb66aeb17
Schlüssel Gefunden : HKLM\Software\Babylon
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\*\shell\filescout
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{8D5CFE57-B0FD-4396-97A2-DFD0B7DA935B}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{1663C10B-0D55-438D-8496-19A3DBAEC0E4}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{A43DE495-3D00-47D4-9D2C-303115707939}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{AF175732-0D59-716D-F757-9F1492D808D9}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\driverscanner
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{A36BCB13-778D-4A40-99C1-D686086D268F}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar.CT2653012
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar.CT3289847
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{CCA8F2AB-BE4E-41F0-A289-4D960CEA58EA}
Schlüssel Gefunden : HKLM\Software\Conduit
Schlüssel Gefunden : HKLM\Software\DataMngr
Schlüssel Gefunden : HKLM\Software\Delta
Schlüssel Gefunden : HKLM\Software\ExpressFiles
Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp
Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\kekfoodhbhpjhjcdecjngamojfhknooc
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4250488A-CB24-0893-C066-B1AEA57BCFF2}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_veoh_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_veoh_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\driverscanner_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\driverscanner_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\Savings Sidekick_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\Savings Sidekick_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_evillyrics_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_evillyrics_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_audiocon_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_audiocon_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_comicreader_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_comicreader_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_free-youtube-download_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_free-youtube-download_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\wajam_install_rasapi32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\wajam_install_rasmancs
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SP_4e24eecb
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SP_703c874a
Schlüssel Gefunden : HKLM\Software\Myfree Codec
Schlüssel Gefunden : HKLM\Software\SoftwareUpdater
Schlüssel Gefunden : HKLM\Software\SP Global
Schlüssel Gefunden : HKLM\Software\SProtector
Schlüssel Gefunden : HKLM\Software\Uniblue
Schlüssel Gefunden : HKLM\Software\Uniblue\DriverScanner
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{1231839B-064E-4788-B865-465A1B5266FD}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{2DAC2231-CC35-482B-97C5-CED1D4185080}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{3F1CD84C-04A3-4EA0-9EA1-7D134FD66C82}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{3F83A9CA-B5F0-44EC-9357-35BB3E84B07F}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{47E520EA-CAD2-4F51-8F30-613B3A1C33EB}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{57C91446-8D81-4156-A70E-624551442DE9}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{70AFB7B2-9FB5-4A70-905B-0E9576142E1D}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{7AD65FD1-79E0-406D-B03C-DD7C14726D69}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{97DD820D-2E20-40AD-B01E-6730B2FCE630}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{A36BCB13-778D-4A40-99C1-D686086D268F}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{B177446D-54A4-4869-BABC-8566110B4BE0}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{D54C859C-6066-4F31-8FE0-2AAEDCAE67D7}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{D9D1DFC5-502D-43E4-B1BB-4D0B7841489A}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{E0B07188-A528-4F9E-B2F7-C7FDE8680AE4}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{F05B12E1-ADE8-4485-B45B-898748B53C37}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\DivX\Install\Setup\WizardLayout\ConduitToolbar
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Wert Gefunden : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [ntfdsaftsfdfdxx@mozilla.org]
Wert Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{32099AAC-C132-4136-9E9A-4E364A424E17}]
Wert Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16428
Einstellung Gefunden : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page] - hxxp://websearch.searchesplace.info/?pid=714&r=2013/08/06&hid=626440395&lg=EN&cc=AT&unqvl=30
Einstellung Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] - hxxp://websearch.searchesplace.info/?pid=714&r=2013/08/06&hid=626440395&lg=EN&cc=AT&unqvl=30
Einstellung Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default] - hxxp://feed.snap.do/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=AT&userid=c563f731-df84-4057-8178-ba6ef3ec461c&searchtype=ds&q={searchTerms}&installDate=24/03/2013
Einstellung Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default] - hxxp://feed.snap.do/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=AT&userid=c563f731-df84-4057-8178-ba6ef3ec461c&searchtype=ds&q={searchTerms}&installDate=24/03/2013
-\\ Mozilla Firefox v27.0 (de)
[ Datei : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js ]
Zeile gefunden : user_pref("CT3289847.FF19Solved", "true");
Zeile gefunden : user_pref("CT3289847.UserID", "UN39714774142223222");
Zeile gefunden : user_pref("CT3289847.browser.search.defaultthis.engineName", "true");
Zeile gefunden : user_pref("CT3289847.installDate", "21/5/2013 16:11:56");
Zeile gefunden : user_pref("CT3289847.installSessionId", "-1");
Zeile gefunden : user_pref("CT3289847.installSp", "TRUE");
Zeile gefunden : user_pref("CT3289847.installerVersion", "1.4.2.3");
Zeile gefunden : user_pref("CT3289847.keyword", "true");
Zeile gefunden : user_pref("CT3289847.originalHomepage", "hxxp://www.google.at/");
Zeile gefunden : user_pref("CT3289847.originalSearchAddressUrl", "");
Zeile gefunden : user_pref("CT3289847.originalSearchEngine", "Hola Search");
Zeile gefunden : user_pref("CT3289847.searchRevert", "true");
Zeile gefunden : user_pref("CT3289847.searchUserMode", "2");
Zeile gefunden : user_pref("CT3289847.smartbar.homepage", "true");
Zeile gefunden : user_pref("CT3289847.versionFromInstaller", "10.16.2.9");
Zeile gefunden : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3289847&octid=CT3289847&SearchSource=61&CUI=UN39714774142223222&UM=2&UP=SP749BC241-15DC-4C40-AA2D-1174B1D75133");
Zeile gefunden : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "");
Zeile gefunden : user_pref("browser.search.defaultenginename", "Conduit Search");
Zeile gefunden : user_pref("browser.search.defaultthis.engineName", "WhiteSmoke New Customized Web Search");
Zeile gefunden : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3289847&CUI=UN39714774142223222&UM=2&SearchSource=3&q={searchTerms}");
Zeile gefunden : user_pref("browser.search.selectedEngine", "Conduit Search");
Zeile gefunden : user_pref("extensions.delta.admin", false);
Zeile gefunden : user_pref("extensions.delta.aflt", "babsst");
Zeile gefunden : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
Zeile gefunden : user_pref("extensions.delta.autoRvrt", "false");
Zeile gefunden : user_pref("extensions.delta.bbDpng", "5");
Zeile gefunden : user_pref("extensions.delta.cntry", "AT");
Zeile gefunden : user_pref("extensions.delta.dfltLng", "de");
Zeile gefunden : user_pref("extensions.delta.excTlbr", false);
Zeile gefunden : user_pref("extensions.delta.ffxUnstlRst", true);
Zeile gefunden : user_pref("extensions.delta.hdrMd5", "28263874FEE07DFB855676D393357012");
Zeile gefunden : user_pref("extensions.delta.id", "56852f7f0000000000002208cae4df32");
Zeile gefunden : user_pref("extensions.delta.instlDay", "15922");
Zeile gefunden : user_pref("extensions.delta.instlRef", "sst");
Zeile gefunden : user_pref("extensions.delta.lastVrsnTs", "1.8.22.07:52:11");
Zeile gefunden : user_pref("extensions.delta.newTab", false);
Zeile gefunden : user_pref("extensions.delta.prdct", "delta");
Zeile gefunden : user_pref("extensions.delta.prtnrId", "delta");
Zeile gefunden : user_pref("extensions.delta.rvrt", "false");
Zeile gefunden : user_pref("extensions.delta.sg", "azb");
Zeile gefunden : user_pref("extensions.delta.smplGrp", "none");
Zeile gefunden : user_pref("extensions.delta.tlbrId", "base");
Zeile gefunden : user_pref("extensions.delta.tlbrSrchUrl", "");
Zeile gefunden : user_pref("extensions.delta.vrsn", "1.8.22.0");
Zeile gefunden : user_pref("extensions.delta.vrsnTs", "1.8.22.07:52:11");
Zeile gefunden : user_pref("extensions.delta.vrsni", "1.8.22.0");
Zeile gefunden : user_pref("extensions.delta_i.babExt", "");
Zeile gefunden : user_pref("extensions.delta_i.babTrack", "affID=123639&tsp=4965");
Zeile gefunden : user_pref("extensions.delta_i.srcExt", "ss");
Zeile gefunden : user_pref("extensions.ffxtlbr@delta.com.install-event-fired", true);
Zeile gefunden : user_pref("keyword.URL", "hxxp://search.sweetim.com/search.asp?barid=null&src=2&q=");
Zeile gefunden : user_pref("smartbar.addressBarOwnerCTID", "CT3289847");
Zeile gefunden : user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT3289847&CUI=UN39714774142223222&UM=2&SearchSource=13,hxxp://search.conduit.com/?ctid=CT3289847&octid=CT3289847&SearchSource[...]
