| |
| |||||||
Log-Analyse und Auswertung: Chrome und Firefox öffnen ständig Werbeseiten,Malwarebytes funktionioniert nicht mehr,auch nicht mit ChameleonWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
13.09.2014, 12:38
| #1 |
| |  Chrome und Firefox öffnen ständig Werbeseiten,Malwarebytes funktionioniert nicht mehr,auch nicht mit Chameleon Hallo Auf Chrome oder Firefox öffnen sich ständig Werbeeinblendungen oder ganze Werbeseiten wenn ich einen Link anklicke. Heute jetzt auch noch einen Bluescreen bekommen. Läuft aber jetzt wieder alles normal. Bin echt langsam ratlos. Habe hier schon einige Tipps nachgelesen und bei mir auf dem Laptop ausgeführt aber leider noch ohne Erfolg. Kann auch Malwarebytes nicht mehr starten. Und auch der Umweg über Malwarebytes Chameleon funktioniert leider nicht. Die Installation bricht immer ab. Habe jetzt hier schon mal die entsprechenden Logfiles bereit gestellt. Ich hoffe es gibt eine Lösung für mein Problem, sonst habe ich sicherheitshalber schon mal ein Backup erstellt falls ich das System neu aufsetzen muss. frst.txt Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-09-2014
Ran by bernie (administrator) on BERNIE-PC on 13-09-2014 13:27:58
Running from C:\Users\bernie\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
() C:\Program Files (x86)\ver1BlockAndSurf\BlockAndSurf.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Seagate Technology LLC) C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe
(Seagate Technology LLC) C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\MobileService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(GARMIN Corp.) C:\Garmin\gStart.exe
(SanDisk Corporation) C:\Users\bernie\AppData\Roaming\SanDisk\Sansa Updater\SansaDispatch.exe
(Federli Informatik AG, CH-8330 Pfäffikon) C:\Program Files (x86)\UBS e-banking\UBS Shell\Ubsshell.exe
(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe
(Seagate Technology LLC) C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Mindjet) C:\Program Files (x86)\Mindjet\MindManager 10\MmReminderService.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Seagate Technology LLC) C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DBAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Dropbox, Inc.) C:\Users\bernie\AppData\Roaming\Dropbox\bin\Dropbox.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Seagate Technology LLC) C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DeviceAgent.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(SEC) C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\SAMSUNG\SamsungFastStart\SmartRestarter.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(SAMSUNG Electronics) C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\Media+Player10\Media+Player10Serv.exe
(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
(Samsung Electronics) C:\Program Files (x86)\Samsung\Samsung Update Plus\SUPBackground.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11775592 2011-01-27] (Realtek Semiconductor)
HKLM\...\Run: [CanonSolutionMenu] => C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [767312 2009-09-04] (CANON INC.)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2782096 2010-07-26] (CANON INC.)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2817872 2012-04-25] (ELAN Microelectronics Corp.)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [MMReminderService] => C:\Program Files (x86)\Mindjet\MindManager 10\MMReminderService.exe [37728 2011-09-14] (Mindjet)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM-x32\...\Run: [DBAgent] => C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DBAgent.exe [1519176 2014-04-30] (Seagate Technology LLC)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [164656 2014-08-27] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\.DEFAULT\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-08-07] (Garmin Ltd or its subsidiaries)
HKU\S-1-5-21-1309665003-1285200881-1394159564-1002\...\Run: [gStart] => C:\Garmin\gStart.exe [1891416 2008-08-13] (GARMIN Corp.)
HKU\S-1-5-21-1309665003-1285200881-1394159564-1002\...\Run: [SansaDispatch] => C:\Users\bernie\AppData\Roaming\SanDisk\Sansa Updater\SansaDispatch.exe
RÃ hî% Ù% ä ¸ 0 % D
HKU\S-1-5-21-1309665003-1285200881-1394159564-1002\...\Run: [UBSShell] => C:\Program Files (x86)\UBS e-banking\UBS Shell\UBSShell.exe [315392 2012-03-14] (Federli Informatik AG, CH-8330 Pfäffikon)
HKU\S-1-5-21-1309665003-1285200881-1394159564-1002\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-08-07] (Garmin Ltd or its subsidiaries)
HKU\S-1-5-21-1309665003-1285200881-1394159564-1002\...\Run: [Uploader] => C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe [126056 2014-04-30] (Seagate Technology LLC)
HKU\S-1-5-21-1309665003-1285200881-1394159564-1002\...\MountPoints2: F - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-1309665003-1285200881-1394159564-1002\...\MountPoints2: {6cd599c9-359e-11e4-9d7c-e0ca943fe78b} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-1309665003-1285200881-1394159564-1002\...\MountPoints2: {e1f69521-0076-11e1-a6db-e0ca943fe78b} - F:\Startme.exe
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [266448 2013-06-21] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [214448 2013-06-21] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\bernie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\bernie\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://samsung.msn.com
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM-x32 - DefaultScope value is missing.
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: BlockAndSurf -> {D28762C9-5216-DCF6-0533-92D2343D2A15} -> C:\Program Files (x86)\ver1BlockAndSurf\178_x64.dll ()
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: CmjBrowserHelperObject Object -> {6FE6A929-59D1-4763-91AD-29B61CFFB35B} -> C:\Program Files (x86)\Mindjet\MindManager 10\Mm8InternetExplorer.dll (Mindjet)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: W2PBrowser Class -> {AA609D72-8482-4076-8991-8CDAE5B93BCB} -> C:\Program Files\Samsung AnyWeb Print\W2PBrowser.dll ()
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default
FF Homepage: https://www.google.ch/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @garmin.com/GpsControl -> C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default\user.js
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default\searchplugins\google-maps.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: German Dictionary (Switzerland) - C:\Users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default\Extensions\de-CH@dictionaries.addons.mozilla.org [2014-06-08]
FF Extension: BrowserAdditions - C:\Users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default\Extensions\toolbarbutton@browseradditions.com [2014-04-19]
FF Extension: Garmin Communicator - C:\Users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2014-01-22]
FF Extension: FoxTrick - C:\Users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default\Extensions\{9d1f059c-cada-4111-9696-41a62d64e3ba} [2014-03-07]
FF Extension: FoxLingo - C:\Users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default\Extensions\{ef62e1ce-d2a4-4cdd-b7ec-92b120366b66} [2012-11-10]
FF Extension: NASA Night Launch - C:\Users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default\Extensions\nasanightlaunch@example.com.xpi [2013-10-22]
FF Extension: YouTube to MP3 - C:\Users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default\Extensions\youtube2mp3@mondayx.de.xpi [2014-05-19]
FF Extension: Adblock Plus - C:\Users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-02-15]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2014-09-13]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-09-13]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2014-09-13]
FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-05-19]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: No Name - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
FF HKCU\...\Firefox\Extensions: [{0C1D2A7B-C770-0307-202D-4A1A6A004C92}] - C:\Program Files (x86)\ver1BlockAndSurf\178.xpi
FF Extension: BlockAndSurf - C:\Program Files (x86)\ver1BlockAndSurf\178.xpi [2014-09-01]
Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR DefaultSearchKeyword: Default -> B1EC653F01C5791AE3FBFD5AFBF77CF4E5F425B58D0D3F4BA85E8AF5EF67A699
CHR DefaultSearchURL: Default -> 292A173EC804F3D107143E8552A14D17EEA84A582D413A9E724883A556DEAD8E
CHR Profile: C:\Users\bernie\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\bernie\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-12]
CHR Extension: (Word CaptureX Extension) - C:\Users\bernie\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjdepfkicdcciagbigfcmdhknnoaaegf [2011-09-14]
CHR Extension: (Google Wallet) - C:\Users\bernie\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-31]
CHR HKLM-x32\...\Chrome\Extension: [mjdepfkicdcciagbigfcmdhknnoaaegf] - C:\Program Files (x86)\Deskperience\Word Capture\wcxChrome.crx [2010-07-23]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-05] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160048 2014-08-27] (Avira Operations GmbH & Co. KG)
R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [438616 2014-08-07] (Garmin Ltd or its subsidiaries)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] () [File not signed]
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2009-12-01] () [File not signed]
R2 Seagate Dashboard Services; C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe [16000 2014-04-30] (Seagate Technology LLC)
R2 Seagate MobileBackup Service; C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\MobileService.exe [157264 2014-04-30] (Seagate Technology LLC)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-06-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-05-27] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-01] (Avira Operations GmbH & Co. KG)
S3 rtport; C:\Windows\SysWOW64\drivers\rtport.sys [15144 2011-08-20] (Windows (R) 2003 DDK 3790 provider)
R2 webinstr; C:\Windows\system32\Drivers\webinstr.sys [58040 2014-09-01] (Corsica)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-13 13:26 - 2014-09-13 13:28 - 00021346 _____ () C:\Users\bernie\Desktop\FRST.txt
2014-09-13 13:14 - 2014-09-13 13:14 - 00262144 _____ () C:\Windows\Minidump\091314-18064-01.dmp
2014-09-13 12:57 - 2014-09-13 12:57 - 00049058 _____ () C:\Users\bernie\Desktop\Gmer.txt
2014-09-13 12:42 - 2014-09-13 12:42 - 00380416 _____ () C:\Users\bernie\Downloads\Gmer-19357.exe
2014-09-13 12:13 - 2014-09-13 12:13 - 00001720 _____ () C:\Users\bernie\Desktop\EreignisseAvira.txt
2014-09-13 11:58 - 2014-09-13 11:58 - 00050477 _____ () C:\Users\bernie\Downloads\Defogger.exe
2014-09-13 11:58 - 2014-09-13 11:58 - 00000474 _____ () C:\Users\bernie\Downloads\defogger_disable.log
2014-09-13 11:58 - 2014-09-13 11:58 - 00000000 _____ () C:\Users\bernie\defogger_reenable
2014-09-13 10:43 - 2014-09-13 10:43 - 01110476 _____ () C:\Users\bernie\Downloads\7z920.exe
2014-09-13 10:39 - 2014-09-13 10:39 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-12 19:13 - 2014-09-12 19:13 - 00000000 ____D () C:\Users\bernie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2014-09-12 00:41 - 2014-08-19 00:05 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-12 00:41 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-09-12 00:40 - 2014-08-19 20:05 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-12 00:40 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-09-12 00:40 - 2014-08-19 01:01 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-12 00:40 - 2014-08-19 00:29 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-12 00:40 - 2014-08-19 00:29 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-12 00:40 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-12 00:40 - 2014-08-19 00:20 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-12 00:40 - 2014-08-19 00:19 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-12 00:40 - 2014-08-19 00:15 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-12 00:40 - 2014-08-19 00:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-12 00:40 - 2014-08-19 00:14 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-12 00:40 - 2014-08-19 00:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-12 00:40 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-09-12 00:40 - 2014-08-19 00:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-12 00:40 - 2014-08-19 00:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-12 00:40 - 2014-08-19 00:03 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-12 00:40 - 2014-08-19 00:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-12 00:40 - 2014-08-19 00:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-12 00:40 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-09-12 00:40 - 2014-08-18 23:56 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-12 00:40 - 2014-08-18 23:51 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-12 00:40 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-09-12 00:40 - 2014-08-18 23:45 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-12 00:40 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-09-12 00:40 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-09-12 00:40 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-09-12 00:40 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-12 00:40 - 2014-08-18 23:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-12 00:40 - 2014-08-18 23:39 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-12 00:40 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-12 00:40 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-09-12 00:40 - 2014-08-18 23:38 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-12 00:40 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-09-12 00:40 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-09-12 00:40 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-09-12 00:40 - 2014-08-18 23:25 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-12 00:40 - 2014-08-18 23:25 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-12 00:40 - 2014-08-18 23:23 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-12 00:40 - 2014-08-18 23:23 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-12 00:40 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-09-12 00:40 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-09-12 00:40 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-09-12 00:40 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-12 00:40 - 2014-08-18 23:16 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-12 00:40 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-12 00:40 - 2014-08-18 23:15 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-12 00:40 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-12 00:40 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-12 00:40 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-09-12 00:40 - 2014-08-18 22:55 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-12 00:40 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-12 00:40 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-12 00:40 - 2014-08-18 22:38 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-12 00:40 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-09-12 00:27 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-12 00:27 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2014-09-11 15:35 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-11 15:35 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-09-11 15:35 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-11 15:35 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-11 15:35 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-09-11 15:35 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-09-11 15:35 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-09-11 15:35 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-11 15:35 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-09-11 15:34 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-11 15:34 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-07 10:00 - 2014-09-07 10:00 - 01101648 _____ () C:\Users\bernie\Downloads\Firefox - CHIP-Installer.exe
2014-09-06 16:52 - 2014-09-06 16:54 - 00070115 _____ () C:\Users\bernie\Downloads\mailpv181.zip
2014-09-06 16:51 - 2014-09-06 16:51 - 01101648 _____ () C:\Users\bernie\Downloads\Mail PassView - CHIP-Installer.exe
2014-09-01 18:46 - 2014-09-07 10:01 - 00001188 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-09-01 18:45 - 2014-09-01 18:45 - 35098384 _____ () C:\Users\bernie\Downloads\Firefox_Setup_32.0.exe
2014-09-01 18:10 - 2014-09-06 18:41 - 00000000 ____D () C:\Users\bernie\AppData\Roaming\MyPhoneExplorer
2014-09-01 18:09 - 2014-09-13 13:18 - 00000426 _____ () C:\Windows\Tasks\BlockAndSurf Update.job
2014-09-01 18:09 - 2014-09-02 08:57 - 00000000 ____D () C:\Program Files (x86)\ver1BlockAndSurf
2014-09-01 18:09 - 2014-09-01 18:09 - 00058040 _____ (Corsica) C:\Windows\system32\Drivers\webinstr.sys
2014-09-01 18:09 - 2014-09-01 18:09 - 00003076 _____ () C:\Windows\System32\Tasks\BlockAndSurf Update
2014-09-01 18:09 - 2014-09-01 18:09 - 00002098 _____ () C:\Users\Public\Desktop\MyPhoneExplorer.lnk
2014-09-01 18:09 - 2014-09-01 18:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_webinstr_01009.Wdf
2014-09-01 18:09 - 2014-09-01 18:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyPhoneExplorer
2014-09-01 18:09 - 2014-09-01 18:09 - 00000000 ____D () C:\Program Files (x86)\MyPhoneExplorer
2014-09-01 18:07 - 2014-09-01 18:07 - 01101648 _____ () C:\Users\bernie\Downloads\MyPhoneExplorer - CHIP-Installer.exe
2014-09-01 17:19 - 2014-09-01 17:19 - 00000000 ____D () C:\Users\bernie\AppData\Local\Seagate_Technology_LLC
2014-09-01 12:13 - 2014-09-01 12:13 - 00003732 _____ () C:\Windows\System32\Tasks\bernie Merge
2014-09-01 12:13 - 2014-09-01 12:13 - 00003716 _____ () C:\Windows\System32\Tasks\bernie
2014-09-01 12:12 - 2014-09-01 12:12 - 00003500 _____ () C:\Windows\System32\Tasks\bernie DBAgent 2 0
2014-09-01 12:12 - 2014-09-01 12:12 - 00000000 ____D () C:\Users\bernie\AppData\Roaming\Nero
2014-09-01 12:11 - 2014-09-01 12:11 - 00003512 _____ () C:\Windows\System32\Tasks\Seagate_Install_Launch
2014-09-01 12:10 - 2014-09-01 12:10 - 00002725 _____ () C:\Users\Public\Desktop\Seagate Dashboard 2.0.lnk
2014-09-01 12:10 - 2014-09-01 12:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Seagate Dashboard 2.0
2014-09-01 12:09 - 2014-09-01 12:09 - 00000000 ____D () C:\ProgramData\Nero
2014-09-01 12:09 - 2014-09-01 12:09 - 00000000 ____D () C:\Program Files (x86)\Seagate
2014-09-01 12:05 - 2014-09-01 12:05 - 00000000 ____D () C:\Users\bernie\AppData\Roaming\Seagate
2014-09-01 12:05 - 2014-09-01 12:05 - 00000000 ____D () C:\ProgramData\Seagate
2014-09-01 12:04 - 2014-09-01 12:04 - 00000000 ____D () C:\Windows\System32\Tasks\Leader Technologies
2014-09-01 12:00 - 2014-09-01 12:00 - 00000000 ____D () C:\Users\bernie\AppData\Roaming\Leadertech
2014-09-01 09:33 - 2014-09-13 13:28 - 00000000 ____D () C:\FRST
2014-09-01 09:32 - 2014-09-13 11:59 - 02105856 _____ (Farbar) C:\Users\bernie\Desktop\FRST64.exe
2014-08-31 17:37 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-31 17:37 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-31 17:37 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-31 10:47 - 2014-08-31 17:15 - 00000000 ____D () C:\Users\Besucher\AppData\Roaming\uTorrent
2014-08-31 10:46 - 2014-08-31 10:46 - 00000000 ____D () C:\Users\Besucher\AppData\Roaming\Malwarebytes
2014-08-31 10:19 - 2014-08-31 17:15 - 00000000 ____D () C:\Users\bernie\Downloads\mbam
2014-08-30 16:33 - 2014-08-31 17:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-08-30 16:33 - 2014-08-31 17:15 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-08-30 16:33 - 2014-08-30 17:07 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-08-30 16:33 - 2014-08-30 16:33 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-08-30 16:09 - 2014-08-30 16:09 - 00000000 __SHD () C:\Users\bernie\AppData\Local\EmieUserList
2014-08-30 16:09 - 2014-08-30 16:09 - 00000000 __SHD () C:\Users\bernie\AppData\Local\EmieSiteList
2014-08-30 14:00 - 2014-08-30 14:00 - 00000000 ____D () C:\ProgramData\NCH Software
2014-08-30 10:49 - 2014-08-30 10:49 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-08-30 10:03 - 2014-08-30 10:08 - 22143876 _____ () C:\Users\bernie\Downloads\mbam-chameleon-3.1.4.0.zip
2014-08-22 06:19 - 2014-08-22 06:19 - 00000000 ____D () C:\Users\bernie\AppData\Local\Adobe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-13 13:28 - 2014-09-13 13:26 - 00021346 _____ () C:\Users\bernie\Desktop\FRST.txt
2014-09-13 13:28 - 2014-09-01 09:33 - 00000000 ____D () C:\FRST
2014-09-13 13:28 - 2009-07-14 06:45 - 00022976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-13 13:28 - 2009-07-14 06:45 - 00022976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-13 13:25 - 2011-03-15 08:46 - 01146836 _____ () C:\Windows\WindowsUpdate.log
2014-09-13 13:24 - 2011-09-09 16:51 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-13 13:21 - 2013-10-10 17:44 - 00000000 ___RD () C:\Users\bernie\Dropbox
2014-09-13 13:21 - 2013-10-10 17:41 - 00000000 ____D () C:\Users\bernie\AppData\Roaming\Dropbox
2014-09-13 13:21 - 2012-04-30 06:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-13 13:18 - 2014-09-01 18:09 - 00000426 _____ () C:\Windows\Tasks\BlockAndSurf Update.job
2014-09-13 13:18 - 2011-09-09 16:51 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-13 13:18 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-13 13:17 - 2009-07-14 06:51 - 00243458 _____ () C:\Windows\setupact.log
2014-09-13 13:14 - 2014-09-13 13:14 - 00262144 _____ () C:\Windows\Minidump\091314-18064-01.dmp
2014-09-13 13:14 - 2011-09-11 11:01 - 00000000 ____D () C:\Windows\Minidump
2014-09-13 13:14 - 2011-09-11 11:00 - 690897441 _____ () C:\Windows\MEMORY.DMP
2014-09-13 12:57 - 2014-09-13 12:57 - 00049058 _____ () C:\Users\bernie\Desktop\Gmer.txt
2014-09-13 12:42 - 2014-09-13 12:42 - 00380416 _____ () C:\Users\bernie\Downloads\Gmer-19357.exe
2014-09-13 12:30 - 2012-03-31 08:11 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-13 12:13 - 2014-09-13 12:13 - 00001720 _____ () C:\Users\bernie\Desktop\EreignisseAvira.txt
2014-09-13 11:59 - 2014-09-01 09:32 - 02105856 _____ (Farbar) C:\Users\bernie\Desktop\FRST64.exe
2014-09-13 11:58 - 2014-09-13 11:58 - 00050477 _____ () C:\Users\bernie\Downloads\Defogger.exe
2014-09-13 11:58 - 2014-09-13 11:58 - 00000474 _____ () C:\Users\bernie\Downloads\defogger_disable.log
2014-09-13 11:58 - 2014-09-13 11:58 - 00000000 _____ () C:\Users\bernie\defogger_reenable
2014-09-13 11:58 - 2011-09-08 12:24 - 00000000 ____D () C:\Users\bernie
2014-09-13 10:43 - 2014-09-13 10:43 - 01110476 _____ () C:\Users\bernie\Downloads\7z920.exe
2014-09-13 10:39 - 2014-09-13 10:39 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-13 01:11 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-12 19:25 - 2011-09-09 16:52 - 00002212 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-09-12 19:13 - 2014-09-12 19:13 - 00000000 ____D () C:\Users\bernie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2014-09-12 00:48 - 2011-09-08 18:50 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-09-12 00:38 - 2011-09-08 21:18 - 01603716 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-09-12 00:38 - 2011-03-16 01:14 - 00703214 _____ () C:\Windows\system32\perfh007.dat
2014-09-12 00:38 - 2011-03-16 01:14 - 00150822 _____ () C:\Windows\system32\perfc007.dat
2014-09-12 00:38 - 2009-07-14 07:13 - 01603716 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-12 00:37 - 2013-07-22 06:12 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-12 00:29 - 2011-09-12 12:24 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-12 00:27 - 2014-05-06 22:34 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-11 16:40 - 2012-03-31 08:11 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-11 16:40 - 2012-03-31 08:11 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-11 16:40 - 2011-09-08 20:34 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-11 15:26 - 2014-05-18 12:08 - 00001174 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-09-11 15:26 - 2014-05-10 18:44 - 00000000 ____D () C:\ProgramData\Package Cache
2014-09-11 15:26 - 2013-02-24 10:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-09-07 10:01 - 2014-09-01 18:46 - 00001188 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-09-07 10:01 - 2011-09-08 12:44 - 00001200 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-09-07 10:00 - 2014-09-07 10:00 - 01101648 _____ () C:\Users\bernie\Downloads\Firefox - CHIP-Installer.exe
2014-09-06 18:41 - 2014-09-01 18:10 - 00000000 ____D () C:\Users\bernie\AppData\Roaming\MyPhoneExplorer
2014-09-06 17:02 - 2013-02-06 22:11 - 00000000 ____D () C:\Windows\System32\Tasks\NCH Software
2014-09-06 16:54 - 2014-09-06 16:52 - 00070115 _____ () C:\Users\bernie\Downloads\mailpv181.zip
2014-09-06 16:51 - 2014-09-06 16:51 - 01101648 _____ () C:\Users\bernie\Downloads\Mail PassView - CHIP-Installer.exe
2014-09-05 23:31 - 2011-09-18 10:14 - 00000000 ____D () C:\Users\bernie\AppData\Local\CrashDumps
2014-09-05 04:10 - 2014-09-11 15:34 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-05 04:05 - 2014-09-11 15:34 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-02 08:57 - 2014-09-01 18:09 - 00000000 ____D () C:\Program Files (x86)\ver1BlockAndSurf
2014-09-01 18:45 - 2014-09-01 18:45 - 35098384 _____ () C:\Users\bernie\Downloads\Firefox_Setup_32.0.exe
2014-09-01 18:09 - 2014-09-01 18:09 - 00058040 _____ (Corsica) C:\Windows\system32\Drivers\webinstr.sys
2014-09-01 18:09 - 2014-09-01 18:09 - 00003076 _____ () C:\Windows\System32\Tasks\BlockAndSurf Update
2014-09-01 18:09 - 2014-09-01 18:09 - 00002098 _____ () C:\Users\Public\Desktop\MyPhoneExplorer.lnk
2014-09-01 18:09 - 2014-09-01 18:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_webinstr_01009.Wdf
2014-09-01 18:09 - 2014-09-01 18:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyPhoneExplorer
2014-09-01 18:09 - 2014-09-01 18:09 - 00000000 ____D () C:\Program Files (x86)\MyPhoneExplorer
2014-09-01 18:07 - 2014-09-01 18:07 - 01101648 _____ () C:\Users\bernie\Downloads\MyPhoneExplorer - CHIP-Installer.exe
2014-09-01 17:19 - 2014-09-01 17:19 - 00000000 ____D () C:\Users\bernie\AppData\Local\Seagate_Technology_LLC
2014-09-01 12:13 - 2014-09-01 12:13 - 00003732 _____ () C:\Windows\System32\Tasks\bernie Merge
2014-09-01 12:13 - 2014-09-01 12:13 - 00003716 _____ () C:\Windows\System32\Tasks\bernie
2014-09-01 12:12 - 2014-09-01 12:12 - 00003500 _____ () C:\Windows\System32\Tasks\bernie DBAgent 2 0
2014-09-01 12:12 - 2014-09-01 12:12 - 00000000 ____D () C:\Users\bernie\AppData\Roaming\Nero
2014-09-01 12:11 - 2014-09-01 12:11 - 00003512 _____ () C:\Windows\System32\Tasks\Seagate_Install_Launch
2014-09-01 12:10 - 2014-09-01 12:10 - 00002725 _____ () C:\Users\Public\Desktop\Seagate Dashboard 2.0.lnk
2014-09-01 12:10 - 2014-09-01 12:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Seagate Dashboard 2.0
2014-09-01 12:09 - 2014-09-01 12:09 - 00000000 ____D () C:\ProgramData\Nero
2014-09-01 12:09 - 2014-09-01 12:09 - 00000000 ____D () C:\Program Files (x86)\Seagate
2014-09-01 12:05 - 2014-09-01 12:05 - 00000000 ____D () C:\Users\bernie\AppData\Roaming\Seagate
2014-09-01 12:05 - 2014-09-01 12:05 - 00000000 ____D () C:\ProgramData\Seagate
2014-09-01 12:04 - 2014-09-01 12:04 - 00000000 ____D () C:\Windows\System32\Tasks\Leader Technologies
2014-09-01 12:00 - 2014-09-01 12:00 - 00000000 ____D () C:\Users\bernie\AppData\Roaming\Leadertech
2014-08-31 17:44 - 2009-07-14 06:45 - 00423376 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-31 17:16 - 2013-05-11 13:45 - 00000000 ____D () C:\Users\Besucher
2014-08-31 17:15 - 2014-08-31 10:47 - 00000000 ____D () C:\Users\Besucher\AppData\Roaming\uTorrent
2014-08-31 17:15 - 2014-08-31 10:19 - 00000000 ____D () C:\Users\bernie\Downloads\mbam
2014-08-31 17:15 - 2014-08-30 16:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-08-31 17:15 - 2014-08-30 16:33 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-08-31 17:15 - 2013-10-10 17:42 - 00000000 ____D () C:\Users\bernie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-08-31 17:15 - 2013-02-17 22:54 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-08-31 17:15 - 2011-09-09 17:17 - 00000000 ____D () C:\Users\bernie\AppData\Roaming\vlc
2014-08-31 17:15 - 2011-09-09 16:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-08-31 17:15 - 2011-09-08 20:34 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2014-08-31 17:15 - 2011-09-08 20:16 - 00000000 ____D () C:\Users\bernie\AppData\Roaming\iPodder
2014-08-31 17:15 - 2011-03-15 09:08 - 00000000 ____D () C:\ProgramData\WinClon
2014-08-31 17:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-08-31 17:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\AppCompat
2014-08-31 17:13 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-08-31 17:09 - 2011-03-16 00:45 - 00000000 ____D () C:\Windows\SysWOW64\XPSViewer
2014-08-31 17:09 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\MUI
2014-08-31 17:09 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\MUI
2014-08-31 17:09 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\servicing
2014-08-31 17:05 - 2014-05-27 12:59 - 00000000 ____D () C:\AdwCleaner
2014-08-31 17:05 - 2013-02-24 10:28 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-08-31 17:05 - 2013-02-06 22:11 - 00000000 ____D () C:\Program Files (x86)\NCH Software
2014-08-31 17:05 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-08-31 10:46 - 2014-08-31 10:46 - 00000000 ____D () C:\Users\Besucher\AppData\Roaming\Malwarebytes
2014-08-31 10:46 - 2013-08-17 22:11 - 00115456 _____ () C:\Users\Besucher\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-30 17:07 - 2014-08-30 16:33 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-08-30 16:33 - 2014-08-30 16:33 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-08-30 16:09 - 2014-08-30 16:09 - 00000000 __SHD () C:\Users\bernie\AppData\Local\EmieUserList
2014-08-30 16:09 - 2014-08-30 16:09 - 00000000 __SHD () C:\Users\bernie\AppData\Local\EmieSiteList
2014-08-30 14:00 - 2014-08-30 14:00 - 00000000 ____D () C:\ProgramData\NCH Software
2014-08-30 10:49 - 2014-08-30 10:49 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-08-30 10:08 - 2014-08-30 10:03 - 22143876 _____ () C:\Users\bernie\Downloads\mbam-chameleon-3.1.4.0.zip
2014-08-23 04:07 - 2014-08-31 17:37 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-08-31 17:37 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-08-31 17:37 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-22 06:19 - 2014-08-22 06:19 - 00000000 ____D () C:\Users\bernie\AppData\Local\Adobe
2014-08-19 20:05 - 2014-09-12 00:40 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-19 19:39 - 2014-09-12 00:40 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-19 01:01 - 2014-09-12 00:40 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-19 00:29 - 2014-09-12 00:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-19 00:29 - 2014-09-12 00:40 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-19 00:26 - 2014-09-12 00:40 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-19 00:20 - 2014-09-12 00:40 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-19 00:19 - 2014-09-12 00:40 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-19 00:15 - 2014-09-12 00:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-19 00:15 - 2014-09-12 00:40 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-19 00:14 - 2014-09-12 00:40 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-19 00:14 - 2014-09-12 00:40 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-19 00:08 - 2014-09-12 00:40 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-19 00:08 - 2014-09-12 00:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-19 00:08 - 2014-09-12 00:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-19 00:05 - 2014-09-12 00:41 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-19 00:03 - 2014-09-12 00:40 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-19 00:03 - 2014-09-12 00:40 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-19 00:03 - 2014-09-12 00:40 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-18 23:57 - 2014-09-12 00:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-18 23:56 - 2014-09-12 00:40 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-18 23:51 - 2014-09-12 00:40 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-18 23:46 - 2014-09-12 00:40 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-18 23:45 - 2014-09-12 00:40 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-18 23:45 - 2014-09-12 00:40 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-18 23:44 - 2014-09-12 00:40 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-18 23:44 - 2014-09-12 00:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-18 23:42 - 2014-09-12 00:40 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-18 23:40 - 2014-09-12 00:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-18 23:39 - 2014-09-12 00:40 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-18 23:39 - 2014-09-12 00:40 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-18 23:39 - 2014-09-12 00:40 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-18 23:38 - 2014-09-12 00:40 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-18 23:37 - 2014-09-12 00:41 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-18 23:36 - 2014-09-12 00:40 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-18 23:35 - 2014-09-12 00:40 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-18 23:27 - 2014-09-12 00:40 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-18 23:25 - 2014-09-12 00:40 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-18 23:25 - 2014-09-12 00:40 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-18 23:23 - 2014-09-12 00:40 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-18 23:23 - 2014-09-12 00:40 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-18 23:22 - 2014-09-12 00:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-18 23:19 - 2014-09-12 00:40 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-18 23:17 - 2014-09-12 00:40 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-18 23:17 - 2014-09-12 00:40 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-18 23:16 - 2014-09-12 00:40 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-18 23:15 - 2014-09-12 00:40 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-18 23:15 - 2014-09-12 00:40 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-18 23:09 - 2014-09-12 00:40 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-18 23:08 - 2014-09-12 00:40 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-18 23:07 - 2014-09-12 00:40 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-18 22:55 - 2014-09-12 00:40 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-18 22:46 - 2014-09-12 00:40 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-18 22:38 - 2014-09-12 00:40 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-18 22:38 - 2014-09-12 00:40 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-18 22:36 - 2014-09-12 00:40 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-15 20:46 - 2014-05-14 06:17 - 00000000 ____D () C:\Users\bernie\Downloads\torro
2014-08-14 06:04 - 2013-10-10 17:44 - 00001021 _____ () C:\Users\bernie\Desktop\Dropbox.lnk
Some content of TEMP:
====================
C:\Users\bernie\AppData\Local\Temp\addit20.EXE
C:\Users\bernie\AppData\Local\Temp\AskSLib.dll
C:\Users\bernie\AppData\Local\Temp\avgnt.exe
C:\Users\bernie\AppData\Local\Temp\BackupSetup.exe
C:\Users\bernie\AppData\Local\Temp\contentDATs.exe
C:\Users\bernie\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpmhnybs.dll
C:\Users\bernie\AppData\Local\Temp\DseShExt-x64.dll
C:\Users\bernie\AppData\Local\Temp\DseShExt-x86.dll
C:\Users\bernie\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe
C:\Users\bernie\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\bernie\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe
C:\Users\bernie\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe
C:\Users\bernie\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe
C:\Users\bernie\AppData\Local\Temp\jre-6u39-windows-i586-iftw.exe
C:\Users\bernie\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe
C:\Users\bernie\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\bernie\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\bernie\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\bernie\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\bernie\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\bernie\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\bernie\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe
C:\Users\bernie\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe
C:\Users\bernie\AppData\Local\Temp\MouseKeyboardCenterx64_1031.exe
C:\Users\bernie\AppData\Local\Temp\nsa949B.exe
C:\Users\bernie\AppData\Local\Temp\nsaCC64.exe
C:\Users\bernie\AppData\Local\Temp\nsf9075.exe
C:\Users\bernie\AppData\Local\Temp\nsqC34E.exe
C:\Users\bernie\AppData\Local\Temp\nsqC745.exe
C:\Users\bernie\AppData\Local\Temp\nsv9A95.exe
C:\Users\bernie\AppData\Local\Temp\ose00000.exe
C:\Users\bernie\AppData\Local\Temp\post1.exe
C:\Users\bernie\AppData\Local\Temp\post2.dll
C:\Users\bernie\AppData\Local\Temp\post2.exe
C:\Users\bernie\AppData\Local\Temp\SDShelEx-win32.dll
C:\Users\bernie\AppData\Local\Temp\SDShelEx-x64.dll
C:\Users\bernie\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\bernie\AppData\Local\Temp\setup_3.0.5579.exe
C:\Users\bernie\AppData\Local\Temp\setup_3.0.5606.exe
C:\Users\bernie\AppData\Local\Temp\setup_3.0.5617.exe
C:\Users\bernie\AppData\Local\Temp\setup_3.2.10.exe
C:\Users\bernie\AppData\Local\Temp\setup_3.2.20.exe
C:\Users\bernie\AppData\Local\Temp\SEVINST64x86.EXE
C:\Users\bernie\AppData\Local\Temp\sp-downloader.exe
C:\Users\bernie\AppData\Local\Temp\tmp1439.exe
C:\Users\bernie\AppData\Local\Temp\tmp6F8A.exe
C:\Users\bernie\AppData\Local\Temp\uttCA7D.tmp.exe
C:\Users\bernie\AppData\Local\Temp\winxp_62891.dll
C:\Users\bernie\AppData\Local\Temp\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}_NIS_19362.exe
C:\Users\Besucher\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-09-06 11:37
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-09-2014
Ran by bernie at 2014-09-13 13:28:20
Running from C:\Users\bernie\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version: - Microsoft)
„Windows Live Essentials“ (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
„Windows Live Mail“ (x32 Version: 15.4.3502.0922 - „Microsoft Corporation“) Hidden
„Windows Live Messenger“ (x32 Version: 15.4.3502.0922 - „Microsoft Corporation“) Hidden
„Windows Live“ fotogalerija (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version: - )
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.2.0.2070 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.2.0.2070 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader X (10.1.11) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.11 - Adobe Systems Incorporated)
Agatha Christie - Death on the Nile (x32 Version: 2.2.0.82 - WildTangent) Hidden
ANT Drivers Installer x64 (Version: 2.3.4 - Garmin Ltd or its subsidiaries) Hidden
Atheros Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 9.0 - Atheros)
AtomicTime (HKLM-x32\...\AtomicTime) (Version: - BasisOne Software)
Avira (HKLM-x32\...\{70e83cd8-4bd5-4039-ab5a-6b94a8abb641}) (Version: 1.1.21.25162 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.21.25162 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.6.570 - Avira)
BatteryLifeExtender (HKLM-x32\...\{FFD0E594-823B-4E2B-B680-720B3C852588}) (Version: 1.0.11 - Samsung)
Bejeweled 2 Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Bing Bar (HKLM-x32\...\{1E03DB52-D5CB-4338-A338-E526DD4D4DB1}) (Version: 7.0.610.0 - Microsoft Corporation)
BlockAndSurf (HKLM-x32\...\221138F2-3CA6-B697-125C-1D0BF4682582) (Version: - BlockAndSurf) <==== ATTENTION
Broadcom 802.11 Network Adapter (HKLM\...\Broadcom 802.11 Network Adapter) (Version: 5.60.48.55 - Broadcom Corporation)
Build-a-lot (x32 Version: 2.2.0.82 - WildTangent) Hidden
Canon MP Navigator EX 2.0 (HKLM-x32\...\MP Navigator EX 2.0) (Version: - )
Canon MP540 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP540_series) (Version: - )
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: - )
Canon Utilities Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version: - )
Canon Utilities Solution Menu (HKLM-x32\...\CanonSolutionMenu) (Version: - )
Chuzzle Deluxe (x32 Version: 2.2.0.82 - WildTangent) Hidden
CyberLink Media Suite (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 8.0.2227 - CyberLink Corp.)
