| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Zbot.A.1193 eingefangen, lässt sich nicht löschenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
25.09.2014, 18:50
| #1 |
| |  Zbot.A.1193 eingefangen, lässt sich nicht löschen Hey, hab mir einen zbot.a.1193 eingefangen der sich nicht löschen lässt.. Wenn ich unten was falsch gemacht habe gerade sagen danke. Appdata/Roaming/Roiq/ybwu FRST: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 25-09-2014 01
Ran by Uwe (administrator) on UWE-PC on 25-09-2014 19:07:48
Running from C:\Users\Uwe\Downloads
Loaded Profile: Uwe (Available profiles: Uwe)
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Bayer Healthcare LLC) C:\Program Files\Bayer HealthCare SmartLaunch\bin\BayerHCService.exe
(B.H.A Corporation) C:\Windows\System32\bgsvcgen.exe
(TOSHIBA) C:\Program Files\TOSHIBA\TOSHIBA Web Camera Application\TWebCameraSrv.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
() C:\Program Files\Canon\IJPLM\ijplmsvc.exe
(Toshiba Europe GmbH) C:\Program Files\Toshiba TEMPRO\TemproSvc.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\hidfind.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
(Avira) C:\Program Files\Avira\AviraSpeedup\avira_system_speedup.exe
(TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TEco.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
(Toshiba Europe GmbH) C:\Program Files\Toshiba TEMPRO\TemproTray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(CANON INC.) C:\Program Files\Canon\Quick Menu\CNQMMAIN.EXE
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(TOSHIBA) C:\Program Files\TOSHIBA\Toshiba Online Product Information\TOPI.exe
(Samsung) C:\Program Files\Samsung\Kies\Kies.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPoint\SetPoint.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
() C:\Program Files\Web Assistant\ExtensionUpdaterService.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
() C:\Windows\System32\mjcm\dnkt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(CANON INC.) C:\Program Files\Canon\Quick Menu\CNQMUPDT.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
(APN LLC.) C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
(APN) C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(APN LLC.) C:\Users\Uwe\AppData\Local\AskPartnerNetwork\Toolbar\Updater\IDC\IdcLdr.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
() C:\Windows\System32\dmwu.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avscan.exe
(Farbar) C:\Users\Uwe\Downloads\FRST(1).exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [184320 2009-03-29] (Alps Electric Co., Ltd.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7625248 2009-07-28] (Realtek Semiconductor)
HKLM\...\Run: [00TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [729088 2009-03-23] (TOSHIBA Corporation)
HKLM\...\Run: [HSON] => C:\Program Files\TOSHIBA\TBS\HSON.exe [55160 2009-03-09] (TOSHIBA Corporation)
HKLM\...\Run: [HWSetup] => C:\Program Files\TOSHIBA\Utilities\HWSetup.exe [421888 2007-04-16] (TOSHIBA Electronics, Inc.)
HKLM\...\Run: [KeNotify] => C:\Program Files\TOSHIBA\Utilities\KeNotify.exe [34088 2009-01-13] (TOSHIBA CORPORATION)
HKLM\...\Run: [SmartFaceVWatcher] => C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatcher.exe [163840 2009-03-24] (TOSHIBA Corporation)
HKLM\...\Run: [SmoothView] => C:\Program Files\Toshiba\SmoothView\SmoothView.exe [503808 2009-03-31] (TOSHIBA Corporation)
HKLM\...\Run: [Teco] => C:\Program Files\TOSHIBA\TECO\Teco.exe [1323008 2009-04-24] (TOSHIBA Corporation)
HKLM\...\Run: [ToshibaServiceStation] => C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [1295736 2011-02-11] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe [1011712 2009-04-23] (TOSHIBA Corporation)
HKLM\...\Run: [TPCHWMsg] => C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe [570736 2009-04-15] (TOSHIBA Corporation)
HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [468320 2009-03-06] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba TEMPRO] => C:\Program Files\Toshiba TEMPRO\TemproTray.exe [1050072 2010-10-26] (Toshiba Europe GmbH)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-04] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] => C:\Windows\KHALMNPR.EXE [55824 2009-06-17] (Logitech, Inc.)
HKLM\...\Run: [CanonQuickMenu] => C:\Program Files\Canon\Quick Menu\CNQMMAIN.EXE [1279120 2012-09-27] (CANON INC.)
HKLM\...\Run: [spup] => C:\Users\Uwe\AppData\Roaming\ShinyProfile\spup.exe [197664 2013-07-10] ()
HKLM\...\Run: [KiesTrayAgent] => C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [310064 2014-06-14] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [ApnTBMon] => C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1942424 2014-09-22] (APN)
HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [164656 2014-08-27] (Avira Operations GmbH & Co. KG)
HKLM\...\Policies\Explorer: [TaskbarNoNotification] 0
HKLM\...\Policies\Explorer: [HideSCAHealth] 0
HKU\S-1-5-21-2242340406-3198609139-1784460280-1000\...\Run: [TOSHIBA Online Product Information] => C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe [6158240 2009-03-16] (TOSHIBA)
HKU\S-1-5-21-2242340406-3198609139-1784460280-1000\...\Run: [] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [843568 2014-06-14] (Samsung)
HKU\S-1-5-21-2242340406-3198609139-1784460280-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1563440 2014-06-14] (Samsung)
HKU\S-1-5-21-2242340406-3198609139-1784460280-1000\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\S-1-5-21-2242340406-3198609139-1784460280-1000\...\Policies\Explorer: [HideSCAHealth] 0
HKU\S-1-5-21-2242340406-3198609139-1784460280-1000\...\MountPoints2: D - D:\unlock.exe autoplay=true
HKU\S-1-5-21-2242340406-3198609139-1784460280-1000\...\MountPoints2: {3521d782-930d-11e2-a17c-0026223020e5} - D:\unlock.exe autoplay=true
HKU\S-1-5-18\...\Run: [AviraSpeedup] => C:\Program Files\Avira\AviraSpeedup\avira_system_speedup.exe [5085416 2014-09-14] (Avira)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Logitech SetPoint.lnk
ShortcutTarget: Logitech SetPoint.lnk -> C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSEG&bmod=TSEG;
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?publisher=YahooAM&dpid=YahooAM&co=DE&userid=75e2a47c-b344-c844-75e7-308cadf66af7&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=28/11/2013&type=hp4000
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x372D99EA78BDCA01
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.helperbar.com/?publisher=YahooAM&dpid=YahooAM&co=DE&userid=75e2a47c-b344-c844-75e7-308cadf66af7&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=28/11/2013&type=hp4000
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
URLSearchHook: HKLM - (No Name) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - No File
SearchScopes: HKLM - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=YahooAM&dpid=YahooAM&co=DE&userid=75e2a47c-b344-c844-75e7-308cadf66af7&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=28/11/2013&type=hp4000
SearchScopes: HKLM - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=YahooAM&dpid=YahooAM&co=DE&userid=75e2a47c-b344-c844-75e7-308cadf66af7&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=28/11/2013&type=hp4000
SearchScopes: HKCU - DefaultScope {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://mystart.incredibar.com/?a=6PQIwYYZqt&loc=skw&search={searchTerms}&i=26
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=YahooAM&dpid=YahooAM&co=DE&userid=75e2a47c-b344-c844-75e7-308cadf66af7&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=28/11/2013&type=hp4000
SearchScopes: HKCU - {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://mystart.incredibar.com/?a=6PQIwYYZqt&loc=skw&search={searchTerms}&i=26
BHO: RealPlayer Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
BHO: Web Assistant -> {336D0C35-8A85-403a-B9D2-65C292C39087} -> C:\Program Files\Web Assistant\Extension32.dll ()
BHO: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO: Incredibar.com Helper Object -> {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} -> C:\Program Files\Incredibar.com\incredibar\1.5.11.14\bh\incredibar.dll (Montera Technologeis LTD)
BHO: SSVHelper Class -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: ShinyProfile Class -> {C8B7D03D-30D7-493A-95E5-6547E2FAC2FE} -> C:\Users\Uwe\AppData\Roaming\ShinyProfile\shinyprofile.dll (TODO: <Company name>)
BHO: Ask Toolbar -> {D4027C7F-154A-4066-A1AD-4243D8127440} -> No File
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKLM - Incredibar Toolbar - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - C:\Program Files\Incredibar.com\incredibar\1.5.11.14\incredibarTlbr.dll (Montera Technologeis LTD)
Toolbar: HKLM - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Toolbar: HKCU - No Name - {8DBB6D8E-E4A6-4E3B-9753-AF78B226441C} - No File
Toolbar: HKCU - No Name - {30F9B915-B755-4826-820B-08FBA6BD249D} - No File
Toolbar: HKCU - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Toolbar: HKCU - No Name - {EBD898F8-FCF6-4694-BC3B-EABC7271EEB1} - No File
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_IKEA_Win32.cab
DPF: {6E718D87-6909-4FCE-92D4-EDCB2F725727} hxxp://navigram.com/engine/v1026/Navigram.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_67-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0067-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_67-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_67-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default
FF NewTab: google.de
FF Homepage: hxxp://www.google.de/
FF Keyword.URL: hxxp://mystart.incredibar.com/?a=6PQIwYYZqt&i=26&loc=skw&search=
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\17.1.2\\npsitesafety.dll No File
FF Plugin: @canon.com/EPPEX -> C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin: @google.com/npPicasa2,version=2.0.0 -> C:\Program Files\Picasa2\npPicasa2.dll (Google, Inc.)
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=6.0.12.775 -> C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprjplug;version=1.0.3.775 -> C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprphtml5videoshim;version=1.0.0.0 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpjplug;version=6.0.12.775 -> C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF Plugin: @SonyCreativeSoftware.com/Media Go,version=1.0 -> C:\Program Files\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @lightspark.github.com/Lightspark;version=1 -> C:\Program Files\Lightspark 0.5.3-git\nplightsparkplugin.dll No File
FF SearchPlugin: C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\searchplugins\ask-search.xml
FF SearchPlugin: C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\searchplugins\MyStart Search.xml
FF SearchPlugin: C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\searchplugins\Web Search.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\avg-secure-search.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira Browser Safety - C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\Extensions\abs@avira.com [2014-09-05]
FF Extension: Block site - C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\Extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc} [2014-02-04]
FF Extension: Adblock Plus - C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-02-03]
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010-09-08]
FF HKLM\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\Web Assistant\Firefox
FF Extension: Web Assistant - C:\Program Files\Web Assistant\Firefox [2012-09-03]
FF HKLM\...\Firefox\Extensions: [{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}] - C:\Program Files\Web Assistant\Firefox
FF HKLM\...\Firefox\Extensions: [ext@flash-Enhancer.com] - C:\Program Files\AmiExt\flashEnhancer\ff
Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR RestoreOnStartup: Default -> "hxxp://www.google.com/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR CustomProfile: C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-07-28]
CHR Extension: (Google Search) - C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-07-28]
CHR Extension: (No Name) - C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjajpkikblccgefaibcafkfbanllpefi [2013-08-14]
CHR Extension: (ShinyProfile) - C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmmoilmbogfommjccikojnfgbmjknefc [2013-11-28]
CHR Extension: (RealPlayer HTML5Video Downloader Extension) - C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk [2013-07-28]
CHR Extension: (Gmail) - C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-07-28]
CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\Web Assistant\source.crx [2012-09-03]
CHR HKLM\...\Chrome\Extension: [gjajpkikblccgefaibcafkfbanllpefi] - C:\Users\Uwe\AppData\Roaming\7go\7go.crx [2013-07-30]
CHR HKLM\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx [2010-09-08]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-08-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-04] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [166296 2014-09-22] (APN LLC.)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [160048 2014-08-27] (Avira Operations GmbH & Co. KG)
R2 BayerHealthcareService; C:\Program Files\Bayer HealthCare SmartLaunch\bin\BayerHCService.exe [134584 2012-09-18] (Bayer Healthcare LLC)
R2 bgsvcgen; C:\Windows\System32\bgsvcgen.exe [145504 2007-06-15] (B.H.A Corporation)
R2 camsvc; C:\Program Files\TOSHIBA\TOSHIBA Web Camera Application\TWebCameraSrv.exe [20544 2009-04-16] (TOSHIBA)
R2 FsUsbExService; C:\Windows\system32\FsUsbExService.Exe [233472 2013-04-18] (Teruten) [File not signed]
S3 GameConsoleService; C:\Program Files\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe [242424 2009-02-11] (WildTangent, Inc.)