Zeile gefunden : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3289847&SearchSource=2&CUI=UN39714774142223222&UM=2&q=");
Zeile gefunden : user_pref("smartbar.defaultSearchOwnerCTID", "CT3289847");
Zeile gefunden : user_pref("smartbar.homePageOwnerCTID", "CT3289847");
Zeile gefunden : user_pref("smartbar.originalHomepage", "hxxp://search.conduit.com/?ctid=CT3289847&CUI=UN39714774142223222&UM=2&SearchSource=13");
*************************
AdwCleaner[R0].txt - [20532 octets] - [21/12/2013 18:31:58]
AdwCleaner[R1].txt - [20601 octets] - [21/12/2013 22:07:03]
AdwCleaner[R2].txt - [20259 octets] - [21/12/2013 22:16:35]
########## EOF - C:\AdwCleaner\AdwCleaner[R2].txt - [20320 octets] ##########
AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.210 - Bericht erstellt am 23/05/2014 um 17:21:14
# Aktualisiert 19/05/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Ich - ICH-PC
# Gestartet von : C:\Users\Ich\Downloads\adwcleaner_3.210.exe
# Option : Suchen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Datei Gefunden : C:\END
Datei Gefunden : C:\Users\Ich\AppData\Roaming\LiveSupport.exe_log.txt
Datei Gefunden : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\Extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi
Datei Gefunden : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\invalidprefs.js
Datei Gefunden : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\user.js
Datei Gefunden : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\user.js
Datei Gefunden : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\e03ctse8.default-1386090037992\user.js
Datei Gefunden : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\mData\user.js
Datei Gefunden : C:\Users\Ich\AppData\Roaming\regsvr32.exe_log.txt
Datei Gefunden : C:\Windows\System32\Tasks\YourFile DownloaderUpdate
Ordner Gefunden : C:\Program Files (x86)\Advanced System Protector
Ordner Gefunden : C:\Program Files (x86)\Conduit
Ordner Gefunden : C:\ProgramData\Conduit
Ordner Gefunden : C:\Users\Ich\AppData\Local\Conduit
Ordner Gefunden : C:\Users\Ich\AppData\Local\Temp\OCS
Ordner Gefunden : C:\Users\Ich\AppData\LocalLow\Conduit
Ordner Gefunden : C:\Users\Ich\AppData\Roaming\Systweak
Ordner Gefunden : C:\Users\Ich\AppData\Roaming\YourFileDownloader
Ordner Gefunden : C:\Windows\SysWOW64\SearchProtect
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gefunden : HKCU\Software\anchorfree
Schlüssel Gefunden : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\blockAndSurf
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gefunden : HKCU\Software\Conduit
Schlüssel Gefunden : HKCU\Software\distromatic
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gefunden : HKCU\Software\OCS
Schlüssel Gefunden : HKCU\Software\Softonic
Schlüssel Gefunden : HKCU\Software\systweak
Schlüssel Gefunden : HKCU\Software\YourFileDownloader
Schlüssel Gefunden : [x64] HKCU\Software\anchorfree
Schlüssel Gefunden : [x64] HKCU\Software\Conduit
Schlüssel Gefunden : [x64] HKCU\Software\distromatic
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gefunden : [x64] HKCU\Software\OCS
Schlüssel Gefunden : [x64] HKCU\Software\Softonic
Schlüssel Gefunden : [x64] HKCU\Software\systweak
Schlüssel Gefunden : [x64] HKCU\Software\YourFileDownloader
Schlüssel Gefunden : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gefunden : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gefunden : HKLM\Software\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar.CT1561552
Schlüssel Gefunden : HKLM\Software\Conduit
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\updateMegaBrowse_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\updateMegaBrowse_RASMANCS
Schlüssel Gefunden : HKLM\Software\systweak
Schlüssel Gefunden : HKLM\Software\YourFileDownloader
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{0BDDE35F-64F7-49C3-99B2-404E899C49F7}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{24236608-609C-42C5-B13C-A8A3EC921850}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{28B1A706-4B97-4EB1-8B32-125042685AD9}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{33575A26-D9CF-40C6-8A3E-116F17201C7F}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{4BDFD19F-93D7-49CE-B554-5C215FDC0136}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{7307CF0F-7173-4FBF-8649-B149916DD322}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{80A5E38C-5F6B-485F-BD97-0B5BE991FAD5}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{9544D727-A26F-4D57-AF38-4496088640EA}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{AC4C30BF-7D5F-4EAB-9C2A-454178F079AA}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{BC6F9C26-93EA-4C6D-A4A7-C1FA333B4BBE}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{E975527B-ABE7-40B3-B5C1-385016913E3B}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{EFA4B5B1-6C76-4B20-BCDB-D41A93E79053}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\DivX\Install\Setup\WizardLayout\ConduitToolbar
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17041
-\\ Mozilla Firefox v29.0.1 (de)
[ Datei : C:\Users\Mama\AppData\Roaming\Mozilla\Firefox\Profiles\9x0vzil8.default\prefs.js ]
[ Datei : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js ]
Zeile gefunden : user_pref("extensions.buenosearch.admin", false);
Zeile gefunden : user_pref("extensions.buenosearch.aflt", "babsst");
Zeile gefunden : user_pref("extensions.buenosearch.appId", "{37EB75F2-7392-4DBE-B5AD-147EC6D7BF5F}");
Zeile gefunden : user_pref("extensions.buenosearch.autoRvrt", "false");
Zeile gefunden : user_pref("extensions.buenosearch.dfltLng", "de");
Zeile gefunden : user_pref("extensions.buenosearch.excTlbr", false);
Zeile gefunden : user_pref("extensions.buenosearch.ffxUnstlRst", true);
Zeile gefunden : user_pref("extensions.buenosearch.id", "56852f7f0000000000002208cae4df32");
Zeile gefunden : user_pref("extensions.buenosearch.instlDay", "16211");
Zeile gefunden : user_pref("extensions.buenosearch.instlRef", "sst");
Zeile gefunden : user_pref("extensions.buenosearch.newTab", false);
Zeile gefunden : user_pref("extensions.buenosearch.prdct", "buenosearch");
Zeile gefunden : user_pref("extensions.buenosearch.prtnrId", "buenosearch");
Zeile gefunden : user_pref("extensions.buenosearch.rvrt", "false");
Zeile gefunden : user_pref("extensions.buenosearch.smplGrp", "none");
Zeile gefunden : user_pref("extensions.buenosearch.tb_url", "hxxp://www.buenosearch.com/?q={searchTerms}&babsrc=TB_ss&mntrId=56852208CAE4DF32&affID=128235&tsp=5254");
Zeile gefunden : user_pref("extensions.buenosearch.tlbrId", "base");
Zeile gefunden : user_pref("extensions.buenosearch.tlbrSrchUrl", "hxxp://www.buenosearch.com/?q={searchTerms}&babsrc=TB_ss&mntrId=56852208CAE4DF32&affID=128235&tsp=5254");
Zeile gefunden : user_pref("extensions.buenosearch.vrsn", "1.8.28.7");
Zeile gefunden : user_pref("extensions.buenosearch.vrsnTs", "1.8.28.719:03:30");
Zeile gefunden : user_pref("extensions.buenosearch.vrsni", "1.8.28.7");
Zeile gefunden : user_pref("extensions.delta.admin", false);
Zeile gefunden : user_pref("extensions.delta.aflt", "babsst");