CyberLink Media Suite (x32 Version: 8.0.2227 - CyberLink Corp.) Hidden
CyberLink Media+ Player10 (HKLM-x32\...\InstallShield_{34FBC7C4-CD31-4D93-A428-0E524EAC4586}) (Version: 10.0.1110.00 - CyberLink Corp.)
CyberLink Media+ Player10 (x32 Version: 10.0.1110.00 - CyberLink Corp.) Hidden
CyberLink MediaShow (HKLM-x32\...\InstallShield_{80E158EA-7181-40FE-A701-301CE6BE64AB}) (Version: 5.0.1130a - CyberLink Corp.)
CyberLink MediaShow (x32 Version: 5.0.1130a - CyberLink Corp.) Hidden
CyberLink Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.3802 - CyberLink Corp.)
CyberLink Power2Go (x32 Version: 6.1.3802 - CyberLink Corp.) Hidden
CyberLink PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 8.0.3306 - CyberLink Corp.)
CyberLink PowerDirector (x32 Version: 8.0.3306 - CyberLink Corp.) Hidden
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.1.3509 - CyberLink Corp.)
CyberLink YouCam (x32 Version: 3.1.3509 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.82 - WildTangent) Hidden
Dropbox (HKCU\...\Dropbox) (Version: 2.10.27 - Dropbox, Inc.)
Easy Content Share (HKLM-x32\...\{2DDC70C1-C77A-4D08-89D2-9AB648504533}) (Version: 1.0 - Samsung Electronics Co., LTD)
Easy Display Manager (HKLM-x32\...\{17283B95-21A8-4996-97DA-547A48DB266F}) (Version: 3.2 - Samsung Electronics Co., Ltd.)
Easy Migration (HKLM-x32\...\{AD86049C-3D9C-43E1-BE73-643F57D83D50}) (Version: 1.0 - Samsung Electronics Co., Ltd.)
Easy Network Manager (HKLM-x32\...\{8732818E-CA78-4ACB-B077-22311BF4C0E4}) (Version: 4.4.7 - Samsung)
Easy SpeedUp Manager (HKLM-x32\...\{EF367AA4-070B-493C-9575-85BE59D789C9}) (Version: 2.1.1.1 - Samsung Electronics Co.,Ltd.)
EasyBatteryManager (HKLM-x32\...\{4A331D24-A9E8-484F-835E-1BA7B139689C}) (Version: 4.0.0.4 - Samsung)
EasyFileShare (HKLM-x32\...\{16880765-677F-440B-B16A-BFD9B9C00012}) (Version: 1.0.12 - Samsung)
Elevated Installer (x32 Version: 3.2.17.0 - Garmin Ltd or its subsidiaries) Hidden
ETDWare PS/2-X64 10.7.14.12_WHQL (HKLM\...\Elantech) (Version: 10.7.14.12 - ELAN Microelectronic Corp.)
EVEREST Home Edition v2.20 (HKLM-x32\...\EVEREST Home Edition_is1) (Version: 2.20 - Lavalys Inc)
Express Zip (HKLM-x32\...\ExpressZip) (Version: - NCH Software)
Farm Frenzy (x32 Version: 2.2.0.82 - WildTangent) Hidden
Fast Start (HKLM-x32\...\{77F45ECD-FAFC-45A8-8896-CFFB139DAAA3}) (Version: 2.2.0.1 - SAMSUNG)
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Free YouTube to MP3 Converter version 3.12.35.514 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.35.514 - DVDVideoSoft Ltd.)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie foto Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Garmin Communicator Plugin (HKLM-x32\...\{8ED02445-D491-414C-A56D-2ED6BBB7239A}) (Version: 3.0.1 - Garmin Ltd or its subsidiaries)
Garmin Express (HKLM-x32\...\{b43ffffb-1adc-4bcb-b277-7844ebff94da}) (Version: 3.2.17.0 - Garmin Ltd or its subsidiaries)
Garmin Express (x32 Version: 3.2.17.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin Express Tray (x32 Version: 3.2.17.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin POI Loader (HKLM-x32\...\{3213ED5E-7BBE-4613-BE69-8B1E4FE520DD}) (Version: 2.7.3 - Garmin Ltd or its subsidiaries)
Garmin Training Center (HKLM-x32\...\{2A03B9F8-BE6D-43C6-A16A-B9998A194AF0}) (Version: 3.4.5 - Garmin Ltd or its subsidiaries)
Garmin USB Drivers (HKLM-x32\...\{3D5D6CFC-3097-425A-8D8F-7EAF5D57641D}) (Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)
Garmin WebUpdater (HKLM-x32\...\{00FE2935-FB56-4410-AB5F-D6E70C1771D2}) (Version: 2.5.6 - Garmin Ltd or its subsidiaries)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 37.0.2062.120 - Google Inc.)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
Hattrick Organizer (remove only) (HKLM-x32\...\Hattrick Organizer) (Version: - )
Insaniquarium Deluxe (x32 Version: 2.2.0.82 - WildTangent) Hidden
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2622 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.0.0.1046 - Intel Corporation)
IPTInstaller (HKLM-x32\...\{08208143-777D-4A06-BB54-71BF0AD1BB70}) (Version: 4.0.8 - HTC)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.30 - Irfan Skiljan)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) Hidden
John Deere Drive Green (x32 Version: 2.2.0.82 - WildTangent) Hidden
Juice 2.2.2-a1 (HKLM-x32\...\Juice) (Version: 2.2.2-a1 - Juice Team)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.2.173.0 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (Version: 2.2.173.0 - Microsoft Corporation) Hidden
Mindjet MindManager 2012 (HKLM-x32\...\{2005E0A6-ED25-4B8A-801C-F3A0B846A317}) (Version: 10.0.445 - Mindjet)
Movie Color Enhancer (HKLM-x32\...\{7F6F62F0-7884-4CFB-B86C-597A4A6D9C4D}) (Version: 1.0 - Samsung Electronics Co., Ltd.)
Mozilla Firefox 32.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.1 (x86 de)) (Version: 32.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 32.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM-x32\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
Multimedia POP (HKLM-x32\...\{331ECF61-69AF-4F57-AC35-AFED610231C3}) (Version: 1.1 - )
MyPhoneExplorer (HKLM-x32\...\MPE) (Version: 1.8.6 - F.J. Wechselberger)
NAVIGON Fresh 3.5.1 (HKLM-x32\...\NAVIGON Fresh) (Version: 3.5.1 - NAVIGON)
Norton Online Backup (HKLM-x32\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.1.17869 - Symantec Corporation)
NVIDIA Grafiktreiber 320.49 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 320.49 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.124.810 - NVIDIA Corporation) Hidden
NVIDIA Optimus 1.10.8 (Version: 1.10.8 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.0604 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.0604 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0604 - NVIDIA Corporation)
NVIDIA Systemsteuerung 320.49 (Version: 320.49 - NVIDIA Corporation) Hidden
NVIDIA Update 1.10.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.10.8 - NVIDIA Corporation)
NVIDIA Update Components (Version: 1.10.8 - NVIDIA Corporation) Hidden
PDF-XChange 3 (HKLM\...\PDF-XChange 3_is1) (Version: - Tracker Software)
Peggle (x32 Version: 2.2.0.82 - WildTangent) Hidden
Penguins! (x32 Version: 2.2.0.82 - WildTangent) Hidden
PhoneShare (HKLM-x32\...\{3F50512F-53DF-46B1-8CCB-6C7E638CADD6}) (Version: 9.1.4 - Samsung)
Plants vs. Zombies (x32 Version: 2.2.0.82 - WildTangent) Hidden
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Polar Golfer (x32 Version: 2.2.0.82 - WildTangent) Hidden
Pošta Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Power Vision Software (HKLM\...\{F4DA8B2F-8860-416C-868F-8ABAF6B78033}) (Version: 2.0.6.1319 - Dynojet Research Inc.)
QXL Ricardo Assistant 5 (HKLM-x32\...\QXL Ricardo Assistant 5) (Version: 0.0.0.0 - )
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.36.1224.2010 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6301 - Realtek Semiconductor Corp.)
Samsung AnyWeb Print (HKLM-x32\...\{318DBE01-1E6B-4243-84B0-210391FE789A}) (Version: 1.1.21.0 - Samsung Electronics Co., Ltd.)
Samsung AnyWeb Print (x32 Version: 1.0 - Samsung Electronics Co., Ltd.) Hidden
Samsung Recovery Solution 5 (HKLM-x32\...\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}) (Version: 5.0.0.10 - Samsung)
Samsung Support Center 1.0 (HKLM-x32\...\{F687E657-F636-44DF-8125-9FEEA2C362F5}) (Version: 1.1.38 - Samsung)
Samsung Universal Print Driver (HKLM-x32\...\Samsung Universal Print Driver) (Version: 2.01.06.00:16 - Samsung Electronics Co., Ltd.)
Samsung Universal Scan Driver (HKLM-x32\...\Samsung Universal Scan Driver) (Version: 1.2.1.0 - Samsung Electronics Co., Ltd.)
Samsung Update Plus (HKLM-x32\...\{142D8CA7-2C6F-45A7-83E3-099AAFD99133}) (Version: 3.0.1.17 - Samsung Electronics Co., Ltd.)
Sansa Updater (HKCU\...\Sansa Updater) (Version: 1.313 - SanDisk Corporation)
Seagate Dashboard (HKLM-x32\...\{67445E65-3D93-428F-83A5-446F7D02689A}) (Version: 3.1.3.0 - Seagate)
SISShortcut (HKLM-x32\...\{FDAE128F-A355-42B1-8422-1AF3ACEE34F4}) (Version: 1.00.000 - Samsung)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Sony Ericsson Update Engine (HKLM-x32\...\Update Engine) (Version: 2.11.10.7 - Sony Ericsson Mobile Communications AB)
SportTracks 3.1 (HKLM-x32\...\{99895EF0-B290-4B21-B1FE-FB00E1B5D195}) (Version: 3.1.5314 - Zone Five Software)
Überwachungstool für die Intel® Turbo-Boost-Technik 2.0 (HKLM\...\{B77EFA0B-9BD3-4122-9F9A-15A963B5EA24}) (Version: 2.0.82.0 - Intel)
UBS Pay 5.6.004 (build 1) (HKLM-x32\...\{99CA9F1B-2774-40D4-BAE1-BC3CE7D85018}) (Version: 05.06.0401 - UBS AG)
UBSPay PayNet Extension 2.1.002 (b2) (HKLM-x32\...\{C4B39EAA-57BE-4446-8604-5121A6965545}) (Version: 02.01.0202 - UBS AG)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2889914) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{F3F83933-75FC-4B60-84F2-3F8FA63D042E}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
User Guide (HKLM-x32\...\{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}) (Version: 1.0 - )
VLC media player 1.1.11 (HKLM-x32\...\VLC media player) (Version: 1.1.11 - VideoLAN)
VobSub v2.23 (Remove Only) (HKLM-x32\...\VobSub) (Version: - )
WIDCOMM Bluetooth Software (HKLM\...\{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}) (Version: 6.3.0.7600 - Broadcom Corporation)
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.1.5 - WildTangent)
WildTangent ORB Game Console (x32 Version: - WildTangent) Hidden
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (04/19/2012 2.3.1.0) (HKLM\...\98157A226B40B173301B0F53C8E98C47805D5152) (Version: 04/19/2012 2.3.1.0 - Garmin)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live fotoattēlu galerija (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogaléria (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Foto-galerija (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalleri (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotoğraf Galerisi (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotótár (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Galeria de Fotos (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Galerija fotografija (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Pošta (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 메일 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 사진 갤러리 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 필수 패키지 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 影像中心 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 照片库 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 程式集 (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live 程式集 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 软件包 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven sähköposti (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven valokuvavalikoima (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
Windows-Treiberpaket - Dynastream Innovations, Inc. ANT LibUSB Drivers (04/11/2012 1.2.40.201) (HKLM\...\F9D2A789F9CFF8CEC36B544F53877C80F1F73C46) (Version: 04/11/2012 1.2.40.201 - Dynastream Innovations, Inc.)
Windows-Treiberpaket - Silicon Labs Software (DSI_SiUSBXp_3_1) USB (02/06/2007 3.1) (HKLM\...\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software)
WinRAR 5.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
WordCaptureX Pro (HKLM-x32\...\{139C1D95-9037-3AB3-F5F4-4A79BF6831EC}) (Version: 4.0.0 - Deskperience)
Zattoo4 4.0.5 (HKLM-x32\...\Zattoo4) (Version: 4.0.5 - Zattoo Inc.)
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Почта Windows Live (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Фотогалерия на Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
بريد Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
معرض صور Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\bernie\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\bernie\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\bernie\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\bernie\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\bernie\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\bernie\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\bernie\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\bernie\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\bernie\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
==================== Restore Points =========================
01-09-2014 10:09:00 Installed Seagate Dashboard.
01-09-2014 21:44:59 Windows Update
05-09-2014 21:33:43 Windows Update
11-09-2014 13:34:59 Windows Update
11-09-2014 22:26:37 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {0A095A88-3C29-427D-A4D6-D08A449B846F} - System32\Tasks\SamsungSupportCenter => C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe [2011-09-04] (SAMSUNG Electronics)
Task: {32F58E55-1084-4966-A24B-E0E14E1D2883} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-11] (Adobe Systems Incorporated)
Task: {341E50B1-516C-450C-893F-B27D631A2BA3} - System32\Tasks\bernie Merge => C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\NBCore.exe [2014-04-30] (Seagate Technology LLC)
Task: {3C278BCA-231F-44F0-81DC-C82ED199D770} - System32\Tasks\MovieColorEnhancer => C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe [2010-11-29] (Samsung Electronics Co., Ltd.)
Task: {434AEA50-953F-484D-AFF0-1106D3F818DB} - System32\Tasks\{748B4F7E-7007-48A8-9172-FDF277577ABD} => Firefox.exe
Task: {45087653-CB61-45B2-B51C-8C36BCB941E1} - System32\Tasks\bernie DBAgent 2 0 => C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DBAgent.exe [2014-04-30] (Seagate Technology LLC)
Task: {57CE4D70-6963-41A6-AB37-4A03DA510D4C} - System32\Tasks\EasySpeedUpManager => C:\Program Files (x86)\Samsung\EasySpeedUpManager\EasySpeedUpManager2.exe [2010-12-23] (Samsung Electronics)
Task: {5E6D4B98-C0B7-4D32-BF7F-A39E0CC879D5} - System32\Tasks\BatteryLifeExtender => C:\Program Files (x86)\Samsung\BatteryLifeExtender\BatteryLifeExtender.exe [2010-12-18] (Samsung Electronics. Co. Ltd.)
Task: {63FB381D-D7B5-4E11-AF4C-78708675BDEC} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)
Task: {65D05265-0823-423B-9A24-567EDE30E866} - System32\Tasks\SUPBackground => C:\Program Files (x86)\Samsung\Samsung Update Plus\SUPBackground.exe [2011-12-20] (Samsung Electronics)
Task: {77ACFA9E-80DF-4079-8018-BB1D4F451470} - System32\Tasks\{A2D25906-EDBE-409F-9331-6740B243AC43} => Firefox.exe
Task: {7C24F3CB-8BA8-478C-B715-014564826342} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2010-11-10] (CyberLink)
Task: {861D1A4A-85E0-4192-BDFD-A52BAEC35913} - System32\Tasks\WifiManager => C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe [2011-01-04] (Samsung Electronics Co., Ltd.)
Task: {8BF2CF48-9685-4BA3-A649-AB6213A08FBD} - System32\Tasks\{513C43F7-E3B0-4E5C-8898-3C747CB6A296} => Firefox.exe
Task: {94B43B29-0E75-4F4C-8170-84ED93DA0814} - System32\Tasks\NCH Software\ExpressZipReminder => C:\Program Files (x86)\NCH Software\ExpressZip\ExpressZip.exe [2012-12-14] (NCH Software)
Task: {9A4C3D11-5002-4292-840E-F7E9B3C70E35} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)
Task: {A1D2D9C4-17B0-4563-8881-817404C12BAD} - System32\Tasks\SmartRestarter => C:\Program Files\Samsung\SamsungFastStart\SmartRestarter.exe [2010-08-05] (Samsung Electronics Co., Ltd.)
Task: {ADD1A2CD-48F4-455A-9C48-0158947EF657} - System32\Tasks\advSRS5 => C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe [2010-11-17] (SEC)
Task: {B1F67B28-6DAD-4D83-BCD7-C18E0AB99D77} - System32\Tasks\bernie => C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\NBCore.exe [2014-04-30] (Seagate Technology LLC)
Task: {C63BA876-2CC9-4FB6-8285-80EEDFBC8556} - System32\Tasks\Launch HTC Sync Loader => C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe
Task: {C815ABD9-D7A2-49F9-9310-43B8ADFF2C1E} - System32\Tasks\EasyBatteryManager => C:\Program Files (x86)\Samsung\EasyBatteryManager\EasyBatteryMgr4.exe [2010-07-20] (SAMSUNG Electronics co., LTD.)
Task: {D39CAEF2-F8AB-4E92-9D23-22D978FDDCD5} - System32\Tasks\Seagate_Install_Launch => C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Dashboard.exe [2014-04-30] (Seagate Technology LLC)
Task: {DD01003A-3323-488B-AF6A-F0815B0A9CCA} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)
Task: {DDF6112A-0E0B-444E-AAA9-FAE71EEBDC7B} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2013-05-13] (Microsoft)
Task: {DE0AA40B-C247-44CA-A0C7-B90038E1A26C} - System32\Tasks\GarminUpdaterTask => C:\Program Files (x86)\Garmin\Express Self Updater\ExpressSelfUpdater.exe [2014-08-07] ()
Task: {DE2521FE-3B56-4F47-8A46-B31A83C0139C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-09-09] (Google Inc.)
Task: {E393A237-CA1D-425C-9C87-C2F9582C8976} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)
Task: {EEFC22EC-2C3E-4E6C-903F-FD6A46FCDD95} - System32\Tasks\EasyDisplayMgr => C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe [2010-12-23] (Samsung Electronics Co., Ltd.)
Task: {F853ABD3-0AFB-4A5C-9733-F12F3F2B1380} - System32\Tasks\BlockAndSurf Update => C:\Program Files (x86)\ver1BlockAndSurf\D2BlockAndSurfL71.exe [2014-09-01] () <==== ATTENTION
Task: {FDFF8AC8-E07E-4F07-AD8E-4B4D8D605F13} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-09-09] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\BlockAndSurf Update.job => C:\Program Files (x86)\ver1BlockAndSurf\D2BlockAndSurfL71.exe <==== ATTENTION
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2011-09-08 12:32 - 2008-06-05 01:53 - 00027648 _____ () C:\Windows\System32\spd__l.dll
2013-09-15 10:19 - 2013-06-21 12:23 - 00087328 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-09-01 18:09 - 2014-09-01 18:09 - 00104960 _____ () C:\Program Files (x86)\ver1BlockAndSurf\BlockAndSurf.exe
2013-09-14 16:07 - 2012-12-07 17:26 - 00167424 _____ () C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
2011-03-15 09:00 - 2009-12-01 09:21 - 00244904 ____N () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
2011-09-08 12:32 - 2010-04-21 01:44 - 00719872 _____ () C:\Windows\system32\SnMinDrv.dll
2011-03-15 23:56 - 2010-12-17 02:37 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2011-03-15 08:49 - 2006-08-12 05:48 - 00049152 _____ () C:\Program Files (x86)\Samsung\Easy Display Manager\HookDllPS2.dll
2014-08-27 15:00 - 2014-08-27 15:00 - 00139056 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll
2014-08-27 15:00 - 2014-08-27 15:00 - 00066864 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.AvConnectorNative.dll
2011-09-14 14:02 - 2011-09-14 14:02 - 00150856 _____ () C:\Program Files (x86)\Mindjet\MindManager 10\zlib.dll
2014-05-18 12:08 - 2014-08-27 15:00 - 00052472 _____ () C:\Users\bernie\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
2014-09-13 13:20 - 2014-09-13 13:20 - 00043008 _____ () c:\users\bernie\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpmhnybs.dll
2013-08-23 21:01 - 2013-08-23 21:01 - 25100288 _____ () C:\Users\bernie\AppData\Roaming\Dropbox\bin\libcef.dll
2011-03-15 09:08 - 2010-05-07 16:22 - 01636864 _____ () C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\Resdll.dll
2014-09-13 10:39 - 2014-09-13 10:39 - 03716720 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2011-03-15 09:07 - 2010-07-05 12:42 - 00203776 _____ () C:\Program Files (x86)\Samsung\Movie Color Enhancer\WinCRT.dll
2009-11-02 07:20 - 2009-11-02 07:20 - 00619816 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
2009-11-02 07:23 - 2009-11-02 07:23 - 00013096 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
2014-09-11 16:40 - 2014-09-11 16:40 - 16825520 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (09/05/2014 11:31:21 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ipmGui.exe, Version: 14.0.6.522, Zeitstempel: 0x53bec647
Name des fehlerhaften Moduls: ipmGui.exe, Version: 14.0.6.522, Zeitstempel: 0x53bec647
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000795b
ID des fehlerhaften Prozesses: 0xef0
Startzeit der fehlerhaften Anwendung: 0xipmGui.exe0
Pfad der fehlerhaften Anwendung: ipmGui.exe1
Pfad des fehlerhaften Moduls: ipmGui.exe2
Berichtskennung: ipmGui.exe3
Error: (09/01/2014 06:09:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 31.0.0.5310, Zeitstempel: 0x53c75e91
Name des fehlerhaften Moduls: mozalloc.dll, Version: 31.0.0.5310, Zeitstempel: 0x53c72e91
Ausnahmecode: 0x80000003
Fehleroffset: 0x0000141b
ID des fehlerhaften Prozesses: 0xb6c
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Error: (08/31/2014 06:08:09 PM) (Source: Avira Antivirus) (EventID: 4117) (User: NT-AUTORITÄT)
Description: Die Lizenzdatei enthält keine gültige Lizenz. Der Dienst wird beendet!
Error: (08/31/2014 05:44:25 PM) (Source: Avira Antivirus) (EventID: 4117) (User: NT-AUTORITÄT)
Description: Die Lizenzdatei enthält keine gültige Lizenz. Der Dienst wird beendet!
Error: (08/31/2014 05:28:42 PM) (Source: Avira Antivirus) (EventID: 4117) (User: NT-AUTORITÄT)
Description: Die Lizenzdatei enthält keine gültige Lizenz. Der Dienst wird beendet!
Error: (08/31/2014 05:18:21 PM) (Source: Avira Antivirus) (EventID: 4117) (User: NT-AUTORITÄT)
Description: Die Lizenzdatei enthält keine gültige Lizenz. Der Dienst wird beendet!
Error: (08/31/2014 11:48:41 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: SHELL32.dll, Version: 6.1.7601.18517, Zeitstempel: 0x53aa2e07
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000050506
ID des fehlerhaften Prozesses: 0x1414
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3
Error: (08/31/2014 11:48:04 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: SHELL32.dll, Version: 6.1.7601.18517, Zeitstempel: 0x53aa2e07
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000050506
ID des fehlerhaften Prozesses: 0x132c
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3
Error: (08/31/2014 11:24:34 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: SHELL32.dll, Version: 6.1.7601.18517, Zeitstempel: 0x53aa2e07
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000050506
ID des fehlerhaften Prozesses: 0x1070
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3
Error: (08/31/2014 11:19:32 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: SHELL32.dll, Version: 6.1.7601.18517, Zeitstempel: 0x53aa2e07
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000050506
ID des fehlerhaften Prozesses: 0xa50
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3
System errors:
=============
Error: (09/13/2014 01:22:53 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (09/13/2014 01:22:53 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (09/13/2014 01:18:40 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Garmin Core Update Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (09/13/2014 01:18:40 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Garmin Core Update Service erreicht.
Error: (09/13/2014 01:15:04 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1084WSearch{9E175B6D-F52A-11D8-B9A5-505054503030}
Error: (09/13/2014 01:15:03 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1084WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
Error: (09/13/2014 01:14:59 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (09/13/2014 01:14:59 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (09/13/2014 01:14:59 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (09/13/2014 01:14:57 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Microsoft Office Sessions:
=========================
Error: (12/31/2012 05:33:41 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 29 seconds with 0 seconds of active time. This session ended with a crash.
Error: (07/23/2012 07:48:26 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 1126 seconds with 1020 seconds of active time. This session ended with a crash.
CodeIntegrity Errors:
===================================
Date: 2011-09-09 17:26:36.913
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\bernie\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2011-09-09 17:26:36.840
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\bernie\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2011-09-09 17:26:36.720
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2011-09-09 17:26:36.655
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-2410M CPU @ 2.30GHz
Percentage of memory in use: 40%
Total physical RAM: 6057.55 MB
Available physical RAM: 3595.33 MB
Total Pagefile: 12113.27 MB
Available Pagefile: 9288.73 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:177 GB) (Free:76.34 GB) NTFS
Drive d: () (Fixed) (Total:264.78 GB) (Free:203.77 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: FDF38C38)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=177 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=264.8 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=23.9 GB) - (Type=27)
==================== End Of Log ============================
|
|
13.09.2014, 12:40
| #2 |
| /// TB-Ausbilder   | Chrome und Firefox öffnen ständig Werbeseiten,Malwarebytes funktionioniert nicht mehr,auch nicht mit Chameleon Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen. Bitte beachte folgende Hinweise:
Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab und poste alle Logdateien in CODE-Tags:  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert deinem Helfer massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
Danke für deine Mitarbeit! Scan mit Combofix
|
|
13.09.2014, 12:41
| #3 |
| | Chrome und Firefox öffnen ständig Werbeseiten,Malwarebytes funktionioniert nicht mehr,auch nicht mit Chameleon Weiter txt Files hier angehängt!
__________________gmer Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-09-13 12:57:54
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD50 rev.01.0 465.76GB
Running: Gmer-19357.exe; Driver: C:\Users\bernie\AppData\Local\Temp\pwdiipog.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff800033ee000 10 bytes [F3, 22, 00, 0F, 84, 57, 17, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 667 fffff800033ee08b 11 bytes [01, 00, 00, 00, 48, 3B, 73, ...]