R2 IBUpdaterService; C:\Windows\system32\dmwu.exe [2387760 2014-09-17] ()
R2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [138192 2011-02-07] ()
R2 TemproMonitoringService; C:\Program Files\Toshiba TEMPRO\TemproSvc.exe [124368 2010-10-26] (Toshiba Europe GmbH)
R3 TMachInfo; C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [54136 2011-02-11] (TOSHIBA Corporation)
R2 TOSHIBA eco Utility Service; C:\Program Files\TOSHIBA\TECO\TecoService.exe [176128 2009-04-24] (TOSHIBA Corporation) [File not signed]
R2 TOSHIBA HDD SSD Alert Service; C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [73728 2009-03-17] (TOSHIBA Corporation) [File not signed]
R2 TPCHSrv; C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe [656752 2009-04-15] (TOSHIBA Corporation)
R2 Web Assistant; C:\Program Files\Web Assistant\ExtensionUpdaterService.exe [188760 2013-01-29] () [File not signed]
S2 vToolbarUpdater17.1.2; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\17.1.2\ToolbarUpdater.exe [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-07-03] (Avira Operations GmbH & Co. KG)
R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [37664 2013-11-11] (AVG Technologies)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-06-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-25] (Avira Operations GmbH & Co. KG)
R1 cdrbsdrv; C:\Windows\system32\Drivers\cdrbsdrv.sys [33408 2006-02-20] (B.H.A Corporation) [File not signed]
R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [37344 2013-04-18] () [File not signed]
R3 PGEffect; C:\Windows\System32\DRIVERS\pgeffect.sys [22272 2009-03-18] (TOSHIBA Corporation)
R3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [157536 2009-05-20] (Realtek Semiconductor Corp.)
S3 s0017bus; C:\Windows\System32\DRIVERS\s0017bus.sys [86824 2008-10-21] (MCCI Corporation)
S3 s0017mdfl; C:\Windows\System32\DRIVERS\s0017mdfl.sys [15016 2008-10-21] (MCCI Corporation)
S3 s0017mdm; C:\Windows\System32\DRIVERS\s0017mdm.sys [114600 2008-10-21] (MCCI Corporation)
S3 s0017mgmt; C:\Windows\System32\DRIVERS\s0017mgmt.sys [108328 2008-10-21] (MCCI Corporation)
S3 s0017nd5; C:\Windows\System32\DRIVERS\s0017nd5.sys [26024 2008-10-21] (MCCI Corporation)
S3 s0017obex; C:\Windows\System32\DRIVERS\s0017obex.sys [104616 2008-10-21] (MCCI Corporation)
S3 s0017unic; C:\Windows\System32\DRIVERS\s0017unic.sys [109736 2008-10-21] (MCCI Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R2 TVALZFL; C:\Windows\System32\DRIVERS\TVALZFL.sys [12920 2009-03-21] (TOSHIBA Corporation)
R3 WinDriver6; C:\Windows\System32\drivers\windrvr6.sys [195424 2012-07-16] (Jungo)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-25 19:07 - 2014-09-25 19:08 - 00027208 _____ () C:\Users\Uwe\Downloads\FRST.txt
2014-09-25 19:07 - 2014-09-25 19:07 - 00000000 ____D () C:\FRST
2014-09-25 19:04 - 2014-09-25 19:05 - 01100800 _____ (Farbar) C:\Users\Uwe\Downloads\FRST(1).exe
2014-09-25 18:53 - 2014-09-25 18:54 - 00000000 ____D () C:\Users\Uwe\AppData\Roaming\Roiq
2014-09-25 18:44 - 2014-09-25 18:45 - 03640880 _____ () C:\Users\Uwe\Downloads\avg_remover_zbot.exe
2014-09-25 18:43 - 2014-09-25 18:43 - 01100800 _____ (Farbar) C:\Users\Uwe\Downloads\FRST.exe
2014-09-25 18:28 - 2014-09-25 18:28 - 00122976 _____ (Kaspersky Lab ZAO) C:\Users\Uwe\Downloads\zbotkiller.exe
2014-09-25 18:27 - 2014-09-25 18:27 - 00000000 ___HD () C:\Windows\PIF
2014-09-25 17:58 - 2014-09-25 17:58 - 01101648 _____ () C:\Users\Uwe\Downloads\BitDefender ZBot Removal Tool - CHIP-Installer.exe
2014-09-22 17:16 - 2014-09-22 17:16 - 00005270 _____ () C:\Windows\PFRO.log
2014-09-22 01:00 - 2014-09-23 18:38 - 00009252 _____ () C:\Windows\setupact.log
2014-09-22 01:00 - 2014-09-22 01:00 - 00000000 _____ () C:\Windows\setuperr.log
2014-09-19 14:12 - 2014-09-25 18:42 - 00000000 ____D () C:\Users\Uwe\AppData\Roaming\Avambu
2014-09-14 10:55 - 2014-09-14 11:06 - 00000000 ____D () C:\Users\Uwe\AppData\Local\AviraSpeedup
2014-09-14 10:55 - 2014-09-14 10:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviraSpeedup
2014-09-14 10:53 - 2014-09-14 10:53 - 00001100 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-09-10 22:46 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-10 22:46 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-10 22:46 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-10 22:46 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-10 22:46 - 2014-08-18 23:57 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-10 22:46 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-10 22:46 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-10 22:46 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-10 22:46 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-10 22:46 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-10 22:46 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-10 22:46 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-10 22:46 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-10 22:46 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-10 22:46 - 2014-08-18 23:36 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-10 22:46 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-10 22:46 - 2014-08-18 23:30 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-10 22:46 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-10 22:46 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-10 22:46 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-10 22:46 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-10 22:46 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-10 22:46 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-10 22:46 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-10 22:46 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-10 22:46 - 2014-08-18 23:08 - 00673792 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-10 22:46 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-10 22:46 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-10 22:46 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-10 22:46 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-10 22:45 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-10 19:05 - 2014-07-07 03:40 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-10 19:05 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-10 19:04 - 2014-09-05 03:52 - 00445952 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-10 19:04 - 2014-09-05 03:47 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-10 19:04 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-10 19:04 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-10 18:44 - 2014-09-10 18:44 - 01054912 _____ (Adobe) C:\Users\Uwe\Downloads\install_flashplayer15x32au_mssd_aaa_aih.exe
2014-08-31 12:20 - 2014-08-31 12:28 - 00010565 _____ () C:\Users\Uwe\Documents\Materialliste FC WC 2014.08.31.xlsx
2014-08-31 12:09 - 2014-08-31 12:09 - 00029450 _____ () C:\Users\Uwe\Documents\Materialliste 2014.08.31.xlsx
2014-08-30 20:01 - 2014-08-30 20:01 - 01058200 _____ (Adobe) C:\Users\Uwe\Downloads\install_flashplayer14x32au_mssd_aaa_aih.exe
2014-08-29 17:12 - 2014-08-23 03:46 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-29 17:12 - 2014-08-23 02:42 - 02352640 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-25 19:08 - 2014-09-25 19:07 - 00027208 _____ () C:\Users\Uwe\Downloads\FRST.txt
2014-09-25 19:07 - 2014-09-25 19:07 - 00000000 ____D () C:\FRST
2014-09-25 19:06 - 2010-03-06 20:17 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-25 19:05 - 2014-09-25 19:04 - 01100800 _____ (Farbar) C:\Users\Uwe\Downloads\FRST(1).exe
2014-09-25 19:02 - 2012-04-02 17:54 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-25 18:54 - 2014-09-25 18:53 - 00000000 ____D () C:\Users\Uwe\AppData\Roaming\Roiq
2014-09-25 18:48 - 2010-03-06 22:09 - 00019440 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-25 18:48 - 2010-03-06 22:09 - 00019440 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-25 18:45 - 2014-09-25 18:44 - 03640880 _____ () C:\Users\Uwe\Downloads\avg_remover_zbot.exe
2014-09-25 18:43 - 2014-09-25 18:43 - 01100800 _____ (Farbar) C:\Users\Uwe\Downloads\FRST.exe
2014-09-25 18:42 - 2014-09-19 14:12 - 00000000 ____D () C:\Users\Uwe\AppData\Roaming\Avambu
2014-09-25 18:29 - 2010-03-06 22:34 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-25 18:28 - 2014-09-25 18:28 - 00122976 _____ (Kaspersky Lab ZAO) C:\Users\Uwe\Downloads\zbotkiller.exe
2014-09-25 18:27 - 2014-09-25 18:27 - 00000000 ___HD () C:\Windows\PIF
2014-09-25 17:58 - 2014-09-25 17:58 - 01101648 _____ () C:\Users\Uwe\Downloads\BitDefender ZBot Removal Tool - CHIP-Installer.exe
2014-09-25 17:57 - 2014-05-11 18:24 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-09-25 17:43 - 2010-03-06 20:17 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-25 17:38 - 2012-04-02 17:54 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-09-25 17:38 - 2011-05-14 09:43 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-09-24 18:12 - 2012-01-29 12:20 - 00000000 ____D () C:\Users\Uwe\AppData\Local\Windows Live
2014-09-24 18:01 - 2010-03-07 12:17 - 00006656 _____ () C:\Users\Uwe\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-09-24 18:01 - 2010-03-06 22:25 - 01152600 _____ () C:\Windows\WindowsUpdate.log
2014-09-23 18:38 - 2014-09-22 01:00 - 00009252 _____ () C:\Windows\setupact.log
2014-09-23 18:38 - 2013-06-10 20:26 - 00000350 _____ () C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job