Zeile gefunden : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
Zeile gefunden : user_pref("extensions.delta.autoRvrt", "false");
Zeile gefunden : user_pref("extensions.delta.dfltLng", "de");
Zeile gefunden : user_pref("extensions.delta.excTlbr", false);
Zeile gefunden : user_pref("extensions.delta.ffxUnstlRst", true);
Zeile gefunden : user_pref("extensions.delta.id", "56852f7f0000000000002208cae4df32");
Zeile gefunden : user_pref("extensions.delta.instlDay", "15922");
Zeile gefunden : user_pref("extensions.delta.instlRef", "sst");
Zeile gefunden : user_pref("extensions.delta.newTab", false);
Zeile gefunden : user_pref("extensions.delta.prdct", "delta");
Zeile gefunden : user_pref("extensions.delta.prtnrId", "delta");
Zeile gefunden : user_pref("extensions.delta.rvrt", "false");
Zeile gefunden : user_pref("extensions.delta.smplGrp", "none");
Zeile gefunden : user_pref("extensions.delta.tlbrId", "base");
Zeile gefunden : user_pref("extensions.delta.tlbrSrchUrl", "");
Zeile gefunden : user_pref("extensions.delta.vrsn", "1.8.22.0");
Zeile gefunden : user_pref("extensions.delta.vrsnTs", "1.8.22.07:52:11");
Zeile gefunden : user_pref("extensions.delta.vrsni", "1.8.22.0");
Zeile gefunden : user_pref("extensions.delta_i.babExt", "");
Zeile gefunden : user_pref("extensions.delta_i.babTrack", "affID=123639&tsp=4965");
Zeile gefunden : user_pref("extensions.delta_i.srcExt", "ss");
[ Datei : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\prefs.js ]
-\\ Google Chrome v
*************************
AdwCleaner[R0].txt - [40481 octets] - [21/12/2013 19:31:58]
AdwCleaner[R1].txt - [30200 octets] - [21/12/2013 23:07:03]
AdwCleaner[R2].txt - [29881 octets] - [21/12/2013 23:16:35]
AdwCleaner[S0].txt - [36983 octets] - [21/12/2013 23:18:00]
########## EOF - C:\AdwCleaner\AdwCleaner[R2].txt - [30003 octets] ##########
dass ist das junkwarve log Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Professional x64
Ran by Ich on 23.05.2014 at 17:24:31,09
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\anchorfree
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\conduit
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\distromatic
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\softonic
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\systweak
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\yourfiledownloader
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\conduitsearchscopes
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\smartbar
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-653767932-1258093497-3206199211-1001\Software\sweetim
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\conduit
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\systweak
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\yourfiledownloader
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Toolbar.CT1561552
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110011501160}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\EvilLyrics_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\EvilLyrics_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011501160}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\EvilLyrics_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\EvilLyrics_RASMANCS
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{AD4DB906-4F2D-4958-B850-F4824CD76F92}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{D26A34AF-2086-4657-92CF-1FD005A3F8EF}
~~~ Files
Successfully deleted: [File] "C:\end"
~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\conduit"
Successfully deleted: [Folder] "C:\ProgramData\drivergenius"
Successfully deleted: [Folder] "C:\Users\Ich\AppData\Roaming\systweak"
Successfully deleted: [Folder] "C:\Users\Ich\AppData\Roaming\yourfiledownloader"
Successfully deleted: [Folder] "C:\Users\Ich\appdata\locallow\boost_interprocess"
Successfully deleted: [Folder] "C:\Users\Ich\appdata\locallow\conduit"
Successfully deleted: [Folder] "C:\Program Files (x86)\advanced system protector"
Successfully deleted: [Folder] "C:\Program Files (x86)\conduit"
Successfully deleted: [Folder] "C:\Program Files (x86)\myfree codec"
Successfully deleted: [Folder] "C:\Program Files (x86)\saveshare"
~~~ FireFox
Successfully deleted: [File] C:\Users\Ich\AppData\Roaming\mozilla\firefox\profiles\5ffvwt3l.default-1352296656028\user.js
Successfully deleted: [File] C:\Users\Ich\AppData\Roaming\mozilla\firefox\profiles\7a7ej4nx.Ich\user.js
Successfully deleted: [File] C:\Users\Ich\AppData\Roaming\mozilla\firefox\profiles\5ffvwt3l.default-1352296656028\invalidprefs.js
Successfully deleted the following from C:\Users\Ich\AppData\Roaming\mozilla\firefox\profiles\5ffvwt3l.default-1352296656028\prefs.js
user_pref("extensions.buenosearch.tb_url", "hxxp://www.buenosearch.com/?q={searchTerms}&babsrc=TB_ss&mntrId=56852208CAE4DF32&affID=128235&tsp=5254");
user_pref("extensions.buenosearch.tlbrSrchUrl", "hxxp://www.buenosearch.com/?q={searchTerms}&babsrc=TB_ss&mntrId=56852208CAE4DF32&affID=128235&tsp=5254");
user_pref("extensions.delta.admin", false);
user_pref("extensions.delta.aflt", "babsst");
user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
user_pref("extensions.delta.autoRvrt", "false");
user_pref("extensions.delta.dfltLng", "de");
user_pref("extensions.delta.excTlbr", false);
user_pref("extensions.delta.ffxUnstlRst", true);
user_pref("extensions.delta.id", "56852f7f0000000000002208cae4df32");
user_pref("extensions.delta.instlDay", "15922");
user_pref("extensions.delta.instlRef", "sst");
user_pref("extensions.delta.newTab", false);
user_pref("extensions.delta.prdct", "delta");
user_pref("extensions.delta.prtnrId", "delta");
user_pref("extensions.delta.rvrt", "false");
user_pref("extensions.delta.smplGrp", "none");
user_pref("extensions.delta.tlbrId", "base");
user_pref("extensions.delta.tlbrSrchUrl", "");
user_pref("extensions.delta.vrsn", "1.8.22.0");
user_pref("extensions.delta.vrsnTs", "1.8.22.07:52:11");
user_pref("extensions.delta.vrsni", "1.8.22.0");
user_pref("extensions.delta_i.babExt", "");
user_pref("extensions.delta_i.babTrack", "affID=123639&tsp=4965");
user_pref("extensions.delta_i.srcExt", "ss");
Emptied folder: C:\Users\Ich\AppData\Roaming\mozilla\firefox\profiles\5ffvwt3l.default-1352296656028\minidumps [259 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 23.05.2014 at 17:31:22,62
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-05-2014
Ran by Ich (administrator) on ICH-PC on 23-05-2014 19:35:22
Running from C:\Users\Ich\Downloads
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(WIBU-SYSTEMS AG) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
(Microsoft Corporation) C:\Windows\splwow64.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM-x32\...\Run: [NPSStartup] => [X]
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\.DEFAULT\...\RunOnce: [SpUninstallDeleteDir] - rmdir /s /q "\SearchProtect"
HKU\S-1-5-21-653767932-1258093497-3206199211-1001\...\MountPoints2: {6458225e-2a76-11e2-b097-c860008a7293} - O:\setup\rsrc\Autorun.exe