---- User code sections - GMER 2.1 ----
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1524] C:\Windows\system32\kernel32.dll!RegSetValueExW 000000007730a400 7 bytes JMP 000000016fff0260
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1524] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077313f20 5 bytes JMP 000000016fff01b8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1524] C:\Windows\system32\kernel32.dll!RegDeleteValueW 000000007732ffb0 5 bytes JMP 000000016fff01f0
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1524] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007733f2e0 5 bytes JMP 000000016fff0148
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1524] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077369a30 7 bytes JMP 000000016fff00d8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1524] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000773794c0 5 bytes JMP 000000016fff0180
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1524] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW 0000000077379630 5 bytes JMP 000000016fff0110
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1524] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000773987e0 7 bytes JMP 000000016fff0228
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1524] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefdc37490 11 bytes JMP 000007fffd4e0228
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1524] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefdc4bf00 7 bytes JMP 000007fffd4e0260
.text C:\Users\bernie\AppData\Roaming\SanDisk\Sansa Updater\SansaDispatch.exe[3960] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075061d29 5 bytes JMP 00000001646e11e5
.text C:\Users\bernie\AppData\Roaming\SanDisk\Sansa Updater\SansaDispatch.exe[3960] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075061dd7 5 bytes JMP 00000001646e1019
.text C:\Users\bernie\AppData\Roaming\SanDisk\Sansa Updater\SansaDispatch.exe[3960] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075062ab1 5 bytes JMP 00000001646e1573
.text C:\Users\bernie\AppData\Roaming\SanDisk\Sansa Updater\SansaDispatch.exe[3960] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075062d17 5 bytes JMP 00000001646e128f
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe[3632] C:\Windows\syswow64\KERNEL32.dll!RegQueryValueExW 0000000075fb1f0e 7 bytes JMP 00000001646e16b3
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe[3632] C:\Windows\syswow64\KERNEL32.dll!RegSetValueExW 0000000075fb5bad 7 bytes JMP 00000001646e11cc
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe[3632] C:\Windows\syswow64\KERNEL32.dll!RegSetValueExA 0000000075fc1409 7 bytes JMP 00000001646e12a8
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe[3632] C:\Windows\syswow64\KERNEL32.dll!RegDeleteValueW 0000000075fcea45 7 bytes JMP 00000001646e1262
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe[3632] C:\Windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW 0000000075fdb21b 5 bytes JMP 00000001646e15c8
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe[3632] C:\Windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx 0000000076058e24 7 bytes JMP 00000001646e1357
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe[3632] C:\Windows\syswow64\KERNEL32.dll!K32GetModuleInformation 0000000076058ea9 5 bytes JMP 00000001646e16f4
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe[3632] C:\Windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW 00000000760591ff 5 bytes JMP 00000001646e101e
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe[3632] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075061d29 5 bytes JMP 00000001646e11e5
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe[3632] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075061dd7 5 bytes JMP 00000001646e1019
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe[3632] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075062ab1 5 bytes JMP 00000001646e1573
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe[3632] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075062d17 5 bytes JMP 00000001646e128f
.text C:\Users\bernie\AppData\Roaming\Dropbox\bin\Dropbox.exe[4192] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000075fb1f0e 7 bytes JMP 00000001646e16b3
.text C:\Users\bernie\AppData\Roaming\Dropbox\bin\Dropbox.exe[4192] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000075fb5bad 7 bytes JMP 00000001646e11cc
.text C:\Users\bernie\AppData\Roaming\Dropbox\bin\Dropbox.exe[4192] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000075fc1409 7 bytes JMP 00000001646e12a8
.text C:\Users\bernie\AppData\Roaming\Dropbox\bin\Dropbox.exe[4192] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 0000000075fcea45 7 bytes JMP 00000001646e1262
.text C:\Users\bernie\AppData\Roaming\Dropbox\bin\Dropbox.exe[4192] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 0000000075fdb21b 5 bytes JMP 00000001646e15c8
.text C:\Users\bernie\AppData\Roaming\Dropbox\bin\Dropbox.exe[4192] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000076058e24 7 bytes JMP 00000001646e1357
.text C:\Users\bernie\AppData\Roaming\Dropbox\bin\Dropbox.exe[4192] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000076058ea9 5 bytes JMP 00000001646e16f4
.text C:\Users\bernie\AppData\Roaming\Dropbox\bin\Dropbox.exe[4192] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000760591ff 5 bytes JMP 00000001646e101e
.text C:\Users\bernie\AppData\Roaming\Dropbox\bin\Dropbox.exe[4192] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075061d29 5 bytes JMP 00000001646e11e5
.text C:\Users\bernie\AppData\Roaming\Dropbox\bin\Dropbox.exe[4192] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075061dd7 5 bytes JMP 00000001646e1019
.text C:\Users\bernie\AppData\Roaming\Dropbox\bin\Dropbox.exe[4192] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075062ab1 5 bytes JMP 00000001646e1573
.text C:\Users\bernie\AppData\Roaming\Dropbox\bin\Dropbox.exe[4192] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075062d17 5 bytes JMP 00000001646e128f
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DBAgent.exe[4408] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000075fb1f0e 7 bytes JMP 00000001646e16b3
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DBAgent.exe[4408] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000075fb5bad 7 bytes JMP 00000001646e11cc
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DBAgent.exe[4408] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000075fc1409 7 bytes JMP 00000001646e12a8
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DBAgent.exe[4408] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 0000000075fcea45 7 bytes JMP 00000001646e1262
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DBAgent.exe[4408] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 0000000075fdb21b 5 bytes JMP 00000001646e15c8
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DBAgent.exe[4408] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000076058e24 7 bytes JMP 00000001646e1357
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DBAgent.exe[4408] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000076058ea9 5 bytes JMP 00000001646e16f4
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DBAgent.exe[4408] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000760591ff 5 bytes JMP 00000001646e101e
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DBAgent.exe[4408] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075061d29 5 bytes JMP 00000001646e11e5
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DBAgent.exe[4408] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075061dd7 5 bytes JMP 00000001646e1019
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DBAgent.exe[4408] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075062ab1 5 bytes JMP 00000001646e1573
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DBAgent.exe[4408] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075062d17 5 bytes JMP 00000001646e128f
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DBAgent.exe[4408] C:\Windows\syswow64\USER32.dll!CreateWindowExW 00000000756c8a29 5 bytes JMP 00000001646e1046
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DBAgent.exe[4408] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 00000000756d4572 5 bytes JMP 00000001646e10c8
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DBAgent.exe[4408] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 00000000756ee567 5 bytes JMP 00000001646e1433
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DBAgent.exe[4408] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000075727a5c 5 bytes JMP 00000001646e15f0
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[4436] C:\Windows\syswow64\KERNEL32.dll!RegQueryValueExW 0000000075fb1f0e 7 bytes JMP 00000001646e16b3
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[4436] C:\Windows\syswow64\KERNEL32.dll!RegSetValueExW 0000000075fb5bad 7 bytes JMP 00000001646e11cc
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[4436] C:\Windows\syswow64\KERNEL32.dll!RegSetValueExA 0000000075fc1409 7 bytes JMP 00000001646e12a8
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[4436] C:\Windows\syswow64\KERNEL32.dll!RegDeleteValueW 0000000075fcea45 7 bytes JMP 00000001646e1262
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[4436] C:\Windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW 0000000075fdb21b 5 bytes JMP 00000001646e15c8
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[4436] C:\Windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx 0000000076058e24 7 bytes JMP 00000001646e1357
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[4436] C:\Windows\syswow64\KERNEL32.dll!K32GetModuleInformation 0000000076058ea9 5 bytes JMP 00000001646e16f4
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[4436] C:\Windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW 00000000760591ff 5 bytes JMP 00000001646e101e
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[4436] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075061d29 5 bytes JMP 00000001646e11e5
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[4436] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075061dd7 5 bytes JMP 00000001646e1019
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[4436] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075062ab1 5 bytes JMP 00000001646e1573
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[4436] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075062d17 5 bytes JMP 00000001646e128f
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4500] C:\Windows\system32\kernel32.dll!RegSetValueExW 000000007730a400 7 bytes JMP 000000016fff0260
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4500] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077313f20 5 bytes JMP 000000016fff01b8
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4500] C:\Windows\system32\kernel32.dll!RegDeleteValueW 000000007732ffb0 5 bytes JMP 000000016fff01f0
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4500] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007733f2e0 5 bytes JMP 000000016fff0148
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4500] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077369a30 7 bytes JMP 000000016fff00d8
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4500] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000773794c0 5 bytes JMP 000000016fff0180
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4500] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW 0000000077379630 5 bytes JMP 000000016fff0110
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4500] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000773987e0 7 bytes JMP 000000016fff0228
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4500] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd532db0 5 bytes JMP 000007fffd4e0180
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4500] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd5337d0 7 bytes JMP 000007fffd4e00d8
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4500] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd538ef0 6 bytes JMP 000007fffd4e0148
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4500] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd54af60 5 bytes JMP 000007fffd4e0110
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4500] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff6a89f0 8 bytes JMP 000007fffd4e01f0
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4500] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff6abe50 8 bytes JMP 000007fffd4e01b8
.text C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5024] C:\Windows\system32\kernel32.dll!RegSetValueExW 000000007730a400 7 bytes JMP 000000016fff0260
.text C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5024] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077313f20 5 bytes JMP 000000016fff01b8
.text C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5024] C:\Windows\system32\kernel32.dll!RegDeleteValueW 000000007732ffb0 5 bytes JMP 000000016fff01f0
.text C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5024] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007733f2e0 5 bytes JMP 000000016fff0148
.text C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5024] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077369a30 7 bytes JMP 000000016fff00d8
.text C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5024] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000773794c0 5 bytes JMP 000000016fff0180
.text C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5024] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW 0000000077379630 5 bytes JMP 000000016fff0110
.text C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5024] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000773987e0 7 bytes JMP 000000016fff0228
.text C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5024] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd532db0 5 bytes JMP 000007fffd4e0180
.text C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5024] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd5337d0 7 bytes JMP 000007fffd4e00d8
.text C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5024] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd538ef0 6 bytes JMP 000007fffd4e0148
.text C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5024] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd54af60 5 bytes JMP 000007fffd4e0110
.text C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5024] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff6a89f0 8 bytes JMP 000007fffd4e01f0
.text C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5024] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff6abe50 8 bytes JMP 000007fffd4e01b8
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DeviceAgent.exe[3668] C:\Windows\syswow64\KERNEL32.dll!RegQueryValueExW 0000000075fb1f0e 7 bytes JMP 00000001646e16b3
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DeviceAgent.exe[3668] C:\Windows\syswow64\KERNEL32.dll!RegSetValueExW 0000000075fb5bad 7 bytes JMP 00000001646e11cc
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DeviceAgent.exe[3668] C:\Windows\syswow64\KERNEL32.dll!RegSetValueExA 0000000075fc1409 7 bytes JMP 00000001646e12a8
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DeviceAgent.exe[3668] C:\Windows\syswow64\KERNEL32.dll!RegDeleteValueW 0000000075fcea45 7 bytes JMP 00000001646e1262
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DeviceAgent.exe[3668] C:\Windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW 0000000075fdb21b 5 bytes JMP 00000001646e15c8
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DeviceAgent.exe[3668] C:\Windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx 0000000076058e24 7 bytes JMP 00000001646e1357
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DeviceAgent.exe[3668] C:\Windows\syswow64\KERNEL32.dll!K32GetModuleInformation 0000000076058ea9 5 bytes JMP 00000001646e16f4
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DeviceAgent.exe[3668] C:\Windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW 00000000760591ff 5 bytes JMP 00000001646e101e
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DeviceAgent.exe[3668] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075061d29 5 bytes JMP 00000001646e11e5
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DeviceAgent.exe[3668] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075061dd7 5 bytes JMP 00000001646e1019
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DeviceAgent.exe[3668] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075062ab1 5 bytes JMP 00000001646e1573
.text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DeviceAgent.exe[3668] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075062d17 5 bytes JMP 00000001646e128f
.text C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe[1592] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000075fb1f0e 7 bytes JMP 00000001646e16b3
.text C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe[1592] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000075fb5bad 7 bytes JMP 00000001646e11cc
.text C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe[1592] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000075fc1409 7 bytes JMP 00000001646e12a8
.text C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe[1592] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 0000000075fcea45 7 bytes JMP 00000001646e1262
.text C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe[1592] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 0000000075fdb21b 5 bytes JMP 00000001646e15c8
.text C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe[1592] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000076058e24 7 bytes JMP 00000001646e1357
.text C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe[1592] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000076058ea9 5 bytes JMP 00000001646e16f4
.text C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe[1592] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000760591ff 5 bytes JMP 00000001646e101e
.text C:\Windows\system32\prevhost.exe[6860] C:\Windows\system32\kernel32.dll!RegSetValueExW 000000007730a400 7 bytes JMP 000000016fff0260
.text C:\Windows\system32\prevhost.exe[6860] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077313f20 5 bytes JMP 000000016fff01b8
.text C:\Windows\system32\prevhost.exe[6860] C:\Windows\system32\kernel32.dll!RegDeleteValueW 000000007732ffb0 5 bytes JMP 000000016fff01f0
.text C:\Windows\system32\prevhost.exe[6860] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007733f2e0 5 bytes JMP 000000016fff0148
.text C:\Windows\system32\prevhost.exe[6860] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077369a30 7 bytes JMP 000000016fff00d8
.text C:\Windows\system32\prevhost.exe[6860] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000773794c0 5 bytes JMP 000000016fff0180
.text C:\Windows\system32\prevhost.exe[6860] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW 0000000077379630 5 bytes JMP 000000016fff0110
.text C:\Windows\system32\prevhost.exe[6860] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000773987e0 7 bytes JMP 000000016fff0228
.text C:\Windows\system32\prevhost.exe[6860] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd532db0 5 bytes JMP 000007fffd4e0180
.text C:\Windows\system32\prevhost.exe[6860] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd5337d0 7 bytes JMP 000007fffd4e00d8
.text C:\Windows\system32\prevhost.exe[6860] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd538ef0 6 bytes JMP 000007fffd4e0148
.text C:\Windows\system32\prevhost.exe[6860] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd54af60 5 bytes JMP 000007fffd4e0110
.text C:\Windows\system32\prevhost.exe[6860] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff6a89f0 8 bytes JMP 000007fffd4e01f0
.text C:\Windows\system32\prevhost.exe[6860] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff6abe50 8 bytes JMP 000007fffd4e01b8
.text C:\Windows\system32\prevhost.exe[6860] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefdc37490 11 bytes JMP 000007fffd4e0228
.text C:\Windows\system32\prevhost.exe[6860] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefdc4bf00 7 bytes JMP 000007fffd4e0260
.text C:\Users\bernie\Downloads\Gmer-19357.exe[5016] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000075fb1f0e 7 bytes JMP 00000001646e16b3
.text C:\Users\bernie\Downloads\Gmer-19357.exe[5016] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000075fb5bad 7 bytes JMP 00000001646e11cc
.text C:\Users\bernie\Downloads\Gmer-19357.exe[5016] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000075fc1409 7 bytes JMP 00000001646e12a8
.text C:\Users\bernie\Downloads\Gmer-19357.exe[5016] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 0000000075fcea45 7 bytes JMP 00000001646e1262
.text C:\Users\bernie\Downloads\Gmer-19357.exe[5016] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 0000000075fdb21b 5 bytes JMP 00000001646e15c8
.text C:\Users\bernie\Downloads\Gmer-19357.exe[5016] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000076058e24 7 bytes JMP 00000001646e1357
.text C:\Users\bernie\Downloads\Gmer-19357.exe[5016] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000076058ea9 5 bytes JMP 00000001646e16f4
.text C:\Users\bernie\Downloads\Gmer-19357.exe[5016] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000760591ff 5 bytes JMP 00000001646e101e
.text C:\Users\bernie\Downloads\Gmer-19357.exe[5016] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075061d29 5 bytes JMP 00000001646e11e5
.text C:\Users\bernie\Downloads\Gmer-19357.exe[5016] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075061dd7 5 bytes JMP 00000001646e1019
.text C:\Users\bernie\Downloads\Gmer-19357.exe[5016] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075062ab1 5 bytes JMP 00000001646e1573
.text C:\Users\bernie\Downloads\Gmer-19357.exe[5016] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075062d17 5 bytes JMP 00000001646e128f
.text C:\Users\bernie\Downloads\Gmer-19357.exe[5016] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 0000000075dfe96b 5 bytes JMP 00000001646e15e1
.text C:\Users\bernie\Downloads\Gmer-19357.exe[5016] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 0000000075dfeba5 5 bytes JMP 00000001646e11a9
.text C:\Users\bernie\Downloads\Gmer-19357.exe[5016] C:\Windows\syswow64\USER32.dll!CreateWindowExW 00000000756c8a29 5 bytes JMP 00000001646e1046
.text C:\Users\bernie\Downloads\Gmer-19357.exe[5016] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 00000000756d4572 5 bytes JMP 00000001646e10c8
.text C:\Users\bernie\Downloads\Gmer-19357.exe[5016] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 00000000756ee567 5 bytes JMP 00000001646e1433
.text C:\Users\bernie\Downloads\Gmer-19357.exe[5016] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000075727a5c 5 bytes JMP 00000001646e15f0
.text C:\Users\bernie\Downloads\Gmer-19357.exe[5016] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000075af5ea5 5 bytes JMP 00000001646e1618
.text C:\Users\bernie\Downloads\Gmer-19357.exe[5016] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000075b29d0b 5 bytes JMP 00000001646e123f
---- Processes - GMER 2.1 ----
Process C:\Users\bernie\AppData\Roaming\SanDisk\Sansa Updater\SansaDispatch.exe (*** suspicious ***) @ C:\Users\bernie\AppData\Roaming\SanDisk\Sansa Updater\SansaDispatch.exe [3960] (Sansa Dispatcher/SanDisk Corporation)(2012-04-13 09:28:17) 0000000000400000
Library C:\Users\bernie\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll (*** suspicious ***) @ C:\Users\bernie\AppData\Roaming\Dropbox\bin\Dropbox.exe [4192](2014-07-30 00:20:20) 0000000004200000
Library c:\users\bernie\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpduho6q.dll (*** suspicious ***) @ C:\Users\bernie\AppData\Roaming\Dropbox\bin\Dropbox.exe [4192](2014-09-13 07:20:01) 00000000040e0000
Library C:\Users\bernie\AppData\Roaming\Dropbox\bin\libcef.dll (*** suspicious ***) @ C:\Users\bernie\AppData\Roaming\Dropbox\bin\Dropbox.exe [4192](2013-08-23 19:01:44) 00000000611a0000
Library C:\Users\bernie\AppData\Roaming\Dropbox\bin\icudt.dll (*** suspicious ***) @ C:\Users\bernie\AppData\Roaming\Dropbox\bin\Dropbox.exe [4192] (ICU Data DLL/The ICU Project)(2013-08-23 19:01:42) 0000000060450000
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001bb115d31b
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001bb1d33403
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\e0ca943fe78b
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\e0ca943fe78b@d8b377049b99 0x81 0x93 0xC7 0x26 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\e0ca943fe78b@d8b37704db22 0x02 0x3B 0x52 0xB0 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001bb115d31b (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001bb1d33403 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\e0ca943fe78b (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\e0ca943fe78b@d8b377049b99 0x81 0x93 0xC7 0x26 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\e0ca943fe78b@d8b37704db22 0x02 0x3B 0x52 0xB0 ...
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=3f7ca94294c72c48b6113ddd7b5d98f1
# engine=19915
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-08-30 10:54:18
# local_time=2014-08-30 12:54:18 (+0100, Mitteleuropäische Sommerzeit)
# country="Switzerland"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 46189 153898832 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 57184 161025908 0 0
# scanned=276287
# found=52
# cleaned=0
# scan_time=7294
sh=8992F72873D09212597E582A16F8D9BC60E6A22A ft=1 fh=e21391a34e842ffc vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\DVDVideoSoft\TB\ConduitInstaller.exe.vir"
sh=0BC47DE01BA10961EE0D7D6C95A9916DA748A5C7 ft=1 fh=39158cfce6f871c9 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe.vir"
sh=68BF1E0437E11832B4DC5E9923DCA5FFB92914AC ft=1 fh=fe3fcc60a0369b2a vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\SPTool.dll.vir"
sh=74ADF35C3A3456993B5D72F70AE1EDEB28987C80 ft=1 fh=90d7e36e3b85c7e4 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\uninstall.exe.vir"
sh=4929EB5864840E7F5A0ACA7FA5723D703F4B5E73 ft=1 fh=ce188f0b56e64136 vn="Variante von Win32/Conduit.SearchProtect.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe.vir"
sh=C1C4A9783C1F509E37A328A0C16F556C2F8DDFA2 ft=1 fh=afa1bf8c8fc4ffe1 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPTool64.exe.vir"
sh=8A0819C25BB2568FF451BED451955B4E69E724D7 ft=1 fh=7bc6a5dd57c41934 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32.dll.vir"
sh=53BD46E5463C07C3BBDFD087401F2E08A08688A3 ft=1 fh=d7610d97dff53ad1 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll.vir"
sh=D0A19C8A6E8262E5A49AD278DB110F8521CA6BD9 ft=1 fh=b7d04a9494a7c178 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64.dll.vir"
sh=01E8A066B023DAACD6FE9CBC35372A56BE6EC5B1 ft=1 fh=832dcd421f4cfd2d vn="Variante von Win64/Conduit.SearchProtect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll.vir"
sh=FB7948E63D42672E50D4A521CDB6DBACD615D773 ft=1 fh=fc81cec60cf9c6da vn="Variante von Win32/Conduit.SearchProtect.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe.vir"
sh=16068B8977B4DC562AE782D91BC009472667E331 ft=1 fh=c3b5a87b7d152749 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\bernie\AppData\Local\Temp\OCS\ocs_v71a.exe.vir"
sh=31CE21FE36C11E107A6E315EFE1875743809B4CC ft=1 fh=48abcfa6ce4a4014 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\bernie\AppData\Local\Temp\OCS\ocs_v71b.exe.vir"
sh=A15C9536148CE02615132AE1DB1A6BF8F873A726 ft=1 fh=41c25fe63c7f6257 vn="Win32/Toolbar.Conduit.R evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\bernie\AppData\Roaming\OpenCandy\7E340BC032964A51AF4D6F34ADC3926E\search_protect_global.exe.vir"
sh=9E77E1D2FD7B77B0FD8A71A70C35DD5A16836CF3 ft=1 fh=b241df9fafd25e77 vn="Win32/Systweak.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\bernie\AppData\Roaming\Systweak\ssd\SSDPTstub.exe.vir"
sh=C5AA96F17ED2B68CA4C839EA7394F4534B4F5C3F ft=1 fh=57a85fb4fd4bc01c vn="Variante von Win64/Systweak.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\System32\roboot64.exe.vir"
sh=3B29C36CCB0FD00A0812896E61D3AE6CE18E5EEE ft=1 fh=5ce1e22016c2ce7d vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1EBKHZZY\spstub[1].exe"
sh=F94104F2D991A9E5D015EB923AFCDA375CEE1CCE ft=1 fh=f5a775242e081da4 vn="Win32/Toolbar.Conduit.U evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7OSZCM0J\sp-downloader[1].exe"
sh=CEFE0A678B49D72BDCC996F79CF2DB0B95FEF6B1 ft=1 fh=9d7011981dcd65ae vn="Win32/SpeedUpMyPC evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7OSZCM0J\SpeedUpMyPC-standalone-setup[1].exe"
sh=A45F3906F9738DDE4B8A1B9710B5299F1910A1C1 ft=1 fh=6e0be9ea4b96459a vn="Win32/SpeedUpMyPC.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FXWWPLIZ\speedupmypc[1].exe"
sh=FEC19241949864DE766A2D193BC81E3366E379E4 ft=1 fh=ac6e9bcd558de938 vn="Win32/Conduit.SearchProtect.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FXWWPLIZ\SPSetup[1].exe"
sh=0FFBBBFC9857649822BC4ADF08BF4697B8B85D33 ft=1 fh=6d1ecaf81c317ba8 vn="Variante von Win32/TrojanDownloader.Agent.ALF Trojaner" ac=I fn="C:\Users\bernie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T6IOV97F\scstmp[2].exe"
sh=063BCA5022A1D489D0237CEE68441868E128E707 ft=1 fh=9eefb7e9fe25901a vn="Variante von Win32/Toolbar.Babylon.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Temp\addit20.EXE"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Temp\nsa949B.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Temp\nsaCC64.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Temp\nsf9075.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Temp\nsqC34E.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Temp\nsqC745.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Temp\nsv9A95.exe"
sh=C4420C6E94B8CAACCB3811384280D8A93CB0A37D ft=1 fh=25f111c507a31a21 vn="Win32/Toolbar.Conduit.R evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Temp\sp-downloader.exe"
sh=953D44F4BF59B02BE6E35587DAF60E63463E78C3 ft=1 fh=a83bfe4d2b644d64 vn="Variante von Win32/Toolbar.Babylon.H evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Temp\9B4D979D-BAB0-7891-8BDC-EF907F113DD9\Setup.exe"
sh=CEFE0A678B49D72BDCC996F79CF2DB0B95FEF6B1 ft=1 fh=9d7011981dcd65ae vn="Win32/SpeedUpMyPC evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Temp\is-QKK75.tmp\SpeedUpMyPC-standalone-setup.exe"
sh=C7241007662586F5DE3A9F9927CFBD9D52A52AC9 ft=1 fh=a7692001af61d921 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Temp\nsv747C\SpSetup.exe"
sh=99F97AD369E8621AB4D17DF53E80E60FEE99C727 ft=1 fh=42567613b862d846 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Temp\OCS\ocs_v71b.exe"
sh=7AE9F4A5943569504C24D1043551115688387E73 ft=1 fh=81fa830a32c99e11 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\Downloads\7 Zip 32 Bit - CHIP-Downloader.exe"
sh=E1476812A4BD414F53416C93AF14D22BFEFBFF7D ft=1 fh=e6a33b27fb0ee099 vn="Variante von Win32/Toolbar.Babylon.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\Downloads\Babylon9_setup.exe"
sh=FF42995D8E24E05FF9EBA12DCB27B9AAB183A290 ft=1 fh=605214e765268a80 vn="Variante von Win32/Toolbar.Conduit.AI evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\Downloads\FreeYouTubeToMP3Converter31011.exe"
sh=0EE947E611E936E7EC88C1B521B27D07FC423B75 ft=1 fh=a54b09b9b27a9c95 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\Downloads\Samsung Channel List PC Editor - CHIP-Installer.exe"
sh=9D5B7F6FF554136FDC44EBC640FF6DD93F5D4030 ft=1 fh=17a582e231c0604a vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\Downloads\youtube2mp3-1.2.4 - CHIP-Downloader.exe"
sh=66023B99067DCD391F9FDC797F7F20812D5403AD ft=1 fh=3dc61c98ed8d0974 vn="Variante von Generik.LMYDTZQ Trojaner" ac=I fn="D:\Backup11\Downloads\kazaa\kazaa_lite.exe"
sh=A4A3F88F6E8AC0FB9F3370E7666FEF74CF583029 ft=1 fh=f2201697f19ea9bb vn="Variante von Win32/Adware.Kazaa.A Anwendung" ac=I fn="D:\Backup11\Downloads\kazaa\kmd.exe"
sh=03A7D97387FBF9BAC969A591B68A8EDC2D493417 ft=1 fh=02850d967aa2d2ec vn="Variante von Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="D:\Backup11\Downloads\regi\asc-setup.exe"
sh=0152FB975FDBEA6FFA27BB8038FBA0DBC983EF3F ft=1 fh=d957d30811d3851e vn="Win32/RegistryBooster evtl. unerwünschte Anwendung" ac=I fn="D:\Backup11\Downloads\regi\registrybooster.exe"
sh=D931ACFEC77DB89FF56A2E8EE89C7941F8B8E82E ft=1 fh=3fb4448e9a99ad06 vn="Win32/RegistryBooster evtl. unerwünschte Anwendung" ac=I fn="D:\Backup11\Downloads\regi\registrybooster2011.exe"
sh=D201EB86D971A3C87B474D8811F0FDD595DA92CF ft=0 fh=0000000000000000 vn="Variante von Win32/Dialer.StarDialer Anwendung" ac=I fn="D:\Backup11\Downloads\serials\s2k.serials2k7.1.zip"
sh=FA2B3944279DF512591C4912182F924DB6618BA0 ft=0 fh=0000000000000000 vn="Variante von Win32/Dialer.StarDialer Anwendung" ac=I fn="D:\Backup11\Downloads\serials\update\dtg.010103.full.zip"
sh=6EDDB2EB783CFCB3BDC20E9799CD0BB014FD9040 ft=0 fh=0000000000000000 vn="Variante von Win32/Dialer.StarDialer Anwendung" ac=I fn="D:\Backup11\Downloads\serials\update\fms.2003-04-15.full.zip"
sh=48E2C976ECD217B68CA91EBCCD89CD0146BE3699 ft=1 fh=5d265ee2fd010414 vn="Mehrere Bedrohungen" ac=I fn="D:\Backup11\Tools\Tools\Freeware\regetjr.exe"
sh=EF2249272FFA5746D60EFD6373D139A8DA874E7D ft=1 fh=d1d07989e880c5cc vn="Mehrere Bedrohungen" ac=I fn="D:\Backup11\Tools\Tools\iMeshV3\iMeshV3.exe"
sh=9193581E2E18DBBBF4F63A11BB35EAC644B99706 ft=1 fh=c192647f90f20529 vn="möglicherweise Variante von Win32/Adware.WurldMedia Anwendung" ac=I fn="D:\Backup11\Tools\Tools\morpheus\installm19.exe"
sh=23095DE6FFA0C14E2E2C6881A4EAEF7FE414C6BF ft=1 fh=c71c00118ba24104 vn="Variante von Win32/InstallCore.OF evtl. unerwünschte Anwendung" ac=I fn="D:\Downloads\Garmin\garmin-lifetime-updater-2.exe"
sh=9731CDE471BFED17B474F7A099E8CF8CFB7781C4 ft=1 fh=d37785297e6be4db vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="D:\Downloads\navigon\Navigon Fresh - CHIP-Downloader.exe"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=3085503e3d7ace408ef4b3a45dda7f29
# engine=19915
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-08-30 01:57:50
# local_time=2014-08-30 03:57:50 (+0100, Mitteleuropäische Sommerzeit)
# country="Switzerland"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777214 100 100 8921 153909844 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 7943 161036920 0 0
# scanned=272878
# found=52
# cleaned=52
# scan_time=7652
sh=8992F72873D09212597E582A16F8D9BC60E6A22A ft=1 fh=e21391a34e842ffc vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\DVDVideoSoft\TB\ConduitInstaller.exe.vir"
sh=0BC47DE01BA10961EE0D7D6C95A9916DA748A5C7 ft=1 fh=39158cfce6f871c9 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe.vir"
sh=68BF1E0437E11832B4DC5E9923DCA5FFB92914AC ft=1 fh=fe3fcc60a0369b2a vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\SPTool.dll.vir"
sh=74ADF35C3A3456993B5D72F70AE1EDEB28987C80 ft=1 fh=90d7e36e3b85c7e4 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\uninstall.exe.vir"
sh=4929EB5864840E7F5A0ACA7FA5723D703F4B5E73 ft=1 fh=ce188f0b56e64136 vn="Variante von Win32/Conduit.SearchProtect.I evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe.vir"
sh=C1C4A9783C1F509E37A328A0C16F556C2F8DDFA2 ft=1 fh=afa1bf8c8fc4ffe1 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPTool64.exe.vir"
sh=8A0819C25BB2568FF451BED451955B4E69E724D7 ft=1 fh=7bc6a5dd57c41934 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32.dll.vir"
sh=53BD46E5463C07C3BBDFD087401F2E08A08688A3 ft=1 fh=d7610d97dff53ad1 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll.vir"
sh=D0A19C8A6E8262E5A49AD278DB110F8521CA6BD9 ft=1 fh=b7d04a9494a7c178 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64.dll.vir"
sh=01E8A066B023DAACD6FE9CBC35372A56BE6EC5B1 ft=1 fh=832dcd421f4cfd2d vn="Variante von Win64/Conduit.SearchProtect.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll.vir"
sh=FB7948E63D42672E50D4A521CDB6DBACD615D773 ft=1 fh=fc81cec60cf9c6da vn="Variante von Win32/Conduit.SearchProtect.I evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe.vir"
sh=16068B8977B4DC562AE782D91BC009472667E331 ft=1 fh=c3b5a87b7d152749 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\bernie\AppData\Local\Temp\OCS\ocs_v71a.exe.vir"
sh=99F97AD369E8621AB4D17DF53E80E60FEE99C727 ft=1 fh=42567613b862d846 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\bernie\AppData\Local\Temp\OCS\ocs_v71b.exe.vir"
sh=A15C9536148CE02615132AE1DB1A6BF8F873A726 ft=1 fh=41c25fe63c7f6257 vn="Win32/Toolbar.Conduit.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\bernie\AppData\Roaming\OpenCandy\7E340BC032964A51AF4D6F34ADC3926E\search_protect_global.exe.vir"
sh=9E77E1D2FD7B77B0FD8A71A70C35DD5A16836CF3 ft=1 fh=b241df9fafd25e77 vn="Win32/Systweak.G evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\bernie\AppData\Roaming\Systweak\ssd\SSDPTstub.exe.vir"
sh=C5AA96F17ED2B68CA4C839EA7394F4534B4F5C3F ft=1 fh=57a85fb4fd4bc01c vn="Variante von Win64/Systweak.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Windows\System32\roboot64.exe.vir"
sh=3B29C36CCB0FD00A0812896E61D3AE6CE18E5EEE ft=1 fh=5ce1e22016c2ce7d vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1EBKHZZY\spstub[1].exe"
sh=F94104F2D991A9E5D015EB923AFCDA375CEE1CCE ft=1 fh=f5a775242e081da4 vn="Win32/Toolbar.Conduit.U evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7OSZCM0J\sp-downloader[1].exe"
sh=CEFE0A678B49D72BDCC996F79CF2DB0B95FEF6B1 ft=1 fh=9d7011981dcd65ae vn="Win32/SpeedUpMyPC evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7OSZCM0J\SpeedUpMyPC-standalone-setup[1].exe"
sh=A45F3906F9738DDE4B8A1B9710B5299F1910A1C1 ft=1 fh=6e0be9ea4b96459a vn="Win32/SpeedUpMyPC.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FXWWPLIZ\speedupmypc[1].exe"
sh=FEC19241949864DE766A2D193BC81E3366E379E4 ft=1 fh=ac6e9bcd558de938 vn="Win32/Conduit.SearchProtect.Q evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FXWWPLIZ\SPSetup[1].exe"
sh=0FFBBBFC9857649822BC4ADF08BF4697B8B85D33 ft=1 fh=6d1ecaf81c317ba8 vn="Variante von Win32/TrojanDownloader.Agent.ALF Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T6IOV97F\scstmp[2].exe"
sh=063BCA5022A1D489D0237CEE68441868E128E707 ft=1 fh=9eefb7e9fe25901a vn="Variante von Win32/Toolbar.Babylon.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Temp\addit20.EXE"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Temp\nsa949B.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Temp\nsaCC64.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Temp\nsf9075.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Temp\nsqC34E.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Temp\nsqC745.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Temp\nsv9A95.exe"
sh=C4420C6E94B8CAACCB3811384280D8A93CB0A37D ft=1 fh=25f111c507a31a21 vn="Win32/Toolbar.Conduit.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Temp\sp-downloader.exe"
sh=953D44F4BF59B02BE6E35587DAF60E63463E78C3 ft=1 fh=a83bfe4d2b644d64 vn="Variante von Win32/Toolbar.Babylon.H evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Temp\9B4D979D-BAB0-7891-8BDC-EF907F113DD9\Setup.exe"
sh=CEFE0A678B49D72BDCC996F79CF2DB0B95FEF6B1 ft=1 fh=9d7011981dcd65ae vn="Win32/SpeedUpMyPC evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Temp\is-QKK75.tmp\SpeedUpMyPC-standalone-setup.exe"
sh=C7241007662586F5DE3A9F9927CFBD9D52A52AC9 ft=1 fh=a7692001af61d921 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Temp\nsv747C\SpSetup.exe"
sh=99F97AD369E8621AB4D17DF53E80E60FEE99C727 ft=1 fh=42567613b862d846 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Temp\OCS\ocs_v71b.exe"
sh=7AE9F4A5943569504C24D1043551115688387E73 ft=1 fh=81fa830a32c99e11 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\Downloads\7 Zip 32 Bit - CHIP-Downloader.exe"
sh=E1476812A4BD414F53416C93AF14D22BFEFBFF7D ft=1 fh=e6a33b27fb0ee099 vn="Variante von Win32/Toolbar.Babylon.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\Downloads\Babylon9_setup.exe"
sh=FF42995D8E24E05FF9EBA12DCB27B9AAB183A290 ft=1 fh=605214e765268a80 vn="Variante von Win32/Toolbar.Conduit.AI evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\Downloads\FreeYouTubeToMP3Converter31011.exe"
sh=0EE947E611E936E7EC88C1B521B27D07FC423B75 ft=1 fh=a54b09b9b27a9c95 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\Downloads\Samsung Channel List PC Editor - CHIP-Installer.exe"
sh=9D5B7F6FF554136FDC44EBC640FF6DD93F5D4030 ft=1 fh=17a582e231c0604a vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\Downloads\youtube2mp3-1.2.4 - CHIP-Downloader.exe"
sh=66023B99067DCD391F9FDC797F7F20812D5403AD ft=1 fh=3dc61c98ed8d0974 vn="Variante von Generik.LMYDTZQ Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="D:\Backup11\Downloads\kazaa\kazaa_lite.exe"
sh=A4A3F88F6E8AC0FB9F3370E7666FEF74CF583029 ft=1 fh=f2201697f19ea9bb vn="Variante von Win32/Adware.Kazaa.A Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="D:\Backup11\Downloads\kazaa\kmd.exe"
sh=03A7D97387FBF9BAC969A591B68A8EDC2D493417 ft=1 fh=02850d967aa2d2ec vn="Variante von Win32/Toolbar.Widgi evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="D:\Backup11\Downloads\regi\asc-setup.exe"
sh=0152FB975FDBEA6FFA27BB8038FBA0DBC983EF3F ft=1 fh=d957d30811d3851e vn="Win32/RegistryBooster evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="D:\Backup11\Downloads\regi\registrybooster.exe"
sh=D931ACFEC77DB89FF56A2E8EE89C7941F8B8E82E ft=1 fh=3fb4448e9a99ad06 vn="Win32/RegistryBooster evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="D:\Backup11\Downloads\regi\registrybooster2011.exe"
sh=D201EB86D971A3C87B474D8811F0FDD595DA92CF ft=0 fh=0000000000000000 vn="Variante von Win32/Dialer.StarDialer Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="D:\Backup11\Downloads\serials\s2k.serials2k7.1.zip"
sh=FA2B3944279DF512591C4912182F924DB6618BA0 ft=0 fh=0000000000000000 vn="Variante von Win32/Dialer.StarDialer Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="D:\Backup11\Downloads\serials\update\dtg.010103.full.zip"
sh=6EDDB2EB783CFCB3BDC20E9799CD0BB014FD9040 ft=0 fh=0000000000000000 vn="Variante von Win32/Dialer.StarDialer Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="D:\Backup11\Downloads\serials\update\fms.2003-04-15.full.zip"
sh=48E2C976ECD217B68CA91EBCCD89CD0146BE3699 ft=1 fh=5d265ee2fd010414 vn="Mehrere Bedrohungen (gelöscht - in Quarantäne kopiert)" ac=C fn="D:\Backup11\Tools\Tools\Freeware\regetjr.exe"
sh=EF2249272FFA5746D60EFD6373D139A8DA874E7D ft=1 fh=d1d07989e880c5cc vn="Mehrere Bedrohungen (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="D:\Backup11\Tools\Tools\iMeshV3\iMeshV3.exe"
sh=9193581E2E18DBBBF4F63A11BB35EAC644B99706 ft=1 fh=c192647f90f20529 vn="möglicherweise Variante von Win32/Adware.WurldMedia Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="D:\Backup11\Tools\Tools\morpheus\installm19.exe"
sh=23095DE6FFA0C14E2E2C6881A4EAEF7FE414C6BF ft=1 fh=c71c00118ba24104 vn="Variante von Win32/InstallCore.OF evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="D:\Downloads\Garmin\garmin-lifetime-updater-2.exe"
sh=9731CDE471BFED17B474F7A099E8CF8CFB7781C4 ft=1 fh=d37785297e6be4db vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="D:\Downloads\navigon\Navigon Fresh - CHIP-Downloader.exe"
Code:
ATTFilter Exportierte Ereignisse:
02.09.2014 08:57 [System-Scanner] Malware gefunden
Die Datei 'C:\Program Files (x86)\ver1BlockAndSurf\178.dll'
enthielt einen Virus oder unerwünschtes Programm 'TR/Zusy.103904.102' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '51ddf90b.qua'
verschoben!