2014-09-23 18:38 - 2013-06-04 07:13 - 00000350 _____ () C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job
2014-09-23 18:38 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-22 17:21 - 2011-06-19 01:25 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-09-22 17:20 - 2010-03-06 22:09 - 00000000 ____D () C:\Users\Uwe
2014-09-22 17:19 - 2014-06-27 23:16 - 00000000 ____D () C:\Windows\system32\mjcm
2014-09-22 17:19 - 2012-09-03 16:28 - 00000000 ____D () C:\Windows\system32\WNLT
2014-09-22 17:19 - 2012-09-03 16:28 - 00000000 ____D () C:\Windows\system32\ARFC
2014-09-22 17:16 - 2014-09-22 17:16 - 00005270 _____ () C:\Windows\PFRO.log
2014-09-22 17:16 - 2012-04-22 13:38 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-09-22 01:00 - 2014-09-22 01:00 - 00000000 _____ () C:\Windows\setuperr.log
2014-09-17 15:01 - 2012-09-03 16:28 - 02387760 _____ () C:\Windows\system32\dmwu.exe
2014-09-17 14:55 - 2012-09-03 16:28 - 00027136 _____ (IncrediMail, Ltd.) C:\Windows\system32\ImHttpComm.dll
2014-09-16 21:20 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-09-16 16:20 - 2012-09-03 16:28 - 00632656 _____ (Microsoft Corporation) C:\Windows\system32\msvcr80.dll
2014-09-16 16:20 - 2012-09-03 16:28 - 00554832 _____ (Microsoft Corporation) C:\Windows\system32\msvcp80.dll
2014-09-16 16:20 - 2012-09-03 16:28 - 00479232 _____ (Microsoft Corporation) C:\Windows\system32\msvcm80.dll
2014-09-16 16:20 - 2012-09-03 16:28 - 00001870 _____ () C:\Windows\system32\Microsoft.VC80.CRT.manifest
2014-09-16 16:20 - 2011-06-11 01:58 - 00421200 _____ (Microsoft Corporation) C:\Windows\system32\msvcp100.dll
2014-09-14 13:57 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-09-14 11:06 - 2014-09-14 10:55 - 00000000 ____D () C:\Users\Uwe\AppData\Local\AviraSpeedup
2014-09-14 11:06 - 2013-01-22 20:57 - 00000000 ____D () C:\Users\Uwe\AppData\Roaming\TeamViewer
2014-09-14 11:06 - 2012-04-28 16:37 - 00000000 ____D () C:\Windows\Minidump
2014-09-14 11:06 - 2010-03-13 17:02 - 00000000 ____D () C:\Windows\IP4000,3000
2014-09-14 11:06 - 2010-03-06 23:50 - 00000000 ____D () C:\Users\Uwe\AppData\Roaming\skypePM
2014-09-14 10:55 - 2014-09-14 10:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviraSpeedup
2014-09-14 10:55 - 2012-11-04 13:16 - 00000000 ____D () C:\Program Files\Avira
2014-09-14 10:53 - 2014-09-14 10:53 - 00001100 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-09-14 10:53 - 2014-08-04 12:19 - 00000000 ____D () C:\ProgramData\Package Cache
2014-09-14 10:53 - 2012-11-04 13:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-09-10 22:46 - 2009-06-09 11:35 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-09-10 22:45 - 2013-08-14 18:18 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-10 22:35 - 2014-05-06 17:45 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-10 22:35 - 2010-03-16 19:28 - 98758480 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-10 22:35 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-09-10 18:44 - 2014-09-10 18:44 - 01054912 _____ (Adobe) C:\Users\Uwe\Downloads\install_flashplayer15x32au_mssd_aaa_aih.exe
2014-09-05 03:52 - 2014-09-10 19:04 - 00445952 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-05 03:47 - 2014-09-10 19:04 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-03 18:29 - 2011-11-18 19:03 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-08-31 12:28 - 2014-08-31 12:20 - 00010565 _____ () C:\Users\Uwe\Documents\Materialliste FC WC 2014.08.31.xlsx
2014-08-31 12:10 - 2010-07-04 16:45 - 00000000 ____D () C:\Users\Uwe\Allerlei
2014-08-31 12:09 - 2014-08-31 12:09 - 00029450 _____ () C:\Users\Uwe\Documents\Materialliste 2014.08.31.xlsx
2014-08-30 20:01 - 2014-08-30 20:01 - 01058200 _____ (Adobe) C:\Users\Uwe\Downloads\install_flashplayer14x32au_mssd_aaa_aih.exe
2014-08-30 19:59 - 2009-07-14 06:33 - 00397344 _____ () C:\Windows\system32\FNTCACHE.DAT
Some content of TEMP:
====================
C:\Users\Uwe\AppData\Local\Temp\avgnt.exe
C:\Users\Uwe\AppData\Local\Temp\KB00200851.exe
C:\Users\Uwe\AppData\Local\Temp\KB81375300.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-09-16 21:11
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 25-09-2014 01
Ran by Uwe at 2014-09-25 19:09:15
Running from C:\Users\Uwe\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Activation Assistant for the 2007 Microsoft Office suites (HKLM\...\Activation Assistant for the 2007 Microsoft Office suites) (Version: - Microsoft Corporation)
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader X (10.1.12) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.12 - Adobe Systems Incorporated)
ALPS Touch Pad Driver (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 7.2.302.105 - ALPS ELECTRIC CO., LTD.)
Ask Toolbar Updater (HKCU\...\{79A765E1-C399-405B-85AF-466F52E918B0}) (Version: 1.2.5.36191 - Ask.com) <==== ATTENTION
ATI Catalyst Install Manager (HKLM\...\{4324E4DD-C67C-A413-5C12-5DC694A99AF6}) (Version: 3.0.723.0 - ATI Technologies, Inc.)
AVG Security Toolbar (HKLM\...\AVG Secure Search) (Version: 17.1.2.1 - AVG Technologies)
Avira (HKLM\...\{70e83cd8-4bd5-4039-ab5a-6b94a8abb641}) (Version: 1.1.21.25162 - Avira Operations GmbH & Co. KG)
Avira (Version: 1.1.21.25162 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.6.570 - Avira)
Avira System Speedup (HKLM\...\AviraSpeedup) (Version: 1.3.1.9930 - Avira System Speedup)
Canon Easy-PhotoPrint EX (HKLM\...\Easy-PhotoPrint EX) (Version: - )
Canon Easy-WebPrint EX (HKLM\...\Easy-WebPrint EX) (Version: - )
Canon IJ Network Scanner Selector EX (HKLM\...\Canon_IJ_Network_Scanner_Selector_EX) (Version: - )
Canon IJ Network Tool (HKLM\...\Canon_IJ_Network_UTILITY) (Version: - )
Canon Inkjet Printer Driver Add-On Module (HKLM\...\CANONIJINBOXADDON100) (Version: - )
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM\...\CANONIJPLM100) (Version: - )
Canon MG5300 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5300_series) (Version: - )
Canon MP Navigator EX 5.0 (HKLM\...\MP Navigator EX 5.0) (Version: - )
Canon My Printer (HKLM\...\CanonMyPrinter) (Version: - )
Canon PhotoRecord (HKLM\...\{D958FAC4-BAE0-4B1D-A42E-DE9BFDE7DDEE}) (Version: 02.02.00013 - Cisra)
Canon Quick Menu (HKLM\...\CanonQuickMenu) (Version: 2.1.0 - Canon Inc.)
Canon Utilities Easy-PrintToolBox (HKLM\...\Easy-PrintToolBox) (Version: - )
Catalyst Control Center - Branding (Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center Core Implementation (Version: 2009.0421.2132.36832 - ATI) Hidden
Catalyst Control Center Graphics Full Existing (Version: 2009.0421.2132.36832 - ATI) Hidden
Catalyst Control Center Graphics Full New (Version: 2009.0421.2132.36832 - ATI) Hidden
Catalyst Control Center Graphics Light (Version: 2009.0421.2132.36832 - ATI) Hidden
Catalyst Control Center Graphics Previews Vista (Version: 2009.0421.2132.36832 - ATI) Hidden
Catalyst Control Center InstallProxy (Version: 2009.0421.2132.36832 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (Version: 2009.0421.2132.36832 - ATI) Hidden
CCC Help Chinese Standard (Version: 2009.0421.2131.36832 - ATI) Hidden
CCC Help Chinese Traditional (Version: 2009.0421.2131.36832 - ATI) Hidden
CCC Help Czech (Version: 2009.0421.2131.36832 - ATI) Hidden
CCC Help Danish (Version: 2009.0421.2131.36832 - ATI) Hidden
CCC Help Dutch (Version: 2009.0421.2131.36832 - ATI) Hidden
CCC Help English (Version: 2009.0421.2131.36832 - ATI) Hidden
CCC Help Finnish (Version: 2009.0421.2131.36832 - ATI) Hidden
CCC Help French (Version: 2009.0421.2131.36832 - ATI) Hidden
CCC Help German (Version: 2009.0421.2131.36832 - ATI) Hidden
CCC Help Greek (Version: 2009.0421.2131.36832 - ATI) Hidden
CCC Help Hungarian (Version: 2009.0421.2131.36832 - ATI) Hidden
CCC Help Italian (Version: 2009.0421.2131.36832 - ATI) Hidden
CCC Help Japanese (Version: 2009.0421.2131.36832 - ATI) Hidden
CCC Help Korean (Version: 2009.0421.2131.36832 - ATI) Hidden
CCC Help Norwegian (Version: 2009.0421.2131.36832 - ATI) Hidden
CCC Help Polish (Version: 2009.0421.2131.36832 - ATI) Hidden
CCC Help Portuguese (Version: 2009.0421.2131.36832 - ATI) Hidden
CCC Help Russian (Version: 2009.0421.2131.36832 - ATI) Hidden
CCC Help Spanish (Version: 2009.0421.2131.36832 - ATI) Hidden
CCC Help Swedish (Version: 2009.0421.2131.36832 - ATI) Hidden
CCC Help Thai (Version: 2009.0421.2131.36832 - ATI) Hidden
CCC Help Turkish (Version: 2009.0421.2131.36832 - ATI) Hidden
ccc-core-static (Version: 2009.0421.2132.36832 - Ihr Firmenname) Hidden
ccc-utility (Version: 2009.0421.2132.36832 - ATI) Hidden
CDDRV_Installer (Version: 4.60 - Logitech) Hidden
CD-LabelPrint (HKLM\...\MediaNavigation.CDLabelPrint) (Version: - )
Conduit Engine (HKLM\...\conduitEngine) (Version: - Conduit Ltd.) <==== ATTENTION
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{650DE870-ECA3-4E63-8D77-778512BE5D4C}) (Version: - Microsoft)
Easy-WebPrint (HKLM\...\Easy-WebPrint) (Version: - )
Feedback Tool (HKLM\...\{13A5E785-5197-4EAD-8EE3-D660271E49BC}) (Version: 1.2.0 - Microsoft Corporation)
Fotogalerie (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Furnish Pro (HKLM\...\Furnish Pro) (Version: - )
GLUCOFACTS(TM) Deluxe (HKLM\...\{32A5C7EC-A602-471C-97D2-AF6CBD52E8C4}) (Version: 3.03.15 - Bayer HealthCare)
GLUCOFACTS(TM) Deluxe Smart Launch (HKLM\...\{BDC53880-55F0-4F56-8737-7D9286A5F095}) (Version: 1.18.01 - Bayer HealthCare)
Google SketchUp 8 (HKLM\...\{15F02176-0D12-4FAF-B2CD-2767C7781427}) (Version: 3.0.4993 - Google, Inc.)