HKU\S-1-5-21-653767932-1258093497-3206199211-1001\...\MountPoints2: {6ccde770-c52a-11e1-820b-c860008a7293} - I:\OriginInstaller.exe
HKU\S-1-5-21-653767932-1258093497-3206199211-1001\...\MountPoints2: {9f44160e-29e5-11e2-82cc-c860008a7293} - N:\setup.exe
HKU\S-1-5-21-653767932-1258093497-3206199211-1001\...\MountPoints2: {bd5c79d4-b4af-11e1-aaf7-c860008a7293} - H:\OriginInstaller.exe
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://at.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x4F606FF5A73DCD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-AT
URLSearchHook: HKLM-x32 - Default Value = {74198672-5F7D-4FE9-A611-4AC1D5A66A15}
SearchScopes: HKLM-x32 - DefaultScope {D26A34AF-2086-4657-92CF-1FD005A3F8EF} URL =
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll (Logitech, Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: YouTube To MP3 - {43e8d393-3036-4f25-a522-d0ac693d3a68} - C:\Program Files (x86)\YouTube To MP3\YouTube To MP3.dll (SoundFrost Company)
BHO-x32: Aimersoft Video Converter Ultimate - {54F73992-6549-4369-9A0D-84FD310A464A} - C:\Program Files (x86)\Aimersoft\Video Converter Ultimate\SVRIEPlugin.dll (Aimersoft Software Co., Ltd.)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll (Logitech, Inc.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: 127.0.0.1 activate.adobe.com
Tcpip\Parameters: [DhcpNameServer] 195.34.133.21 212.186.211.21
FireFox:
========
FF ProfilePath: C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich
FF Homepage: user_pref("browser.startup.homepage", );
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.9.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.1 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.2 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.7 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.8 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.1 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.2 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.4 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @java.com/DTPlugin,version=10.4.1 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.4.1 - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll (Nullsoft, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Ich\AppData\Roaming\mozilla\plugins\np-mswmp.dll (Microsoft Corporation)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM-x32\...\Firefox\Extensions: [{CF13FA66-1F4F-426d-BB1B-E07A13BFF2C8}] - C:\Program Files (x86)\Aimersoft\Video Converter Ultimate\SVRFirefoxExt\
FF Extension: Aimersoft Video Converter Ultimate - C:\Program Files (x86)\Aimersoft\Video Converter Ultimate\SVRFirefoxExt\ []
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Chặn quảng cáo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2013-09-25]
FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2014-05-06]
FF HKCU\...\Firefox\Extensions: [YouTube To MP3@helper.com] - C:\PROGRA~2\YOUTUB~1\YOUTUB~1.XPI
FF Extension: YouTube To MP3 - C:\PROGRA~2\YOUTUB~1\YOUTUB~1.XPI [2013-01-15]
FF HKCU\...\Firefox\Extensions: [{CF13FA66-1F4F-426d-BB1B-E07A13BFF2C8}] - C:\Program Files (x86)\Aimersoft\Video Converter Ultimate\SVRFirefoxExt\
FF Extension: Aimersoft Video Converter Ultimate - C:\Program Files (x86)\Aimersoft\Video Converter Ultimate\SVRFirefoxExt\ []
FF HKCU\...\Firefox\Extensions: [{640B3CAE-8E84-33CB-6BF8-C1424043D58A}] - C:\Program Files (x86)\BlockAndSurf-soft\170.xpi
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (No Name) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\dnpicgdnjfnbkibnicdnnpkkpklkjkki [2013-04-12]
CHR Extension: (BlockAndSurf) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmjanljkmdghannnegcfcggmldgnddii [2014-05-21]
CHR HKLM-x32\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - https://chrome.google.com/webstore/detail/blbkdnmdcafmfhinpmnlhhddbepgkeaa [2014-05-21]
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2013-08-14]
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2013-08-14]
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2013-08-14]
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2013-08-14]
CHR HKLM-x32\...\Chrome\Extension: [mapcejffhcbidcjmomhalabpcbaeimcb] - C:\Program Files (x86)\Aimersoft\Video Converter Ultimate\SVRChromePlugin.crx [2013-09-23]
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2013-08-14]
CHR HKLM-x32\...\Chrome\Extension: [pkijdmeepjhpenmighhaodgfoogncnlk] - C:\Program Files (x86)\Offline Explorer\mpoe.crx [2013-08-14]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Services (Whitelisted) =================
S4 AdobeActiveFileMonitor10.0; C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe [169624 2011-09-01] (Adobe Systems Incorporated)
R2 avp; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2013-10-01] (Kaspersky Lab ZAO)
S4 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [116104 2010-04-05] ()
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
S4 Nero BackItUp Scheduler 3; C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe [877864 2008-06-08] (Nero AG)
S4 NMIndexingService; C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe [537896 2008-06-24] (Nero AG)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15125280 2013-11-14] (NVIDIA Corporation)
S4 OMSI download service; C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [90112 2009-04-30] ()
S4 PLFlash DeviceIoControl Service; C:\Windows\SysWOW64\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.)
==================== Drivers (Whitelisted) ====================
R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [138872 2011-12-04] (SlySoft, Inc.)
R3 AnyDVD; C:\Windows\SysWOW64\Drivers\AnyDVD.sys [138872 2011-12-04] (SlySoft, Inc.)
R0 asahci64; C:\Windows\System32\DRIVERS\asahci64.sys [49760 2012-01-06] (Asmedia Technology)
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-12-30] ()
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2013-11-06] (Kaspersky Lab ZAO)
S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [115296 2014-03-20] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [625248 2014-03-20] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2013-10-01] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2014-02-17] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-10-01] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2013-05-14] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178272 2013-12-18] (Kaspersky Lab ZAO)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-11-14] (NVIDIA Corporation)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R0 SI3132; C:\Windows\System32\DRIVERS\SI3132.sys [90664 2012-05-26] (Silicon Image, Inc)
R0 Si3132r5; C:\Windows\System32\DRIVERS\Si3132r5.sys [337960 2007-12-26] (Silicon Image, Inc)
R0 SiFilter; C:\Windows\System32\DRIVERS\SiWinAcc.sys [22056 2012-05-26] (Silicon Image, Inc)
R0 SiRemFil; C:\Windows\System32\DRIVERS\SiRemFil.sys [17448 2012-05-26] (Silicon Image, Inc)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2012-11-08] ()
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-10-16] (Anchorfree Inc.)