Der Registrierungseintrag
<HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser
Helper Objects\{D28762C9-5216-DCF6-0533-92D2343D2A15}> wurde erfolgreich
repariert.
02.09.2014 08:54 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Program Files (x86)\ver1BlockAndSurf\178.dll'
wurde ein Virus oder unerwünschtes Programm 'TR/Zusy.103904.102' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
|
|
13.09.2014, 12:42
| #4 |
| /// TB-Ausbilder | Chrome und Firefox öffnen ständig Werbeseiten,Malwarebytes funktionioniert nicht mehr,auch nicht mit Chameleon Servus, meinen 1. Post beachten und mit ComboFix beginnen bitte. |
|
13.09.2014, 14:19
| #5 |
| | Chrome und Firefox öffnen ständig Werbeseiten,Malwarebytes funktionioniert nicht mehr,auch nicht mit Chameleon Hallo M-K-D-B Danke für deine schnelle Reaktion und Hilfe. Combofix ist jetzt durchgelaufen und hier die Log Datei angefügt: Code:
ATTFilter ComboFix 14-09-12.01 - bernie 13.09.2014 13:48:14.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.41.1031.18.6058.3612 [GMT 2:00]
ausgeführt von:: c:\users\bernie\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\bernie\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
c:\windows\SysWow64\win.ini
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-08-13 bis 2014-09-13 ))))))))))))))))))))))))))))))
.
.
2014-09-13 11:59 . 2014-09-13 11:59 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-09-13 11:59 . 2014-09-13 11:59 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2014-09-13 11:59 . 2014-09-13 11:59 -------- d-----w- c:\users\Besucher\AppData\Local\temp
2014-09-11 22:41 . 2014-08-18 20:45 360448 ----a-w- c:\program files\Internet Explorer\IEShims.dll
2014-09-11 22:41 . 2014-08-18 20:41 259584 ----a-w- c:\program files (x86)\Internet Explorer\IEShims.dll
2014-09-11 22:41 . 2014-08-18 22:06 222720 ----a-w- c:\program files\Internet Explorer\ielowutil.exe
2014-09-11 22:41 . 2014-08-18 22:05 596480 ----a-w- c:\windows\system32\ieui.dll
2014-09-11 22:41 . 2014-08-18 21:38 222720 ----a-w- c:\program files (x86)\Internet Explorer\ielowutil.exe
2014-09-11 22:41 . 2014-08-18 21:17 470016 ----a-w- c:\program files (x86)\Internet Explorer\ieinstal.exe
2014-09-11 22:27 . 2014-06-27 02:08 2777088 ----a-w- c:\windows\system32\msmpeg2vdec.dll
2014-09-11 22:27 . 2014-06-27 01:45 2285056 ----a-w- c:\windows\SysWow64\msmpeg2vdec.dll
2014-09-11 13:35 . 2014-08-01 11:53 1031168 ----a-w- c:\windows\system32\TSWorkspace.dll
2014-09-11 13:35 . 2014-08-01 11:35 793600 ----a-w- c:\windows\SysWow64\TSWorkspace.dll
2014-09-11 13:35 . 2014-06-24 03:29 2565120 ----a-w- c:\windows\system32\d3d10warp.dll
2014-09-11 13:35 . 2014-06-24 02:59 1987584 ----a-w- c:\windows\SysWow64\d3d10warp.dll
2014-09-11 13:35 . 2014-07-07 02:06 728064 ----a-w- c:\windows\system32\kerberos.dll
2014-09-11 13:35 . 2014-07-07 01:40 550912 ----a-w- c:\windows\SysWow64\kerberos.dll
2014-09-11 13:35 . 2014-07-07 02:06 1460736 ----a-w- c:\windows\system32\lsasrv.dll
2014-09-11 13:35 . 2014-07-07 01:40 22016 ----a-w- c:\windows\SysWow64\secur32.dll
2014-09-11 13:35 . 2014-07-07 01:39 96768 ----a-w- c:\windows\SysWow64\sspicli.dll
2014-09-11 13:34 . 2014-09-05 02:10 578048 ----a-w- c:\windows\system32\aepdu.dll
2014-09-11 13:34 . 2014-09-05 02:05 424448 ----a-w- c:\windows\system32\aeinv.dll
2014-09-01 16:10 . 2014-09-06 16:41 -------- d-----w- c:\users\bernie\AppData\Roaming\MyPhoneExplorer
2014-09-01 16:09 . 2014-09-01 16:09 -------- d-----w- c:\program files (x86)\MyPhoneExplorer
2014-09-01 16:09 . 2014-09-01 16:09 58040 ----a-w- c:\windows\system32\drivers\webinstr.sys
2014-09-01 16:09 . 2014-09-02 06:57 -------- d-----w- c:\program files (x86)\ver1BlockAndSurf
2014-09-01 15:37 . 2014-09-01 15:37 -------- d-----w- c:\users\bernie\My Online Documents
2014-09-01 15:19 . 2014-09-01 15:19 -------- d-----w- c:\users\bernie\AppData\Local\Seagate_Technology_LLC
2014-09-01 10:12 . 2014-09-01 10:12 -------- d-----w- c:\users\bernie\AppData\Roaming\Nero
2014-09-01 10:10 . 2014-09-01 10:10 -------- d-----w- c:\program files (x86)\Common Files\Nero
2014-09-01 10:09 . 2014-09-01 10:09 -------- d-----w- c:\programdata\Nero
2014-09-01 10:09 . 2014-09-01 10:09 -------- d-----w- c:\program files (x86)\Seagate
2014-09-01 10:05 . 2014-09-01 10:05 -------- d-----w- c:\programdata\Seagate
2014-09-01 10:05 . 2014-09-01 10:05 -------- d-----w- c:\users\bernie\AppData\Roaming\Seagate
2014-09-01 10:00 . 2014-09-01 10:00 -------- d-----w- c:\users\bernie\AppData\Roaming\Leadertech
2014-09-01 07:33 . 2014-09-13 11:28 -------- d-----w- C:\FRST
2014-08-31 15:37 . 2014-08-23 00:59 3163648 ----a-w- c:\windows\system32\win32k.sys
2014-08-31 15:37 . 2014-08-23 02:07 404480 ----a-w- c:\windows\system32\gdi32.dll
2014-08-31 15:37 . 2014-08-23 01:45 311808 ----a-w- c:\windows\SysWow64\gdi32.dll
2014-08-31 08:47 . 2014-08-31 15:15 -------- d-----w- c:\users\Besucher\AppData\Roaming\uTorrent
2014-08-31 08:46 . 2014-08-31 08:46 -------- d-----w- c:\users\Besucher\AppData\Roaming\Malwarebytes
2014-08-30 14:33 . 2014-08-30 15:07 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2014-08-30 14:33 . 2014-08-31 15:15 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy 2
2014-08-30 14:09 . 2014-08-30 14:09 -------- d-sh--w- c:\users\bernie\AppData\Local\EmieUserList
2014-08-30 14:09 . 2014-08-30 14:09 -------- d-sh--w- c:\users\bernie\AppData\Local\EmieSiteList
2014-08-30 12:00 . 2014-08-30 12:00 -------- d-----w- c:\programdata\NCH Software
2014-08-30 08:49 . 2014-08-30 08:49 -------- d-----w- c:\program files (x86)\ESET
2014-08-22 04:19 . 2014-08-22 04:19 -------- d-----w- c:\users\bernie\AppData\Local\Adobe
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-09-11 22:29 . 2011-09-12 10:24 101694776 ----a-w- c:\windows\system32\MRT.exe
2014-09-11 14:40 . 2012-03-31 06:11 701104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-09-11 14:40 . 2011-09-08 18:34 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-08-31 15:29 . 2010-06-24 02:33 23256 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2014-08-21 09:24 . 2014-09-12 07:31 11319192 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{0B9873BA-DB16-4EFE-B999-A4030C2B8A67}\mpengine.dll
2014-08-09 21:47 . 2014-08-09 21:47 98216 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-08-05 07:20 . 2011-09-08 10:41 270496 ------w- c:\windows\system32\MpSigStub.exe
2014-07-25 00:35 . 2014-07-25 00:35 875688 ----a-w- c:\windows\SysWow64\msvcr120_clr0400.dll
2014-07-24 21:47 . 2014-07-24 21:47 869544 ----a-w- c:\windows\system32\msvcr120_clr0400.dll
2014-07-16 03:23 . 2014-08-13 10:19 2048 ----a-w- c:\windows\system32\tzres.dll
2014-07-16 02:46 . 2014-08-13 10:19 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2014-07-14 02:02 . 2014-08-13 10:19 1216000 ----a-w- c:\windows\system32\rpcrt4.dll
2014-07-14 01:40 . 2014-08-13 10:19 664064 ----a-w- c:\windows\SysWow64\rpcrt4.dll
2014-07-09 02:03 . 2014-08-13 10:19 7168 ----a-w- c:\windows\system32\KBDTAT.DLL
2014-07-09 02:03 . 2014-08-13 10:19 7168 ----a-w- c:\windows\system32\KBDRU1.DLL
2014-07-09 02:03 . 2014-08-13 10:19 6656 ----a-w- c:\windows\system32\KBDRU.DLL
2014-07-09 02:03 . 2014-08-13 10:19 7168 ----a-w- c:\windows\system32\KBDYAK.DLL
2014-07-09 02:03 . 2014-08-13 10:19 7168 ----a-w- c:\windows\system32\KBDBASH.DLL
2014-07-09 01:31 . 2014-08-13 10:19 7168 ----a-w- c:\windows\SysWow64\KBDYAK.DLL
2014-07-09 01:31 . 2014-08-13 10:19 6656 ----a-w- c:\windows\SysWow64\KBDBASH.DLL
2014-07-08 10:04 . 2013-05-06 10:18 42040 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2014-06-30 22:24 . 2014-08-13 10:50 8856 ----a-w- c:\windows\system32\icardres.dll
2014-06-30 22:14 . 2014-08-13 10:50 8856 ----a-w- c:\windows\SysWow64\icardres.dll
2014-06-25 02:05 . 2014-08-13 10:19 14175744 ----a-w- c:\windows\system32\shell32.dll
2014-06-24 10:14 . 2013-03-20 11:20 117712 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2014-06-18 02:18 . 2014-07-09 04:12 692736 ----a-w- c:\windows\system32\osk.exe
2014-06-18 01:51 . 2014-07-09 04:12 646144 ----a-w- c:\windows\SysWow64\osk.exe
2014-06-16 02:10 . 2014-08-13 10:19 985536 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 131480 ----a-w- c:\users\bernie\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 131480 ----a-w- c:\users\bernie\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 131480 ----a-w- c:\users\bernie\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"gStart"="c:\garmin\gStart.exe" [2008-08-13 1891416]
"SansaDispatch"="c:\users\bernie\AppData\Roaming\SanDisk\Sansa Updater\SansaDispatch.exe" [2013-03-16 613888]
"UBSShell"="c:\program files (x86)\UBS e-banking\UBS Shell\UBSShell.exe" [2012-03-14 315392]
"GarminExpressTrayApp"="c:\program files (x86)\Garmin\Express Tray\ExpressTray.exe" [2014-08-07 688984]
"Uploader"="c:\program files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe" [2014-04-30 126056]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"MMReminderService"="c:\program files (x86)\Mindjet\MindManager 10\MMReminderService.exe" [2011-09-14 37728]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-08-05 751184]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-07-25 256896]
"DBAgent"="c:\program files (x86)\Seagate\Seagate Dashboard 2.0\DBAgent.exe" [2014-04-30 1519176]
"Avira Systray"="c:\program files (x86)\Avira\My Avira\Avira.OE.Systray.exe" [2014-08-27 164656]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"GarminExpressTrayApp"="c:\program files (x86)\Garmin\Express Tray\ExpressTray.exe" [2014-08-07 688984]
.
c:\users\bernie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\bernie\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-7-30 36414496]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2011-1-13 1138464]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.8.150\SSScheduler.exe [2014-4-9 332016]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [x]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys;c:\windows\SYSNATIVE\DRIVERS\ggflt.sys [x]
R3 HTCAND64;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys;c:\windows\SYSNATIVE\Drivers\ANDROIDUSB.sys [x]
R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys;c:\windows\SYSNATIVE\DRIVERS\htcnprot.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.8.150\McCHSvc.exe;c:\program files\McAfee Security Scan\3.8.150\McCHSvc.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 Samsung UPD Service;Samsung UPD Service;c:\windows\System32\SUPDSvc.exe;c:\windows\SYSNATIVE\SUPDSvc.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe;c:\program files\Intel\TurboBoost\TurboBoost.exe [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys;c:\windows\SYSNATIVE\Drivers\SABI.sys [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [x]
S2 Garmin Core Update Service;Garmin Core Update Service;c:\program files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe;c:\program files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [x]
S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]
S2 PassThru Service;Internet Pass-Through Service;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [x]
S2 Seagate Dashboard Services;Seagate Dashboard Services;c:\program files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe;c:\program files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe [x]
S2 Seagate MobileBackup Service;Seagate MobileBackup Service;c:\program files (x86)\Seagate\Seagate Dashboard 2.0\MobileService.exe;c:\program files (x86)\Seagate\Seagate Dashboard 2.0\MobileService.exe [x]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys;c:\windows\SYSNATIVE\DRIVERS\TurboB.sys [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 webinstr;webinstr;c:\windows\system32\Drivers\webinstr.sys;c:\windows\SYSNATIVE\Drivers\webinstr.sys [x]
S3 BTWAMPFL;BTWAMPFL;c:\windows\system32\DRIVERS\btwampfl.sys;c:\windows\SYSNATIVE\DRIVERS\btwampfl.sys [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys;c:\windows\SYSNATIVE\DRIVERS\dc3d.sys [x]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys;c:\windows\SYSNATIVE\DRIVERS\ETD.sys [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 Point64;Microsoft Mouse and Keyboard Center Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-09-12 17:24 1096520 ----a-w- c:\program files (x86)\Google\Chrome\Application\37.0.2062.120\Installer\chrmstp.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{90EF4A5E-85DB-4825-96F5-1AB93C2A8EEB}]
2011-09-14 12:00 1409 ----a-r- c:\program files (x86)\Mindjet\MindManager 10\sys\MmInternetExplorerActiveSetup.vbs
.
Inhalt des "geplante Tasks" Ordners
.
2014-09-13 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 14:40]
.
2014-09-13 c:\windows\Tasks\BlockAndSurf Update.job
- c:\program files (x86)\ver1BlockAndSurf\D2BlockAndSurfL71.exe [2014-09-01 16:09]
.
2014-09-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-09 14:51]
.
2014-09-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-09 14:51]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D28762C9-5216-DCF6-0533-92D2343D2A15}]
2014-09-01 16:09 212992 ----a-w- c:\program files (x86)\ver1BlockAndSurf\178_x64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 164760 ----a-w- c:\users\bernie\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 164760 ----a-w- c:\users\bernie\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 164760 ----a-w- c:\users\bernie\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 164760 ----a-w- c:\users\bernie\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-01-26 11775592]
"CanonSolutionMenu"="c:\program files (x86)\Canon\SolutionMenu\CNSLMAIN.exe" [2009-09-03 767312]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2010-07-26 2782096]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-02-02 167704]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-02-02 392984]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-02-02 417560]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE:
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Bild an MindManager senden - c:\program files (x86)\Mindjet\MindManager 10\Mm8InternetExplorer.dll/201
IE: Free YouTube to MP3 Converter - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm
IE: Link an MindManager senden - c:\program files (x86)\Mindjet\MindManager 10\Mm8InternetExplorer.dll/203
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Seite an MindManager senden - c:\program files (x86)\Mindjet\MindManager 10\Mm8InternetExplorer.dll/204
IE: Text an MindManager senden - c:\program files (x86)\Mindjet\MindManager 10\Mm8InternetExplorer.dll/202
TCP: DhcpNameServer = 192.168.1.1
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/3.0.1.0/GarminAxControl.CAB
FF - ProfilePath - c:\users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default\
FF - prefs.js: browser.startup.homepage - hxxps://www.google.ch/
FF - user.js: extensions.autoDisableScopes - 0
FF - user.js: extensions.shownSelectionUI - true
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
HKLM-Run-ETDCtrl - c:\program files (x86)\Elantech\ETDCtrl.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_152_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_152_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_152_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_152_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_152.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.15"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_152.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_152.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_152.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\ver1BlockAndSurf\BlockAndSurf.exe
c:\program files (x86)\CyberLink\Shared files\RichVideo.exe
c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE
c:\program files (x86)\CyberLink\YouCam\YCMMirage.exe
c:\program files (x86)\Samsung\Easy Display Manager\WifiManager.exe
c:\program files (x86)\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe
c:\program files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe
c:\program files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe
c:\program files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Samsung\Samsung Update Plus\SUPBackground.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-09-13 14:15:37 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2014-09-13 12:15
.
Vor Suchlauf: 16 Verzeichnis(se), 82'117'017'600 Bytes frei
Nach Suchlauf: 22 Verzeichnis(se), 83'076'009'984 Bytes frei
.
- - End Of File - - FCE11D39FB81F9A8A8042000ED2E46D4
Ich wieder, die Lösung mit dem Combofix war offenbar ein Volltreffer! Werbeseiten sind verschwunden und es öffnen sich auch keine neuen mehr. Malwarebytes konnte ich jetzt deinstallieren, wieder neu installieren und durch laufen lassen. Wie es aussieht ist das System wieder clean. Anbei noch das Log File von Malwarebytes: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 13.09.2014 Suchlauf-Zeit: 14:45:43 Logdatei: Malware.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.09.13.01 Rootkit Datenbank: v2014.09.12.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: bernie Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 429356 Verstrichene Zeit: 19 Min, 42 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 1 PUP.Optional.BlockAndSurf.A, C:\Program Files (x86)\ver1BlockAndSurf\BlockAndSurf.exe, 2920, , [4adba94484f72c0a0e95cc2458aa926e] Module: 0 (No malicious items detected) Registrierungsschlüssel: 11 PUP.Optional.AdLyrics, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\221138F2-3CA6-B697-125C-1D0BF4682582, , [ba6b38b5631855e19fcb252e38c88c74], PUP.Optional.AddLyrics, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WEBINSTR, , [e540db124a31bc7a30ac8f6de81a50b0], PUP.Optional.SearchProtect.A, HKU\S-1-5-21-1309665003-1285200881-1394159564-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Conduit_Search_Protect, , [80a5f0fd710aac8abfdde08538ccf907], PUP.Optional.BlockAndSurf.A, HKU\S-1-5-21-1309665003-1285200881-1394159564-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\BlockAndSurf, , [8d98f2fb5c1fa5911ab519ec38cba45c], PUP.Optional.BlockAndSurf.A, HKLM\SOFTWARE\CLASSES\CLSID\{D28762C9-5216-DCF6-0533-92D2343D2A15}, , [4adba94484f72c0a0e95cc2458aa926e], PUP.Optional.BlockAndSurf.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{8F768E90-EC81-3A43-BB93-F3E5E103F68E}, , [4adba94484f72c0a0e95cc2458aa926e], PUP.Optional.BlockAndSurf.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{76169D65-873B-7432-8B81-380C7DACFBD9}, , [4adba94484f72c0a0e95cc2458aa926e], PUP.Optional.BlockAndSurf.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{76169D65-873B-7432-8B81-380C7DACFBD9}, , [4adba94484f72c0a0e95cc2458aa926e], PUP.Optional.BlockAndSurf.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{8F768E90-EC81-3A43-BB93-F3E5E103F68E}, , [4adba94484f72c0a0e95cc2458aa926e], PUP.Optional.BlockAndSurf.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{D28762C9-5216-DCF6-0533-92D2343D2A15}, , [4adba94484f72c0a0e95cc2458aa926e], PUP.Optional.BlockAndSurf.A, HKLM\SOFTWARE\CLASSES\CLSID\{D28762C9-5216-DCF6-0533-92D2343D2A15}\INPROCSERVER32, , [4adba94484f72c0a0e95cc2458aa926e], Registrierungswerte: 2 PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY|AppPath, C:\Program Files (x86)\Mysearchdial\1.8.29.0\, , [b66fd7166d0eea4c5fcf0e583ec6d52b] PUP.Optional.AddLyrics, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WEBINSTR|DisplayName, webinstr, , [e540db124a31bc7a30ac8f6de81a50b0] Registrierungsdaten: 0 (No malicious items detected) Ordner: 2 PUP.Optional.BlockAndSurf.A, C:\Program Files (x86)\ver1BlockAndSurf, , [4adba94484f72c0a0e95cc2458aa926e], PUP.Optional.BlockAndSurf.A, C:\Program Files (x86)\ver1BlockAndSurf\x64, , [4adba94484f72c0a0e95cc2458aa926e], Dateien: 21 PUP.Optional.AdLyrics, C:\Program Files (x86)\ver1BlockAndSurf\D2BlockAndSurfL71.exe, , [c95c727b4536f93d73f79bb87c84fb05], PUP.Optional.AdLyrics, C:\Program Files (x86)\ver1BlockAndSurf\Uninstall.exe, , [ba6b38b5631855e19fcb252e38c88c74], PUP.Optional.Linkular, C:\Users\bernie\Downloads\combofixsetup.exe, , [28fd85686e0dfc3a96244d2906fe0bf5], PUP.Optional.BlockAndSurf.A, C:\Windows\System32\Tasks\BlockAndSurf Update, , [091c7f6eef8c7bbbcf4b18f6d42f8878], PUP.Optional.Superfish.A, C:\Users\bernie\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage, , [f0354da03a41989e13620810ce3518e8], PUP.Optional.Superfish.A, C:\Users\bernie\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage-journal, , [38edcc217dfed264b8bdea2e34cf1ee2], PUP.Optional.BlockAndSurf.A, C:\Windows\Tasks\BlockAndSurf Update.job, , [cc593ab3166574c2e9a2aa7842c13ec2], PUP.Optional.AddLyrics, C:\Windows\System32\drivers\webinstr.sys, , [e540db124a31bc7a30ac8f6de81a50b0], PUP.Optional.BlockAndSurf.A, C:\Program Files (x86)\ver1BlockAndSurf\178.dat, , [4adba94484f72c0a0e95cc2458aa926e], PUP.Optional.BlockAndSurf.A, C:\Program Files (x86)\ver1BlockAndSurf\178.xpi, , [4adba94484f72c0a0e95cc2458aa926e], PUP.Optional.BlockAndSurf.A, C:\Program Files (x86)\ver1BlockAndSurf\178_x64.dll, , [4adba94484f72c0a0e95cc2458aa926e], PUP.Optional.BlockAndSurf.A, C:\Program Files (x86)\ver1BlockAndSurf\a.db, , [4adba94484f72c0a0e95cc2458aa926e], PUP.Optional.BlockAndSurf.A, C:\Program Files (x86)\ver1BlockAndSurf\b.db, , [4adba94484f72c0a0e95cc2458aa926e], PUP.Optional.BlockAndSurf.A, C:\Program Files (x86)\ver1BlockAndSurf\BlockAndSurf.exe, , [4adba94484f72c0a0e95cc2458aa926e], PUP.Optional.BlockAndSurf.A, C:\Program Files (x86)\ver1BlockAndSurf\D2BlockAndSurfL71.dll, , [4adba94484f72c0a0e95cc2458aa926e], PUP.Optional.BlockAndSurf.A, C:\Program Files (x86)\ver1BlockAndSurf\p1BlockAndSurfoQ178.bin, , [4adba94484f72c0a0e95cc2458aa926e], PUP.Optional.BlockAndSurf.A, C:\Program Files (x86)\ver1BlockAndSurf\Sqlite3.dll, , [4adba94484f72c0a0e95cc2458aa926e], PUP.Optional.BlockAndSurf.A, C:\Program Files (x86)\ver1BlockAndSurf\x64\TandemRunner.exe, , [4adba94484f72c0a0e95cc2458aa926e], PUP.Optional.BlockAndSurf.A, C:\Program Files (x86)\ver1BlockAndSurf\x64\WdfCoInstaller01009.dll, , [4adba94484f72c0a0e95cc2458aa926e], PUP.Optional.BlockAndSurf.A, C:\Program Files (x86)\ver1BlockAndSurf\x64\webinstr.inf, , [4adba94484f72c0a0e95cc2458aa926e], PUP.Optional.BlockAndSurf.A, C:\Program Files (x86)\ver1BlockAndSurf\x64\webinstr.sys, , [4adba94484f72c0a0e95cc2458aa926e], Physische Sektoren: 0 (No malicious items detected) (end) Danke |
|
13.09.2014, 15:04
| #6 |
| /// TB-Ausbilder | Chrome und Firefox öffnen ständig Werbeseiten,Malwarebytes funktionioniert nicht mehr,auch nicht mit Chameleon Servus, ich tue jetzt einfach mal so, als hättest du MBAM nicht ausgeführt, hab davon ja auch nichts geschrieben. so geht es weiter: Schritt 1 Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Schritt 2 Downloade Dir bitte  Malwarebytes Anti-Malware
Schritt 3 Bitte deaktiviere dein Anti-Viren-Programm, da es das Ergebnis beeinflussen oder ggf. die Bereinigung stören kann. Bitte lade dir zoek.exe von hier: http://hijackthis.nl/smeenk/ und speichere die Datei auf deinem Desktop.
Schritt 4
Bitte poste mit deiner nächsten Antwort
|
|
13.09.2014, 16:17
| #7 |
| | Chrome und Firefox öffnen ständig Werbeseiten,Malwarebytes funktionioniert nicht mehr,auch nicht mit Chameleon ooops..sorry, da war ich wohl zu euphorisch.  Hier also die geforderten Log Dateien: AdwCleaner AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.308 - Bericht erstellt am 30/08/2014 um 13:03:05
# Aktualisiert 20/08/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : bernie - BERNIE-PC
# Gestartet von : C:\Users\bernie\Downloads\adwcleaner_3.308.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\NCH Software
Ordner Gelöscht : C:\Program Files (x86)\NCH Software
Ordner Gelöscht : C:\Users\bernie\AppData\Local\Temp\OCS
Datei Gelöscht : C:\Users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\bopakagnckmlgajfccecajhnimjiiedh
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17239
-\\ Mozilla Firefox v31.0 (x86 de)
[ Datei : C:\Users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default\prefs.js ]
Zeile gelöscht : user_pref("extensions.foxtrick.prefs.Markers.hxxp://foxtrick.googlecode.com/svn/trunk/res/staff/editor.json", "{\n \"type\": \"editor\",\n \"list\": [\n { \"id\": 7564618, \"name\": \"-Shamil-\" },\n[...]
Zeile gelöscht : user_pref("extensions.foxtrick.prefs.Markers.hxxp://foxtrick.googlecode.com/svn/trunk/res/staff/editor.json.zip", "{\r\n \"type\": \"editor\",\r\n \"list\": [\r\n { \"id\": 7564618, \"name\": \"-Sham[...]
Zeile gelöscht : user_pref("extensions.irmysearch.aflt", "ir_14_19_ff");
Zeile gelöscht : user_pref("extensions.irmysearch.cd", "2XzuyEtN2Y1L1Qzu0EzztCtCtAtByB0A0AtDtCyEtB0CyCzytN0D0Tzu0SzzyCtCtN1L2XzutBtFtBtDtFzytFtBtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StCzz0CtB0BzztBzztG0DtDtD0Ct[...]
Zeile gelöscht : user_pref("extensions.irmysearch.cr", "283573743");
Zeile gelöscht : user_pref("extensions.irmysearch.instlRef", "140305_b");
[ Datei : C:\Users\Besucher\AppData\Roaming\Mozilla\Firefox\Profiles\s5ydljcd.default\prefs.js ]
-\\ Google Chrome v36.0.1985.143
[ Datei : C:\Users\bernie\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Gelöscht [Extension] : bopakagnckmlgajfccecajhnimjiiedh
[ Datei : C:\Users\Besucher\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [9491 octets] - [27/05/2014 12:59:04]
AdwCleaner[R1].txt - [3087 octets] - [30/08/2014 13:00:27]
AdwCleaner[S0].txt - [8685 octets] - [27/05/2014 13:00:58]
AdwCleaner[S1].txt - [2958 octets] - [30/08/2014 13:03:05]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [3018 octets] ##########
AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.310 - Bericht erstellt am 13/09/2014 um 16:16:30
# Aktualisiert 12/09/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : bernie - BERNIE-PC
# Gestartet von : C:\Users\bernie\Desktop\AdwCleaner_3.310 (2).exe
# Option : Löschen
***** [ Dienste ] *****
[#] Dienst Gelöscht : webinstr
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\NCH Software
Ordner Gelöscht : C:\Program Files (x86)\NCH Software
Ordner Gelöscht : C:\Program Files (x86)\ver1BlockAndSurf
Ordner Gelöscht : C:\Users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default\Extensions\{ef62e1ce-d2a4-4cdd-b7ec-92b120366b66}
Datei Gelöscht : C:\Users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default\user.js
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Wert Gelöscht : HKCU\Software\Mozilla\Firefox\Extensions [{0C1D2A7B-C770-0307-202D-4A1A6A004C92}]
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\bopakagnckmlgajfccecajhnimjiiedh
Schlüssel Gelöscht : HKCU\Software\OCS
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17280
-\\ Mozilla Firefox v32.0.1 (x86 de)
[ Datei : C:\Users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default\prefs.js ]
Zeile gelöscht : user_pref("extensions.foxtrick.prefs.Markers.hxxp://foxtrick.googlecode.com/svn/trunk/res/staff/editor.json", "{\n \"type\": \"editor\",\n \"list\": [\n { \"id\": 7564618, \"name\": \"-Shamil-\" },\n[...]
Zeile gelöscht : user_pref("extensions.foxtrick.prefs.Markers.hxxp://foxtrick.googlecode.com/svn/trunk/res/staff/editor.json.zip", "{\r\n \"type\": \"editor\",\r\n \"list\": [\r\n { \"id\": 7564618, \"name\": \"-Sham[...]
Zeile gelöscht : user_pref("extensions.irmysearch.aflt", "ir_14_19_ff");
Zeile gelöscht : user_pref("extensions.irmysearch.cd", "2XzuyEtN2Y1L1Qzu0EzztCtCtAtByB0A0AtDtCyEtB0CyCzytN0D0Tzu0SzzyCtCtN1L2XzutBtFtBtDtFzytFtBtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StCzz0CtB0BzztBzztG0DtDtD0Ct[...]
Zeile gelöscht : user_pref("extensions.irmysearch.cr", "283573743");
Zeile gelöscht : user_pref("extensions.irmysearch.instlRef", "140305_b");
[ Datei : C:\Users\Besucher\AppData\Roaming\Mozilla\Firefox\Profiles\s5ydljcd.default\prefs.js ]
-\\ Google Chrome v37.0.2062.120
[ Datei : C:\Users\bernie\AppData\Local\Google\Chrome\User Data\Default\preferences ]
[ Datei : C:\Users\Besucher\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [9491 octets] - [27/05/2014 12:59:04]
AdwCleaner[R1].txt - [6043 octets] - [30/08/2014 13:00:27]
AdwCleaner[S0].txt - [8685 octets] - [27/05/2014 13:00:58]
AdwCleaner[S1].txt - [5877 octets] - [30/08/2014 13:03:05]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [5937 octets] ##########
MBAM Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 13.09.2014 Suchlauf-Zeit: 16:27:30 Logdatei: mbam.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.09.13.02 Rootkit Datenbank: v2014.09.12.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: bernie Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 429223 Verstrichene Zeit: 16 Min, 35 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Warnen PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 1 PUP.Optional.Linkular, C:\Users\bernie\Downloads\combofixsetup.exe, In Quarantäne, [33f320cdb0cbe0562fafdc9add275ba5], Physische Sektoren: 0 (No malicious items detected) (end) Code:
ATTFilter Zoek.exe v5.0.0.0 Updated 10-September-2014
Tool run by bernie on 13.09.2014 at 17:02:12.79.
Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\bernie\Desktop\zoek.exe [Scan all users] [Script inserted]
==== System Restore Info ======================
13.09.2014 17:04:19 Zoek.exe System Restore Point Created Succesfully.