Google Toolbar for Internet Explorer (HKLM\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.24.15 - Google Inc.) Hidden
IB Updater Service (HKLM\...\WNLT) (Version: 5.1.4.1 - ) <==== ATTENTION
Incredibar Toolbar on IE (HKLM\...\incredibar) (Version: - ) <==== ATTENTION
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - Intel Corporation)
Java 7 Update 67 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
Java Auto Updater (Version: 2.1.67.1 - Oracle, Inc.) Hidden
JavaFX 2.1.1 (HKLM\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
Jawbreaker (HKLM\...\99_is1) (Version: - EasyFactuur.com)
Junk Mail filter update (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
KhalInstallWrapper (Version: 2.00.0000 - Logitech) Hidden
Logitech SetPoint (HKLM\...\{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}) (Version: 4.80 - Logitech)
Media Go (HKLM\...\{BE4F388F-E7B6-43E8-8856-6B74AC375A87}) (Version: 1.8.121 - Sony)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2010 (HKLM\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Proof (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SkyDrive (HKCU\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP1 English (HKLM\...\{E59113EB-0285-4BFD-A37A-B79EAC6B8F4B}) (Version: 3.5.5692.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218 (HKLM\...\{E503B4BF-F7BB-3D5F-8BC8-F694B1CFF942}) (Version: 9.0.21022.218 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{402ED4A1-8F5B-387A-8688-997ABF58B8F2}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Movie Maker (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Mozilla Firefox 32.0.2 (x86 de) (HKLM\...\Mozilla Firefox 32.0.2 (x86 de)) (Version: 32.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 24.6.0 (x86 de) (HKLM\...\Mozilla Thunderbird 24.6.0 (x86 de)) (Version: 24.6.0 - Mozilla)
MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (Version: 16.4.1108.0727 - Microsoft) Hidden
MSXML 4.0 SP2 (KB941833) (HKLM\...\{C523D256-313D-4866-B36A-F3DE528246EF}) (Version: 4.20.9849.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyFreeCodec (HKCU\...\MyFreeCodec) (Version: - )
NAVIGON Fresh 3.4.1 (HKLM\...\NAVIGON Fresh) (Version: 3.4.1 - NAVIGON)
OpenOffice.org 3.2 (HKLM\...\{8D1E61D1-1395-4E97-997F-D002DB3A5074}) (Version: 3.2.9502 - OpenOffice.org)
PaperPort Image Printer (HKLM\...\{332CC6BF-E6C7-48EE-BA3D-435E576AD67F}) (Version: 1.00.0000 - Nuance Communications, Inc.)
pCon.planner 6 Beta (HKLM\...\pCon.planner 6 Beta) (Version: 6.3.0.4 - EasternGraphics)
pCon.planner 6 Beta (Version: 6.3.0.4 - EasternGraphics) Hidden
Photo Gallery (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
PHOTOfunSTUDIO 4.0 HD Edition (HKLM\...\{381D847E-7E56-4E82-B261-F799E0F40EB4}) (Version: 4.00.262 - Panasonic Corporation)
Picasa 3 (HKLM\...\Picasa 3) (Version: 3.8 - Google, Inc.)
PlayReady PC runtime (HKLM\...\{B0E5D7E7-A106-458F-BA7B-2F8CAEA3BF16}) (Version: 1 - Microsoft Corporation)
PlayStation(R)Network Downloader (HKLM\...\{B6659DD8-00A7-4A24-BBFB-C1F6982E5D66}) (Version: 2.06.00741 - Sony Computer Entertainment Inc.)
PlayStation(R)Store (HKLM\...\{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}) (Version: 4.3.3.12540 - Sony Computer Entertainment Inc.)
ProfiCAD 6.7.2 (HKLM\...\ProfiCAD_is1) (Version: - )
RealPlayer (HKLM\...\RealPlayer 12.0) (Version: - RealNetworks)
Realtek 8136 8168 8169 Ethernet Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0004 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5904 - Realtek Semiconductor Corp.)
RealUpgrade 1.0 (Version: 1.0.0 - RealNetworks, Inc.) Hidden
Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.2.14014_7 - Samsung Electronics Co., Ltd.)
Samsung Kies (Version: 2.6.2.14014_7 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.43.0 - SAMSUNG Electronics Co., Ltd.)
ScanSoft PaperPort 11 (HKLM\...\{B6C89654-A6A2-477C-873B-724EC1C56407}) (Version: 11.1.0000 - Nuance Communications, Inc.)
Search App by Ask (HKLM\...\{4F524A2D-5350-4500-76A7-A758B70C1101}) (Version: 12.17.1.65 - APN, LLC) <==== ATTENTION
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (Version: - Microsoft) Hidden
Skins (Version: 2009.0421.2132.36832 - ATI) Hidden
Skype™ 6.11 (HKLM\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Softonic Deutsch Toolbar (HKLM\...\Softonic_Deutsch Toolbar) (Version: 6.3.0.26 - Softonic Deutsch) <==== ATTENTION
Sony Ericsson Update Engine (HKLM\...\Update Engine) (Version: 2.11.7.13 - Sony Ericsson Mobile Communications AB)
TOSHIBA Assist (HKLM\...\{12B3A009-A080-4619-9A2A-C6DB151D8D67}) (Version: 2.01.10 - TOSHIBA)
TOSHIBA Benutzerhandbücher (HKLM\...\{1C971EE3-B4C4-4367-9676-57549919C6CE}) (Version: 7.40 - TOSHIBA)
TOSHIBA DVD PLAYER (HKLM\...\{6C5F3BDC-0A1B-4436-A696-5939629D5C31}) (Version: 3.00.1.04-A - TOSHIBA Corporation)
TOSHIBA eco Utility (HKLM\...\InstallShield_{53536479-DFB0-47ED-9D10-43F3708C222D}) (Version: 1.0.3.0 - TOSHIBA Corporation)
TOSHIBA eco Utility (Version: 1.0.3.0 - TOSHIBA Corporation) Hidden
TOSHIBA Extended Tiles for Windows Mobility Center (HKLM\...\InstallShield_{617C36FD-0CBE-4600-84B2-441CEB12FADF}) (Version: 1.01.00 - Toshiba)
TOSHIBA Extended Tiles for Windows Mobility Center (Version: 1.01.00 - Toshiba) Hidden
TOSHIBA Face Recognition (HKLM\...\InstallShield_{C730E42C-935A-45BB-A0C5-37E5234D111B}) (Version: 3.0.5.32 - TOSHIBA Corporation)
TOSHIBA Face Recognition (Version: 3.0.5.32 - TOSHIBA Corporation) Hidden
TOSHIBA Flash Cards Support Utility (HKLM\...\InstallShield_{620BBA5E-F848-4D56-8BDA-584E44584C5E}) (Version: 1.63.0.3C - TOSHIBA CORPORATION)
TOSHIBA Flash Cards Support Utility (Version: 1.63.0.3C - TOSHIBA CORPORATION) Hidden
TOSHIBA Hardware Setup (HKLM\...\InstallShield_{5279374D-87FE-4879-9385-F17278EBB9D3}) (Version: 1.63.0.6C - TOSHIBA CORPORATION)
TOSHIBA Hardware Setup (Version: 1.63.0.6C - TOSHIBA CORPORATION) Hidden
TOSHIBA HDD/SSD Alert (HKLM\...\InstallShield_{D4322448-B6AF-4316-B859-D8A0E84DCB38}) (Version: 3.0.0.1 - TOSHIBA Corporation)
TOSHIBA HDD/SSD Alert (Version: 3.0.0.1 - TOSHIBA Corporation) Hidden
Toshiba Online Product Information (HKLM\...\{2290A680-4083-410A-ADCC-7092C67FC052}) (Version: 2.06.0000 - TOSHIBA)
TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.3.2.0 - TOSHIBA Corporation)
TOSHIBA Recovery Disc Creator (HKLM\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.0.0.2 - TOSHIBA)
TOSHIBA Recovery Disk Creator Reminder (HKLM\...\InstallShield_{773970F1-5EBA-4474-ADEE-1EA3B0A59492}) (Version: 1.00.0017 - TOSHIBA)
TOSHIBA Recovery Disk Creator Reminder (Version: 1.00.0017 - TOSHIBA) Hidden
TOSHIBA SD Memory Utilities (HKLM\...\{EBFF48F5-3CFA-436F-8FD5-94FB01D3A0A7}) (Version: 1.8.1.6 - TOSHIBA)
TOSHIBA Service Station (HKLM\...\{AC6569FA-6919-442A-8552-073BE69E247A}) (Version: 2.2.9 - TOSHIBA)
TOSHIBA Supervisor Password (Version: 1.63.0.3C - TOSHIBA CORPORATION) Hidden
TOSHIBA Supervisorkennwort (HKLM\...\InstallShield_{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}) (Version: 1.63.0.3C - TOSHIBA CORPORATION)
TOSHIBA TEMPRO (HKLM\...\{3A9B3B6D-3C08-4283-AF50-FD82C49DD71E}) (Version: 3.34 - Toshiba Europe GmbH)
TOSHIBA Value Added Package (HKLM\...\InstallShield_{FEDD27A0-B306-45EF-BF58-B527406B42C8}) (Version: 1.2.8 - TOSHIBA Corporation)
TOSHIBA Value Added Package (Version: 1.2.8 - TOSHIBA Corporation) Hidden
TOSHIBA Web Camera Application (HKLM\...\{5E6F6CF3-BACC-4144-868C-E14622C658F3}) (Version: 1.0.1.8 - TOSHIBA Corporation)
TRORDCLauncher (HKLM\...\InstallShield_{E65C7D8E-186D-484B-BEA8-DEF0331CE600}) (Version: 1.0.0.6 - TOSHIBA)
TRORDCLauncher (Version: 1.0.0.6 - TOSHIBA) Hidden
TuneUp Utilities Language Pack (de-DE) (Version: 9.0.4700.21 - TuneUp Software) Hidden
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version: - Microsoft)
Update for Microsoft Excel 2010 (KB2889836) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{9179FC17-97A8-4D98-9E09-05720AF5D44E}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2687502) 32-Bit Edition (HKLM\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{7DE7DF97-82FE-4B3A-AB8D-1621F9CC464A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2825635) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{F1A20C69-9FE5-40FD-9CD5-84EABC2EF64A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2837581) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{334FB202-28D7-4BA4-8BC9-4FE4AB233EA0}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2837606) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{B0D672F7-883E-4279-8E75-D97A5445AB46}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2878252) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{B0DB9F71-E0F7-4FE6-8925-35B860CAC0C4}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition (HKLM\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{EAD7BEF9-B28C-425F-B2C5-538CB27EF013}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition (HKLM\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{089DBFD7-8211-43B2-AAAE-5BDD8C23E3A8}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{40EC8FB1-5202-469D-9232-C28FB1C6FC64}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2BA40F82-F3A4-441C-BF1A-ED4C42FF4872}) (Version: - Microsoft)
Update for Microsoft Visio 2010 (KB2880526) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{7B29D8B8-6A87-496C-A65E-B935E740448A}) (Version: - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2837587) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{38CF30E4-3348-4BD1-A859-B630C355A56F}) (Version: - Microsoft)
Update for Microsoft Word 2010 (KB2880529) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{B9B89E01-5B6B-4F73-BC34-B2C0D8ACB4CD}) (Version: - Microsoft)
Utility Common Driver (Version: 1.0.50.22C - TOSHIBA) Hidden
Web Assistant 2.0.0.573 (HKLM\...\{336D0C35-8A85-403a-B9D2-65C292C39087}_is1) (Version: 2.0.0.573 - IncrediBar) <==== ATTENTION
WildTangent-Spiele (HKLM\...\WildTangent toshiba Master Uninstall) (Version: 1.0.0.71 - WildTangent)
Windows Live Communications Platform (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
Windows Live Essentials (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Messenger (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Photo Common (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Writer (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Writer Resources (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-2242340406-3198609139-1784460280-1000_Classes\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\localserver32 -> C:\Users\Uwe\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2242340406-3198609139-1784460280-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Uwe\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2242340406-3198609139-1784460280-1000_Classes\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\localserver32 -> C:\Users\Uwe\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2242340406-3198609139-1784460280-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Uwe\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2242340406-3198609139-1784460280-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Uwe\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2242340406-3198609139-1784460280-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Uwe\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\FileSyncApi.dll (Microsoft Corporation)
==================== Restore Points =========================
14-09-2014 08:54:57 Avira System Speedup(1.3.1.9930)
14-09-2014 09:04:54 Erstelle Systemwiederherstellungspunkt bevor Junk-Dateien gelöscht werden.