U3 aji4dbjt; C:\Windows\System32\Drivers\aji4dbjt.sys [0 ] (Microsoft Corporation)
S1 A2DDA; \??\C:\Users\Ich\AppData\Local\Temp\Rar$EXa0.301\Run\a2ddax64.sys [X]
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-05-23 19:35 - 2014-05-23 19:35 - 00019773 _____ () C:\Users\Ich\Downloads\FRST.txt
2014-05-23 19:34 - 2014-05-23 19:35 - 02067456 _____ (Farbar) C:\Users\Ich\Downloads\FRST64.exe
2014-05-23 17:31 - 2014-05-23 17:31 - 00006015 _____ () C:\Users\Ich\Desktop\JRT.txt
2014-05-23 17:24 - 2014-05-23 17:24 - 01016261 _____ (Thisisu) C:\Users\Ich\Downloads\JRT.exe
2014-05-23 17:24 - 2014-05-23 17:24 - 00000000 ____D () C:\Windows\ERUNT
2014-05-23 17:18 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-05-23 17:17 - 2014-05-23 17:17 - 01326389 _____ () C:\Users\Ich\Downloads\adwcleaner_3.210.exe
2014-05-23 07:13 - 2014-05-23 07:13 - 00000000 ____H () C:\ProgramData\cm-lock
2014-05-22 14:59 - 2014-05-22 14:59 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys
2014-05-22 14:43 - 2014-05-23 19:35 - 00000000 ____D () C:\FRST
2014-05-22 11:27 - 2014-05-23 07:14 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-22 11:27 - 2014-05-22 11:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-05-22 11:27 - 2014-05-22 11:27 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-05-22 11:27 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-22 11:27 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-21 19:03 - 2014-05-21 19:03 - 00003140 _____ () C:\Windows\System32\Tasks\YourFile DownloaderUpdate
2014-05-21 19:03 - 2014-05-21 19:03 - 00000512 __RSH () C:\ProgramData\ntuser.pol
2014-05-21 18:27 - 2014-05-21 18:55 - 00000000 ____D () C:\Program Files (x86)\CardRecovery
2014-05-19 17:44 - 2014-05-19 17:44 - 00000000 ____D () C:\Users\Mama\AppData\Local\Macromedia
2014-05-19 17:43 - 2014-05-19 17:43 - 00000000 ____D () C:\Users\Mama\AppData\Roaming\Mozilla
2014-05-19 17:43 - 2014-05-19 17:43 - 00000000 ____D () C:\Users\Mama\AppData\Local\Mozilla
2014-05-19 17:10 - 2014-05-19 17:10 - 00000000 ____D () C:\Users\Mama\AppData\Roaming\Winamp
2014-05-19 16:13 - 2014-05-19 16:13 - 00000508 _____ () C:\Users\Mama\Desktop\Volume (F) - Verknüpfung.lnk
2014-05-19 16:13 - 2014-05-19 16:13 - 00000494 _____ () C:\Users\Mama\Desktop\Lokaler Datenträger (G) - Verknüpfung.lnk
2014-05-19 16:13 - 2014-05-19 16:13 - 00000472 _____ () C:\Users\Mama\Desktop\Volume (K) - Verknüpfung.lnk
2014-05-19 16:13 - 2014-05-19 16:13 - 00000340 _____ () C:\Users\Mama\Desktop\DVD H oben.lnk
2014-05-19 16:13 - 2014-05-19 16:13 - 00000336 _____ () C:\Users\Mama\Desktop\DVD I unten.lnk
2014-05-19 16:12 - 2014-05-19 16:12 - 00000512 _____ () C:\Users\Mama\Desktop\Lokaler Datenträger (C) - Verknüpfung.lnk
2014-05-19 16:12 - 2014-05-19 16:12 - 00000472 _____ () C:\Users\Mama\Desktop\Volume (E) - Verknüpfung.lnk
2014-05-19 16:12 - 2014-05-19 16:12 - 00000472 _____ () C:\Users\Mama\Desktop\Volume (D) - Verknüpfung.lnk
2014-05-19 16:08 - 2014-05-19 17:48 - 00000000 ____D () C:\Users\Mama\AppData\Roaming\Apple Computer
2014-05-19 16:08 - 2014-05-19 16:08 - 00288752 _____ () C:\Users\Mama\AppData\Local\GDIPFONTCACHEV1.DAT
2014-05-19 16:08 - 2014-05-19 16:08 - 00000000 ____D () C:\Users\Mama\AppData\Local\Apple Computer
2014-05-19 16:08 - 2014-05-19 16:08 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-05-19 16:07 - 2014-05-19 16:07 - 00002290 _____ () C:\Users\Mama\Desktop\Sicherer Zahlungsverkehr.lnk
2014-05-19 16:07 - 2014-05-19 16:07 - 00001421 _____ () C:\Users\Mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-05-19 16:07 - 2014-05-19 16:07 - 00000020 ___SH () C:\Users\Mama\ntuser.ini
2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Vorlagen
2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Startmenü
2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Netzwerkumgebung
2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Lokale Einstellungen
2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Eigene Dateien
2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Druckumgebung
2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Documents\Eigene Musik
2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Documents\Eigene Bilder
2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\AppData\Local\Verlauf
2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\AppData\Local\Anwendungsdaten
2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Anwendungsdaten
2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 ___RD () C:\Users\Mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 ___RD () C:\Users\Mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 ____D () C:\Users\Mama\AppData\Roaming\Adobe
2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 ____D () C:\Users\Mama
2014-05-19 16:07 - 2012-06-23 21:31 - 00000000 ____D () C:\Users\Mama\AppData\Roaming\Macromedia
2014-05-19 16:07 - 2012-05-29 18:12 - 00000000 ____D () C:\Users\Mama\AppData\Local\Microsoft Help
2014-05-19 16:07 - 2009-07-14 06:54 - 00000000 ___RD () C:\Users\Mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-05-19 16:07 - 2009-07-14 06:49 - 00000000 ___RD () C:\Users\Mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-05-18 18:42 - 2013-12-30 03:54 - 00233472 _____ (Teruten) C:\Windows\SysWOW64\FsUsbExService.Exe
2014-05-18 18:42 - 2013-12-30 03:54 - 00037344 _____ () C:\Windows\SysWOW64\FsUsbExDisk.Sys
2014-05-18 18:42 - 2012-06-26 16:03 - 00110592 _____ () C:\Windows\SysWOW64\FsUsbExDevice.Dll
2014-05-18 18:41 - 2014-05-18 18:41 - 00000000 ____D () C:\Users\Public\Documents\CrashDump
2014-05-16 21:02 - 2014-05-16 21:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-05-16 21:02 - 2014-05-16 21:02 - 00000000 ____D () C:\Program Files\iTunes
2014-05-16 21:02 - 2014-05-16 21:02 - 00000000 ____D () C:\Program Files\iPod
2014-05-15 08:01 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-15 08:01 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-15 08:01 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-15 08:01 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-15 08:01 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-15 08:01 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-15 07:08 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-15 07:08 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-15 07:08 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-15 07:08 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-15 07:08 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-15 07:08 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-15 07:08 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-15 07:08 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-15 07:08 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-15 07:08 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-05-15 07:08 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-05-15 07:08 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-15 07:08 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-15 07:08 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-15 07:08 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-15 07:08 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-15 07:08 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-15 07:08 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-15 07:08 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-15 07:08 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-15 07:08 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-15 07:08 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-15 07:08 