==== Deleting CLSID Registry Keys ======================
HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8dcb7100-df86-4384-8842-8fa844297b3f} deleted successfully
HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{8dcb7100-df86-4384-8842-8fa844297b3f} deleted successfully
HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D2CE3E00-F94A-4740-988E-03DC2F38C34F} deleted successfully
HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D2CE3E00-F94A-4740-988E-03DC2F38C34F} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{8dcb7100-df86-4384-8842-8fa844297b3f} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{D2CE3E00-F94A-4740-988E-03DC2F38C34F} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D2CE3E00-F94A-4740-988E-03DC2F38C34F} deleted successfully
==== Deleting CLSID Registry Values ======================
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{8dcb7100-df86-4384-8842-8fa844297b3f} deleted successfully
==== FireFox Fix ======================
Deleted from C:\Users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default\prefs.js:
user_pref("browser.startup.homepage", "https://www.google.ch/");
Added to C:\Users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default\prefs.js:
Deleted from C:\Users\Besucher\AppData\Roaming\Mozilla\Firefox\Profiles\s5ydljcd.default\prefs.js:
Added to C:\Users\Besucher\AppData\Roaming\Mozilla\Firefox\Profiles\s5ydljcd.default\prefs.js:
user_pref("browser.startup.homepage", "hxxp://www.google.com");
user_pref("browser.search.defaulturl", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "hxxp://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);
==== Firefox Extensions Registry ======================
[HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions]
"{e4f94d1e-2f53-401e-8885-681602c0ddd8}"="C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi" [04.04.2014 12:36]
==== Firefox Extensions ======================
ProfilePath: C:\Users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default
- Deutsches Wrterbuch Schweiz - %ProfilePath%\extensions\de-CH@dictionaries.addons.mozilla.org
- BrowserAdditions - %ProfilePath%\extensions\toolbarbutton@browseradditions.com
- Garmin Communicator - %ProfilePath%\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
- FoxTrick - %ProfilePath%\extensions\{9d1f059c-cada-4111-9696-41a62d64e3ba}
- NASA Night Launch - %ProfilePath%\extensions\nasanightlaunch@example.com.xpi
- YouTube to MP3 - %ProfilePath%\extensions\youtube2mp3@mondayx.de.xpi
- Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
ProfilePath: C:\Users\Besucher\AppData\Roaming\Mozilla\Firefox\Profiles\s5ydljcd.default
- Undetermined - %ProfilePath%\extensions\staged
AppDir: C:\Program Files (x86)\Mozilla Firefox
- Java Console - %AppDir%\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
- Java Console - %AppDir%\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
- Java Console - %AppDir%\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
==== Firefox Plugins ======================
Profilepath: C:\Users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default
DFC9460CC37E5C414DC4680B10C19E7A - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll - Shockwave Flash
4390CCD3790F8D9C427C0C29590C62D7 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll - Shockwave Flash
CE252B04FB9F4F773A7DB5338BFEEA5B - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL - CANON iMAGE GATEWAY Album Plugin Utility
==== Set IE to Default ======================
Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://www.google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU
New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
==== All HKCU SearchScopes ======================
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
==== Reset Google Chrome ======================
C:\Users\bernie\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Besucher\AppData\Local\Google\Chrome\User Data\Default\preferences was reset successfully
C:\Users\bernie\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
C:\Users\Besucher\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
==== shortcuts on Users Desktops ======================
C:\Users\bernie\Desktop\AtomicTime.lnk - C:\Programme\AtomicTime\AtomicTime.exe
C:\Users\bernie\Desktop\Dropbox.lnk - C:\Users\bernie\AppData\Roaming\Dropbox\bin\Dropbox.exe /home
C:\Users\bernie\Desktop\EVEREST Home Edition.lnk - C:\Program Files (x86)\Lavalys\EVEREST Home Edition\everest.exe
C:\Users\bernie\Desktop\Ihre Meinung ist wichtig.lnk -
C:\Users\bernie\Desktop\Ipods - Verknüpfung.lnk -
C:\Users\bernie\Desktop\IrfanView Thumbnails.lnk - C:\Program Files (x86)\IrfanView\i_view32.exe /thumbs
C:\Users\bernie\Desktop\IrfanView.lnk - C:\Program Files (x86)\IrfanView\i_view32.exe
C:\Users\bernie\Desktop\Juice.lnk - C:\Program Files (x86)\Juice\Juice.exe
C:\Users\bernie\Desktop\KLK.lnk - C:\Program Files (x86)\KLK\klk.exe
C:\Users\bernie\Desktop\Microsoft Office Outlook 2007.lnk - C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe
C:\Users\bernie\Desktop\Microsoft Office Publisher 2007.lnk - C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe
C:\Users\bernie\Desktop\Microsoft Office Word 2007.lnk - C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe
C:\Users\bernie\Desktop\Mozilla Firefox.lnk - C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\bernie\Desktop\Ricardo Assistant 5 – Superlister.lnk -
C:\Users\bernie\Desktop\Snipping Tool.lnk -
C:\Users\bernie\Desktop\SportTracks 3.0.lnk - C:\Program Files (x86)\Zone Five Software\SportTracks 3\SportTracks.exe
C:\Users\bernie\Desktop\START.lnk - C:\Program Files (x86)\UBS e-banking\UBS Shell\Ubsshell.exe
C:\Users\bernie\Desktop\Zattoo.lnk - C:\Program Files (x86)\Zattoo4\Zattoo.exe
C:\Users\UpdatusUser\Desktop\AtomicTime.lnk - C:\Programme\AtomicTime\AtomicTime.exe
C:\Users\UpdatusUser\Desktop\EVEREST Home Edition.lnk - C:\Program Files (x86)\Lavalys\EVEREST Home Edition\everest.exe
C:\Users\UpdatusUser\Desktop\IrfanView Thumbnails.lnk - C:\Program Files (x86)\IrfanView\i_view32.exe /thumbs
C:\Users\UpdatusUser\Desktop\IrfanView.lnk - C:\Program Files (x86)\IrfanView\i_view32.exe
C:\Users\UpdatusUser\Desktop\Juice.lnk - C:\Program Files (x86)\Juice\Juice.exe
C:\Users\UpdatusUser\Desktop\Ricardo Assistant 5 – Superlister.lnk -
C:\Users\UpdatusUser\Desktop\Zattoo.lnk - C:\Program Files (x86)\Zattoo4\Zattoo.exe
==== shortcuts on All Users Desktop ======================
C:\Users\Public\Desktop\Adobe Reader X.lnk - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe
C:\Users\Public\Desktop\Avira Control Center.lnk - C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe
C:\Users\Public\Desktop\Avira.lnk - C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe /showMiniGui
C:\Users\Public\Desktop\Canon Easy-PhotoPrint EX.lnk - C:\Program Files\Canon\Easy-PhotoPrint EX\CNEZMAIN.EXE
C:\Users\Public\Desktop\Canon My Printer.lnk - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE /dt
C:\Users\Public\Desktop\Canon Solution Menu.lnk - C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.EXE
C:\Users\Public\Desktop\Free YouTube to MP3 Converter.lnk - C:\Program Files (x86)\DVDVideoSoft\Free YouTube to MP3 Converter\FreeYouTubeToMP3Converter.exe
C:\Users\Public\Desktop\Garmin Express.lnk - C:\Program Files (x86)\Garmin\Express\Express.exe
C:\Users\Public\Desktop\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Public\Desktop\Google Earth.lnk - C:\Program Files (x86)\Google\Google Earth\client\googleearth.exe
C:\Users\Public\Desktop\Hattrick Organizer.lnk - C:\HattrickOrganizer\HO.bat
C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk - C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk - C:\Program Files\McAfee Security Scan\3.8.150\McUICnt.exe SecurityScanner.dll
C:\Users\Public\Desktop\Mindjet MindManager 2012.lnk - C:\Windows\Installer\{2005E0A6-ED25-4B8A-801C-F3A0B846A317}\Desktop_MindManager6_C4D150117314479F90CAEF8478756B79.exe
C:\Users\Public\Desktop\Mozilla Firefox.lnk - C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\Public\Desktop\MP Navigator EX 2.0.lnk - C:\Program Files (x86)\Canon\MP Navigator EX 2.0\mpnex20.exe
C:\Users\Public\Desktop\Multimedia POP.lnk - C:\Program Files\Samsung\MultimediaPOP\MultimediaPOP.exe
C:\Users\Public\Desktop\MyPhoneExplorer.lnk - C:\Program Files (x86)\MyPhoneExplorer\MyPhoneExplorer.exe
C:\Users\Public\Desktop\NAVIGON Fresh.lnk - C:\Program Files (x86)\NAVIGON\NAVIGON Fresh\bin\Fresh.exe C:\Program Files (x86)\NAVIGON\NAVIGON Fresh\bin
C:\Users\Public\Desktop\Remote Support.lnk - C:\Program Files (x86)\Samsung\SISShortcut\SISShortcut.exe
C:\Users\Public\Desktop\Samsung Support Center.lnk - C:\Program Files (x86)\Samsung\Samsung Support Center\SSCMain.exe
C:\Users\Public\Desktop\Samsung Update Plus.lnk - C:\Program Files (x86)\Samsung\Samsung Update Plus\SupClientApp.exe
C:\Users\Public\Desktop\Seagate Dashboard 2.0.lnk - C:\Windows\Installer\{67445E65-3D93-428F-83A5-446F7D02689A}\ScDashBoardDesktop_942064A30E474CC8BCA1C6511C4CD457.exe
C:\Users\Public\Desktop\User Guide.lnk - C:\Program Files\Samsung\SamsungManual\RunManual.exe
C:\Users\Public\Desktop\VLC media player.lnk - C:\Program Files (x86)\VideoLAN\VLC\vlc.exe
C:\Users\Public\Desktop\WinPV.lnk - C:\Windows\Installer\{F4DA8B2F-8860-416C-868F-8ABAF6B78033}\ICO_WinPV.exe
C:\Users\Public\Desktop\WinRAR.lnk - C:\Program Files (x86)\WinRAR\WinRAR.exe
==== shortcuts in Users Start Menu ======================
C:\Users\bernie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte\HTC Desire S (2).lnk -
C:\Users\bernie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte\HTC Desire S.lnk -
C:\Users\bernie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox\Dropbox.lnk - C:\Users\bernie\AppData\Roaming\Dropbox\bin\Dropbox.exe /home
C:\Users\bernie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox\Uninstall Dropbox.lnk - C:\Users\bernie\AppData\Roaming\Dropbox\bin\DropboxUninstaller.exe
C:\Users\bernie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk - C:\Users\bernie\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup
==== shortcuts in All Users Start Menu ======================
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk - C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip File Manager.lnk - C:\Program Files (x86)\7-Zip\7zFM.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip Help.lnk - C:\Program Files (x86)\7-Zip\7-zip.chm
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira\My Avira\Avira.lnk - C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe /showMiniGui
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware \Malwarebytes Anti-Malware entfernen.lnk - C:\Program Files (x86)\ Malwarebytes Anti-Malware \unins000.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware \ Malwarebytes Anti-Malware .lnk - C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware \Tools\Malwarebytes Anti-Malware Chameleon.lnk - C:\Program Files (x86)\ Malwarebytes Anti-Malware \Chameleon\Windows\chameleon.chm
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyPhoneExplorer\MyPhoneExplorer.lnk - C:\Program Files (x86)\MyPhoneExplorer\MyPhoneExplorer.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyPhoneExplorer\Uninstall.lnk - C:\Program Files (x86)\MyPhoneExplorer\uninstall.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Seagate Dashboard 2.0\Seagate Dashboard 2.0.lnk - C:\Windows\Installer\{67445E65-3D93-428F-83A5-446F7D02689A}\ScDashBoardDesktop_B87504CE5AD94575AAA0494D8F67D841.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2\Uninstall Spybot-S&D.lnk - C:\Program Files (x86)\Spybot - Search & Destroy 2\unins000.exe
==== shortcuts in Quick Launch ======================
C:\Users\bernie\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\bernie\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\bernie\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Outlook.lnk - C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE /recycle
C:\Users\bernie\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mindjet MindManager 2012.lnk - C:\Windows\Installer\{2005E0A6-ED25-4B8A-801C-F3A0B846A317}\QuickLaunch_MindMana_C4D150117314479F90CAEF8478756B79.exe
C:\Users\bernie\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\bernie\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\bernie\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Calculator.lnk - C:\Windows\system32\calc.exe
C:\Users\bernie\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\bernie\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\bernie\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk - C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\bernie\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Snipping Tool.lnk -
C:\Users\bernie\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk - C:\Windows\explorer.exe
C:\Users\bernie\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Media Player.lnk - C:\Program Files (x86)\Windows Media Player\wmplayer.exe /prefetch:1
C:\Users\Besucher\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Besucher\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Besucher\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\Besucher\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Besucher\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Besucher\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk - C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\Besucher\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk - C:\Windows\explorer.exe
C:\Users\Besucher\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Media Player.lnk - C:\Program Files (x86)\Windows Media Player\wmplayer.exe /prefetch:1
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
==== Reset IE Proxy ======================
Value(s) before fix:
"ProxyEnable"=dword:00000000
Value(s) after fix:
"ProxyEnable"=dword:00000000
==== C:\zoek_backup content ======================
C:\zoek_backup (files=0 folders=0 0 bytes)
==== EOF on 13.09.2014 at 17:05:38.73 ======================
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-09-2014
Ran by bernie (administrator) on BERNIE-PC on 13-09-2014 17:07:18
Running from C:\Users\bernie\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Seagate Technology LLC) C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe
(Seagate Technology LLC) C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\MobileService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(GARMIN Corp.) C:\Garmin\gStart.exe
(SanDisk Corporation) C:\Users\bernie\AppData\Roaming\SanDisk\Sansa Updater\SansaDispatch.exe
(Federli Informatik AG, CH-8330 Pfäffikon) C:\Program Files (x86)\UBS e-banking\UBS Shell\Ubsshell.exe
(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe
(Seagate Technology LLC) C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Dropbox, Inc.) C:\Users\bernie\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Mindjet) C:\Program Files (x86)\Mindjet\MindManager 10\MmReminderService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Seagate Technology LLC) C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DBAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Seagate Technology LLC) C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DeviceAgent.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(SEC) C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\SAMSUNG\SamsungFastStart\SmartRestarter.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\Media+Player10\Media+Player10Serv.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe
(SAMSUNG Electronics) C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe
(Samsung Electronics) C:\Program Files (x86)\Samsung\Samsung Update Plus\SUPBackground.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11775592 2011-01-27] (Realtek Semiconductor)
HKLM\...\Run: [CanonSolutionMenu] => C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [767312 2009-09-04] (CANON INC.)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2782096 2010-07-26] (CANON INC.)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2817872 2012-04-25] (ELAN Microelectronics Corp.)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [MMReminderService] => C:\Program Files (x86)\Mindjet\MindManager 10\MMReminderService.exe [37728 2011-09-14] (Mindjet)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM-x32\...\Run: [DBAgent] => C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DBAgent.exe [1519176 2014-04-30] (Seagate Technology LLC)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [164656 2014-08-27] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\.DEFAULT\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-08-07] (Garmin Ltd or its subsidiaries)
HKU\S-1-5-21-1309665003-1285200881-1394159564-1002\...\Run: [gStart] => C:\Garmin\gStart.exe [1891416 2008-08-13] (GARMIN Corp.)
HKU\S-1-5-21-1309665003-1285200881-1394159564-1002\...\Run: [SansaDispatch] => C:\Users\bernie\AppData\Roaming\SanDisk\Sansa Updater\SansaDispatch.exe
RÃ hî% Ù% ä ¸ 0 % D
HKU\S-1-5-21-1309665003-1285200881-1394159564-1002\...\Run: [UBSShell] => C:\Program Files (x86)\UBS e-banking\UBS Shell\UBSShell.exe [315392 2012-03-14] (Federli Informatik AG, CH-8330 Pfäffikon)
HKU\S-1-5-21-1309665003-1285200881-1394159564-1002\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-08-07] (Garmin Ltd or its subsidiaries)
HKU\S-1-5-21-1309665003-1285200881-1394159564-1002\...\Run: [Uploader] => C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe [126056 2014-04-30] (Seagate Technology LLC)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [266448 2013-06-21] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [214448 2013-06-21] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\bernie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\bernie\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: CmjBrowserHelperObject Object -> {6FE6A929-59D1-4763-91AD-29B61CFFB35B} -> C:\Program Files (x86)\Mindjet\MindManager 10\Mm8InternetExplorer.dll (Mindjet)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: W2PBrowser Class -> {AA609D72-8482-4076-8991-8CDAE5B93BCB} -> C:\Program Files\Samsung AnyWeb Print\W2PBrowser.dll ()
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @garmin.com/GpsControl -> C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default\searchplugins\google-maps.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: German Dictionary (Switzerland) - C:\Users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default\Extensions\de-CH@dictionaries.addons.mozilla.org [2014-06-08]
FF Extension: BrowserAdditions - C:\Users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default\Extensions\toolbarbutton@browseradditions.com [2014-04-19]
FF Extension: Garmin Communicator - C:\Users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2014-01-22]
FF Extension: FoxTrick - C:\Users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default\Extensions\{9d1f059c-cada-4111-9696-41a62d64e3ba} [2014-03-07]
FF Extension: NASA Night Launch - C:\Users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default\Extensions\nasanightlaunch@example.com.xpi [2013-10-22]
FF Extension: YouTube to MP3 - C:\Users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default\Extensions\youtube2mp3@mondayx.de.xpi [2014-05-19]
FF Extension: Adblock Plus - C:\Users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-02-15]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2014-09-13]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-09-13]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2014-09-13]
FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-05-19]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: No Name - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
FF Extension: No Name - C:\Users\bernie\AppData\Roaming\Mozilla\Firefox\Profiles\u7dyprj2.default\extensions\{ef62e1ce-d2a4-4cdd-b7ec-92b120366b66} [Not Found]
Chrome:
=======
CHR HomePage: Default -> 1FCCAD3DF927F18C4A7A067F29A1E27A5A474D4829D96B8335E253BDD702B76B
CHR DefaultSearchKeyword: Default -> B1EC653F01C5791AE3FBFD5AFBF77CF4E5F425B58D0D3F4BA85E8AF5EF67A699
CHR DefaultSearchProvider: Default -> 9C02846470BE25339D2CEA63125E740D5C3DA14B68C8DB2643C2DD5531E749E6
CHR DefaultSearchURL: Default -> 292A173EC804F3D107143E8552A14D17EEA84A582D413A9E724883A556DEAD8E
CHR Profile: C:\Users\bernie\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\bernie\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-13]
CHR Extension: (Google Docs) - C:\Users\bernie\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-09-13]
CHR Extension: (Google Drive) - C:\Users\bernie\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-13]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\bernie\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-12]
CHR Extension: (YouTube) - C:\Users\bernie\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-09-13]
CHR Extension: (Google-Suche) - C:\Users\bernie\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-09-13]
CHR Extension: (Google Tabellen) - C:\Users\bernie\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-13]
CHR Extension: (Word CaptureX Extension) - C:\Users\bernie\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjdepfkicdcciagbigfcmdhknnoaaegf [2011-09-14]
CHR Extension: (Google Wallet) - C:\Users\bernie\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-31]
CHR Extension: (Google Mail) - C:\Users\bernie\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-09-13]
CHR HKLM-x32\...\Chrome\Extension: [mjdepfkicdcciagbigfcmdhknnoaaegf] - C:\Program Files (x86)\Deskperience\Word Capture\wcxChrome.crx [2010-07-23]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-05] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160048 2014-08-27] (Avira Operations GmbH & Co. KG)
R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [438616 2014-08-07] (Garmin Ltd or its subsidiaries)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] () [File not signed]
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2009-12-01] () [File not signed]
R2 Seagate Dashboard Services; C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe [16000 2014-04-30] (Seagate Technology LLC)
R2 Seagate MobileBackup Service; C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\MobileService.exe [157264 2014-04-30] (Seagate Technology LLC)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-06-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-05-27] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-01] (Avira Operations GmbH & Co. KG)
S3 rtport; C:\Windows\SysWOW64\drivers\rtport.sys [15144 2011-08-20] (Windows (R) 2003 DDK 3790 provider)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-13 17:07 - 2014-09-13 17:07 - 00021627 _____ () C:\Users\bernie\Desktop\FRST.txt
2014-09-13 17:06 - 2014-09-13 17:06 - 00019067 _____ () C:\Users\bernie\Desktop\zoek-results.txt
2014-09-13 17:03 - 2014-09-13 17:05 - 00019067 _____ () C:\zoek-results.log
2014-09-13 17:02 - 2014-09-13 17:02 - 00000000 ____D () C:\zoek_backup
2014-09-13 17:01 - 2014-09-13 17:01 - 01290240 _____ () C:\Users\bernie\Desktop\zoek.exe
2014-09-13 16:45 - 2014-09-13 16:59 - 00001247 _____ () C:\Users\bernie\Desktop\mbam.txt
2014-09-13 16:20 - 2014-09-13 16:20 - 00006017 _____ () C:\Users\bernie\Desktop\AdwCleaner[S1].txt
2014-09-13 16:20 - 2014-09-13 16:20 - 00000000 ____D () C:\Users\bernie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2014-09-13 16:14 - 2014-09-13 16:14 - 01373475 _____ () C:\Users\bernie\Desktop\AdwCleaner_3.310 (2).exe
2014-09-13 16:12 - 2014-09-13 16:12 - 01373475 _____ () C:\Users\bernie\Downloads\AdwCleaner_3.310.exe
2014-09-13 16:12 - 2014-09-13 16:12 - 01373475 _____ () C:\Users\bernie\Downloads\AdwCleaner_3.310 (1).exe
2014-09-13 15:08 - 2014-09-13 15:08 - 00006126 _____ () C:\Users\bernie\Desktop\Malware.txt
2014-09-13 14:45 - 2014-09-13 16:58 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-13 14:44 - 2014-09-13 14:44 - 00001143 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-13 14:44 - 2014-09-13 14:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-09-13 14:44 - 2014-09-13 14:44 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-13 14:44 - 2014-09-13 14:44 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-09-13 14:44 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-13 14:44 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-09-13 14:44 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-13 14:43 - 2014-09-13 14:44 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\bernie\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-13 14:37 - 2014-09-13 14:37 - 00321848 _____ (Malwarebytes Corporation) C:\Users\bernie\Downloads\mbam-clean-2.1.1.1001.exe
2014-09-13 14:37 - 2014-09-13 14:37 - 00321848 _____ (Malwarebytes Corporation) C:\Users\bernie\Downloads\mbam-clean-2.1.1.1001 (1).exe
2014-09-13 14:17 - 2014-09-13 14:17 - 00027922 _____ () C:\Users\bernie\Desktop\combofix.txt
2014-09-13 14:15 - 2014-09-13 14:15 - 00027922 _____ () C:\ComboFix.txt
2014-09-13 13:45 - 2014-09-13 14:16 - 00000000 ____D () C:\Qoobox
2014-09-13 13:45 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-09-13 13:45 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-09-13 13:45 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-09-13 13:45 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-09-13 13:45 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-09-13 13:45 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-09-13 13:45 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-09-13 13:45 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-09-13 13:44 - 2014-09-13 14:12 - 00000000 ____D () C:\Windows\erdnt
2014-09-13 13:44 - 2014-09-13 13:44 - 05577449 ____R (Swearware) C:\Users\bernie\Desktop\ComboFix.exe
2014-09-13 13:14 - 2014-09-13 13:14 - 00262144 _____ () C:\Windows\Minidump\091314-18064-01.dmp
2014-09-13 12:57 - 2014-09-13 12:57 - 00049058 _____ () C:\Users\bernie\Desktop\Gmer.txt
2014-09-13 12:42 - 2014-09-13 12:42 - 00380416 _____ () C:\Users\bernie\Downloads\Gmer-19357.exe
2014-09-13 12:13 - 2014-09-13 12:13 - 00001720 _____ () C:\Users\bernie\Desktop\EreignisseAvira.txt
2014-09-13 11:58 - 2014-09-13 11:58 - 00050477 _____ () C:\Users\bernie\Downloads\Defogger.exe
2014-09-13 11:58 - 2014-09-13 11:58 - 00000474 _____ () C:\Users\bernie\Downloads\defogger_disable.log
2014-09-13 11:58 - 2014-09-13 11:58 - 00000000 _____ () C:\Users\bernie\defogger_reenable
2014-09-13 10:43 - 2014-09-13 10:43 - 01110476 _____ () C:\Users\bernie\Downloads\7z920.exe
2014-09-13 10:39 - 2014-09-13 10:39 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-12 00:41 - 2014-08-19 00:05 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-12 00:41 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-09-12 00:40 - 2014-08-19 20:05 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-12 00:40 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-09-12 00:40 - 2014-08-19 01:01 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-12 00:40 - 2014-08-19 00:29 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-12 00:40 - 2014-08-19 00:29 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-12 00:40 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-12 00:40 - 2014-08-19 00:20 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-12 00:40 - 2014-08-19 00:19 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-12 00:40 - 2014-08-19 00:15 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-12 00:40 - 2014-08-19 00:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-12 00:40 - 2014-08-19 00:14 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-12 00:40 - 2014-08-19 00:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-12 00:40 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-09-12 00:40 - 2014-08-19 00:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-12 00:40 - 2014-08-19 00:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-12 00:40 - 2014-08-19 00:03 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-12 00:40 - 2014-08-19 00:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-12 00:40 - 2014-08-19 00:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-12 00:40 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-09-12 00:40 - 2014-08-18 23:56 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-12 00:40 - 2014-08-18 23:51 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-12 00:40 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-09-12 00:40 - 2014-08-18 23:45 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-12 00:40 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-09-12 00:40 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-09-12 00:40 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-09-12 00:40 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-12 00:40 - 2014-08-18 23:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-12 00:40 - 2014-08-18 23:39 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-12 00:40 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-12 00:40 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-09-12 00:40 - 2014-08-18 23:38 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-12 00:40 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-09-12 00:40 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-09-12 00:40 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-09-12 00:40 - 2014-08-18 23:25 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-12 00:40 - 2014-08-18 23:25 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-12 00:40 - 2014-08-18 23:23 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-12 00:40 - 2014-08-18 23:23 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-12 00:40 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-09-12 00:40 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-09-12 00:40 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-09-12 00:40 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-12 00:40 - 2014-08-18 23:16 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-12 00:40 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-12 00:40 - 2014-08-18 23:15 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-12 00:40 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-12 00:40 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-12 00:40 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-09-12 00:40 - 2014-08-18 22:55 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-12 00:40 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-12 00:40 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-12 00:40 - 2014-08-18 22:38 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-12 00:40 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-09-12 00:27 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-12 00:27 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2014-09-11 15:35 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-11 15:35 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-09-11 15:35 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-11 15:35 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-11 15:35 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-09-11 15:35 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-09-11 15:35 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-09-11 15:35 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-11 15:35 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-09-11 15:34 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-11 15:34 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-07 10:00 - 2014-09-07 10:00 - 01101648 _____ () C:\Users\bernie\Downloads\Firefox - CHIP-Installer.exe
2014-09-06 16:52 - 2014-09-06 16:54 - 00070115 _____ () C:\Users\bernie\Downloads\mailpv181.zip
2014-09-06 16:51 - 2014-09-06 16:51 - 01101648 _____ () C:\Users\bernie\Downloads\Mail PassView - CHIP-Installer.exe
2014-09-01 18:46 - 2014-09-07 10:01 - 00001188 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-09-01 18:45 - 2014-09-01 18:45 - 35098384 _____ () C:\Users\bernie\Downloads\Firefox_Setup_32.0.exe
2014-09-01 18:10 - 2014-09-06 18:41 - 00000000 ____D () C:\Users\bernie\AppData\Roaming\MyPhoneExplorer
2014-09-01 18:09 - 2014-09-01 18:09 - 00002098 _____ () C:\Users\Public\Desktop\MyPhoneExplorer.lnk
2014-09-01 18:09 - 2014-09-01 18:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_webinstr_01009.Wdf
2014-09-01 18:09 - 2014-09-01 18:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyPhoneExplorer
2014-09-01 18:09 - 2014-09-01 18:09 - 00000000 ____D () C:\Program Files (x86)\MyPhoneExplorer
2014-09-01 18:07 - 2014-09-01 18:07 - 01101648 _____ () C:\Users\bernie\Downloads\MyPhoneExplorer - CHIP-Installer.exe
2014-09-01 17:19 - 2014-09-01 17:19 - 00000000 ____D () C:\Users\bernie\AppData\Local\Seagate_Technology_LLC
2014-09-01 12:13 - 2014-09-01 12:13 - 00003732 _____ () C:\Windows\System32\Tasks\bernie Merge
2014-09-01 12:13 - 2014-09-01 12:13 - 00003716 _____ () C:\Windows\System32\Tasks\bernie
2014-09-01 12:12 - 2014-09-01 12:12 - 00003500 _____ () C:\Windows\System32\Tasks\bernie DBAgent 2 0
2014-09-01 12:12 - 2014-09-01 12:12 - 00000000 ____D () C:\Users\bernie\AppData\Roaming\Nero
2014-09-01 12:11 - 2014-09-01 12:11 - 00003512 _____ () C:\Windows\System32\Tasks\Seagate_Install_Launch
2014-09-01 12:10 - 2014-09-01 12:10 - 00002725 _____ () C:\Users\Public\Desktop\Seagate Dashboard 2.0.lnk
2014-09-01 12:10 - 2014-09-01 12:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Seagate Dashboard 2.0
2014-09-01 12:09 - 2014-09-01 12:09 - 00000000 ____D () C:\ProgramData\Nero
2014-09-01 12:09 - 2014-09-01 12:09 - 00000000 ____D () C:\Program Files (x86)\Seagate
2014-09-01 12:05 - 2014-09-01 12:05 - 00000000 ____D () C:\Users\bernie\AppData\Roaming\Seagate
2014-09-01 12:05 - 2014-09-01 12:05 - 00000000 ____D () C:\ProgramData\Seagate
2014-09-01 12:04 - 2014-09-01 12:04 - 00000000 ____D () C:\Windows\System32\Tasks\Leader Technologies
2014-09-01 12:00 - 2014-09-01 12:00 - 00000000 ____D () C:\Users\bernie\AppData\Roaming\Leadertech
2014-09-01 09:33 - 2014-09-13 17:07 - 00000000 ____D () C:\FRST
2014-09-01 09:32 - 2014-09-13 11:59 - 02105856 _____ (Farbar) C:\Users\bernie\Desktop\FRST64.exe
2014-08-31 17:37 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-31 17:37 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-31 17:37 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-31 10:47 - 2014-08-31 17:15 - 00000000 ____D () C:\Users\Besucher\AppData\Roaming\uTorrent
2014-08-31 10:46 - 2014-08-31 10:46 - 00000000 ____D () C:\Users\Besucher\AppData\Roaming\Malwarebytes
2014-08-31 10:19 - 2014-08-31 17:15 - 00000000 ____D () C:\Users\bernie\Downloads\mbam
2014-08-30 16:33 - 2014-08-31 17:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-08-30 16:33 - 2014-08-31 17:15 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-08-30 16:33 - 2014-08-30 17:07 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-08-30 16:33 - 2014-08-30 16:33 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-08-30 16:09 - 2014-08-30 16:09 - 00000000 __SHD () C:\Users\bernie\AppData\Local\EmieUserList
2014-08-30 16:09 - 2014-08-30 16:09 - 00000000 __SHD () C:\Users\bernie\AppData\Local\EmieSiteList
2014-08-30 10:49 - 2014-08-30 10:49 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-08-30 10:03 - 2014-08-30 10:08 - 22143876 _____ () C:\Users\bernie\Downloads\mbam-chameleon-3.1.4.0.zip
2014-08-22 06:19 - 2014-08-22 06:19 - 00000000 ____D () C:\Users\bernie\AppData\Local\Adobe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-13 17:07 - 2014-09-13 17:07 - 00021627 _____ () C:\Users\bernie\Desktop\FRST.txt
2014-09-13 17:07 - 2014-09-01 09:33 - 00000000 ____D () C:\FRST
2014-09-13 17:06 - 2014-09-13 17:06 - 00019067 _____ () C:\Users\bernie\Desktop\zoek-results.txt
2014-09-13 17:05 - 2014-09-13 17:03 - 00019067 _____ () C:\zoek-results.log
2014-09-13 17:02 - 2014-09-13 17:02 - 00000000 ____D () C:\zoek_backup
2014-09-13 17:01 - 2014-09-13 17:01 - 01290240 _____ () C:\Users\bernie\Desktop\zoek.exe
2014-09-13 16:59 - 2014-09-13 16:45 - 00001247 _____ () C:\Users\bernie\Desktop\mbam.txt
2014-09-13 16:58 - 2014-09-13 14:45 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-13 16:55 - 2009-07-14 06:45 - 00022976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-13 16:55 - 2009-07-14 06:45 - 00022976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-13 16:54 - 2013-10-10 17:44 - 00000000 ___RD () C:\Users\bernie\Dropbox
2014-09-13 16:54 - 2013-10-10 17:41 - 00000000 ____D () C:\Users\bernie\AppData\Roaming\Dropbox
2014-09-13 16:53 - 2011-09-09 16:51 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-13 16:51 - 2011-03-15 08:46 - 01177138 _____ () C:\Windows\WindowsUpdate.log
2014-09-13 16:47 - 2011-09-08 18:16 - 00591532 _____ () C:\Windows\PFRO.log
2014-09-13 16:47 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-13 16:47 - 2009-07-14 06:51 - 00243682 _____ () C:\Windows\setupact.log
2014-09-13 16:30 - 2012-03-31 08:11 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-13 16:24 - 2011-09-09 16:51 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-13 16:20 - 2014-09-13 16:20 - 00006017 _____ () C:\Users\bernie\Desktop\AdwCleaner[S1].txt
2014-09-13 16:20 - 2014-09-13 16:20 - 00000000 ____D () C:\Users\bernie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2014-09-13 16:17 - 2011-03-15 10:34 - 00000000 ____D () C:\Windows\ko
2014-09-13 16:16 - 2014-05-27 12:59 - 00000000 ____D () C:\AdwCleaner
2014-09-13 16:14 - 2014-09-13 16:14 - 01373475 _____ () C:\Users\bernie\Desktop\AdwCleaner_3.310 (2).exe
2014-09-13 16:12 - 2014-09-13 16:12 - 01373475 _____ () C:\Users\bernie\Downloads\AdwCleaner_3.310.exe
2014-09-13 16:12 - 2014-09-13 16:12 - 01373475 _____ () C:\Users\bernie\Downloads\AdwCleaner_3.310 (1).exe
2014-09-13 15:08 - 2014-09-13 15:08 - 00006126 _____ () C:\Users\bernie\Desktop\Malware.txt