15-09-2014 15:34:50 Windows-Sicherung
16-09-2014 15:46:52 Windows-Sicherung
16-09-2014 18:13:06 Windows Update
21-09-2014 17:00:23 Windows-Sicherung
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {0152BF0F-F096-44DF-BF05-DDEA5207EE0E} - System32\Tasks\Adobe Reader and Acrobat Manager => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-08-21] (Adobe Systems Incorporated)
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {453043EE-3B8E-4FF7-9898-A645F6CC43AF} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2014-07-25] (Oracle Corporation)
Task: {49E86FF2-376F-4A48-8265-93757718430B} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv => C:\Windows\TEMP\{1FF26CEC-30A9-4FBA-BC9E-58BD59F156B2}.exe
Task: {4EE08EBE-D8B4-4266-B326-2E90A5117416} - System32\Tasks\{01107948-FB8C-4405-9933-28A0DE6D1820} => Iexplore.exe hxxp://ui.skype.com/ui/0/4.2.0.155/de/abandoninstall?source=lightinstaller&page=tsMain&installinfo=google-toolbar:notoffered;toolbarpresent,google-chrome:offered-installed
Task: {561375CB-FF5A-417B-B297-BA73DE149581} - System32\Tasks\Microsoft\Windows\Wired\GatherWiredInfo => C:\Windows\system32\gatherWiredInfo.vbs
Task: {6079E96E-74A4-4B3D-9E56-BB8A293F4C30} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-25] (Adobe Systems Incorporated)
Task: {6249591A-A1FA-477F-9BF0-E80EAE18C735} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {63AAD67A-384C-4226-9834-2B22CD03A96E} - System32\Tasks\{F80C51F7-4D2A-4CEC-B8FE-68B451ED4B57} => C:\Program Files\Canon\CD-LabelPrint\Uninstal.exe [2004-04-30] (Monolith Corp.)
Task: {6D241061-6909-406A-86B4-32AE1F7F338B} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv => C:\Windows\TEMP\{DD678A93-41D6-494C-9A5F-7C2322483C87}.exe
Task: {6DC99D41-6CC5-482C-BA84-1403EE87C7B5} - System32\Tasks\ScanSoft Background Update => C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2006-10-25] (Nuance Communications, Inc.)
Task: {7365C406-3986-4D17-A359-F37CBE709D39} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-2242340406-3198609139-1784460280-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2010-06-03] (RealNetworks, Inc.)
Task: {7594801C-432E-4D29-9FD1-D73F8ECDCD58} - System32\Tasks\{579C3B85-1E92-4A7F-AF9A-9FD5F426007D} => Iexplore.exe hxxp://ui.skype.com/ui/0/4.2.0.155/de/abandoninstall?source=lightinstaller&page=tsMain&installinfo=google-toolbar:notoffered;toolbarpresent,google-chrome:notoffered;alreadyoffered
Task: {7EEAE1FD-46C8-4DAB-9769-815E834D718A} - System32\Tasks\{CBBC1AA6-EBA0-42C5-A951-E6B2CEADA394} => C:\Program Files\NAVIGON\NAVIGON Fresh\uninst.exe [2012-12-24] (NAVIGON AG)
Task: {81F4015B-7D13-4E88-965B-C4D52F9C52BB} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2010-03-06] (Google Inc.)
Task: {92E8D4FF-1896-41AE-B51C-39659DE8AF10} - System32\Tasks\Real Player-Online-Aktualisierungsprogramm => C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2010-09-08] (RealNetworks, Inc.)
Task: {9401694A-310E-42BB-8CF6-AF6AA1DE225F} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-2242340406-3198609139-1784460280-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2010-06-03] (RealNetworks, Inc.)
Task: {9509B561-975B-4C61-98D9-425053DE1313} - System32\Tasks\{EA2AA7F1-45DA-43B4-82A2-92B8EEE1DB4C} => C:\Program Files\Canon\CD-LabelPrint\Uninstal.exe [2004-04-30] (Monolith Corp.)
Task: {9A96DB6A-379D-4FE0-BD8C-451CF673931A} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-08-21] (Adobe Systems Incorporated)
Task: {9E240401-DB99-4DAD-83E8-3AB602B5D7FB} - System32\Tasks\{6AB2DF01-1E87-4538-ACC5-60BC8CBE6F2C} => C:\Program Files\Canon\CD-LabelPrint\Uninstal.exe [2004-04-30] (Monolith Corp.)
Task: {A429ABE9-2BB0-44AE-A459-B4C61B0F6ECE} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2011 => C:\Program Files\TuneUp Utilities 2011\OneClick.exe
Task: {C153D146-7FB3-4E86-BDBF-D4CA2DBC318C} - System32\Tasks\{BB9F2AC4-CDFA-4B43-8D35-237EA4F8A180} => C:\Program Files\NAVIGON\NAVIGON Fresh\uninst.exe [2012-12-24] (NAVIGON AG)
Task: {E07E31E0-CCB0-4A24-9AEB-0BC2A40002AF} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2010-03-06] (Google Inc.)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs
Task: {F013C6FE-3E21-427B-99C6-467F9C27E9D6} - System32\Tasks\AviraSpeedup => C:\Program Files\Avira\AviraSpeedup\avira_system_speedup.exe [2014-09-14] (Avira)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job => C:\Windows\TEMP\{DD678A93-41D6-494C-9A5F-7C2322483C87}.exe
Task: C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job => C:\Windows\TEMP\{1FF26CEC-30A9-4FBA-BC9E-58BD59F156B2}.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2011-11-18 19:08 - 2011-02-07 09:56 - 00138192 _____ () C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
2009-03-07 15:15 - 2009-03-07 15:15 - 07005496 _____ () C:\Program Files\TOSHIBA\FlashCards\BlackPng.dll
2009-06-09 11:13 - 2006-10-10 12:44 - 00009728 _____ () C:\Program Files\TOSHIBA\TOSHIBA Assist\NotifyX.dll
2009-03-12 20:08 - 2009-03-12 20:08 - 00049152 _____ () C:\Program Files\Toshiba\PCDiag\NotifyPCD.dll
2006-12-01 19:55 - 2006-12-01 19:55 - 00009216 _____ () C:\Program Files\Toshiba\TBS\NotifyTBS.dll
2009-04-24 12:39 - 2009-04-24 12:39 - 00516096 _____ () C:\Program Files\TOSHIBA\TECO\TecoPower.dll
2009-01-30 22:11 - 2009-01-30 22:11 - 00073728 _____ () C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll
2014-08-04 12:19 - 2014-08-27 15:00 - 00052472 _____ () C:\Users\Uwe\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
2014-08-27 15:00 - 2014-08-27 15:00 - 00139056 _____ () C:\Program Files\Avira\My Avira\Avira.OE.NativeCore.dll
2014-07-22 17:44 - 2014-07-22 17:44 - 00186368 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Commonc65c5a95#\75cd8ee7e3164f7b18c76a2c7668b2d0\Kies.Common.DeviceServiceLib.Interface.ni.dll
2014-07-22 17:44 - 2014-07-22 17:44 - 14993920 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Theme\e6f83b1e807b714f177c5cc236b100fa\Kies.Theme.ni.dll
2014-07-22 17:44 - 2014-07-22 17:44 - 01865728 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.UI\f901a89aaacd0658db1b88188f5b1df6\Kies.UI.ni.dll
2014-07-22 17:44 - 2014-07-22 17:44 - 00081920 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.MVVM\ea6f79f5bd31f9e22b4fff87d4f39050\Kies.MVVM.ni.dll
2014-04-01 21:12 - 2014-04-01 21:12 - 00236032 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\ASF_cSharpAPI\cffeb31975c17760187d713cf2d7934d\ASF_cSharpAPI.ni.dll
2012-11-13 19:09 - 2009-07-20 13:27 - 00017936 _____ () C:\Program Files\Logitech\SetPoint\khalwrapper.dll
2012-09-03 16:28 - 2013-01-29 15:28 - 00188760 _____ () C:\Program Files\Web Assistant\ExtensionUpdaterService.exe
2014-09-17 15:01 - 2014-09-17 15:01 - 00730928 _____ () C:\Windows\System32\mjcm\dnkt.exe
2014-09-17 15:01 - 2014-09-17 15:01 - 01778480 _____ () C:\Windows\System32\mjcm\5141\nsib.dll
2014-08-27 15:00 - 2014-08-27 15:00 - 00066864 _____ () C:\Program Files\Avira\My Avira\Avira.OE.AvConnectorNative.dll
2014-05-11 18:24 - 2014-09-19 15:14 - 03734640 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2012-09-03 16:28 - 2014-09-17 15:01 - 02387760 _____ () C:\Windows\system32\dmwu.exe
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Users\Uwe\Eingangsbestätigung - Ihr Kauf bei und.aus (ebay.de).eml:OECustomProperty
AlternateDataStreams: C:\Users\Uwe\Kündigungsbestätigung _ Vertragsnummer 303051064.eml:OECustomProperty
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^PHOTOfunSTUDIO 4.0 HD Edition.lnk => C:\Windows\pss\PHOTOfunSTUDIO 4.0 HD Edition.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Uwe^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk => C:\Windows\pss\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk.Startup
MSCONFIG\startupreg: ApnUpdater => "C:\Program Files\Ask.com\Updater\Updater.exe"
MSCONFIG\startupreg: CanonMyPrinter => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
MSCONFIG\startupreg: CanonSolutionMenuEx => C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE /logon
MSCONFIG\startupreg: Easy-PrintToolBox => C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
MSCONFIG\startupreg: IJNetworkScannerSelectorEX => C:\Program Files\Canon\IJ Network Scanner Selector EX\CNMNSST.exe /FORCE
MSCONFIG\startupreg: IndexSearch => "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
MSCONFIG\startupreg: KiesAirMessage => C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup
MSCONFIG\startupreg: KiesHelper => C:\Program Files\Samsung\Kies\KiesHelper.exe /s
MSCONFIG\startupreg: KiesPDLR => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
MSCONFIG\startupreg: KiesPreload => C:\Program Files\Samsung\Kies\Kies.exe /preload
MSCONFIG\startupreg: KiesTrayAgent => C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
MSCONFIG\startupreg: PaperPort PTD => "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
MSCONFIG\startupreg: TWebCamera => "%ProgramFiles%\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun
========================= Accounts: ==========================
Administrator (S-1-5-21-2242340406-3198609139-1784460280-500 - Disabled - Status: Degraded)
Gast (S-1-5-21-2242340406-3198609139-1784460280-501 - Disabled - Status: Degraded)
HomeGroupUser$ (S-1-5-21-2242340406-3198609139-1784460280-1002 - Enabled - Status: OK)
Uwe (S-1-5-21-2242340406-3198609139-1784460280-1000 - Enabled - Status: OK) => C:\Users\Uwe
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (09/25/2014 05:38:18 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: CNQMUPDT.EXE, Version: 2.1.0.0, Zeitstempel: 0x5063d75d
Name des fehlerhaften Moduls: CNMDWLD.DLL, Version: 1.0.0.0, Zeitstempel: 0x4f5eedc8
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000023c6
ID des fehlerhaften Prozesses: 0x13dc
Startzeit der fehlerhaften Anwendung: 0xCNQMUPDT.EXE0
Pfad der fehlerhaften Anwendung: CNQMUPDT.EXE1
Pfad des fehlerhaften Moduls: CNQMUPDT.EXE2
Berichtskennung: CNQMUPDT.EXE3
Error: (09/23/2014 07:21:05 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (09/23/2014 07:20:31 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1". Fehler in Manifest- oder Richtliniendatei "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"2" in Zeile Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8".