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-15 07:08 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-15 07:08 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-15 07:08 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-15 07:08 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-15 07:08 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-15 07:08 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-15 07:08 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-05-15 07:08 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-05-15 07:08 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-05-15 07:08 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-05-15 07:08 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-05-15 07:08 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-05-15 07:08 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-05-15 07:08 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-05-15 07:08 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-05-15 07:08 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-05-15 07:08 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-05-15 07:08 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-05-15 07:08 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-05-15 07:08 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-05-15 07:08 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-05-15 07:08 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-05-13 17:15 - 2014-05-13 17:15 - 00001159 _____ () C:\Users\Ich\Desktop\Any Video Converter.lnk
2014-05-13 17:15 - 2014-05-13 17:15 - 00000000 ____D () C:\Users\Ich\Documents\Any Video Converter
2014-05-13 17:15 - 2014-05-13 17:15 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\AnvSoft
2014-05-13 17:15 - 2014-05-13 17:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AnvSoft
2014-05-13 17:14 - 2014-05-13 17:14 - 00000000 ____D () C:\Program Files (x86)\AnvSoft
2014-05-12 12:04 - 2014-05-12 12:04 - 00001221 _____ () C:\Users\Ich\Desktop\Eigene Downloads.lnk
2014-05-12 09:15 - 2014-05-12 09:15 - 00000000 __SHD () C:\Users\Ich\AppData\Local\EmieUserList
2014-05-12 09:15 - 2014-05-12 09:15 - 00000000 __SHD () C:\Users\Ich\AppData\Local\EmieSiteList
2014-05-10 07:35 - 2014-05-22 19:50 - 00037336 _____ () C:\Windows\PFRO.log
2014-05-09 21:20 - 2014-05-10 08:10 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-08 07:34 - 2014-05-23 07:13 - 00015595 _____ () C:\Windows\setupact.log
2014-05-08 07:34 - 2014-05-08 07:34 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-06 23:26 - 2014-05-15 08:07 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-06 15:10 - 2014-05-06 15:10 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-05-06 15:10 - 2014-05-06 15:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-05-02 20:11 - 2014-05-02 20:11 - 00016896 _____ (ASUS) C:\Windows\AsTaskSched.dll
2014-05-02 20:11 - 2014-05-02 20:11 - 00000000 ____D () C:\Windows\Intel_Chipset_V9301019_XPWin7
2014-05-02 20:11 - 2011-02-25 08:25 - 00296320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2014-05-02 14:10 - 2012-05-21 00:25 - 00789824 _____ (Intel Corporation) C:\Windows\system32\Drivers\iusb3xhc.sys
2014-05-02 14:10 - 2012-05-21 00:25 - 00357184 _____ (Intel Corporation) C:\Windows\system32\Drivers\iusb3hub.sys
2014-05-02 14:10 - 2012-05-21 00:25 - 00019264 _____ (Intel Corporation) C:\Windows\system32\Drivers\iusb3hcs.sys
2014-04-29 14:56 - 2014-04-29 14:56 - 00002776 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-04-29 14:56 - 2014-04-29 14:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
==================== One Month Modified Files and Folders =======
2014-05-23 19:35 - 2014-05-23 19:35 - 00019773 _____ () C:\Users\Ich\Downloads\FRST.txt
2014-05-23 19:35 - 2014-05-23 19:34 - 02067456 _____ (Farbar) C:\Users\Ich\Downloads\FRST64.exe
2014-05-23 19:35 - 2014-05-22 14:43 - 00000000 ____D () C:\FRST
2014-05-23 19:16 - 2012-06-06 21:05 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-23 17:37 - 2012-09-13 17:09 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-05-23 17:31 - 2014-05-23 17:31 - 00006015 _____ () C:\Users\Ich\Desktop\JRT.txt
2014-05-23 17:24 - 2014-05-23 17:24 - 01016261 _____ (Thisisu) C:\Users\Ich\Downloads\JRT.exe
2014-05-23 17:24 - 2014-05-23 17:24 - 00000000 ____D () C:\Windows\ERUNT
2014-05-23 17:21 - 2013-12-21 19:31 - 00000000 ____D () C:\AdwCleaner
2014-05-23 17:17 - 2014-05-23 17:17 - 01326389 _____ () C:\Users\Ich\Downloads\adwcleaner_3.210.exe
2014-05-23 17:17 - 2012-07-15 20:52 - 00000000 ____D () C:\Users\Ich\Documents\Outlook-Dateien
2014-05-23 10:09 - 2012-11-18 09:36 - 01515913 _____ () C:\Windows\WindowsUpdate.log
2014-05-23 07:21 - 2009-07-14 06:45 - 00021920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-23 07:21 - 2009-07-14 06:45 - 00021920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-23 07:19 - 2011-04-12 09:43 - 00702942 _____ () C:\Windows\system32\perfh007.dat
2014-05-23 07:19 - 2011-04-12 09:43 - 00150582 _____ () C:\Windows\system32\perfc007.dat
2014-05-23 07:19 - 2009-07-14 07:13 - 01629348 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-23 07:14 - 2014-05-22 11:27 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-23 07:14 - 2012-05-29 18:02 - 00000000 ____D () C:\Program Files (x86)\JDownloader
2014-05-23 07:13 - 2014-05-23 07:13 - 00000000 ____H () C:\ProgramData\cm-lock
2014-05-23 07:13 - 2014-05-08 07:34 - 00015595 _____ () C:\Windows\setupact.log
2014-05-23 07:13 - 2012-06-05 16:49 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-05-23 07:13 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-22 21:58 - 2012-06-01 14:49 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Mp3tag
2014-05-22 20:22 - 2012-05-29 19:07 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\vlc
2014-05-22 20:17 - 2012-07-18 13:30 - 00000000 ____D () C:\Users\Ich\Documents\ConvertXToDVD
2014-05-22 19:50 - 2014-05-10 07:35 - 00037336 _____ () C:\Windows\PFRO.log
2014-05-22 14:59 - 2014-05-22 14:59 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys
2014-05-22 11:27 - 2014-05-22 11:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-05-22 11:27 - 2014-05-22 11:27 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-05-22 11:27 - 2012-07-24 06:54 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Malwarebytes
2014-05-22 11:27 - 2012-07-24 06:54 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-21 19:07 - 2012-06-06 21:05 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-21 19:07 - 2012-06-06 21:05 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-21 19:07 - 2012-06-06 21:05 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-21 19:06 - 2012-05-29 16:32 - 00000000 ___RD () C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-21 19:03 - 2014-05-21 19:03 - 00003140 _____ () C:\Windows\System32\Tasks\YourFile DownloaderUpdate
2014-05-21 19:03 - 2014-05-21 19:03 - 00000512 __RSH () C:\ProgramData\ntuser.pol
2014-05-21 19:03 - 2009-07-14 05:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-05-21 19:03 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy
2014-05-21 18:55 - 2014-05-21 18:27 - 00000000 ____D () C:\Program Files (x86)\CardRecovery
2014-05-21 18:22 - 2012-10-23 20:29 - 00000069 _____ () C:\Windows\NeroDigital.ini
2014-05-21 18:22 - 2012-10-23 20:29 - 00000069 _____ () C:\Users\Ich\AppData\Roaming\default.pls
2014-05-19 17:48 - 2014-05-19 16:08 - 00000000 ____D () C:\Users\Mama\AppData\Roaming\Apple Computer
2014-05-19 17:44 - 2014-05-19 17:44 - 00000000 ____D () C:\Users\Mama\AppData\Local\Macromedia