2014-09-13 14:44 - 2014-09-13 14:44 - 00001143 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-13 14:44 - 2014-09-13 14:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-09-13 14:44 - 2014-09-13 14:44 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-13 14:44 - 2014-09-13 14:44 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-09-13 14:44 - 2014-09-13 14:43 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\bernie\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-13 14:37 - 2014-09-13 14:37 - 00321848 _____ (Malwarebytes Corporation) C:\Users\bernie\Downloads\mbam-clean-2.1.1.1001.exe
2014-09-13 14:37 - 2014-09-13 14:37 - 00321848 _____ (Malwarebytes Corporation) C:\Users\bernie\Downloads\mbam-clean-2.1.1.1001 (1).exe
2014-09-13 14:17 - 2014-09-13 14:17 - 00027922 _____ () C:\Users\bernie\Desktop\combofix.txt
2014-09-13 14:16 - 2014-09-13 13:45 - 00000000 ____D () C:\Qoobox
2014-09-13 14:15 - 2014-09-13 14:15 - 00027922 _____ () C:\ComboFix.txt
2014-09-13 14:15 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-09-13 14:12 - 2014-09-13 13:44 - 00000000 ____D () C:\Windows\erdnt
2014-09-13 14:03 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-09-13 14:00 - 2012-04-30 06:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-13 13:44 - 2014-09-13 13:44 - 05577449 ____R (Swearware) C:\Users\bernie\Desktop\ComboFix.exe
2014-09-13 13:14 - 2014-09-13 13:14 - 00262144 _____ () C:\Windows\Minidump\091314-18064-01.dmp
2014-09-13 13:14 - 2011-09-11 11:01 - 00000000 ____D () C:\Windows\Minidump
2014-09-13 13:14 - 2011-09-11 11:00 - 690897441 _____ () C:\Windows\MEMORY.DMP
2014-09-13 12:57 - 2014-09-13 12:57 - 00049058 _____ () C:\Users\bernie\Desktop\Gmer.txt
2014-09-13 12:42 - 2014-09-13 12:42 - 00380416 _____ () C:\Users\bernie\Downloads\Gmer-19357.exe
2014-09-13 12:13 - 2014-09-13 12:13 - 00001720 _____ () C:\Users\bernie\Desktop\EreignisseAvira.txt
2014-09-13 11:59 - 2014-09-01 09:32 - 02105856 _____ (Farbar) C:\Users\bernie\Desktop\FRST64.exe
2014-09-13 11:58 - 2014-09-13 11:58 - 00050477 _____ () C:\Users\bernie\Downloads\Defogger.exe
2014-09-13 11:58 - 2014-09-13 11:58 - 00000474 _____ () C:\Users\bernie\Downloads\defogger_disable.log
2014-09-13 11:58 - 2014-09-13 11:58 - 00000000 _____ () C:\Users\bernie\defogger_reenable
2014-09-13 11:58 - 2011-09-08 12:24 - 00000000 ____D () C:\Users\bernie
2014-09-13 10:43 - 2014-09-13 10:43 - 01110476 _____ () C:\Users\bernie\Downloads\7z920.exe
2014-09-13 10:39 - 2014-09-13 10:39 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-13 01:11 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-12 19:25 - 2011-09-09 16:52 - 00002212 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-09-12 00:48 - 2011-09-08 18:50 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-09-12 00:38 - 2011-09-08 21:18 - 01603716 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-09-12 00:38 - 2011-03-16 01:14 - 00703214 _____ () C:\Windows\system32\perfh007.dat
2014-09-12 00:38 - 2011-03-16 01:14 - 00150822 _____ () C:\Windows\system32\perfc007.dat
2014-09-12 00:38 - 2009-07-14 07:13 - 01603716 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-12 00:37 - 2013-07-22 06:12 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-12 00:29 - 2011-09-12 12:24 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-12 00:27 - 2014-05-06 22:34 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-11 16:40 - 2012-03-31 08:11 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-11 16:40 - 2012-03-31 08:11 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-11 16:40 - 2011-09-08 20:34 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-11 15:26 - 2014-05-18 12:08 - 00001174 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-09-11 15:26 - 2014-05-10 18:44 - 00000000 ____D () C:\ProgramData\Package Cache
2014-09-11 15:26 - 2013-02-24 10:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-09-07 10:01 - 2014-09-01 18:46 - 00001188 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-09-07 10:01 - 2011-09-08 12:44 - 00001200 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-09-07 10:00 - 2014-09-07 10:00 - 01101648 _____ () C:\Users\bernie\Downloads\Firefox - CHIP-Installer.exe
2014-09-06 18:41 - 2014-09-01 18:10 - 00000000 ____D () C:\Users\bernie\AppData\Roaming\MyPhoneExplorer
2014-09-06 17:02 - 2013-02-06 22:11 - 00000000 ____D () C:\Windows\System32\Tasks\NCH Software
2014-09-06 16:54 - 2014-09-06 16:52 - 00070115 _____ () C:\Users\bernie\Downloads\mailpv181.zip
2014-09-06 16:51 - 2014-09-06 16:51 - 01101648 _____ () C:\Users\bernie\Downloads\Mail PassView - CHIP-Installer.exe
2014-09-05 23:31 - 2011-09-18 10:14 - 00000000 ____D () C:\Users\bernie\AppData\Local\CrashDumps
2014-09-05 04:10 - 2014-09-11 15:34 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-05 04:05 - 2014-09-11 15:34 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-01 18:45 - 2014-09-01 18:45 - 35098384 _____ () C:\Users\bernie\Downloads\Firefox_Setup_32.0.exe
2014-09-01 18:09 - 2014-09-01 18:09 - 00002098 _____ () C:\Users\Public\Desktop\MyPhoneExplorer.lnk
2014-09-01 18:09 - 2014-09-01 18:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_webinstr_01009.Wdf
2014-09-01 18:09 - 2014-09-01 18:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyPhoneExplorer
2014-09-01 18:09 - 2014-09-01 18:09 - 00000000 ____D () C:\Program Files (x86)\MyPhoneExplorer
2014-09-01 18:07 - 2014-09-01 18:07 - 01101648 _____ () C:\Users\bernie\Downloads\MyPhoneExplorer - CHIP-Installer.exe
2014-09-01 17:19 - 2014-09-01 17:19 - 00000000 ____D () C:\Users\bernie\AppData\Local\Seagate_Technology_LLC
2014-09-01 12:13 - 2014-09-01 12:13 - 00003732 _____ () C:\Windows\System32\Tasks\bernie Merge
2014-09-01 12:13 - 2014-09-01 12:13 - 00003716 _____ () C:\Windows\System32\Tasks\bernie
2014-09-01 12:12 - 2014-09-01 12:12 - 00003500 _____ () C:\Windows\System32\Tasks\bernie DBAgent 2 0
2014-09-01 12:12 - 2014-09-01 12:12 - 00000000 ____D () C:\Users\bernie\AppData\Roaming\Nero
2014-09-01 12:11 - 2014-09-01 12:11 - 00003512 _____ () C:\Windows\System32\Tasks\Seagate_Install_Launch
2014-09-01 12:10 - 2014-09-01 12:10 - 00002725 _____ () C:\Users\Public\Desktop\Seagate Dashboard 2.0.lnk
2014-09-01 12:10 - 2014-09-01 12:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Seagate Dashboard 2.0
2014-09-01 12:09 - 2014-09-01 12:09 - 00000000 ____D () C:\ProgramData\Nero
2014-09-01 12:09 - 2014-09-01 12:09 - 00000000 ____D () C:\Program Files (x86)\Seagate
2014-09-01 12:05 - 2014-09-01 12:05 - 00000000 ____D () C:\Users\bernie\AppData\Roaming\Seagate
2014-09-01 12:05 - 2014-09-01 12:05 - 00000000 ____D () C:\ProgramData\Seagate
2014-09-01 12:04 - 2014-09-01 12:04 - 00000000 ____D () C:\Windows\System32\Tasks\Leader Technologies
2014-09-01 12:00 - 2014-09-01 12:00 - 00000000 ____D () C:\Users\bernie\AppData\Roaming\Leadertech
2014-08-31 17:44 - 2009-07-14 06:45 - 00423376 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-31 17:16 - 2013-05-11 13:45 - 00000000 ____D () C:\Users\Besucher
2014-08-31 17:15 - 2014-08-31 10:47 - 00000000 ____D () C:\Users\Besucher\AppData\Roaming\uTorrent
2014-08-31 17:15 - 2014-08-31 10:19 - 00000000 ____D () C:\Users\bernie\Downloads\mbam
2014-08-31 17:15 - 2014-08-30 16:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-08-31 17:15 - 2014-08-30 16:33 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-08-31 17:15 - 2013-10-10 17:42 - 00000000 ____D () C:\Users\bernie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-08-31 17:15 - 2011-09-09 17:17 - 00000000 ____D () C:\Users\bernie\AppData\Roaming\vlc
2014-08-31 17:15 - 2011-09-09 16:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-08-31 17:15 - 2011-09-08 20:34 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2014-08-31 17:15 - 2011-09-08 20:16 - 00000000 ____D () C:\Users\bernie\AppData\Roaming\iPodder
2014-08-31 17:15 - 2011-03-15 09:08 - 00000000 ____D () C:\ProgramData\WinClon
2014-08-31 17:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-08-31 17:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\AppCompat
2014-08-31 17:13 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-08-31 17:09 - 2011-03-16 00:45 - 00000000 ____D () C:\Windows\SysWOW64\XPSViewer
2014-08-31 17:09 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\MUI
2014-08-31 17:09 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\MUI
2014-08-31 17:09 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\servicing
2014-08-31 17:05 - 2013-02-24 10:28 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-08-31 17:05 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-08-31 10:46 - 2014-08-31 10:46 - 00000000 ____D () C:\Users\Besucher\AppData\Roaming\Malwarebytes
2014-08-31 10:46 - 2013-08-17 22:11 - 00115456 _____ () C:\Users\Besucher\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-30 17:07 - 2014-08-30 16:33 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-08-30 16:33 - 2014-08-30 16:33 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-08-30 16:09 - 2014-08-30 16:09 - 00000000 __SHD () C:\Users\bernie\AppData\Local\EmieUserList
2014-08-30 16:09 - 2014-08-30 16:09 - 00000000 __SHD () C:\Users\bernie\AppData\Local\EmieSiteList
2014-08-30 10:49 - 2014-08-30 10:49 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-08-30 10:08 - 2014-08-30 10:03 - 22143876 _____ () C:\Users\bernie\Downloads\mbam-chameleon-3.1.4.0.zip
2014-08-23 04:07 - 2014-08-31 17:37 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-08-31 17:37 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-08-31 17:37 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-22 06:19 - 2014-08-22 06:19 - 00000000 ____D () C:\Users\bernie\AppData\Local\Adobe
2014-08-19 20:05 - 2014-09-12 00:40 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-19 19:39 - 2014-09-12 00:40 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-19 01:01 - 2014-09-12 00:40 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-19 00:29 - 2014-09-12 00:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-19 00:29 - 2014-09-12 00:40 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-19 00:26 - 2014-09-12 00:40 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-19 00:20 - 2014-09-12 00:40 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-19 00:19 - 2014-09-12 00:40 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-19 00:15 - 2014-09-12 00:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-19 00:15 - 2014-09-12 00:40 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-19 00:14 - 2014-09-12 00:40 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-19 00:14 - 2014-09-12 00:40 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-19 00:08 - 2014-09-12 00:40 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-19 00:08 - 2014-09-12 00:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-19 00:08 - 2014-09-12 00:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-19 00:05 - 2014-09-12 00:41 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-19 00:03 - 2014-09-12 00:40 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-19 00:03 - 2014-09-12 00:40 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-19 00:03 - 2014-09-12 00:40 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-18 23:57 - 2014-09-12 00:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-18 23:56 - 2014-09-12 00:40 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-18 23:51 - 2014-09-12 00:40 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-18 23:46 - 2014-09-12 00:40 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-18 23:45 - 2014-09-12 00:40 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-18 23:45 - 2014-09-12 00:40 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-18 23:44 - 2014-09-12 00:40 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-18 23:44 - 2014-09-12 00:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-18 23:42 - 2014-09-12 00:40 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-18 23:40 - 2014-09-12 00:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-18 23:39 - 2014-09-12 00:40 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-18 23:39 - 2014-09-12 00:40 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-18 23:39 - 2014-09-12 00:40 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-18 23:38 - 2014-09-12 00:40 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-18 23:37 - 2014-09-12 00:41 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-18 23:36 - 2014-09-12 00:40 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-18 23:35 - 2014-09-12 00:40 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-18 23:27 - 2014-09-12 00:40 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-18 23:25 - 2014-09-12 00:40 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-18 23:25 - 2014-09-12 00:40 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-18 23:23 - 2014-09-12 00:40 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-18 23:23 - 2014-09-12 00:40 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-18 23:22 - 2014-09-12 00:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-18 23:19 - 2014-09-12 00:40 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-18 23:17 - 2014-09-12 00:40 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-18 23:17 - 2014-09-12 00:40 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-18 23:16 - 2014-09-12 00:40 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-18 23:15 - 2014-09-12 00:40 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-18 23:15 - 2014-09-12 00:40 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-18 23:09 - 2014-09-12 00:40 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-18 23:08 - 2014-09-12 00:40 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-18 23:07 - 2014-09-12 00:40 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-18 22:55 - 2014-09-12 00:40 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-18 22:46 - 2014-09-12 00:40 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-18 22:38 - 2014-09-12 00:40 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-18 22:38 - 2014-09-12 00:40 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-18 22:36 - 2014-09-12 00:40 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-15 20:46 - 2014-05-14 06:17 - 00000000 ____D () C:\Users\bernie\Downloads\torro
2014-08-14 06:04 - 2013-10-10 17:44 - 00001021 _____ () C:\Users\bernie\Desktop\Dropbox.lnk
Some content of TEMP:
====================
C:\Users\bernie\AppData\Local\Temp\avgnt.exe
C:\Users\bernie\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpmw8_4m.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-09-06 11:37
==================== End Of Log ============================
|
|
13.09.2014, 16:17
| #8 |
| | Chrome und Firefox öffnen ständig Werbeseiten,Malwarebytes funktionioniert nicht mehr,auch nicht mit Chameleon ADDITION Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-09-2014
Ran by bernie at 2014-09-13 17:08:46
Running from C:\Users\bernie\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version: - Microsoft)
„Windows Live Essentials“ (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
„Windows Live Mail“ (x32 Version: 15.4.3502.0922 - „Microsoft Corporation“) Hidden
„Windows Live Messenger“ (x32 Version: 15.4.3502.0922 - „Microsoft Corporation“) Hidden
„Windows Live“ fotogalerija (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version: - )
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.2.0.2070 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.2.0.2070 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader X (10.1.11) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.11 - Adobe Systems Incorporated)
Agatha Christie - Death on the Nile (x32 Version: 2.2.0.82 - WildTangent) Hidden
ANT Drivers Installer x64 (Version: 2.3.4 - Garmin Ltd or its subsidiaries) Hidden
Atheros Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 9.0 - Atheros)
AtomicTime (HKLM-x32\...\AtomicTime) (Version: - BasisOne Software)
Avira (HKLM-x32\...\{70e83cd8-4bd5-4039-ab5a-6b94a8abb641}) (Version: 1.1.21.25162 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.21.25162 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.6.570 - Avira)
BatteryLifeExtender (HKLM-x32\...\{FFD0E594-823B-4E2B-B680-720B3C852588}) (Version: 1.0.11 - Samsung)
Bejeweled 2 Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Bing Bar (HKLM-x32\...\{1E03DB52-D5CB-4338-A338-E526DD4D4DB1}) (Version: 7.0.610.0 - Microsoft Corporation)
Broadcom 802.11 Network Adapter (HKLM\...\Broadcom 802.11 Network Adapter) (Version: 5.60.48.55 - Broadcom Corporation)
Build-a-lot (x32 Version: 2.2.0.82 - WildTangent) Hidden
Canon MP Navigator EX 2.0 (HKLM-x32\...\MP Navigator EX 2.0) (Version: - )
Canon MP540 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP540_series) (Version: - )
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: - )
Canon Utilities Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version: - )
Canon Utilities Solution Menu (HKLM-x32\...\CanonSolutionMenu) (Version: - )
Chuzzle Deluxe (x32 Version: 2.2.0.82 - WildTangent) Hidden
CyberLink Media Suite (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 8.0.2227 - CyberLink Corp.)
CyberLink Media Suite (x32 Version: 8.0.2227 - CyberLink Corp.) Hidden
CyberLink Media+ Player10 (HKLM-x32\...\InstallShield_{34FBC7C4-CD31-4D93-A428-0E524EAC4586}) (Version: 10.0.1110.00 - CyberLink Corp.)
CyberLink Media+ Player10 (x32 Version: 10.0.1110.00 - CyberLink Corp.) Hidden
CyberLink MediaShow (HKLM-x32\...\InstallShield_{80E158EA-7181-40FE-A701-301CE6BE64AB}) (Version: 5.0.1130a - CyberLink Corp.)
CyberLink MediaShow (x32 Version: 5.0.1130a - CyberLink Corp.) Hidden
CyberLink Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.3802 - CyberLink Corp.)
CyberLink Power2Go (x32 Version: 6.1.3802 - CyberLink Corp.) Hidden
CyberLink PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 8.0.3306 - CyberLink Corp.)
CyberLink PowerDirector (x32 Version: 8.0.3306 - CyberLink Corp.) Hidden
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.1.3509 - CyberLink Corp.)
CyberLink YouCam (x32 Version: 3.1.3509 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.82 - WildTangent) Hidden
Dropbox (HKCU\...\Dropbox) (Version: 2.10.27 - Dropbox, Inc.)
Easy Content Share (HKLM-x32\...\{2DDC70C1-C77A-4D08-89D2-9AB648504533}) (Version: 1.0 - Samsung Electronics Co., LTD)
Easy Display Manager (HKLM-x32\...\{17283B95-21A8-4996-97DA-547A48DB266F}) (Version: 3.2 - Samsung Electronics Co., Ltd.)
Easy Migration (HKLM-x32\...\{AD86049C-3D9C-43E1-BE73-643F57D83D50}) (Version: 1.0 - Samsung Electronics Co., Ltd.)
Easy Network Manager (HKLM-x32\...\{8732818E-CA78-4ACB-B077-22311BF4C0E4}) (Version: 4.4.7 - Samsung)
Easy SpeedUp Manager (HKLM-x32\...\{EF367AA4-070B-493C-9575-85BE59D789C9}) (Version: 2.1.1.1 - Samsung Electronics Co.,Ltd.)
EasyBatteryManager (HKLM-x32\...\{4A331D24-A9E8-484F-835E-1BA7B139689C}) (Version: 4.0.0.4 - Samsung)
EasyFileShare (HKLM-x32\...\{16880765-677F-440B-B16A-BFD9B9C00012}) (Version: 1.0.12 - Samsung)
Elevated Installer (x32 Version: 3.2.17.0 - Garmin Ltd or its subsidiaries) Hidden
ETDWare PS/2-X64 10.7.14.12_WHQL (HKLM\...\Elantech) (Version: 10.7.14.12 - ELAN Microelectronic Corp.)
EVEREST Home Edition v2.20 (HKLM-x32\...\EVEREST Home Edition_is1) (Version: 2.20 - Lavalys Inc)
Express Zip (HKLM-x32\...\ExpressZip) (Version: - NCH Software)
Farm Frenzy (x32 Version: 2.2.0.82 - WildTangent) Hidden
Fast Start (HKLM-x32\...\{77F45ECD-FAFC-45A8-8896-CFFB139DAAA3}) (Version: 2.2.0.1 - SAMSUNG)
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Free YouTube to MP3 Converter version 3.12.35.514 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.35.514 - DVDVideoSoft Ltd.)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie foto Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Garmin Communicator Plugin (HKLM-x32\...\{8ED02445-D491-414C-A56D-2ED6BBB7239A}) (Version: 3.0.1 - Garmin Ltd or its subsidiaries)
Garmin Express (HKLM-x32\...\{b43ffffb-1adc-4bcb-b277-7844ebff94da}) (Version: 3.2.17.0 - Garmin Ltd or its subsidiaries)
Garmin Express (x32 Version: 3.2.17.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin Express Tray (x32 Version: 3.2.17.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin POI Loader (HKLM-x32\...\{3213ED5E-7BBE-4613-BE69-8B1E4FE520DD}) (Version: 2.7.3 - Garmin Ltd or its subsidiaries)
Garmin Training Center (HKLM-x32\...\{2A03B9F8-BE6D-43C6-A16A-B9998A194AF0}) (Version: 3.4.5 - Garmin Ltd or its subsidiaries)
Garmin USB Drivers (HKLM-x32\...\{3D5D6CFC-3097-425A-8D8F-7EAF5D57641D}) (Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)
Garmin WebUpdater (HKLM-x32\...\{00FE2935-FB56-4410-AB5F-D6E70C1771D2}) (Version: 2.5.6 - Garmin Ltd or its subsidiaries)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 37.0.2062.120 - Google Inc.)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
Hattrick Organizer (remove only) (HKLM-x32\...\Hattrick Organizer) (Version: - )
Insaniquarium Deluxe (x32 Version: 2.2.0.82 - WildTangent) Hidden
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2622 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.0.0.1046 - Intel Corporation)
IPTInstaller (HKLM-x32\...\{08208143-777D-4A06-BB54-71BF0AD1BB70}) (Version: 4.0.8 - HTC)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.30 - Irfan Skiljan)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) Hidden
John Deere Drive Green (x32 Version: 2.2.0.82 - WildTangent) Hidden
Juice 2.2.2-a1 (HKLM-x32\...\Juice) (Version: 2.2.2-a1 - Juice Team)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.2.173.0 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (Version: 2.2.173.0 - Microsoft Corporation) Hidden
Mindjet MindManager 2012 (HKLM-x32\...\{2005E0A6-ED25-4B8A-801C-F3A0B846A317}) (Version: 10.0.445 - Mindjet)
Movie Color Enhancer (HKLM-x32\...\{7F6F62F0-7884-4CFB-B86C-597A4A6D9C4D}) (Version: 1.0 - Samsung Electronics Co., Ltd.)
Mozilla Firefox 32.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.1 (x86 de)) (Version: 32.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 32.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM-x32\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
Multimedia POP (HKLM-x32\...\{331ECF61-69AF-4F57-AC35-AFED610231C3}) (Version: 1.1 - )
MyPhoneExplorer (HKLM-x32\...\MPE) (Version: 1.8.6 - F.J. Wechselberger)
NAVIGON Fresh 3.5.1 (HKLM-x32\...\NAVIGON Fresh) (Version: 3.5.1 - NAVIGON)
Norton Online Backup (HKLM-x32\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.1.17869 - Symantec Corporation)
NVIDIA Grafiktreiber 320.49 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 320.49 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.124.810 - NVIDIA Corporation) Hidden
NVIDIA Optimus 1.10.8 (Version: 1.10.8 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.0604 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.0604 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0604 - NVIDIA Corporation)
NVIDIA Systemsteuerung 320.49 (Version: 320.49 - NVIDIA Corporation) Hidden
NVIDIA Update 1.10.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.10.8 - NVIDIA Corporation)
NVIDIA Update Components (Version: 1.10.8 - NVIDIA Corporation) Hidden
PDF-XChange 3 (HKLM\...\PDF-XChange 3_is1) (Version: - Tracker Software)
Peggle (x32 Version: 2.2.0.82 - WildTangent) Hidden
Penguins! (x32 Version: 2.2.0.82 - WildTangent) Hidden
PhoneShare (HKLM-x32\...\{3F50512F-53DF-46B1-8CCB-6C7E638CADD6}) (Version: 9.1.4 - Samsung)
Plants vs. Zombies (x32 Version: 2.2.0.82 - WildTangent) Hidden
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Polar Golfer (x32 Version: 2.2.0.82 - WildTangent) Hidden
Pošta Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Power Vision Software (HKLM\...\{F4DA8B2F-8860-416C-868F-8ABAF6B78033}) (Version: 2.0.6.1319 - Dynojet Research Inc.)
QXL Ricardo Assistant 5 (HKLM-x32\...\QXL Ricardo Assistant 5) (Version: 0.0.0.0 - )
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.36.1224.2010 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6301 - Realtek Semiconductor Corp.)
Samsung AnyWeb Print (HKLM-x32\...\{318DBE01-1E6B-4243-84B0-210391FE789A}) (Version: 1.1.21.0 - Samsung Electronics Co., Ltd.)
Samsung AnyWeb Print (x32 Version: 1.0 - Samsung Electronics Co., Ltd.) Hidden
Samsung Recovery Solution 5 (HKLM-x32\...\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}) (Version: 5.0.0.10 - Samsung)
Samsung Support Center 1.0 (HKLM-x32\...\{F687E657-F636-44DF-8125-9FEEA2C362F5}) (Version: 1.1.38 - Samsung)
Samsung Universal Print Driver (HKLM-x32\...\Samsung Universal Print Driver) (Version: 2.01.06.00:16 - Samsung Electronics Co., Ltd.)
Samsung Universal Scan Driver (HKLM-x32\...\Samsung Universal Scan Driver) (Version: 1.2.1.0 - Samsung Electronics Co., Ltd.)
Samsung Update Plus (HKLM-x32\...\{142D8CA7-2C6F-45A7-83E3-099AAFD99133}) (Version: 3.0.1.17 - Samsung Electronics Co., Ltd.)
Sansa Updater (HKCU\...\Sansa Updater) (Version: 1.313 - SanDisk Corporation)
Seagate Dashboard (HKLM-x32\...\{67445E65-3D93-428F-83A5-446F7D02689A}) (Version: 3.1.3.0 - Seagate)
SISShortcut (HKLM-x32\...\{FDAE128F-A355-42B1-8422-1AF3ACEE34F4}) (Version: 1.00.000 - Samsung)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Sony Ericsson Update Engine (HKLM-x32\...\Update Engine) (Version: 2.11.10.7 - Sony Ericsson Mobile Communications AB)
SportTracks 3.1 (HKLM-x32\...\{99895EF0-B290-4B21-B1FE-FB00E1B5D195}) (Version: 3.1.5314 - Zone Five Software)
Überwachungstool für die Intel® Turbo-Boost-Technik 2.0 (HKLM\...\{B77EFA0B-9BD3-4122-9F9A-15A963B5EA24}) (Version: 2.0.82.0 - Intel)
UBS Pay 5.6.004 (build 1) (HKLM-x32\...\{99CA9F1B-2774-40D4-BAE1-BC3CE7D85018}) (Version: 05.06.0401 - UBS AG)
UBSPay PayNet Extension 2.1.002 (b2) (HKLM-x32\...\{C4B39EAA-57BE-4446-8604-5121A6965545}) (Version: 02.01.0202 - UBS AG)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2889914) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{F3F83933-75FC-4B60-84F2-3F8FA63D042E}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
User Guide (HKLM-x32\...\{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}) (Version: 1.0 - )
VLC media player 1.1.11 (HKLM-x32\...\VLC media player) (Version: 1.1.11 - VideoLAN)
VobSub v2.23 (Remove Only) (HKLM-x32\...\VobSub) (Version: - )
WIDCOMM Bluetooth Software (HKLM\...\{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}) (Version: 6.3.0.7600 - Broadcom Corporation)
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.1.5 - WildTangent)
WildTangent ORB Game Console (x32 Version: - WildTangent) Hidden
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (04/19/2012 2.3.1.0) (HKLM\...\98157A226B40B173301B0F53C8E98C47805D5152) (Version: 04/19/2012 2.3.1.0 - Garmin)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live fotoattēlu galerija (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogaléria (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Foto-galerija (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalleri (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotoğraf Galerisi (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotótár (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Galeria de Fotos (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Galerija fotografija (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Pošta (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 메일 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 사진 갤러리 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 필수 패키지 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 影像中心 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 照片库 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 程式集 (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live 程式集 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 软件包 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven sähköposti (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven valokuvavalikoima (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
Windows-Treiberpaket - Dynastream Innovations, Inc. ANT LibUSB Drivers (04/11/2012 1.2.40.201) (HKLM\...\F9D2A789F9CFF8CEC36B544F53877C80F1F73C46) (Version: 04/11/2012 1.2.40.201 - Dynastream Innovations, Inc.)
Windows-Treiberpaket - Silicon Labs Software (DSI_SiUSBXp_3_1) USB (02/06/2007 3.1) (HKLM\...\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software)
WinRAR 5.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
WordCaptureX Pro (HKLM-x32\...\{139C1D95-9037-3AB3-F5F4-4A79BF6831EC}) (Version: 4.0.0 - Deskperience)
Zattoo4 4.0.5 (HKLM-x32\...\Zattoo4) (Version: 4.0.5 - Zattoo Inc.)
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Почта Windows Live (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Фотогалерия на Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
بريد Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
معرض صور Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\bernie\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\bernie\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\bernie\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\bernie\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\bernie\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\bernie\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\bernie\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\bernie\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\bernie\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
==================== Restore Points =========================
01-09-2014 10:09:00 Installed Seagate Dashboard.
01-09-2014 21:44:59 Windows Update
05-09-2014 21:33:43 Windows Update
11-09-2014 13:34:59 Windows Update
11-09-2014 22:26:37 Windows Update
13-09-2014 11:45:28 ComboFix created restore point
13-09-2014 15:03:59 zoek.exe restore point
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2014-09-13 14:00 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {0A095A88-3C29-427D-A4D6-D08A449B846F} - System32\Tasks\SamsungSupportCenter => C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe [2011-09-04] (SAMSUNG Electronics)
Task: {32F58E55-1084-4966-A24B-E0E14E1D2883} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-11] (Adobe Systems Incorporated)
Task: {341E50B1-516C-450C-893F-B27D631A2BA3} - System32\Tasks\bernie Merge => C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\NBCore.exe [2014-04-30] (Seagate Technology LLC)
Task: {3C278BCA-231F-44F0-81DC-C82ED199D770} - System32\Tasks\MovieColorEnhancer => C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe [2010-11-29] (Samsung Electronics Co., Ltd.)
Task: {434AEA50-953F-484D-AFF0-1106D3F818DB} - System32\Tasks\{748B4F7E-7007-48A8-9172-FDF277577ABD} => Firefox.exe
Task: {45087653-CB61-45B2-B51C-8C36BCB941E1} - System32\Tasks\bernie DBAgent 2 0 => C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\DBAgent.exe [2014-04-30] (Seagate Technology LLC)
Task: {57CE4D70-6963-41A6-AB37-4A03DA510D4C} - System32\Tasks\EasySpeedUpManager => C:\Program Files (x86)\Samsung\EasySpeedUpManager\EasySpeedUpManager2.exe [2010-12-23] (Samsung Electronics)
Task: {5E6D4B98-C0B7-4D32-BF7F-A39E0CC879D5} - System32\Tasks\BatteryLifeExtender => C:\Program Files (x86)\Samsung\BatteryLifeExtender\BatteryLifeExtender.exe [2010-12-18] (Samsung Electronics. Co. Ltd.)
Task: {63FB381D-D7B5-4E11-AF4C-78708675BDEC} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)
Task: {65D05265-0823-423B-9A24-567EDE30E866} - System32\Tasks\SUPBackground => C:\Program Files (x86)\Samsung\Samsung Update Plus\SUPBackground.exe [2011-12-20] (Samsung Electronics)
Task: {77ACFA9E-80DF-4079-8018-BB1D4F451470} - System32\Tasks\{A2D25906-EDBE-409F-9331-6740B243AC43} => Firefox.exe
Task: {7C24F3CB-8BA8-478C-B715-014564826342} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2010-11-10] (CyberLink)
Task: {861D1A4A-85E0-4192-BDFD-A52BAEC35913} - System32\Tasks\WifiManager => C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe [2011-01-04] (Samsung Electronics Co., Ltd.)
Task: {8BF2CF48-9685-4BA3-A649-AB6213A08FBD} - System32\Tasks\{513C43F7-E3B0-4E5C-8898-3C747CB6A296} => Firefox.exe
Task: {94B43B29-0E75-4F4C-8170-84ED93DA0814} - System32\Tasks\NCH Software\ExpressZipReminder => C:\Program Files (x86)\NCH Software\ExpressZip\ExpressZip.exe
Task: {9A4C3D11-5002-4292-840E-F7E9B3C70E35} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)
Task: {A1D2D9C4-17B0-4563-8881-817404C12BAD} - System32\Tasks\SmartRestarter => C:\Program Files\Samsung\SamsungFastStart\SmartRestarter.exe [2010-08-05] (Samsung Electronics Co., Ltd.)
Task: {ADD1A2CD-48F4-455A-9C48-0158947EF657} - System32\Tasks\advSRS5 => C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe [2010-11-17] (SEC)
Task: {B1F67B28-6DAD-4D83-BCD7-C18E0AB99D77} - System32\Tasks\bernie => C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\NBCore.exe [2014-04-30] (Seagate Technology LLC)
Task: {C63BA876-2CC9-4FB6-8285-80EEDFBC8556} - System32\Tasks\Launch HTC Sync Loader => C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe
Task: {C815ABD9-D7A2-49F9-9310-43B8ADFF2C1E} - System32\Tasks\EasyBatteryManager => C:\Program Files (x86)\Samsung\EasyBatteryManager\EasyBatteryMgr4.exe [2010-07-20] (SAMSUNG Electronics co., LTD.)
Task: {D39CAEF2-F8AB-4E92-9D23-22D978FDDCD5} - System32\Tasks\Seagate_Install_Launch => C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Dashboard.exe [2014-04-30] (Seagate Technology LLC)
Task: {DD01003A-3323-488B-AF6A-F0815B0A9CCA} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)
Task: {DDF6112A-0E0B-444E-AAA9-FAE71EEBDC7B} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2013-05-13] (Microsoft)
Task: {DE0AA40B-C247-44CA-A0C7-B90038E1A26C} - System32\Tasks\GarminUpdaterTask => C:\Program Files (x86)\Garmin\Express Self Updater\ExpressSelfUpdater.exe [2014-08-07] ()
Task: {DE2521FE-3B56-4F47-8A46-B31A83C0139C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-09-09] (Google Inc.)
Task: {E393A237-CA1D-425C-9C87-C2F9582C8976} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)
Task: {EEFC22EC-2C3E-4E6C-903F-FD6A46FCDD95} - System32\Tasks\EasyDisplayMgr => C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe [2010-12-23] (Samsung Electronics Co., Ltd.)
Task: {FDFF8AC8-E07E-4F07-AD8E-4B4D8D605F13} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-09-09] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2011-09-08 12:32 - 2008-06-05 01:53 - 00027648 _____ () C:\Windows\System32\spd__l.dll
2013-09-15 10:19 - 2013-06-21 12:23 - 00087328 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-09-14 16:07 - 2012-12-07 17:26 - 00167424 _____ () C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
2011-03-15 09:00 - 2009-12-01 09:21 - 00244904 ____N () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
2011-03-15 23:56 - 2010-12-17 02:37 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-08-27 15:00 - 2014-08-27 15:00 - 00139056 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll
2014-08-27 15:00 - 2014-08-27 15:00 - 00066864 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.AvConnectorNative.dll
2011-03-15 08:49 - 2006-08-12 05:48 - 00049152 _____ () C:\Program Files (x86)\Samsung\Easy Display Manager\HookDllPS2.dll
2014-09-13 16:53 - 2014-09-13 16:53 - 00043008 _____ () c:\users\bernie\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpmw8_4m.dll
2013-08-23 21:01 - 2013-08-23 21:01 - 25100288 _____ () C:\Users\bernie\AppData\Roaming\Dropbox\bin\libcef.dll
2011-09-14 14:02 - 2011-09-14 14:02 - 00150856 _____ () C:\Program Files (x86)\Mindjet\MindManager 10\zlib.dll
2014-09-13 14:39 - 2014-08-27 15:00 - 00052472 _____ () C:\Users\bernie\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
2011-03-15 09:08 - 2010-05-07 16:22 - 01636864 _____ () C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\Resdll.dll
2009-11-02 07:20 - 2009-11-02 07:20 - 00619816 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
2009-11-02 07:23 - 2009-11-02 07:23 - 00013096 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
2011-03-15 09:07 - 2010-07-05 12:42 - 00203776 _____ () C:\Program Files (x86)\Samsung\Movie Color Enhancer\WinCRT.dll
2014-09-12 19:25 - 2014-09-04 05:01 - 01098056 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.120\libglesv2.dll
2014-09-12 19:25 - 2014-09-04 05:01 - 00174408 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.120\libegl.dll
2014-09-12 19:25 - 2014-09-04 05:01 - 08577864 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.120\pdf.dll
2014-09-12 19:25 - 2014-09-04 05:01 - 00331592 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.120\ppGoogleNaClPluginChrome.dll
2014-09-12 19:25 - 2014-09-04 05:01 - 01660232 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.120\ffmpegsumo.dll
2014-09-12 19:25 - 2014-09-04 05:01 - 14891848 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.120\PepperFlash\pepflashplayer.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (09/05/2014 11:31:21 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ipmGui.exe, Version: 14.0.6.522, Zeitstempel: 0x53bec647
Name des fehlerhaften Moduls: ipmGui.exe, Version: 14.0.6.522, Zeitstempel: 0x53bec647
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000795b
ID des fehlerhaften Prozesses: 0xef0
Startzeit der fehlerhaften Anwendung: 0xipmGui.exe0
Pfad der fehlerhaften Anwendung: ipmGui.exe1
Pfad des fehlerhaften Moduls: ipmGui.exe2
Berichtskennung: ipmGui.exe3
Error: (09/01/2014 06:09:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 31.0.0.5310, Zeitstempel: 0x53c75e91
Name des fehlerhaften Moduls: mozalloc.dll, Version: 31.0.0.5310, Zeitstempel: 0x53c72e91
Ausnahmecode: 0x80000003
Fehleroffset: 0x0000141b
ID des fehlerhaften Prozesses: 0xb6c
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Error: (08/31/2014 06:08:09 PM) (Source: Avira Antivirus) (EventID: 4117) (User: NT-AUTORITÄT)
Description: Die Lizenzdatei enthält keine gültige Lizenz. Der Dienst wird beendet!