Definition: Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error: (09/23/2014 06:39:49 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/22/2014 05:48:05 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (09/22/2014 05:47:26 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1". Fehler in Manifest- oder Richtliniendatei "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"2" in Zeile Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8".
Definition: Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error: (09/22/2014 05:18:54 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/21/2014 09:57:43 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (09/21/2014 09:57:04 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1". Fehler in Manifest- oder Richtliniendatei "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"2" in Zeile Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8".
Definition: Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error: (09/21/2014 01:48:56 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 32.0.2.5373, Zeitstempel: 0x541a8235
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea91c
Ausnahmecode: 0xc0000374
Fehleroffset: 0x000c3873
ID des fehlerhaften Prozesses: 0x1774
Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0
Pfad der fehlerhaften Anwendung: firefox.exe1
Pfad des fehlerhaften Moduls: firefox.exe2
Berichtskennung: firefox.exe3
System errors:
=============
Error: (09/25/2014 06:39:50 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "IBUpdaterService" wurde unerwartet beendet. Dies ist bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 5000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (09/25/2014 06:39:41 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "IBUpdaterService" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 5000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (09/25/2014 06:26:35 PM) (Source: atikmdag) (EventID: 10261) (User: )
Description: Display is not active
Error: (09/25/2014 05:37:37 PM) (Source: atikmdag) (EventID: 10261) (User: )
Description: Display is not active
Error: (09/24/2014 05:12:38 PM) (Source: atikmdag) (EventID: 10261) (User: )
Description: Display is not active
Error: (09/23/2014 06:40:42 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "Heimnetzgruppen-Listener" wurde mit folgendem dienstspezifischem Fehler beendet: %%-2147023143.
Error: (09/23/2014 06:39:13 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Error: (09/23/2014 06:38:44 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "vToolbarUpdater17.1.2" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (09/23/2014 06:38:08 PM) (Source: atikmdag) (EventID: 10261) (User: )
Description: Display is not active
Error: (09/23/2014 06:38:08 PM) (Source: atikmdag) (EventID: 19468) (User: )
Description: CPLIB :: General - Invalid Parameter
Microsoft Office Sessions:
=========================
Error: (09/25/2014 05:38:18 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: CNQMUPDT.EXE2.1.0.05063d75dCNMDWLD.DLL1.0.0.04f5eedc8c0000005000023c613dc01cfd74cf6b131caC:\Program Files\Canon\Quick Menu\CNQMUPDT.EXEC:\Program Files\Canon\Quick Menu\CNMDWLD.DLLf8607a5e-44c9-11e4-869d-0026223020e5
Error: (09/23/2014 07:21:05 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\Canon\mp navigator ex 5.0\mpnmlif64.exe
Error: (09/23/2014 07:20:31 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"c:\program files\Samsung\Kies\External\firmwareupdate\GT-S5830\DeviceController64.exec:\program files\Samsung\Kies\External\firmwareupdate\GT-S5830\Microsoft.VC90.CRT.MANIFEST11
Error: (09/23/2014 06:39:49 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/22/2014 05:48:05 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\Canon\mp navigator ex 5.0\mpnmlif64.exe
Error: (09/22/2014 05:47:26 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"c:\program files\Samsung\Kies\External\firmwareupdate\GT-S5830\DeviceController64.exec:\program files\Samsung\Kies\External\firmwareupdate\GT-S5830\Microsoft.VC90.CRT.MANIFEST11
Error: (09/22/2014 05:18:54 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/21/2014 09:57:43 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\Canon\mp navigator ex 5.0\mpnmlif64.exe
Error: (09/21/2014 09:57:04 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"c:\program files\Samsung\Kies\External\firmwareupdate\GT-S5830\DeviceController64.exec:\program files\Samsung\Kies\External\firmwareupdate\GT-S5830\Microsoft.VC90.CRT.MANIFEST11
Error: (09/21/2014 01:48:56 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: firefox.exe32.0.2.5373541a8235ntdll.dll6.1.7601.18247521ea91cc0000374000c3873177401cfd591d43e8496C:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\SYSTEM32\ntdll.dll440f3e72-4185-11e4-9594-0026223020e5
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 Duo CPU T6500 @ 2.10GHz
Percentage of memory in use: 71%
Total physical RAM: 3036.88 MB
Available physical RAM: 875.81 MB
Total Pagefile: 6072.04 MB
Available Pagefile: 3765.46 MB
Total Virtual: 2047.88 MB
Available Virtual: 1891.15 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:186.52 GB) (Free:122.78 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (Data) (Fixed) (Total:184.62 GB) (Free:76.73 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 372.6 GB) (Disk ID: DF4EF0B3)
Partition 1: (Not Active) - (Size=1.5 GB) - (Type=27)
Partition 2: (Active) - (Size=186.5 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=184.6 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-09-25 19:44:27
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 TOSHIBA_ rev.FG01 372,61GB
Running: Gmer-19357.exe; Driver: C:\Users\Uwe\AppData\Local\Temp\uwldapow.sys
---- System - GMER 2.1 ----
SSDT 98C534EE ZwCreateSection
SSDT 98C534F8 ZwRequestWaitReplyPort
SSDT 98C534F3 ZwSetContextThread
SSDT 98C534FD ZwSetSecurityObject
SSDT 98C53502 ZwSystemDebugControl
SSDT 98C5348F ZwTerminateProcess
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!ZwRollbackEnlistment + 142D 83479A15 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 834B3212 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!KeRemoveQueueEx + 11F7 834BA58C 4 Bytes [EE, 34, C5, 98] {OUT DX, AL; XOR AL, 0xc5; CWDE }
.text ntkrnlpa.exe!KeRemoveQueueEx + 1553 834BA8E8 4 Bytes [F8, 34, C5, 98] {CLC ; XOR AL, 0xc5; CWDE }
.text ntkrnlpa.exe!KeRemoveQueueEx + 1597 834BA92C 4 Bytes [F3, 34, C5, 98] {XOR AL, 0xc5; CWDE }
.text ntkrnlpa.exe!KeRemoveQueueEx + 1613 834BA9A8 4 Bytes [FD, 34, C5, 98] {STD ; XOR AL, 0xc5; CWDE }
.text ntkrnlpa.exe!KeRemoveQueueEx + 1667 834BA9FC 4 Bytes [02, 35, C5, 98]
.text ...
.text C:\Windows\system32\DRIVERS\atikmdag.sys section is writeable [0x91E02000, 0x2D5378, 0xE8000020]
---- User code sections - GMER 2.1 ----
.text C:\Windows\Explorer.EXE[1836] ntdll.dll!NtResumeThread 777F64E8 5 Bytes JMP 040A81A9
.text C:\Windows\Explorer.EXE[1836] WS2_32.dll!recv 76166B0E 5 Bytes JMP 040B1B99
.text C:\Windows\Explorer.EXE[1836] WS2_32.dll!WSARecv 76167089 5 Bytes JMP 040B1C8E
.text C:\Windows\system32\msiexec.exe[2820] ntdll.dll!NtOpenSection 777F5E08 5 Bytes JMP 7FF93262
.text C:\Windows\system32\msiexec.exe[2820] ws2_32.dll!GetAddrInfoW 76164889 5 Bytes JMP 7FF91C69
---- Devices - GMER 2.1 ----
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys
---- Registry - GMER 2.1 ----
Reg HKLM\SOFTWARE\Microsoft\Windows Search\UsnNotifier\Windows\Catalogs\SystemIndex@{A40DC00F-2938-11DF-9775-806E6F6E6963} 6464214720
---- EOF - GMER 2.1 ----
|
|
25.09.2014, 19:00
| #2 | |
| /// the machine /// TB-Ausbilder    | Zbot.A.1193 eingefangen, lässt sich nicht löschen hi,
__________________Zitat:
Adware & Co. deinstallieren
Scan mit Combofix
__________________ |
|
26.09.2014, 13:21
| #3 |
| | Zbot.A.1193 eingefangen, lässt sich nicht löschen Und es hat wegen dem Avira Antivir gemeckert
__________________Log: Code:
ATTFilter ComboFix 14-09-24.01 - Uwe 25.09.2014 20:20:58.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.3037.1131 [GMT 2:00]
ausgeführt von:: c:\users\Uwe\Desktop\ComboFix.exe
AV: Avira Desktop *Enabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Enabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Recycle.Bin
c:\users\Uwe\AppData\Local\lollipop
c:\users\Uwe\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
c:\users\Uwe\AppData\Roaming\7go
c:\users\Uwe\AppData\Roaming\7go\7go.crx
c:\users\Uwe\AppData\Roaming\7go\icon.ico
c:\users\Uwe\AppData\Roaming\Roiq
c:\users\Uwe\AppData\Roaming\Roiq\ybwu.exe
c:\windows\IsUn0407.exe
c:\windows\system32\System32\MASetupCleaner.exe
c:\windows\system32\System32\muzapp.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-08-25 bis 2014-09-25 ))))))))))))))))))))))))))))))
.
.