2014-05-19 17:43 - 2014-05-19 17:43 - 00000000 ____D () C:\Users\Mama\AppData\Roaming\Mozilla
2014-05-19 17:43 - 2014-05-19 17:43 - 00000000 ____D () C:\Users\Mama\AppData\Local\Mozilla
2014-05-19 17:10 - 2014-05-19 17:10 - 00000000 ____D () C:\Users\Mama\AppData\Roaming\Winamp
2014-05-19 16:13 - 2014-05-19 16:13 - 00000508 _____ () C:\Users\Mama\Desktop\Volume (F) - Verknüpfung.lnk
2014-05-19 16:13 - 2014-05-19 16:13 - 00000494 _____ () C:\Users\Mama\Desktop\Lokaler Datenträger (G) - Verknüpfung.lnk
2014-05-19 16:13 - 2014-05-19 16:13 - 00000472 _____ () C:\Users\Mama\Desktop\Volume (K) - Verknüpfung.lnk
2014-05-19 16:13 - 2014-05-19 16:13 - 00000340 _____ () C:\Users\Mama\Desktop\DVD H oben.lnk
2014-05-19 16:13 - 2014-05-19 16:13 - 00000336 _____ () C:\Users\Mama\Desktop\DVD I unten.lnk
2014-05-19 16:12 - 2014-05-19 16:12 - 00000512 _____ () C:\Users\Mama\Desktop\Lokaler Datenträger (C) - Verknüpfung.lnk
2014-05-19 16:12 - 2014-05-19 16:12 - 00000472 _____ () C:\Users\Mama\Desktop\Volume (E) - Verknüpfung.lnk
2014-05-19 16:12 - 2014-05-19 16:12 - 00000472 _____ () C:\Users\Mama\Desktop\Volume (D) - Verknüpfung.lnk
2014-05-19 16:08 - 2014-05-19 16:08 - 00288752 _____ () C:\Users\Mama\AppData\Local\GDIPFONTCACHEV1.DAT
2014-05-19 16:08 - 2014-05-19 16:08 - 00000000 ____D () C:\Users\Mama\AppData\Local\Apple Computer
2014-05-19 16:08 - 2014-05-19 16:08 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-05-19 16:07 - 2014-05-19 16:07 - 00002290 _____ () C:\Users\Mama\Desktop\Sicherer Zahlungsverkehr.lnk
2014-05-19 16:07 - 2014-05-19 16:07 - 00001421 _____ () C:\Users\Mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-05-19 16:07 - 2014-05-19 16:07 - 00000020 ___SH () C:\Users\Mama\ntuser.ini
2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Vorlagen
2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Startmenü
2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Netzwerkumgebung
2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Lokale Einstellungen
2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Eigene Dateien
2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Druckumgebung
2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Documents\Eigene Musik
2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Documents\Eigene Bilder
2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\AppData\Local\Verlauf
2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\AppData\Local\Anwendungsdaten
2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 _SHDL () C:\Users\Mama\Anwendungsdaten
2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 ___RD () C:\Users\Mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 ___RD () C:\Users\Mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 ____D () C:\Users\Mama\AppData\Roaming\Adobe
2014-05-19 16:07 - 2014-05-19 16:07 - 00000000 ____D () C:\Users\Mama
2014-05-19 16:07 - 2009-07-14 06:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2014-05-18 18:46 - 2013-03-21 18:37 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\TV-Browser
2014-05-18 18:41 - 2014-05-18 18:41 - 00000000 ____D () C:\Users\Public\Documents\CrashDump
2014-05-18 18:41 - 2013-10-24 19:02 - 00000000 ____D () C:\Users\Ich\Documents\SelfMV
2014-05-17 20:01 - 2013-04-20 16:53 - 00000000 ____D () C:\Users\Ich\AppData\Local\Last.fm
2014-05-16 21:02 - 2014-05-16 21:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-05-16 21:02 - 2014-05-16 21:02 - 00000000 ____D () C:\Program Files\iTunes
2014-05-16 21:02 - 2014-05-16 21:02 - 00000000 ____D () C:\Program Files\iPod
2014-05-16 21:02 - 2013-10-25 21:50 - 00001743 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-05-16 21:02 - 2013-02-27 17:38 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-05-16 18:38 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-05-16 17:25 - 2013-11-18 19:03 - 00019456 ___SH () C:\Users\Ich\Thumbs.db
2014-05-15 08:08 - 2012-05-29 16:32 - 00000000 ___RD () C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-15 08:07 - 2014-05-06 23:26 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-15 08:07 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-05-15 08:02 - 2012-05-26 13:57 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-15 08:01 - 2013-08-14 23:34 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-15 07:59 - 2012-05-26 13:16 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-14 19:09 - 2013-09-15 08:23 - 00000000 ____D () C:\ProgramData\Aimersoft Video Converter Ultimate
2014-05-14 15:08 - 2012-05-29 18:10 - 00000000 ____D () C:\Users\Ich\AppData\Local\DVD Profiler
2014-05-13 17:15 - 2014-05-13 17:15 - 00001159 _____ () C:\Users\Ich\Desktop\Any Video Converter.lnk
2014-05-13 17:15 - 2014-05-13 17:15 - 00000000 ____D () C:\Users\Ich\Documents\Any Video Converter
2014-05-13 17:15 - 2014-05-13 17:15 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\AnvSoft
2014-05-13 17:15 - 2014-05-13 17:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AnvSoft
2014-05-13 17:14 - 2014-05-13 17:14 - 00000000 ____D () C:\Program Files (x86)\AnvSoft
2014-05-12 21:50 - 2012-07-02 20:52 - 00000000 ____D () C:\Users\Ich\AppData\Local\Canon Easy-PhotoPrint EX
2014-05-12 21:35 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-05-12 12:04 - 2014-05-12 12:04 - 00001221 _____ () C:\Users\Ich\Desktop\Eigene Downloads.lnk
2014-05-12 09:15 - 2014-05-12 09:15 - 00000000 __SHD () C:\Users\Ich\AppData\Local\EmieUserList
2014-05-12 09:15 - 2014-05-12 09:15 - 00000000 __SHD () C:\Users\Ich\AppData\Local\EmieSiteList
2014-05-12 08:28 - 2012-07-02 20:45 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-05-12 07:26 - 2014-05-22 11:27 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-12 07:26 - 2014-05-22 11:27 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-12 07:25 - 2012-07-24 06:54 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-10 08:10 - 2014-05-09 21:20 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-09 10:23 - 2013-05-22 19:48 - 00000000 ____D () C:\ProgramData\VSO
2014-05-09 08:14 - 2014-05-15 07:08 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-09 08:11 - 2014-05-15 07:08 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-08 18:10 - 2013-06-12 18:36 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\FileZilla
2014-05-08 18:03 - 2012-08-01 21:55 - 00019968 _____ () C:\Users\Ich\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-05-08 07:34 - 2014-05-08 07:34 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-06 15:13 - 2013-12-06 20:38 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-05-06 15:13 - 2013-12-06 20:23 - 00000000 ____D () C:\ProgramData\Origin
2014-05-06 15:12 - 2013-12-06 21:36 - 00000000 ____D () C:\Program Files (x86)\Need for Speed Rivals
2014-05-06 15:10 - 2014-05-06 15:10 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-05-06 15:10 - 2014-05-06 15:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-05-06 15:10 - 2012-05-29 18:38 - 00000000 ____D () C:\Program Files\WinRAR
2014-05-06 15:03 - 2012-05-29 17:04 - 00018960 _____ (Logitech, Inc.) C:\Windows\system32\Drivers\LNonPnP.sys
2014-05-06 15:03 - 2012-05-29 17:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech
2014-05-06 15:03 - 2012-05-29 16:43 - 00000000 ____D () C:\Program Files\Common Files\logishrd
2014-05-06 15:02 - 2012-05-29 17:04 - 00000000 ____D () C:\ProgramData\Logitech
2014-05-06 15:02 - 2012-05-29 17:03 - 00000000 ____D () C:\ProgramData\Logishrd