Error: (08/31/2014 05:44:25 PM) (Source: Avira Antivirus) (EventID: 4117) (User: NT-AUTORITÄT)
Description: Die Lizenzdatei enthält keine gültige Lizenz. Der Dienst wird beendet!
Error: (08/31/2014 05:28:42 PM) (Source: Avira Antivirus) (EventID: 4117) (User: NT-AUTORITÄT)
Description: Die Lizenzdatei enthält keine gültige Lizenz. Der Dienst wird beendet!
Error: (08/31/2014 05:18:21 PM) (Source: Avira Antivirus) (EventID: 4117) (User: NT-AUTORITÄT)
Description: Die Lizenzdatei enthält keine gültige Lizenz. Der Dienst wird beendet!
Error: (08/31/2014 11:48:41 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: SHELL32.dll, Version: 6.1.7601.18517, Zeitstempel: 0x53aa2e07
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000050506
ID des fehlerhaften Prozesses: 0x1414
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3
Error: (08/31/2014 11:48:04 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: SHELL32.dll, Version: 6.1.7601.18517, Zeitstempel: 0x53aa2e07
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000050506
ID des fehlerhaften Prozesses: 0x132c
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3
Error: (08/31/2014 11:24:34 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: SHELL32.dll, Version: 6.1.7601.18517, Zeitstempel: 0x53aa2e07
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000050506
ID des fehlerhaften Prozesses: 0x1070
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3
Error: (08/31/2014 11:19:32 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: SHELL32.dll, Version: 6.1.7601.18517, Zeitstempel: 0x53aa2e07
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000050506
ID des fehlerhaften Prozesses: 0xa50
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3
System errors:
=============
Error: (09/13/2014 04:50:04 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (09/13/2014 04:50:04 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (09/13/2014 04:22:03 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (09/13/2014 04:22:03 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (09/13/2014 02:43:38 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (09/13/2014 02:43:38 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (09/13/2014 02:04:37 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (09/13/2014 02:04:37 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (09/13/2014 02:00:08 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error: (09/13/2014 01:57:09 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\ComboFix\catchme.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Microsoft Office Sessions:
=========================
Error: (12/31/2012 05:33:41 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 29 seconds with 0 seconds of active time. This session ended with a crash.
Error: (07/23/2012 07:48:26 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 1126 seconds with 1020 seconds of active time. This session ended with a crash.
CodeIntegrity Errors:
===================================
Date: 2014-09-13 13:57:09.128
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-09-13 13:57:08.940
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2011-09-09 17:26:36.913
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\bernie\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2011-09-09 17:26:36.840
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\bernie\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2011-09-09 17:26:36.720
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2011-09-09 17:26:36.655
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-2410M CPU @ 2.30GHz
Percentage of memory in use: 35%
Total physical RAM: 6057.55 MB
Available physical RAM: 3932.48 MB
Total Pagefile: 12113.27 MB
Available Pagefile: 9573.63 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:177 GB) (Free:77.17 GB) NTFS
Drive d: () (Fixed) (Total:264.78 GB) (Free:204.09 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: FDF38C38)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=177 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=264.8 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=23.9 GB) - (Type=27)
==================== End Of Log ============================
|
|
14.09.2014, 09:44
| #9 |
| /// TB-Ausbilder | Chrome und Firefox öffnen ständig Werbeseiten,Malwarebytes funktionioniert nicht mehr,auch nicht mit Chameleon Wir entfernen die letzten Reste und kontrollieren nochmal alles. ESET kann länger (> 3 h) dauern. Im Anschluss entfernen wir alle verwendeten Tools und ich gebe dir noch ein paar Tipps mit auf den Weg. Schritt 1 Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter start
CloseProcesses:
Task: {434AEA50-953F-484D-AFF0-1106D3F818DB} - System32\Tasks\{748B4F7E-7007-48A8-9172-FDF277577ABD} => Firefox.exe
Task: {77ACFA9E-80DF-4079-8018-BB1D4F451470} - System32\Tasks\{A2D25906-EDBE-409F-9331-6740B243AC43} => Firefox.exe
Task: {8BF2CF48-9685-4BA3-A649-AB6213A08FBD} - System32\Tasks\{513C43F7-E3B0-4E5C-8898-3C747CB6A296} => Firefox.exe
Task: {8BF2CF48-9685-4BA3-A649-AB6213A08FBD} - System32\Tasks\{513C43F7-E3B0-4E5C-8898-3C747CB6A296} => Firefox.exe
Task: {94B43B29-0E75-4F4C-8170-84ED93DA0814} - System32\Tasks\NCH Software\ExpressZipReminder => C:\Program Files (x86)\NCH Software\ExpressZip\ExpressZip.exe
c:\windows\System32\Tasks\NCH Software
C:\Program Files (x86)\NCH Software
EmptyTemp:
end
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Schritt 2 ESET Online Scanner
Schritt 3 Downloade Dir bitte  SecurityCheck und:
Schritt 4 Lade dir die passende Version von SystemLook vom folgenden Spiegel herunter und speichere das Tool auf dem Desktop: SystemLook (32 bit) | SystemLook (64 bit)
Bitte poste mit deiner nächsten Antwort
|
|
14.09.2014, 19:51
| #10 |
| | Chrome und Firefox öffnen ständig Werbeseiten,Malwarebytes funktionioniert nicht mehr,auch nicht mit Chameleon Die neuen Schritte habe ich jetzt abgearbeitet. Hier die entsprechenden Log Files FRST fix: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 12-09-2014
Ran by bernie at 2014-09-14 17:02:57 Run:1
Running from C:\Users\bernie\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
start
CloseProcesses:
Task: {434AEA50-953F-484D-AFF0-1106D3F818DB} - System32\Tasks\{748B4F7E-7007-48A8-9172-FDF277577ABD} => Firefox.exe
Task: {77ACFA9E-80DF-4079-8018-BB1D4F451470} - System32\Tasks\{A2D25906-EDBE-409F-9331-6740B243AC43} => Firefox.exe
Task: {8BF2CF48-9685-4BA3-A649-AB6213A08FBD} - System32\Tasks\{513C43F7-E3B0-4E5C-8898-3C747CB6A296} => Firefox.exe
Task: {8BF2CF48-9685-4BA3-A649-AB6213A08FBD} - System32\Tasks\{513C43F7-E3B0-4E5C-8898-3C747CB6A296} => Firefox.exe
Task: {94B43B29-0E75-4F4C-8170-84ED93DA0814} - System32\Tasks\NCH Software\ExpressZipReminder => C:\Program Files (x86)\NCH Software\ExpressZip\ExpressZip.exe
c:\windows\System32\Tasks\NCH Software
C:\Program Files (x86)\NCH Software
EmptyTemp:
end
*****************
Processes closed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{434AEA50-953F-484D-AFF0-1106D3F818DB}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{434AEA50-953F-484D-AFF0-1106D3F818DB}" => Key deleted successfully.
C:\Windows\System32\Tasks\{748B4F7E-7007-48A8-9172-FDF277577ABD} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{748B4F7E-7007-48A8-9172-FDF277577ABD}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{77ACFA9E-80DF-4079-8018-BB1D4F451470}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{77ACFA9E-80DF-4079-8018-BB1D4F451470}" => Key deleted successfully.
C:\Windows\System32\Tasks\{A2D25906-EDBE-409F-9331-6740B243AC43} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{A2D25906-EDBE-409F-9331-6740B243AC43}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8BF2CF48-9685-4BA3-A649-AB6213A08FBD}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8BF2CF48-9685-4BA3-A649-AB6213A08FBD}" => Key deleted successfully.
C:\Windows\System32\Tasks\{513C43F7-E3B0-4E5C-8898-3C747CB6A296} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{513C43F7-E3B0-4E5C-8898-3C747CB6A296}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8BF2CF48-9685-4BA3-A649-AB6213A08FBD}" => Key not found.
C:\Windows\System32\Tasks\{513C43F7-E3B0-4E5C-8898-3C747CB6A296} not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{513C43F7-E3B0-4E5C-8898-3C747CB6A296}" => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{94B43B29-0E75-4F4C-8170-84ED93DA0814}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{94B43B29-0E75-4F4C-8170-84ED93DA0814}" => Key deleted successfully.
C:\Windows\System32\Tasks\NCH Software\ExpressZipReminder => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\NCH Software\ExpressZipReminder" => Key deleted successfully.
c:\windows\System32\Tasks\NCH Software => Moved successfully.
"C:\Program Files (x86)\NCH Software" => File/Directory not found.
EmptyTemp: => Removed 828.8 MB temporary data.
The system needed a reboot.
==== End of Fixlog ====
Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=3f7ca94294c72c48b6113ddd7b5d98f1
# engine=19915
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-08-30 10:54:18
# local_time=2014-08-30 12:54:18 (+0100, Mitteleuropäische Sommerzeit)
# country="Switzerland"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 46189 153898832 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 57184 161025908 0 0
# scanned=276287
# found=52
# cleaned=0
# scan_time=7294
sh=8992F72873D09212597E582A16F8D9BC60E6A22A ft=1 fh=e21391a34e842ffc vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\DVDVideoSoft\TB\ConduitInstaller.exe.vir"
sh=0BC47DE01BA10961EE0D7D6C95A9916DA748A5C7 ft=1 fh=39158cfce6f871c9 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe.vir"
sh=68BF1E0437E11832B4DC5E9923DCA5FFB92914AC ft=1 fh=fe3fcc60a0369b2a vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\SPTool.dll.vir"
sh=74ADF35C3A3456993B5D72F70AE1EDEB28987C80 ft=1 fh=90d7e36e3b85c7e4 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\uninstall.exe.vir"
sh=4929EB5864840E7F5A0ACA7FA5723D703F4B5E73 ft=1 fh=ce188f0b56e64136 vn="Variante von Win32/Conduit.SearchProtect.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe.vir"
sh=C1C4A9783C1F509E37A328A0C16F556C2F8DDFA2 ft=1 fh=afa1bf8c8fc4ffe1 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPTool64.exe.vir"
sh=8A0819C25BB2568FF451BED451955B4E69E724D7 ft=1 fh=7bc6a5dd57c41934 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32.dll.vir"
sh=53BD46E5463C07C3BBDFD087401F2E08A08688A3 ft=1 fh=d7610d97dff53ad1 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll.vir"
sh=D0A19C8A6E8262E5A49AD278DB110F8521CA6BD9 ft=1 fh=b7d04a9494a7c178 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64.dll.vir"
sh=01E8A066B023DAACD6FE9CBC35372A56BE6EC5B1 ft=1 fh=832dcd421f4cfd2d vn="Variante von Win64/Conduit.SearchProtect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll.vir"
sh=FB7948E63D42672E50D4A521CDB6DBACD615D773 ft=1 fh=fc81cec60cf9c6da vn="Variante von Win32/Conduit.SearchProtect.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe.vir"
sh=16068B8977B4DC562AE782D91BC009472667E331 ft=1 fh=c3b5a87b7d152749 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\bernie\AppData\Local\Temp\OCS\ocs_v71a.exe.vir"
sh=31CE21FE36C11E107A6E315EFE1875743809B4CC ft=1 fh=48abcfa6ce4a4014 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\bernie\AppData\Local\Temp\OCS\ocs_v71b.exe.vir"
sh=A15C9536148CE02615132AE1DB1A6BF8F873A726 ft=1 fh=41c25fe63c7f6257 vn="Win32/Toolbar.Conduit.R evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\bernie\AppData\Roaming\OpenCandy\7E340BC032964A51AF4D6F34ADC3926E\search_protect_global.exe.vir"
sh=9E77E1D2FD7B77B0FD8A71A70C35DD5A16836CF3 ft=1 fh=b241df9fafd25e77 vn="Win32/Systweak.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\bernie\AppData\Roaming\Systweak\ssd\SSDPTstub.exe.vir"
sh=C5AA96F17ED2B68CA4C839EA7394F4534B4F5C3F ft=1 fh=57a85fb4fd4bc01c vn="Variante von Win64/Systweak.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\System32\roboot64.exe.vir"
sh=3B29C36CCB0FD00A0812896E61D3AE6CE18E5EEE ft=1 fh=5ce1e22016c2ce7d vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1EBKHZZY\spstub[1].exe"
sh=F94104F2D991A9E5D015EB923AFCDA375CEE1CCE ft=1 fh=f5a775242e081da4 vn="Win32/Toolbar.Conduit.U evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7OSZCM0J\sp-downloader[1].exe"
sh=CEFE0A678B49D72BDCC996F79CF2DB0B95FEF6B1 ft=1 fh=9d7011981dcd65ae vn="Win32/SpeedUpMyPC evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7OSZCM0J\SpeedUpMyPC-standalone-setup[1].exe"
sh=A45F3906F9738DDE4B8A1B9710B5299F1910A1C1 ft=1 fh=6e0be9ea4b96459a vn="Win32/SpeedUpMyPC.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FXWWPLIZ\speedupmypc[1].exe"
sh=FEC19241949864DE766A2D193BC81E3366E379E4 ft=1 fh=ac6e9bcd558de938 vn="Win32/Conduit.SearchProtect.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FXWWPLIZ\SPSetup[1].exe"
sh=0FFBBBFC9857649822BC4ADF08BF4697B8B85D33 ft=1 fh=6d1ecaf81c317ba8 vn="Variante von Win32/TrojanDownloader.Agent.ALF Trojaner" ac=I fn="C:\Users\bernie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T6IOV97F\scstmp[2].exe"
sh=063BCA5022A1D489D0237CEE68441868E128E707 ft=1 fh=9eefb7e9fe25901a vn="Variante von Win32/Toolbar.Babylon.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Temp\addit20.EXE"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Temp\nsa949B.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Temp\nsaCC64.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Temp\nsf9075.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Temp\nsqC34E.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Temp\nsqC745.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Temp\nsv9A95.exe"
sh=C4420C6E94B8CAACCB3811384280D8A93CB0A37D ft=1 fh=25f111c507a31a21 vn="Win32/Toolbar.Conduit.R evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Temp\sp-downloader.exe"
sh=953D44F4BF59B02BE6E35587DAF60E63463E78C3 ft=1 fh=a83bfe4d2b644d64 vn="Variante von Win32/Toolbar.Babylon.H evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Temp\9B4D979D-BAB0-7891-8BDC-EF907F113DD9\Setup.exe"
sh=CEFE0A678B49D72BDCC996F79CF2DB0B95FEF6B1 ft=1 fh=9d7011981dcd65ae vn="Win32/SpeedUpMyPC evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Temp\is-QKK75.tmp\SpeedUpMyPC-standalone-setup.exe"
sh=C7241007662586F5DE3A9F9927CFBD9D52A52AC9 ft=1 fh=a7692001af61d921 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Temp\nsv747C\SpSetup.exe"
sh=99F97AD369E8621AB4D17DF53E80E60FEE99C727 ft=1 fh=42567613b862d846 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\AppData\Local\Temp\OCS\ocs_v71b.exe"
sh=7AE9F4A5943569504C24D1043551115688387E73 ft=1 fh=81fa830a32c99e11 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\Downloads\7 Zip 32 Bit - CHIP-Downloader.exe"
sh=E1476812A4BD414F53416C93AF14D22BFEFBFF7D ft=1 fh=e6a33b27fb0ee099 vn="Variante von Win32/Toolbar.Babylon.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\Downloads\Babylon9_setup.exe"
sh=FF42995D8E24E05FF9EBA12DCB27B9AAB183A290 ft=1 fh=605214e765268a80 vn="Variante von Win32/Toolbar.Conduit.AI evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\Downloads\FreeYouTubeToMP3Converter31011.exe"
sh=0EE947E611E936E7EC88C1B521B27D07FC423B75 ft=1 fh=a54b09b9b27a9c95 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\Downloads\Samsung Channel List PC Editor - CHIP-Installer.exe"
sh=9D5B7F6FF554136FDC44EBC640FF6DD93F5D4030 ft=1 fh=17a582e231c0604a vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\Downloads\youtube2mp3-1.2.4 - CHIP-Downloader.exe"
sh=66023B99067DCD391F9FDC797F7F20812D5403AD ft=1 fh=3dc61c98ed8d0974 vn="Variante von Generik.LMYDTZQ Trojaner" ac=I fn="D:\Backup11\Downloads\kazaa\kazaa_lite.exe"
sh=A4A3F88F6E8AC0FB9F3370E7666FEF74CF583029 ft=1 fh=f2201697f19ea9bb vn="Variante von Win32/Adware.Kazaa.A Anwendung" ac=I fn="D:\Backup11\Downloads\kazaa\kmd.exe"
sh=03A7D97387FBF9BAC969A591B68A8EDC2D493417 ft=1 fh=02850d967aa2d2ec vn="Variante von Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="D:\Backup11\Downloads\regi\asc-setup.exe"
sh=0152FB975FDBEA6FFA27BB8038FBA0DBC983EF3F ft=1 fh=d957d30811d3851e vn="Win32/RegistryBooster evtl. unerwünschte Anwendung" ac=I fn="D:\Backup11\Downloads\regi\registrybooster.exe"
sh=D931ACFEC77DB89FF56A2E8EE89C7941F8B8E82E ft=1 fh=3fb4448e9a99ad06 vn="Win32/RegistryBooster evtl. unerwünschte Anwendung" ac=I fn="D:\Backup11\Downloads\regi\registrybooster2011.exe"
sh=D201EB86D971A3C87B474D8811F0FDD595DA92CF ft=0 fh=0000000000000000 vn="Variante von Win32/Dialer.StarDialer Anwendung" ac=I fn="D:\Backup11\Downloads\serials\s2k.serials2k7.1.zip"
sh=FA2B3944279DF512591C4912182F924DB6618BA0 ft=0 fh=0000000000000000 vn="Variante von Win32/Dialer.StarDialer Anwendung" ac=I fn="D:\Backup11\Downloads\serials\update\dtg.010103.full.zip"
sh=6EDDB2EB783CFCB3BDC20E9799CD0BB014FD9040 ft=0 fh=0000000000000000 vn="Variante von Win32/Dialer.StarDialer Anwendung" ac=I fn="D:\Backup11\Downloads\serials\update\fms.2003-04-15.full.zip"
sh=48E2C976ECD217B68CA91EBCCD89CD0146BE3699 ft=1 fh=5d265ee2fd010414 vn="Mehrere Bedrohungen" ac=I fn="D:\Backup11\Tools\Tools\Freeware\regetjr.exe"
sh=EF2249272FFA5746D60EFD6373D139A8DA874E7D ft=1 fh=d1d07989e880c5cc vn="Mehrere Bedrohungen" ac=I fn="D:\Backup11\Tools\Tools\iMeshV3\iMeshV3.exe"
sh=9193581E2E18DBBBF4F63A11BB35EAC644B99706 ft=1 fh=c192647f90f20529 vn="möglicherweise Variante von Win32/Adware.WurldMedia Anwendung" ac=I fn="D:\Backup11\Tools\Tools\morpheus\installm19.exe"
sh=23095DE6FFA0C14E2E2C6881A4EAEF7FE414C6BF ft=1 fh=c71c00118ba24104 vn="Variante von Win32/InstallCore.OF evtl. unerwünschte Anwendung" ac=I fn="D:\Downloads\Garmin\garmin-lifetime-updater-2.exe"
sh=9731CDE471BFED17B474F7A099E8CF8CFB7781C4 ft=1 fh=d37785297e6be4db vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="D:\Downloads\navigon\Navigon Fresh - CHIP-Downloader.exe"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=3085503e3d7ace408ef4b3a45dda7f29
# engine=19915
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-08-30 01:57:50
# local_time=2014-08-30 03:57:50 (+0100, Mitteleuropäische Sommerzeit)
# country="Switzerland"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777214 100 100 8921 153909844 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 7943 161036920 0 0
# scanned=272878
# found=52
# cleaned=52
# scan_time=7652
sh=8992F72873D09212597E582A16F8D9BC60E6A22A ft=1 fh=e21391a34e842ffc vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\DVDVideoSoft\TB\ConduitInstaller.exe.vir"
sh=0BC47DE01BA10961EE0D7D6C95A9916DA748A5C7 ft=1 fh=39158cfce6f871c9 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe.vir"
sh=68BF1E0437E11832B4DC5E9923DCA5FFB92914AC ft=1 fh=fe3fcc60a0369b2a vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\SPTool.dll.vir"
sh=74ADF35C3A3456993B5D72F70AE1EDEB28987C80 ft=1 fh=90d7e36e3b85c7e4 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\uninstall.exe.vir"
sh=4929EB5864840E7F5A0ACA7FA5723D703F4B5E73 ft=1 fh=ce188f0b56e64136 vn="Variante von Win32/Conduit.SearchProtect.I evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe.vir"
sh=C1C4A9783C1F509E37A328A0C16F556C2F8DDFA2 ft=1 fh=afa1bf8c8fc4ffe1 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPTool64.exe.vir"
sh=8A0819C25BB2568FF451BED451955B4E69E724D7 ft=1 fh=7bc6a5dd57c41934 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32.dll.vir"
sh=53BD46E5463C07C3BBDFD087401F2E08A08688A3 ft=1 fh=d7610d97dff53ad1 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll.vir"
sh=D0A19C8A6E8262E5A49AD278DB110F8521CA6BD9 ft=1 fh=b7d04a9494a7c178 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64.dll.vir"
sh=01E8A066B023DAACD6FE9CBC35372A56BE6EC5B1 ft=1 fh=832dcd421f4cfd2d vn="Variante von Win64/Conduit.SearchProtect.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll.vir"
sh=FB7948E63D42672E50D4A521CDB6DBACD615D773 ft=1 fh=fc81cec60cf9c6da vn="Variante von Win32/Conduit.SearchProtect.I evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe.vir"
sh=16068B8977B4DC562AE782D91BC009472667E331 ft=1 fh=c3b5a87b7d152749 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\bernie\AppData\Local\Temp\OCS\ocs_v71a.exe.vir"
sh=99F97AD369E8621AB4D17DF53E80E60FEE99C727 ft=1 fh=42567613b862d846 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\bernie\AppData\Local\Temp\OCS\ocs_v71b.exe.vir"
sh=A15C9536148CE02615132AE1DB1A6BF8F873A726 ft=1 fh=41c25fe63c7f6257 vn="Win32/Toolbar.Conduit.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\bernie\AppData\Roaming\OpenCandy\7E340BC032964A51AF4D6F34ADC3926E\search_protect_global.exe.vir"
sh=9E77E1D2FD7B77B0FD8A71A70C35DD5A16836CF3 ft=1 fh=b241df9fafd25e77 vn="Win32/Systweak.G evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\bernie\AppData\Roaming\Systweak\ssd\SSDPTstub.exe.vir"
sh=C5AA96F17ED2B68CA4C839EA7394F4534B4F5C3F ft=1 fh=57a85fb4fd4bc01c vn="Variante von Win64/Systweak.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Windows\System32\roboot64.exe.vir"
sh=3B29C36CCB0FD00A0812896E61D3AE6CE18E5EEE ft=1 fh=5ce1e22016c2ce7d vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1EBKHZZY\spstub[1].exe"
sh=F94104F2D991A9E5D015EB923AFCDA375CEE1CCE ft=1 fh=f5a775242e081da4 vn="Win32/Toolbar.Conduit.U evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7OSZCM0J\sp-downloader[1].exe"
sh=CEFE0A678B49D72BDCC996F79CF2DB0B95FEF6B1 ft=1 fh=9d7011981dcd65ae vn="Win32/SpeedUpMyPC evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7OSZCM0J\SpeedUpMyPC-standalone-setup[1].exe"
sh=A45F3906F9738DDE4B8A1B9710B5299F1910A1C1 ft=1 fh=6e0be9ea4b96459a vn="Win32/SpeedUpMyPC.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FXWWPLIZ\speedupmypc[1].exe"
sh=FEC19241949864DE766A2D193BC81E3366E379E4 ft=1 fh=ac6e9bcd558de938 vn="Win32/Conduit.SearchProtect.Q evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FXWWPLIZ\SPSetup[1].exe"
sh=0FFBBBFC9857649822BC4ADF08BF4697B8B85D33 ft=1 fh=6d1ecaf81c317ba8 vn="Variante von Win32/TrojanDownloader.Agent.ALF Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T6IOV97F\scstmp[2].exe"
sh=063BCA5022A1D489D0237CEE68441868E128E707 ft=1 fh=9eefb7e9fe25901a vn="Variante von Win32/Toolbar.Babylon.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Temp\addit20.EXE"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Temp\nsa949B.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Temp\nsaCC64.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Temp\nsf9075.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Temp\nsqC34E.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Temp\nsqC745.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Temp\nsv9A95.exe"
sh=C4420C6E94B8CAACCB3811384280D8A93CB0A37D ft=1 fh=25f111c507a31a21 vn="Win32/Toolbar.Conduit.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Temp\sp-downloader.exe"
sh=953D44F4BF59B02BE6E35587DAF60E63463E78C3 ft=1 fh=a83bfe4d2b644d64 vn="Variante von Win32/Toolbar.Babylon.H evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Temp\9B4D979D-BAB0-7891-8BDC-EF907F113DD9\Setup.exe"
sh=CEFE0A678B49D72BDCC996F79CF2DB0B95FEF6B1 ft=1 fh=9d7011981dcd65ae vn="Win32/SpeedUpMyPC evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Temp\is-QKK75.tmp\SpeedUpMyPC-standalone-setup.exe"
sh=C7241007662586F5DE3A9F9927CFBD9D52A52AC9 ft=1 fh=a7692001af61d921 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Temp\nsv747C\SpSetup.exe"
sh=99F97AD369E8621AB4D17DF53E80E60FEE99C727 ft=1 fh=42567613b862d846 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\AppData\Local\Temp\OCS\ocs_v71b.exe"
sh=7AE9F4A5943569504C24D1043551115688387E73 ft=1 fh=81fa830a32c99e11 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\Downloads\7 Zip 32 Bit - CHIP-Downloader.exe"
sh=E1476812A4BD414F53416C93AF14D22BFEFBFF7D ft=1 fh=e6a33b27fb0ee099 vn="Variante von Win32/Toolbar.Babylon.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\Downloads\Babylon9_setup.exe"
sh=FF42995D8E24E05FF9EBA12DCB27B9AAB183A290 ft=1 fh=605214e765268a80 vn="Variante von Win32/Toolbar.Conduit.AI evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\Downloads\FreeYouTubeToMP3Converter31011.exe"
sh=0EE947E611E936E7EC88C1B521B27D07FC423B75 ft=1 fh=a54b09b9b27a9c95 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\Downloads\Samsung Channel List PC Editor - CHIP-Installer.exe"
sh=9D5B7F6FF554136FDC44EBC640FF6DD93F5D4030 ft=1 fh=17a582e231c0604a vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\bernie\Downloads\youtube2mp3-1.2.4 - CHIP-Downloader.exe"
sh=66023B99067DCD391F9FDC797F7F20812D5403AD ft=1 fh=3dc61c98ed8d0974 vn="Variante von Generik.LMYDTZQ Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="D:\Backup11\Downloads\kazaa\kazaa_lite.exe"
sh=A4A3F88F6E8AC0FB9F3370E7666FEF74CF583029 ft=1 fh=f2201697f19ea9bb vn="Variante von Win32/Adware.Kazaa.A Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="D:\Backup11\Downloads\kazaa\kmd.exe"
sh=03A7D97387FBF9BAC969A591B68A8EDC2D493417 ft=1 fh=02850d967aa2d2ec vn="Variante von Win32/Toolbar.Widgi evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="D:\Backup11\Downloads\regi\asc-setup.exe"
sh=0152FB975FDBEA6FFA27BB8038FBA0DBC983EF3F ft=1 fh=d957d30811d3851e vn="Win32/RegistryBooster evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="D:\Backup11\Downloads\regi\registrybooster.exe"
sh=D931ACFEC77DB89FF56A2E8EE89C7941F8B8E82E ft=1 fh=3fb4448e9a99ad06 vn="Win32/RegistryBooster evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="D:\Backup11\Downloads\regi\registrybooster2011.exe"
sh=D201EB86D971A3C87B474D8811F0FDD595DA92CF ft=0 fh=0000000000000000 vn="Variante von Win32/Dialer.StarDialer Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="D:\Backup11\Downloads\serials\s2k.serials2k7.1.zip"
sh=FA2B3944279DF512591C4912182F924DB6618BA0 ft=0 fh=0000000000000000 vn="Variante von Win32/Dialer.StarDialer Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="D:\Backup11\Downloads\serials\update\dtg.010103.full.zip"
sh=6EDDB2EB783CFCB3BDC20E9799CD0BB014FD9040 ft=0 fh=0000000000000000 vn="Variante von Win32/Dialer.StarDialer Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="D:\Backup11\Downloads\serials\update\fms.2003-04-15.full.zip"
sh=48E2C976ECD217B68CA91EBCCD89CD0146BE3699 ft=1 fh=5d265ee2fd010414 vn="Mehrere Bedrohungen (gelöscht - in Quarantäne kopiert)" ac=C fn="D:\Backup11\Tools\Tools\Freeware\regetjr.exe"
sh=EF2249272FFA5746D60EFD6373D139A8DA874E7D ft=1 fh=d1d07989e880c5cc vn="Mehrere Bedrohungen (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="D:\Backup11\Tools\Tools\iMeshV3\iMeshV3.exe"
sh=9193581E2E18DBBBF4F63A11BB35EAC644B99706 ft=1 fh=c192647f90f20529 vn="möglicherweise Variante von Win32/Adware.WurldMedia Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="D:\Backup11\Tools\Tools\morpheus\installm19.exe"
sh=23095DE6FFA0C14E2E2C6881A4EAEF7FE414C6BF ft=1 fh=c71c00118ba24104 vn="Variante von Win32/InstallCore.OF evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="D:\Downloads\Garmin\garmin-lifetime-updater-2.exe"
sh=9731CDE471BFED17B474F7A099E8CF8CFB7781C4 ft=1 fh=d37785297e6be4db vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="D:\Downloads\navigon\Navigon Fresh - CHIP-Downloader.exe"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=618272c2993a7343bcb2150c0ee94be5
# engine=20148
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-09-14 06:23:39
# local_time=2014-09-14 08:23:39 (+0100, Mitteleuropäische Sommerzeit)
# country="Switzerland"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 13124 155221793 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 110390 162348869 0 0
# scanned=295359
# found=10
# cleaned=0
# scan_time=10348
sh=7AE9F4A5943569504C24D1043551115688387E73 ft=1 fh=81fa830a32c99e11 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\Downloads\7 Zip 32 Bit - CHIP-Downloader.exe"
sh=E1476812A4BD414F53416C93AF14D22BFEFBFF7D ft=1 fh=e6a33b27fb0ee099 vn="Variante von Win32/Toolbar.Babylon.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\Downloads\Babylon9_setup.exe"
sh=FF42995D8E24E05FF9EBA12DCB27B9AAB183A290 ft=1 fh=605214e765268a80 vn="Variante von Win32/Toolbar.Conduit.AI evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\Downloads\FreeYouTubeToMP3Converter31011.exe"
sh=0EE947E611E936E7EC88C1B521B27D07FC423B75 ft=1 fh=a54b09b9b27a9c95 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\Downloads\Samsung Channel List PC Editor - CHIP-Installer.exe"
sh=9D5B7F6FF554136FDC44EBC640FF6DD93F5D4030 ft=1 fh=17a582e231c0604a vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\bernie\Downloads\youtube2mp3-1.2.4 - CHIP-Downloader.exe"
sh=7AE9F4A5943569504C24D1043551115688387E73 ft=1 fh=81fa830a32c99e11 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="F:\Seagate Dashboard 2.0\BERNIE-PC\bernie\Backup\0ae9a0e4-85df-47f2-8672-0597f3bd92f0\20140901_121329_bernie\C\Users\bernie\Downloads\7 Zip 32 Bit - CHIP-Downloader.exe"
sh=E1476812A4BD414F53416C93AF14D22BFEFBFF7D ft=1 fh=e6a33b27fb0ee099 vn="Variante von Win32/Toolbar.Babylon.C evtl. unerwünschte Anwendung" ac=I fn="F:\Seagate Dashboard 2.0\BERNIE-PC\bernie\Backup\0ae9a0e4-85df-47f2-8672-0597f3bd92f0\20140901_121329_bernie\C\Users\bernie\Downloads\Babylon9_setup.exe"
sh=FF42995D8E24E05FF9EBA12DCB27B9AAB183A290 ft=1 fh=605214e765268a80 vn="Variante von Win32/Toolbar.Conduit.AI evtl. unerwünschte Anwendung" ac=I fn="F:\Seagate Dashboard 2.0\BERNIE-PC\bernie\Backup\0ae9a0e4-85df-47f2-8672-0597f3bd92f0\20140901_121329_bernie\C\Users\bernie\Downloads\FreeYouTubeToMP3Converter31011.exe"
sh=0EE947E611E936E7EC88C1B521B27D07FC423B75 ft=1 fh=a54b09b9b27a9c95 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="F:\Seagate Dashboard 2.0\BERNIE-PC\bernie\Backup\0ae9a0e4-85df-47f2-8672-0597f3bd92f0\20140901_121329_bernie\C\Users\bernie\Downloads\Samsung Channel List PC Editor - CHIP-Installer.exe"
sh=9D5B7F6FF554136FDC44EBC640FF6DD93F5D4030 ft=1 fh=17a582e231c0604a vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="F:\Seagate Dashboard 2.0\BERNIE-PC\bernie\Backup\0ae9a0e4-85df-47f2-8672-0597f3bd92f0\20140901_121329_bernie\C\Users\bernie\Downloads\youtube2mp3-1.2.4 - CHIP-Downloader.exe"
Code:
ATTFilter Results of screen317's Security Check version 0.99.87
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Avira Desktop
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Java 7 Update 67
Adobe Flash Player 15.0.0.152
Adobe Reader 10.1.11 Adobe Reader out of Date!