2014-09-25 18:30 . 2014-09-25 18:40 -------- d-----w- c:\users\Uwe\AppData\Local\temp
2014-09-25 18:30 . 2014-09-25 18:30 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-09-25 18:04 . 2014-09-25 18:04 -------- d-----w- c:\program files\VS Revo Group
2014-09-25 17:07 . 2014-09-25 17:10 -------- d-----w- C:\FRST
2014-09-25 16:27 . 2014-09-25 16:27 -------- d--h--w- c:\windows\PIF
2014-09-19 12:12 . 2014-09-25 16:42 -------- d-----w- c:\users\Uwe\AppData\Roaming\Avambu
2014-09-14 11:12 . 2014-09-14 11:12 3231696 ----a-w- c:\program files\Mozilla Firefox\d3dcompiler_46.dll
2014-09-14 08:55 . 2014-09-14 09:06 -------- d-----w- c:\users\Uwe\AppData\Local\AviraSpeedup
2014-09-10 20:45 . 2014-06-27 01:45 2285056 ----a-w- c:\windows\system32\msmpeg2vdec.dll
2014-09-10 17:05 . 2014-07-07 01:40 1059840 ----a-w- c:\windows\system32\lsasrv.dll
2014-09-10 17:05 . 2014-07-07 01:40 550912 ----a-w- c:\windows\system32\kerberos.dll
2014-09-10 17:04 . 2014-06-24 02:59 1987584 ----a-w- c:\windows\system32\d3d10warp.dll
2014-09-10 17:04 . 2014-08-01 11:35 793600 ----a-w- c:\windows\system32\TSWorkspace.dll
2014-09-10 17:04 . 2014-09-05 01:52 445952 ----a-w- c:\windows\system32\aepdu.dll
2014-09-10 17:04 . 2014-09-05 01:47 302592 ----a-w- c:\windows\system32\aeinv.dll
2014-09-04 12:50 . 2014-09-04 12:50 188304 ----a-w- c:\program files\Internet Explorer\Plugins\nppdf32.dll
2014-08-29 15:12 . 2014-08-23 01:46 305152 ----a-w- c:\windows\system32\gdi32.dll
2014-08-29 15:12 . 2014-08-23 00:42 2352640 ----a-w- c:\windows\system32\win32k.sys
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-09-25 15:38 . 2012-04-02 15:54 701104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-09-25 15:38 . 2011-05-14 07:43 71344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-09-19 12:14 . 2014-09-19 12:14 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{7EF5DCEF-B190-427F-8607-FFB9E7F80F1F}\offreg.dll
2014-09-16 14:20 . 2012-09-03 14:28 632656 ----a-w- c:\windows\system32\msvcr80.dll
2014-09-16 14:20 . 2012-09-03 14:28 554832 ----a-w- c:\windows\system32\msvcp80.dll
2014-09-16 14:20 . 2012-09-03 14:28 479232 ----a-w- c:\windows\system32\msvcm80.dll
2014-09-16 14:20 . 2011-06-10 23:58 421200 ----a-w- c:\windows\system32\msvcp100.dll
2014-09-09 01:24 . 2014-09-19 11:31 8806800 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{7EF5DCEF-B190-427F-8607-FFB9E7F80F1F}\mpengine.dll
2014-08-30 17:59 . 2012-07-17 13:37 23256 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2014-08-25 04:53 . 2013-11-19 16:44 231584 ------w- c:\windows\system32\MpSigStub.exe
2014-08-18 04:50 . 2014-08-18 04:50 96680 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2014-07-25 00:35 . 2014-07-25 00:35 875688 ----a-w- c:\windows\system32\msvcr120_clr0400.dll
2014-07-24 14:07 . 2013-05-07 08:15 35848 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2014-07-16 02:46 . 2014-08-17 08:53 2048 ----a-w- c:\windows\system32\tzres.dll
2014-07-14 01:42 . 2014-08-17 08:55 654336 ----a-w- c:\windows\system32\rpcrt4.dll
2014-07-03 17:28 . 2012-11-04 11:16 97648 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2014-06-30 22:14 . 2014-08-14 20:23 8856 ----a-w- c:\windows\system32\icardres.dll
2007-03-12 16:59 . 2007-03-12 16:59 299008 ----a-w- c:\program files\navigram_register.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2012-10-30 14:16 220632 ----a-w- c:\users\Uwe\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2012-10-30 14:16 220632 ----a-w- c:\users\Uwe\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2012-10-30 14:16 220632 ----a-w- c:\users\Uwe\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSHIBA Online Product Information"="c:\program files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2009-03-16 6158240]
"KiesPreload"="c:\program files\Samsung\Kies\Kies.exe" [2014-06-14 1563440]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2009-03-29 184320]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-07-28 7625248]
"00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2009-03-23 729088]
"HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2009-03-09 55160]
"HWSetup"="c:\program files\TOSHIBA\Utilities\HWSetup.exe" [2007-04-16 421888]
"KeNotify"="c:\program files\TOSHIBA\Utilities\KeNotify.exe" [2009-01-13 34088]
"SmartFaceVWatcher"="c:\program files\Toshiba\SmartFaceV\SmartFaceVWatcher.exe" [2009-03-24 163840]
"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2009-03-31 503808]
"Teco"="c:\program files\TOSHIBA\TECO\Teco.exe" [2009-04-24 1323008]
"ToshibaServiceStation"="c:\program files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2011-02-11 1295736]
"TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe" [2009-04-23 1011712]
"TPCHWMsg"="c:\program files\TOSHIBA\TPHM\TPCHWMsg.exe" [2009-04-15 570736]
"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2009-03-06 468320]
"Toshiba TEMPRO"="c:\program files\Toshiba TEMPRO\TemproTray.exe" [2010-10-26 1050072]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-08-21 959176]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2014-08-04 751184]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 55824]
"CanonQuickMenu"="c:\program files\Canon\Quick Menu\CNQMMAIN.EXE" [2012-09-27 1279120]
"spup"="c:\users\Uwe\AppData\Roaming\ShinyProfile\spup.exe" [2013-07-10 197664]
"KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2014-06-14 310064]
"Avira Systray"="c:\program files\Avira\My Avira\Avira.OE.Systray.exe" [2014-08-27 164656]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AviraSpeedup"="c:\program files\Avira\AviraSpeedup\avira_system_speedup.exe" [2014-09-14 5085416]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2012-11-13 813584]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
TRDCReminder.lnk - c:\program files\TOSHIBA\TRDCReminder\TRDCReminder.exe [2009-2-24 391072]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"TaskbarNoNotification"= 0 (0x0)
"HideSCAHealth"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"TaskbarNoNotification"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^PHOTOfunSTUDIO 4.0 HD Edition.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\PHOTOfunSTUDIO 4.0 HD Edition.lnk
backup=c:\windows\pss\PHOTOfunSTUDIO 4.0 HD Edition.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^Uwe^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk]
path=c:\users\Uwe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
backup=c:\windows\pss\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2011-04-07 17:09 2565520 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Easy-PrintToolBox]
2004-01-14 01:10 409600 ----a-w- c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IJNetworkScannerSelectorEX]
2011-01-15 15:48 452016 ----a-w- c:\program files\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
2007-01-29 19:10 46632 ----a-w- c:\program files\ScanSoft\PaperPort\IndexSearch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPDLR]
2014-06-14 04:31 843568 ----a-w- c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPreload]
2014-06-14 04:30 1563440 ----a-w- c:\program files\Samsung\Kies\Kies.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent]
2014-06-14 04:30 310064 ----a-w- c:\program files\Samsung\Kies\KiesTrayAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
2007-01-29 19:12 30248 ----a-w- c:\program files\ScanSoft\PaperPort\pptd40nt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TWebCamera]
2009-04-16 17:42 2513472 ----a-w- c:\program files\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "c:\programdata\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
.
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2013-10-23 172192]
R2 TemproMonitoringService;Notebook Performance Tuning Service (TEMPRO);c:\program files\Toshiba TEMPRO\TemproSvc.exe [2010-10-26 124368]
R2 vToolbarUpdater17.1.2;vToolbarUpdater17.1.2;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\17.1.2\ToolbarUpdater.exe [x]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [2014-01-23 32064]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2011-08-22 13224]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2014-08-18 108032]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000-Serie - Adaptertreiber für Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
R3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:\windows\system32\DRIVERS\s0017bus.sys [2008-10-21 86824]
R3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s0017mdfl.sys [2008-10-21 15016]
R3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s0017mdm.sys [2008-10-21 114600]
R3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s0017mgmt.sys [2008-10-21 108328]
R3 s0017nd5;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS);c:\windows\system32\DRIVERS\s0017nd5.sys [2008-10-21 26024]
R3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s0017obex.sys [2008-10-21 104616]
R3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM);c:\windows\system32\DRIVERS\s0017unic.sys [2008-10-21 109736]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2014-01-23 136904]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2014-01-23 17864]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2014-01-23 153672]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys [2014-01-23 130248]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WSDScan;WSD-Scanunterstützung durch UMB;c:\windows\system32\drivers\WSDScan.sys [2009-07-14 20480]
S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [2013-11-11 37664]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2013-11-25 37352]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-08-18 176128]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2014-08-04 430160]
S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files\Avira\My Avira\Avira.OE.ServiceHost.exe [2014-08-27 160048]
S2 BayerHealthcareService;BayerHealthcareService;c:\program files\Bayer HealthCare SmartLaunch\bin\BayerHCService.exe [2012-09-18 134584]
S2 camsvc;TOSHIBA Web Camera Service;c:\program files\TOSHIBA\TOSHIBA Web Camera Application\TWebCameraSrv.exe [2009-04-16 20544]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2013-04-18 233472]
S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe [2009-04-24 176128]
S2 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2009-03-17 73728]
S2 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [2009-04-15 656752]
S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys [2009-03-20 12920]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2013-04-18 37344]
S3 NETw5s32;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 32-Bit;c:\windows\system32\DRIVERS\NETw5s32.sys [2010-01-13 6755840]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [2009-03-18 22272]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-03-01 139776]
S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\DRIVERS\seehcri.sys [2008-01-09 27632]
S3 TMachInfo;TMachInfo;c:\program files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2011-02-11 54136]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - FSUSBEXDISK
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2014-09-25 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 15:38]
.
2014-09-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-06 18:17]
.
2014-09-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-06 18:17]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://mystart.incredibar.com/?a=6PQIwYYZqt&i=26&loc=skw
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://feed.helperbar.com/?publisher=YahooAM&dpid=YahooAM&co=DE&userid=75e2a47c-b344-c844-75e7-308cadf66af7&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=28/11/2013&type=hp4000
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: An OneNote s&enden - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: Easy-WebPrint - Drucken - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Easy-WebPrint - Schnelldruck - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint - Vorschau - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint - Zu Druckliste hinzufügen - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
DPF: Garmin Communicator Plug-In - hxxps://my.garmin.com/static/m/cab/2.8.3/GarminAxControl.CAB
FF - ProfilePath - c:\users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - prefs.js: keyword.URL - hxxp://mystart.incredibar.com/?a=6PQIwYYZqt&i=26&loc=skw&search=
FF - prefs.js: network.proxy.type - 0
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-10 - (no file)
WebBrowser-{8DBB6D8E-E4A6-4E3B-9753-AF78B226441C} - (no file)
WebBrowser-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)
WebBrowser-{EBD898F8-FCF6-4694-BC3B-EABC7271EEB1} - (no file)
MSConfigStartUp-ApnUpdater - c:\program files\Ask.com\Updater\Updater.exe
MSConfigStartUp-CanonSolutionMenuEx - c:\program files\Canon\Solution Menu EX\CNSEMAIN.EXE
MSConfigStartUp-KiesAirMessage - c:\program files\Samsung\Kies\KiesAirMessage.exe
MSConfigStartUp-KiesHelper - c:\program files\Samsung\Kies\KiesHelper.exe
AddRemove-Easy-WebPrint - c:\windows\IsUn0407.exe
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(2240)
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\windows\System32\pnidui.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\atieclxx.exe
c:\windows\system32\taskhost.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\windows\System32\bgsvcgen.exe
c:\program files\Canon\IJPLM\IJPLMSVC.EXE
c:\windows\system32\conhost.exe
c:\program files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
c:\windows\system32\TODDSrv.exe
c:\program files\TOSHIBA\Power Saver\TosCoSrv.exe
c:\program files\Apoint2K\ApMsgFwd.exe
c:\program files\Apoint2K\Apntex.exe
c:\windows\system32\conhost.exe
c:\program files\Apoint2K\HidFind.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
c:\program files\Canon\Quick Menu\CNQMUPDT.EXE
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\sppsvc.exe
c:\windows\system32\DllHost.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-09-25 20:49:14 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2014-09-25 18:49
.