2014-05-06 06:40 - 2014-05-15 08:01 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 06:17 - 2014-05-15 08:01 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 05:25 - 2014-05-15 08:01 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-06 05:07 - 2014-05-15 08:01 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-06 05:00 - 2014-05-15 08:01 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-06 04:10 - 2014-05-15 08:01 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-02 20:11 - 2014-05-02 20:11 - 00016896 _____ (ASUS) C:\Windows\AsTaskSched.dll
2014-05-02 20:11 - 2014-05-02 20:11 - 00000000 ____D () C:\Windows\Intel_Chipset_V9301019_XPWin7
2014-05-01 19:49 - 2012-06-17 17:07 - 00000000 ____D () C:\Program Files (x86)\Flickr Uploadr
2014-04-29 21:35 - 2013-05-20 23:02 - 00000000 ____D () C:\Program Files\Recuva
2014-04-29 14:56 - 2014-04-29 14:56 - 00002776 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-04-29 14:56 - 2014-04-29 14:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-04-29 14:56 - 2012-07-21 18:38 - 00000000 ____D () C:\Program Files\CCleaner
2014-04-25 17:31 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
Files to move or delete:
====================
C:\ProgramData\hpe3371.dll
Some content of TEMP:
====================
C:\Users\Ich\AppData\Local\Temp\BackupSetup.exe
C:\Users\Ich\AppData\Local\Temp\htmlayout.dll
C:\Users\Ich\AppData\Local\Temp\toolbar18559124.exe
C:\Users\Ich\AppData\Local\Temp\toolbar18559664.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-05-19 19:41
==================== End Of Log ============================
--- --- --- [/Code] |
|
23.05.2014, 20:57
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Pup.Optional.BloackAndSurf.A adwCleaner wiederholen. Du hast die Funde nicht entfernt lt. Log
__________________ Logfiles bitte immer in CODE-Tags posten |
|
24.05.2014, 07:19
| #13 |
| | Pup.Optional.BloackAndSurf.A Morgen kenn mich mich grad nicht aus hier das bild vom fertigen adw  AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.210 - Bericht erstellt am 24/05/2014 um 08:16:00
# Aktualisiert 19/05/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Ich - ICH-PC
# Gestartet von : C:\Users\Ich\Downloads\adwcleaner_3.210(1).exe
# Option : Suchen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Datei Gefunden : C:\Users\Ich\AppData\Roaming\LiveSupport.exe_log.txt
Datei Gefunden : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\Extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi
Datei Gefunden : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\e03ctse8.default-1386090037992\user.js
Datei Gefunden : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\mData\user.js
Datei Gefunden : C:\Users\Ich\AppData\Roaming\regsvr32.exe_log.txt
Datei Gefunden : C:\Windows\System32\Tasks\YourFile DownloaderUpdate
Ordner Gefunden : C:\Users\Ich\AppData\Local\Conduit
Ordner Gefunden : C:\Users\Ich\AppData\Local\Temp\OCS
Ordner Gefunden : C:\Windows\SysWOW64\SearchProtect
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gefunden : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\blockAndSurf
Schlüssel Gefunden : HKCU\Software\OCS
Schlüssel Gefunden : [x64] HKCU\Software\OCS
Schlüssel Gefunden : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gefunden : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gefunden : HKLM\Software\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\updateMegaBrowse_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\updateMegaBrowse_RASMANCS
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{0BDDE35F-64F7-49C3-99B2-404E899C49F7}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{24236608-609C-42C5-B13C-A8A3EC921850}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{28B1A706-4B97-4EB1-8B32-125042685AD9}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{33575A26-D9CF-40C6-8A3E-116F17201C7F}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{4BDFD19F-93D7-49CE-B554-5C215FDC0136}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{7307CF0F-7173-4FBF-8649-B149916DD322}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{80A5E38C-5F6B-485F-BD97-0B5BE991FAD5}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{9544D727-A26F-4D57-AF38-4496088640EA}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{AC4C30BF-7D5F-4EAB-9C2A-454178F079AA}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{BC6F9C26-93EA-4C6D-A4A7-C1FA333B4BBE}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{E975527B-ABE7-40B3-B5C1-385016913E3B}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{EFA4B5B1-6C76-4B20-BCDB-D41A93E79053}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\DivX\Install\Setup\WizardLayout\ConduitToolbar
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17041
-\\ Mozilla Firefox v29.0.1 (de)
[ Datei : C:\Users\Mama\AppData\Roaming\Mozilla\Firefox\Profiles\9x0vzil8.default\prefs.js ]
[ Datei : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\5ffvwt3l.default-1352296656028\prefs.js ]
Zeile gefunden : user_pref("extensions.buenosearch.admin", false);
Zeile gefunden : user_pref("extensions.buenosearch.aflt", "babsst");
Zeile gefunden : user_pref("extensions.buenosearch.appId", "{37EB75F2-7392-4DBE-B5AD-147EC6D7BF5F}");
Zeile gefunden : user_pref("extensions.buenosearch.autoRvrt", "false");
Zeile gefunden : user_pref("extensions.buenosearch.dfltLng", "de");
Zeile gefunden : user_pref("extensions.buenosearch.excTlbr", false);
Zeile gefunden : user_pref("extensions.buenosearch.ffxUnstlRst", true);
Zeile gefunden : user_pref("extensions.buenosearch.id", "56852f7f0000000000002208cae4df32");
Zeile gefunden : user_pref("extensions.buenosearch.instlDay", "16211");
Zeile gefunden : user_pref("extensions.buenosearch.instlRef", "sst");
Zeile gefunden : user_pref("extensions.buenosearch.newTab", false);
Zeile gefunden : user_pref("extensions.buenosearch.prdct", "buenosearch");
Zeile gefunden : user_pref("extensions.buenosearch.prtnrId", "buenosearch");
Zeile gefunden : user_pref("extensions.buenosearch.rvrt", "false");
Zeile gefunden : user_pref("extensions.buenosearch.smplGrp", "none");
Zeile gefunden : user_pref("extensions.buenosearch.tlbrId", "base");
Zeile gefunden : user_pref("extensions.buenosearch.vrsn", "1.8.28.7");
Zeile gefunden : user_pref("extensions.buenosearch.vrsnTs", "1.8.28.719:03:30");
Zeile gefunden : user_pref("extensions.buenosearch.vrsni", "1.8.28.7");
[ Datei : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\7a7ej4nx.Ich\prefs.js ]
-\\ Google Chrome v
*************************
AdwCleaner[R0].txt - [40481 octets] - [21/12/2013 19:31:58]
AdwCleaner[R1].txt - [30200 octets] - [21/12/2013 23:07:03]
AdwCleaner[R2].txt - [30172 octets] - [21/12/2013 23:16:35]
AdwCleaner[R3].txt - [5491 octets] - [24/05/2014 08:16:00]
AdwCleaner[S0].txt - [36983 octets] - [21/12/2013 23:18:00]
########## EOF - C:\AdwCleaner\AdwCleaner[R3].txt - [5612 octets] ##########
[/code] was soll ich entfernen? da steht ja drauf abwählen was ich nicth entfernen will z.b.  was soll ich da machen bitte oder  und da steht warte ab und sonst tut sich nix das verstehe ich nicht |
|
24.05.2014, 14:20
| #14 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Pup.Optional.BloackAndSurf.A einfach mal die Anleitung richtig lesen und Schritt für Schritt umsetzen Downloade Dir bitte AdwCleaner auf deinen Desktop.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
25.05.2014, 16:31
| #15 |
| | Pup.Optional.BloackAndSurf.A also egal was ist auf löschen drücken? weil bei vielen dieser Tabs sind eine Menge wie du liest angehakerlt und es steht ja da, warte ab, also sicher auf löschen drücken? denn dann löscht es dinge die ich aber brauche wie du auf den bildern siehst |
|
Linear-Darstellung