Mozilla Firefox (32.0.1)
Google Chrome 37.0.2062.103
Google Chrome 37.0.2062.120
````````Process Check: objlist.exe by Laurent````````
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
Symantec Norton Online Backup NOBuAgent.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
|
|
14.09.2014, 19:52
| #11 |
| | Chrome und Firefox öffnen ständig Werbeseiten,Malwarebytes funktionioniert nicht mehr,auch nicht mit Chameleon Und hier noch der SystemLook Log: Code:
ATTFilter SystemLook 30.07.11 by jpshortstuff
Log created at 20:40 on 14/09/2014 by bernie
Administrator - Elevation successful
========== filefind ==========
Searching for "*ExpressZip*"
C:\AdwCleaner\Quarantine\C\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe.vir --a---- 1064632 bytes [20:11 06/02/2013] [10:38 14/12/2012] 3858BBFEB6C1B5884113186944B36C78
C:\AdwCleaner\Quarantine\C\Program Files (x86)\NCH Software\ExpressZip\expresszipsetup_v2.10.exe.vir --a---- 1008312 bytes [20:11 06/02/2013] [20:09 06/02/2013] 40A88E634BA242C45FAD5FECC2053819
C:\FRST\Quarantine\C\Windows\System32\Tasks\NCH Software\ExpressZipReminder.xBAD --a---- 3520 bytes [15:02 06/09/2014] [15:02 06/09/2014] 933D7F5487ADE76F95F24C9379F45C53
Searching for "*NCH Software*"
C:\Users\bernie\Favorites\Downloadseite von NCH Software.lnk --a---- 282 bytes [20:11 06/02/2013] [20:11 06/02/2013] 263873E740E29E5315A81DFA0995EA0A
========== folderfind ==========
Searching for "*ExpressZip*"
C:\AdwCleaner\Quarantine\C\Program Files (x86)\NCH Software\ExpressZip d------ [11:03 30/08/2014]
Searching for "*NCH Software*"
C:\AdwCleaner\Quarantine\C\Program Files (x86)\NCH Software d------ [11:03 30/08/2014]
C:\FRST\Quarantine\C\Windows\System32\Tasks\NCH Software d------ [15:02 14/09/2014]
C:\FRST\Quarantine\C\Windows\System32\Tasks\NCH Software\NCH Software d------ [20:11 06/02/2013]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Produktpalette d------ [20:11 06/02/2013]
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\NCH Software Produktpalette d------ [20:11 06/02/2013]
========== regfind ==========
Searching for "ExpressZip"
[HKEY_CURRENT_USER\Software\Microsoft\IntelliType Pro\AppSpecific\expresszip.exe]
[HKEY_CURRENT_USER\Software\Microsoft\IntelliType Pro\AppSpecific\expresszip.exe]
"Path"="C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Registration\NCH]
"ExpressZip"="1"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.7z]
"ExpressZip.BAK"="NCH.ExpressZip7z"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.7z\UserChoice]
"Progid"="NCH.ExpressZip.7z"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cab]
"ExpressZip.BAK"="CABFolder"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cab\UserChoice]
"Progid"="NCH.ExpressZip.cab"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gz]
"ExpressZip.BAK"="NCH.ExpressZipgz"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gz\UserChoice]
"Progid"="NCH.ExpressZip.gz"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.IMG]
"ExpressZip.BAK"="IrfanView.IMG"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.IMG\OpenWithList]
"a"="expresszip.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.IMG\UserChoice]
"Progid"="NCH.ExpressZip.img"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iso]
"ExpressZip.BAK"="isofile"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iso\OpenWithList]
"a"="expresszip.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iso\UserChoice]
"Progid"="NCH.ExpressZip.iso"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rar]
"ExpressZip.BAK"="NCH.ExpressZiprar"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rar\OpenWithList]
"b"="expresszip.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rar\UserChoice]
"Progid"="NCH.ExpressZip.rar"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tar]
"ExpressZip.BAK"="NCH.ExpressZiptar"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tar\UserChoice]
"Progid"="NCH.ExpressZip.tar"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tgz]
"ExpressZip.BAK"="NCH.ExpressZiptgz"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tgz\UserChoice]
"Progid"="NCH.ExpressZip.tgz"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithList]
"b"="expresszip.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\UserChoice]
"Progid"="Applications\expresszip.exe"
[HKEY_CURRENT_USER\Software\NCH Software\ExpressZip]
[HKEY_CURRENT_USER\Software\NCH Software\ExpressZip\Settings]
"InstallerPath"="C:\Program Files (x86)\NCH Software\ExpressZip"
[HKEY_CURRENT_USER\Software\WinRAR\Setup\.7z]
"Type"="NCH.ExpressZip.7z"
[HKEY_CURRENT_USER\Software\WinRAR\Setup\.cab]
"Type"="NCH.ExpressZip.cab"
[HKEY_CURRENT_USER\Software\WinRAR\Setup\.gz]
"Type"="NCH.ExpressZip.gz"
[HKEY_CURRENT_USER\Software\WinRAR\Setup\.rar]
"Type"="NCH.ExpressZip.rar"
[HKEY_CURRENT_USER\Software\WinRAR\Setup\.tar]
"Type"="NCH.ExpressZip.tar"
[HKEY_CURRENT_USER\Software\WinRAR\Setup\.tgz]
"Type"="NCH.ExpressZip.tgz"
[HKEY_CURRENT_USER\Software\WinRAR\Setup\.zip]
"Type"="ExpressZip"
[HKEY_CURRENT_USER\Software\Classes\.7z]
"ExpressZip.BAK"="NCH.ExpressZip7z"
[HKEY_CURRENT_USER\Software\Classes\.gz]
"ExpressZip.BAK"="NCH.ExpressZipgz"
[HKEY_CURRENT_USER\Software\Classes\.rar]
"ExpressZip.BAK"="NCH.ExpressZiprar"
[HKEY_CURRENT_USER\Software\Classes\.tar]
"ExpressZip.BAK"="NCH.ExpressZiptar"
[HKEY_CURRENT_USER\Software\Classes\.tgz]
"ExpressZip.BAK"="NCH.ExpressZiptgz"
[HKEY_CURRENT_USER\Software\Classes\AcroExch.Document\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_CURRENT_USER\Software\Classes\dctfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Scribe "%L""
[HKEY_CURRENT_USER\Software\Classes\ds2file\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Scribe "%L""
[HKEY_CURRENT_USER\Software\Classes\ds2file\shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_CURRENT_USER\Software\Classes\dssfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Scribe "%L""
[HKEY_CURRENT_USER\Software\Classes\FirefoxHTML\shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_CURRENT_USER\Software\Classes\IrfanView.bmp\Shell\Diashow erstellen\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_CURRENT_USER\Software\Classes\IrfanView.bmp\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_CURRENT_USER\Software\Classes\IrfanView.gif\Shell\Diashow erstellen\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_CURRENT_USER\Software\Classes\IrfanView.gif\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_CURRENT_USER\Software\Classes\IrfanView.HDP\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_CURRENT_USER\Software\Classes\IrfanView.jpg\Shell\Diashow erstellen\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_CURRENT_USER\Software\Classes\IrfanView.jpg\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_CURRENT_USER\Software\Classes\IrfanView.NLM\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_CURRENT_USER\Software\Classes\IrfanView.png\Shell\Diashow erstellen\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_CURRENT_USER\Software\Classes\IrfanView.png\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_CURRENT_USER\Software\Classes\IrfanView.TIF\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_CURRENT_USER\Software\Classes\ivrfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind IVM "%L""
[HKEY_CURRENT_USER\Software\Classes\meofile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Meo "%L""
[HKEY_CURRENT_USER\Software\Classes\mohfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind IMS "%L""
[HKEY_CURRENT_USER\Software\Classes\mpdpfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind MixPad "%L""
[HKEY_CURRENT_USER\Software\Classes\neffile\Shell\Diashow erstellen\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_CURRENT_USER\Software\Classes\neffile\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_CURRENT_USER\Software\Classes\spjfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.aac\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.aac\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.aif\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.aif\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.aiff\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.aiff\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.asf\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.asf\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.au\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.au\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.avi\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.avi\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.divx\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.divx\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.flac\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.m4a\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.m4v\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.m4v\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.mov\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.mov\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.mp3\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.mp3\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.mp4\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.mp4\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.mpeg\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.mpeg\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.mpeg2\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.mpeg2\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.mpg\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.mpg\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.ogg\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.vob\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.vob\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.voc\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.wav\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.wav\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.wma\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.wma\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_CURRENT_USER\Software\Classes\voxfile\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_CURRENT_USER\Software\Classes\voxfile\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_CURRENT_USER\Software\Classes\vpjfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_CURRENT_USER\Software\Classes\Word.Document.12\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_CURRENT_USER\Software\Classes\Word.Document.8\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_CURRENT_USER\Software\Classes\Word.OpenDocumentText.12\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_CURRENT_USER\Software\Classes\Word.RTF.8\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_CURRENT_USER\Software\Classes\wpdfile\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_CURRENT_USER\Software\Classes\wpfile\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_CURRENT_USER\Software\Classes\xvidfile\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_CURRENT_USER\Software\Classes\xvidfile\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ExpressZip]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.7z\shellex\ContextMenuHandlers\ExpressZip]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cab]
"ExpressZip.BAK"="CABFolder"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cab\shellex\ContextMenuHandlers\ExpressZip]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.gz\shellex\ContextMenuHandlers\ExpressZip]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.img]
@="NCH.ExpressZip.img"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.img]
"ExpressZip.BAK"="IrfanView.img"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.img\shellex\ContextMenuHandlers\ExpressZip]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.iso]
@="NCH.ExpressZip.iso"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.iso]
"ExpressZip.BAK"="isofile"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.iso\shellex\ContextMenuHandlers\ExpressZip]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.rar\shellex\ContextMenuHandlers\ExpressZip]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.tar\shellex\ContextMenuHandlers\ExpressZip]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.tgz\shellex\ContextMenuHandlers\ExpressZip]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.zip\shellex\ContextMenuHandlers\ExpressZip]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.zip\shellex\DropHandler\ExpressZip]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\expresszip.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\expresszip.exe\DefaultIcon]
@="C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe,4"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\expresszip.exe\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CABFolder\shell\Windows Kabinettdatei\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8EEA165E-0B8B-4BA7-9796-50214C767171}\InProcServer32]
@="C:\Program Files (x86)\NCH Software\ExpressZip\ezcm64.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ExpressZip]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\ExpressZip]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IrfanView.img\shell\Datenträgerabbilddatei\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\isofile\shell\Datenträgerabbilddatei\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.7z]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.7z\DefaultIcon]
@="C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe,4"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.7z\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.cab]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.cab\DefaultIcon]
@="C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe,4"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.cab\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.gz]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.gz\DefaultIcon]
@="C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe,4"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.gz\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.img]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.img\DefaultIcon]
@="C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe,4"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.img\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.iso]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.iso\DefaultIcon]
@="C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe,4"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.iso\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.rar]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.rar\DefaultIcon]
@="C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe,4"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.rar\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.tar]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.tar\DefaultIcon]
@="C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe,4"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.tar\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.tgz]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.tgz\DefaultIcon]
@="C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe,4"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.tgz\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip7z]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip7z\Shell\7-Zip-Archivdatei\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZipgz]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZipgz\Shell\GZ-Archivdatei\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZiprar]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZiprar\Shell\RAR-Archivdatei\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZiptar]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZiptar\Shell\TAR-Archivdatei\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZiptgz]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZiptgz\Shell\TGZ-Archivdatei\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.7z\Shell\7-Zip-Archivdatei\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.cab\Shell\Windows Kabinettdatei\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gz\Shell\GZ-Archivdatei\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.img\Shell\Datenträgerabbilddatei\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.iso\Shell\Datenträgerabbilddatei\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rar\Shell\RAR-Archivdatei\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tar\Shell\TAR-Archivdatei\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tgz\Shell\TGZ-Archivdatei\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications]
"ExpressZip"="Software\NCH Software\ExpressZip\Capabilities"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ExpressZip]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ExpressZip]
"UninstallString"=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -uninstall"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ExpressZip]
"DisplayIcon"="C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ExpressZip]
"InstallLocation"="C:\Program Files (x86)\NCH Software\ExpressZip"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\NCH Software\ExpressZip]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\NCH Software\ExpressZip\Capabilities\FileAssociations]
".rar"="NCH.ExpressZip.rar"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\NCH Software\ExpressZip\Capabilities\FileAssociations]
".tar"="NCH.ExpressZip.tar"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\NCH Software\ExpressZip\Capabilities\FileAssociations]
".tgz"="NCH.ExpressZip.tgz"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\NCH Software\ExpressZip\Capabilities\FileAssociations]
".gz"="NCH.ExpressZip.gz"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\NCH Software\ExpressZip\Capabilities\FileAssociations]
".cab"="NCH.ExpressZip.cab"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\NCH Software\ExpressZip\Capabilities\FileAssociations]
".7z"="NCH.ExpressZip.7z"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\NCH Software\ExpressZip\Capabilities\FileAssociations]
".iso"="NCH.ExpressZip.iso"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\NCH Software\ExpressZip\Capabilities\FileAssociations]
".img"="NCH.ExpressZip.img"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\NCH Software\ExpressZip\Capabilities\FileTypes]
".rar"="NCH.ExpressZiprar"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\NCH Software\ExpressZip\Capabilities\FileTypes]
".tar"="NCH.ExpressZiptar"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\NCH Software\ExpressZip\Capabilities\FileTypes]
".tgz"="NCH.ExpressZiptgz"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\NCH Software\ExpressZip\Capabilities\FileTypes]
".gz"="NCH.ExpressZipgz"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\NCH Software\ExpressZip\Capabilities\FileTypes]
".7z"="NCH.ExpressZip7z"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\NCH Software\ExpressZip\Settings]
"InstallerPath"="C:\Program Files (x86)\NCH Software\ExpressZip"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\NCH Software\ExpressZip\Software]
"Installer"="C:\Program Files (x86)\NCH Software\ExpressZip\expresszipsetup_v2.10.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\RegisteredApplications]
"ExpressZip"="Software\NCH Software\ExpressZip\Capabilities"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Microsoft\IntelliType Pro\AppSpecific\expresszip.exe]
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Microsoft\IntelliType Pro\AppSpecific\expresszip.exe]
"Path"="C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Microsoft\Registration\NCH]
"ExpressZip"="1"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.7z]
"ExpressZip.BAK"="NCH.ExpressZip7z"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.7z\UserChoice]
"Progid"="NCH.ExpressZip.7z"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cab]
"ExpressZip.BAK"="CABFolder"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cab\UserChoice]
"Progid"="NCH.ExpressZip.cab"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gz]
"ExpressZip.BAK"="NCH.ExpressZipgz"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gz\UserChoice]
"Progid"="NCH.ExpressZip.gz"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.IMG]
"ExpressZip.BAK"="IrfanView.IMG"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.IMG\OpenWithList]
"a"="expresszip.exe"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.IMG\UserChoice]
"Progid"="NCH.ExpressZip.img"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iso]
"ExpressZip.BAK"="isofile"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iso\OpenWithList]
"a"="expresszip.exe"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iso\UserChoice]
"Progid"="NCH.ExpressZip.iso"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rar]
"ExpressZip.BAK"="NCH.ExpressZiprar"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rar\OpenWithList]
"b"="expresszip.exe"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rar\UserChoice]
"Progid"="NCH.ExpressZip.rar"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tar]
"ExpressZip.BAK"="NCH.ExpressZiptar"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tar\UserChoice]
"Progid"="NCH.ExpressZip.tar"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tgz]
"ExpressZip.BAK"="NCH.ExpressZiptgz"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tgz\UserChoice]
"Progid"="NCH.ExpressZip.tgz"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithList]
"b"="expresszip.exe"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\UserChoice]
"Progid"="Applications\expresszip.exe"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\NCH Software\ExpressZip]
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\NCH Software\ExpressZip\Settings]
"InstallerPath"="C:\Program Files (x86)\NCH Software\ExpressZip"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\WinRAR\Setup\.7z]
"Type"="NCH.ExpressZip.7z"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\WinRAR\Setup\.cab]
"Type"="NCH.ExpressZip.cab"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\WinRAR\Setup\.gz]
"Type"="NCH.ExpressZip.gz"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\WinRAR\Setup\.rar]
"Type"="NCH.ExpressZip.rar"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\WinRAR\Setup\.tar]
"Type"="NCH.ExpressZip.tar"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\WinRAR\Setup\.tgz]
"Type"="NCH.ExpressZip.tgz"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\WinRAR\Setup\.zip]
"Type"="ExpressZip"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\.7z]
"ExpressZip.BAK"="NCH.ExpressZip7z"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\.gz]
"ExpressZip.BAK"="NCH.ExpressZipgz"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\.rar]
"ExpressZip.BAK"="NCH.ExpressZiprar"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\.tar]
"ExpressZip.BAK"="NCH.ExpressZiptar"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\.tgz]
"ExpressZip.BAK"="NCH.ExpressZiptgz"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\AcroExch.Document\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\dctfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Scribe "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\ds2file\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Scribe "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\ds2file\shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\dssfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Scribe "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\FirefoxHTML\shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\IrfanView.bmp\Shell\Diashow erstellen\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\IrfanView.bmp\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\IrfanView.gif\Shell\Diashow erstellen\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\IrfanView.gif\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\IrfanView.HDP\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\IrfanView.jpg\Shell\Diashow erstellen\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\IrfanView.jpg\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\IrfanView.NLM\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\IrfanView.png\Shell\Diashow erstellen\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\IrfanView.png\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\IrfanView.TIF\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\ivrfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind IVM "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\meofile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Meo "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\mohfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind IMS "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\mpdpfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind MixPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\neffile\Shell\Diashow erstellen\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\neffile\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\spjfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.aac\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.aac\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.aif\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.aif\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.aiff\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.aiff\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.asf\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.asf\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.au\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.au\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.avi\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.avi\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.divx\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.divx\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.flac\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.m4a\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.m4v\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.m4v\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.mov\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.mov\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.mp3\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.mp3\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.mp4\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.mp4\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.mpeg\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.mpeg\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.mpeg2\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.mpeg2\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.mpg\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.mpg\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.ogg\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.vob\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.vob\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.voc\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.wav\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.wav\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.wma\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.wma\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\voxfile\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\voxfile\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\vpjfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\Word.Document.12\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\Word.Document.8\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\Word.OpenDocumentText.12\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\Word.RTF.8\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\wpdfile\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\wpfile\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\xvidfile\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\xvidfile\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\.7z]
"ExpressZip.BAK"="NCH.ExpressZip7z"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\.gz]
"ExpressZip.BAK"="NCH.ExpressZipgz"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\.rar]
"ExpressZip.BAK"="NCH.ExpressZiprar"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\.tar]
"ExpressZip.BAK"="NCH.ExpressZiptar"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\.tgz]
"ExpressZip.BAK"="NCH.ExpressZiptgz"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\AcroExch.Document\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\dctfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Scribe "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\ds2file\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Scribe "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\ds2file\shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\dssfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Scribe "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\FirefoxHTML\shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\IrfanView.bmp\Shell\Diashow erstellen\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\IrfanView.bmp\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\IrfanView.gif\Shell\Diashow erstellen\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\IrfanView.gif\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\IrfanView.HDP\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\IrfanView.jpg\Shell\Diashow erstellen\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\IrfanView.jpg\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\IrfanView.NLM\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\IrfanView.png\Shell\Diashow erstellen\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\IrfanView.png\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\IrfanView.TIF\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\ivrfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind IVM "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\meofile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Meo "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\mohfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind IMS "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\mpdpfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind MixPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\neffile\Shell\Diashow erstellen\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\neffile\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\spjfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.aac\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.aac\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.aif\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.aif\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.aiff\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.aiff\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.asf\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.asf\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.au\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.au\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.avi\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.avi\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.divx\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.divx\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.flac\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.m4a\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.m4v\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.m4v\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.mov\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.mov\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.mp3\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.mp3\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.mp4\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.mp4\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.mpeg\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.mpeg\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.mpeg2\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.mpeg2\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.mpg\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.mpg\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.ogg\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.vob\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.vob\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.voc\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.wav\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.wav\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.wma\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.wma\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\voxfile\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\voxfile\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\vpjfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\Word.Document.12\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\Word.Document.8\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\Word.OpenDocumentText.12\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\Word.RTF.8\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\wpdfile\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\wpfile\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\xvidfile\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\xvidfile\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
Searching for "NCH Software"
[HKEY_CURRENT_USER\Software\Microsoft\IntelliType Pro\AppSpecific\expresszip.exe]
"Path"="C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe"
[HKEY_CURRENT_USER\Software\NCH Software]
[HKEY_CURRENT_USER\Software\NCH Software\Components\infozip2]
"Path"="C:\Program Files (x86)\NCH Software\Components\infozip2\unzip32.dll"
[HKEY_CURRENT_USER\Software\NCH Software\Components\zipcloak2]
"Path"="C:\Program Files (x86)\NCH Software\Components\zipcloak2\zipcloak2.exe"
[HKEY_CURRENT_USER\Software\NCH Software\ExpressZip\Settings]
"InstallerPath"="C:\Program Files (x86)\NCH Software\ExpressZip"
[HKEY_CURRENT_USER\Software\Classes\AcroExch.Document\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_CURRENT_USER\Software\Classes\dctfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Scribe "%L""
[HKEY_CURRENT_USER\Software\Classes\ds2file\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Scribe "%L""
[HKEY_CURRENT_USER\Software\Classes\ds2file\shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_CURRENT_USER\Software\Classes\dssfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Scribe "%L""
[HKEY_CURRENT_USER\Software\Classes\FirefoxHTML\shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_CURRENT_USER\Software\Classes\IrfanView.bmp\Shell\Diashow erstellen\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_CURRENT_USER\Software\Classes\IrfanView.bmp\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_CURRENT_USER\Software\Classes\IrfanView.gif\Shell\Diashow erstellen\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_CURRENT_USER\Software\Classes\IrfanView.gif\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_CURRENT_USER\Software\Classes\IrfanView.HDP\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_CURRENT_USER\Software\Classes\IrfanView.jpg\Shell\Diashow erstellen\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_CURRENT_USER\Software\Classes\IrfanView.jpg\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_CURRENT_USER\Software\Classes\IrfanView.NLM\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_CURRENT_USER\Software\Classes\IrfanView.png\Shell\Diashow erstellen\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_CURRENT_USER\Software\Classes\IrfanView.png\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_CURRENT_USER\Software\Classes\IrfanView.TIF\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_CURRENT_USER\Software\Classes\ivrfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind IVM "%L""
[HKEY_CURRENT_USER\Software\Classes\meofile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Meo "%L""
[HKEY_CURRENT_USER\Software\Classes\mohfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind IMS "%L""
[HKEY_CURRENT_USER\Software\Classes\mpdpfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind MixPad "%L""
[HKEY_CURRENT_USER\Software\Classes\neffile\Shell\Diashow erstellen\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_CURRENT_USER\Software\Classes\neffile\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_CURRENT_USER\Software\Classes\spjfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.aac\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.aac\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.aif\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.aif\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.aiff\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.aiff\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.asf\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.asf\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.au\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.au\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.avi\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.avi\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.divx\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.divx\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.flac\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.m4a\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.m4v\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.m4v\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.mov\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.mov\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.mp3\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.mp3\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.mp4\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.mp4\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.mpeg\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.mpeg\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.mpeg2\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.mpeg2\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.mpg\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.mpg\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.ogg\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.vob\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.vob\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.voc\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.wav\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.wav\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.wma\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_CURRENT_USER\Software\Classes\VLC.wma\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_CURRENT_USER\Software\Classes\voxfile\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_CURRENT_USER\Software\Classes\voxfile\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_CURRENT_USER\Software\Classes\vpjfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_CURRENT_USER\Software\Classes\Word.Document.12\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_CURRENT_USER\Software\Classes\Word.Document.8\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_CURRENT_USER\Software\Classes\Word.OpenDocumentText.12\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_CURRENT_USER\Software\Classes\Word.RTF.8\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_CURRENT_USER\Software\Classes\wpdfile\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_CURRENT_USER\Software\Classes\wpfile\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_CURRENT_USER\Software\Classes\xvidfile\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_CURRENT_USER\Software\Classes\xvidfile\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\expresszip.exe\DefaultIcon]
@="C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe,4"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\expresszip.exe\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CABFolder\shell\Windows Kabinettdatei\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8EEA165E-0B8B-4BA7-9796-50214C767171}\InProcServer32]
@="C:\Program Files (x86)\NCH Software\ExpressZip\ezcm64.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IrfanView.img\shell\Datenträgerabbilddatei\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\isofile\shell\Datenträgerabbilddatei\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.7z\DefaultIcon]
@="C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe,4"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.7z\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.cab\DefaultIcon]
@="C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe,4"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.cab\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.gz\DefaultIcon]
@="C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe,4"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.gz\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.img\DefaultIcon]
@="C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe,4"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.img\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.iso\DefaultIcon]
@="C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe,4"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.iso\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.rar\DefaultIcon]
@="C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe,4"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.rar\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.tar\DefaultIcon]
@="C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe,4"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.tar\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.tgz\DefaultIcon]
@="C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe,4"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip.tgz\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZip7z\Shell\7-Zip-Archivdatei\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZipgz\Shell\GZ-Archivdatei\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZiprar\Shell\RAR-Archivdatei\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZiptar\Shell\TAR-Archivdatei\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NCH.ExpressZiptgz\Shell\TGZ-Archivdatei\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.7z\Shell\7-Zip-Archivdatei\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.cab\Shell\Windows Kabinettdatei\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gz\Shell\GZ-Archivdatei\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.img\Shell\Datenträgerabbilddatei\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.iso\Shell\Datenträgerabbilddatei\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rar\Shell\RAR-Archivdatei\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tar\Shell\TAR-Archivdatei\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tgz\Shell\TGZ-Archivdatei\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" "%L""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\NCH Software]
[HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications]
"ExpressZip"="Software\NCH Software\ExpressZip\Capabilities"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ExpressZip]
"Publisher"="NCH Software"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ExpressZip]
"UninstallString"=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -uninstall"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ExpressZip]
"DisplayIcon"="C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ExpressZip]
"InstallLocation"="C:\Program Files (x86)\NCH Software\ExpressZip"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\NCH Software]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\NCH Software\Components\infozip2]
"Path"="C:\Program Files (x86)\NCH Software\Components\infozip2\unzip32.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\NCH Software\Components\zipcloak2]
"Path"="C:\Program Files (x86)\NCH Software\Components\zipcloak2\zipcloak2.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\NCH Software\ExpressZip\Settings]
"InstallerPath"="C:\Program Files (x86)\NCH Software\ExpressZip"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\NCH Software\ExpressZip\Software]
"Installer"="C:\Program Files (x86)\NCH Software\ExpressZip\expresszipsetup_v2.10.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\RegisteredApplications]
"ExpressZip"="Software\NCH Software\ExpressZip\Capabilities"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Microsoft\IntelliType Pro\AppSpecific\expresszip.exe]
"Path"="C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\NCH Software]
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\NCH Software\Components\infozip2]
"Path"="C:\Program Files (x86)\NCH Software\Components\infozip2\unzip32.dll"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\NCH Software\Components\zipcloak2]
"Path"="C:\Program Files (x86)\NCH Software\Components\zipcloak2\zipcloak2.exe"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\NCH Software\ExpressZip\Settings]
"InstallerPath"="C:\Program Files (x86)\NCH Software\ExpressZip"
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\AcroExch.Document\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\dctfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Scribe "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\ds2file\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Scribe "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\ds2file\shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\dssfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Scribe "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\FirefoxHTML\shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\IrfanView.bmp\Shell\Diashow erstellen\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\IrfanView.bmp\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\IrfanView.gif\Shell\Diashow erstellen\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\IrfanView.gif\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\IrfanView.HDP\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\IrfanView.jpg\Shell\Diashow erstellen\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\IrfanView.jpg\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\IrfanView.NLM\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\IrfanView.png\Shell\Diashow erstellen\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\IrfanView.png\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\IrfanView.TIF\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\ivrfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind IVM "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\meofile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Meo "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\mohfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind IMS "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\mpdpfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind MixPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\neffile\Shell\Diashow erstellen\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\neffile\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\spjfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.aac\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.aac\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.aif\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.aif\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.aiff\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.aiff\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.asf\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.asf\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.au\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.au\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.avi\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.avi\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.divx\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.divx\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.flac\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.m4a\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.m4v\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.m4v\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.mov\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.mov\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.mp3\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.mp3\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.mp4\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.mp4\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.mpeg\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.mpeg\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.mpeg2\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.mpeg2\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.mpg\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.mpg\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.ogg\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.vob\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.vob\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.voc\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.wav\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.wav\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.wma\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\VLC.wma\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\voxfile\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\voxfile\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\vpjfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\Word.Document.12\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\Word.Document.8\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\Word.OpenDocumentText.12\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\Word.RTF.8\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\wpdfile\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\wpfile\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\xvidfile\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002\Software\Classes\xvidfile\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\AcroExch.Document\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\dctfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Scribe "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\ds2file\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Scribe "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\ds2file\shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\dssfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Scribe "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\FirefoxHTML\shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\IrfanView.bmp\Shell\Diashow erstellen\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\IrfanView.bmp\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\IrfanView.gif\Shell\Diashow erstellen\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\IrfanView.gif\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\IrfanView.HDP\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\IrfanView.jpg\Shell\Diashow erstellen\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\IrfanView.jpg\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\IrfanView.NLM\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\IrfanView.png\Shell\Diashow erstellen\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\IrfanView.png\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\IrfanView.TIF\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\ivrfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind IVM "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\meofile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Meo "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\mohfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind IMS "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\mpdpfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind MixPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\neffile\Shell\Diashow erstellen\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\neffile\Shell\Imagedatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Pixillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\spjfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind PhotoStage "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.aac\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.aac\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.aif\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.aif\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.aiff\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.aiff\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.asf\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.asf\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.au\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.au\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.avi\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.avi\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.divx\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.divx\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.flac\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.m4a\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.m4v\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.m4v\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.mov\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.mov\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.mp3\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.mp3\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.mp4\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.mp4\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.mpeg\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.mpeg\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.mpeg2\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.mpeg2\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.mpg\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.mpg\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.ogg\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.vob\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.vob\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.voc\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.wav\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.wav\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.wma\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\VLC.wma\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\voxfile\Shell\Sounddatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind WavePad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\voxfile\Shell\Sounddatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Switch "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\vpjfile\shell\open\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\Word.Document.12\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\Word.Document.8\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\Word.OpenDocumentText.12\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\Word.RTF.8\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\wpdfile\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\wpfile\Shell\Dateityp konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Doxillion "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\xvidfile\Shell\Videodatei bearbeiten\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind VideoPad "%L""
[HKEY_USERS\S-1-5-21-1309665003-1285200881-1394159564-1002_Classes\xvidfile\Shell\Videodatei konvertieren\command]
@=""C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -extfind Prism "%L""
-= EOF =-
|
|
15.09.2014, 12:34
| #12 |
| /// TB-Ausbilder | Chrome und Firefox öffnen ständig Werbeseiten,Malwarebytes funktionioniert nicht mehr,auch nicht mit Chameleon Reste entfernen Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter start
CloseProcesses:
C:\Users\bernie\Downloads\7 Zip 32 Bit - CHIP-Downloader.exe
C:\Users\bernie\Downloads\Babylon9_setup.exe
C:\Users\bernie\Downloads\FreeYouTubeToMP3Converter31011.exe
C:\Users\bernie\Downloads\Samsung Channel List PC Editor - CHIP-Installer.exe
C:\Users\bernie\Downloads\youtube2mp3-1.2.4 - CHIP-Downloader.exe
C:\Users\bernie\Favorites\Downloadseite von NCH Software.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Produktpalette
DeleteKey: HKEY_CURRENT_USER\Software\Microsoft\IntelliType Pro\AppSpecific\expresszip.exe
DeleteKey: HKEY_CURRENT_USER\Software\Microsoft\Registration\NCH
end
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Wenn du keine Probleme mehr hast, dann sind wir hier fertig. Deine Logdateien sind sauber.  Zum Schluss müssen wir noch ein paar abschließende Schritte unternehmen, um deinen Pc aufzuräumen und abzusichern. Ändere regelmäßig alle deine Passwörter, jetzt nach der Bereinigung ist ein idealer Zeitpunkt dafür!
Schritt 1 Die Reihenfolge ist hier entscheidend.
Schritt 2 Abschließend habe ich noch ein paar Tipps zur Absicherung deines Systems. Ich kann gar nicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti-Viren-Programm und zusätzlicher Schutz
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden. Mozilla Firefox
Performance
Was du vermeiden solltest:
Nun bleibt mir nur noch dir viel Spaß beim sicheren Surfen zu wünschen... ... und vielleicht möchtest du ja das Trojaner-Board unterstützen? Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann. |
|
18.09.2014, 15:37
| #13 |
| /// TB-Ausbilder | Chrome und Firefox öffnen ständig Werbeseiten,Malwarebytes funktionioniert nicht mehr,auch nicht mit Chameleon Ich bin froh, dass wir helfen konnten  In diesem Forum kannst du eine kurze Rückmeldung zur Bereinigung abgeben, sofern du das möchtest: Lob, Kritik und Wünsche Klicke dazu auf den Button "NEUES THEMA" und poste ein kleines Feedback. Vielen Dank!  Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Solltest Du das Thema erneut brauchen, schicke mir bitte eine PM. Jeder andere bitte hier klicken und einen eigenen Thread erstellen. |
|
| Themen zu Chrome und Firefox öffnen ständig Werbeseiten,Malwarebytes funktionioniert nicht mehr,auch nicht mit Chameleon |
| bereit, bingbar, blockandsurf, bluescreen, dvdvideosoft ltd., fehlercode 0x5, fehlercode 0x80000003, fehlercode 0xc0000005, launch, pup.optional.addlyrics, pup.optional.adlyrics, pup.optional.blockandsurf.a, pup.optional.linkular, pup.optional.mysearchdial.a, pup.optional.searchprotect.a, pup.optional.superfish.a, tr/zusy.103904.102, tracker, win32/clientconnect.a, win32/conduit.searchprotect.h, win32/conduit.searchprotect.i, win32/conduit.searchprotect.q, win32/downloadsponsor.a, win32/speedupmypc.a, win32/systweak.g, win32/toolbar.conduit, win32/toolbar.conduit.r, win32/toolbar.conduit.u, win32/trojandownloader.agent.alf, win64/conduit.searchprotect.a, win64/systweak.a |
Linear-Darstellung