Vor Suchlauf: 13 Verzeichnis(se), 132.290.666.496 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 139.772.006.400 Bytes frei
.
- - End Of File - - 4B83557D057D8FCBB2B9ED7873275A6C
A36C5E4F47E84449FF07ED3517B43A31
Geändert von rene28 (25.09.2014 um 19:53 Uhr) |
|
26.09.2014, 16:08
| #4 |
| /// the machine /// TB-Ausbilder | Zbot.A.1193 eingefangen, lässt sich nicht löschen Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
26.09.2014, 18:29
| #5 |
| | Zbot.A.1193 eingefangen, lässt sich nicht löschen Mbam Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 26.09.2014 Suchlauf-Zeit: 17:52:45 Logdatei: mbam.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.09.26.06 Rootkit Datenbank: v2014.09.19.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x86 Dateisystem: NTFS Benutzer: Uwe Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 315327 Verstrichene Zeit: 17 Min, 11 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 19 PUP.Optional.PricePeep.A, HKLM\SOFTWARE\CLASSES\APPID\{38A066B0-DD5F-4226-AC4F-6A27C1BFB892}, In Quarantäne, [7ac440b292e9b87e784409bffa08eb15], PUP.Optional.Delta.A, HKLM\SOFTWARE\CLASSES\APPID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}, In Quarantäne, [3c0227cbea9126100346a12713ef38c8], Adware.Agent, HKLM\SOFTWARE\CLASSES\TYPELIB\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}, In Quarantäne, [53ebcf23abd0cf6774c723742fd30df3], Adware.Agent, HKLM\SOFTWARE\CLASSES\INTERFACE\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}, In Quarantäne, [53ebcf23abd0cf6774c723742fd30df3], Adware.Agent, HKLM\SOFTWARE\CLASSES\INTERFACE\{75BF416E-4326-45B5-8A2D-AE32D05B930B}, In Quarantäne, [53ebcf23abd0cf6774c723742fd30df3], PUP.Optional.Snapdo.T, HKU\S-1-5-21-2242340406-3198609139-1784460280-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006ee092-9658-4fd6-bd8e-a21a348e59f5}, In Quarantäne, [1c2215dd4734bb7bfdc56e5dba4843bd], PUP.Optional.Snapdo.T, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006EE092-9658-4FD6-BD8E-A21A348E59F5}, In Quarantäne, [1c2215dd4734bb7bfdc56e5dba4843bd], PUP.Optional.PricePeep.A, HKLM\SOFTWARE\CLASSES\PricePeep.PricePeepBho, In Quarantäne, [0b332fc3fe7d54e298b554101ce8e11f], PUP.Optional.PricePeep.A, HKLM\SOFTWARE\CLASSES\PricePeep.PricePeepBho.1, In Quarantäne, [cb7320d2116a61d506477de7ea1aab55], PUP.Optional.PricePeep.A, HKLM\SOFTWARE\CLASSES\APPID\PricePeep.DLL, In Quarantäne, [5ae45f9305766bcbcfe188cf27dd639d], PUP.Optional.Incredibar.A, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\dlnembnfbcpjnepmfjmngjenhhajpdfd, In Quarantäne, [57e70fe3f98246f04442012c2bd8a15f], PUP.Optional.SweetIM.A, HKLM\SOFTWARE\SWEETIM, In Quarantäne, [be80856deb9088ae59b71d3a897b7a86], PUP.Optional.Incredibar.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\dlnembnfbcpjnepmfjmngjenhhajpdfd, In Quarantäne, [48f6ad45d0ab71c55e2864c9fc07d52b], PUP.Optional.InstallBrain.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\WNLT, Löschen bei Neustart, [f44a28ca6d0e5bdbc56370eda262a65a], PUP.Optional.DataMngr.A, HKU\S-1-5-21-2242340406-3198609139-1784460280-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DataMngr_Toolbar, In Quarantäne, [68d6549e2c4f9e985fa474e2a460a957], PUP.Optional.Amonetize.A, HKU\S-1-5-21-2242340406-3198609139-1784460280-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\AMIEXT\IE plugin, In Quarantäne, [ca74bc368deed95d5130c97816edf40c], PUP.Optional.PriceGong.A, HKU\S-1-5-21-2242340406-3198609139-1784460280-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\PriceGong, In Quarantäne, [4ef0ab4763180f2774d4c773ef140ef2], PUP.Optional.Softonic.A, HKU\S-1-5-21-2242340406-3198609139-1784460280-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOFTONIC\Universal Downloader, In Quarantäne, [a698d0224b30d660be4987a8b152c43c], PUP.Optional.SweetIM.A, HKU\S-1-5-21-2242340406-3198609139-1784460280-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SWEETIM, In Quarantäne, [9aa4ab47e992be7860afb0a752b2639d], Registrierungswerte: 10 PUP.Optional.StartPage.A, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS\{336D0C35-8A85-403a-B9D2-65C292C39087}, In Quarantäne, [2c12bf33710acf670c72127ce9191ee2], PUP.Optional.StartPage.A, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|{336D0C35-8A85-403A-B9D2-65C292C39087}, C:\Program Files\Web Assistant\Firefox, In Quarantäne, [2c12bf33710acf670c72127ce9191ee2] PUP.Optional.StartPage.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|{336D0C35-8A85-403A-B9D2-65C292C39087}, C:\Program Files\Web Assistant\Firefox, In Quarantäne, [2c12bf33710acf670c72127ce9191ee2] PUP.Optional.StartPage.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS\{336D0C35-8A85-403a-B9D2-65C292C39087}, In Quarantäne, [b886e60c017aa690b9c57a144eb41ce4], PUP.Optional.SmartBar, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR|{ae07101b-46d4-4a98-af68-0333ea26e113}, Smartbar, In Quarantäne, [2b1348aa5a219b9baaf022ecd42fdf21] PUP.Optional.Incredibar, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}, C:\Program Files\Web Assistant\Firefox, In Quarantäne, [3fffa34ff98222146a24c899c242ca36] PUP.Optional.SweetIM.A, HKLM\SOFTWARE\SWEETIM|simapp_id, 92543518049666109, In Quarantäne, [be80856deb9088ae59b71d3a897b7a86] PUP.Optional.Incredibar, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}, C:\Program Files\Web Assistant\Firefox, In Quarantäne, [0539e50dcfac11256a2476eb8e769f61] PUP.Optional.InstallBrain.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\WNLT|URL, MYSTART, Löschen bei Neustart, [f44a28ca6d0e5bdbc56370eda262a65a] PUP.Optional.SweetIM.A, HKU\S-1-5-21-2242340406-3198609139-1784460280-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SWEETIM|simapp_id, 92543518049666109, In Quarantäne, [9aa4ab47e992be7860afb0a752b2639d] Registrierungsdaten: 4 PUP.Optional.HelperBar.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, hxxp://feed.helperbar.com/?publisher=YahooAM&dpid=YahooAM&co=DE&userid=75e2a47c-b344-c844-75e7-308cadf66af7&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=28/11/2013&type=hp4000, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?publisher=YahooAM&dpid=YahooAM&co=DE&userid=75e2a47c-b344-c844-75e7-308cadf66af7&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=28/11/2013&type=hp4000),Ersetzt,[9ca2866c403b39fd1689a460a56057a9] PUP.Optional.HelperBar.A, HKU\S-1-5-21-2242340406-3198609139-1784460280-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|SearchAssistant, hxxp://feed.helperbar.com/?publisher=YahooAM&dpid=YahooAM&co=DE&userid=75e2a47c-b344-c844-75e7-308cadf66af7&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=28/11/2013&type=hp4000, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?publisher=YahooAM&dpid=YahooAM&co=DE&userid=75e2a47c-b344-c844-75e7-308cadf66af7&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=28/11/2013&type=hp4000),Ersetzt,[52ec38baa6d5f14520852dd7a1644eb2] PUP.Optional.HelperBar.A, HKU\S-1-5-21-2242340406-3198609139-1784460280-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Default_Search_URL, hxxp://feed.helperbar.com/?publisher=YahooAM&dpid=YahooAM&co=DE&userid=75e2a47c-b344-c844-75e7-308cadf66af7&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=28/11/2013&type=hp4000, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?publisher=YahooAM&dpid=YahooAM&co=DE&userid=75e2a47c-b344-c844-75e7-308cadf66af7&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=28/11/2013&type=hp4000),Ersetzt,[48f60ee4cbb0fc3a9014a361b25309f7] PUP.Optional.HelperBar.A, HKU\S-1-5-21-2242340406-3198609139-1784460280-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, hxxp://feed.helperbar.com/?publisher=YahooAM&dpid=YahooAM&co=DE&userid=75e2a47c-b344-c844-75e7-308cadf66af7&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=28/11/2013&type=hp4000, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?publisher=YahooAM&dpid=YahooAM&co=DE&userid=75e2a47c-b344-c844-75e7-308cadf66af7&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=28/11/2013&type=hp4000),Ersetzt,[4bf3955db2c99c9a267a34d08b7a2fd1] Ordner: 9 PUP.Optional.SpeedAnalysis.A, C:\Users\Uwe\AppData\Roaming\SpeedAnalysis2, In Quarantäne, [bf7f9b57e398f83e3a0a30243bc910f0], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.7Go.A, C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjajpkikblccgefaibcafkfbanllpefi, In Quarantäne, [7cc24fa3de9d30067e05885843bf4eb2], PUP.Optional.7Go.A, C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjajpkikblccgefaibcafkfbanllpefi\1.0.0.2, In Quarantäne, [7cc24fa3de9d30067e05885843bf4eb2], PUP.Optional.7Go.A, C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjajpkikblccgefaibcafkfbanllpefi\1.0.0.2\mz, In Quarantäne, [7cc24fa3de9d30067e05885843bf4eb2], PUP.Optional.Datamngr.A, C:\Users\Uwe\AppData\LocalLow\DataMngr, In Quarantäne, [d26c6f83b9c2d264d53bffe36f93b848], PUP.Optional.SearchQu.A, C:\Users\Uwe\AppData\LocalLow\searchquband, In Quarantäne, [b68827cb4b30e94d128302ebe51d6e92], PUP.Optional.IBUpdater.A, C:\ProgramData\IBUpdaterService, In Quarantäne, [e757cd25a8d393a36736ef097a88ac54], Dateien: 162 PUP.Optional.PCPerformer.A, C:\Windows\System32\roboot.exe, In Quarantäne, [82bcd51d1368e452f612031ed8289c64], PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_dlnembnfbcpjnepmfjmngjenhhajpdfd_0.localstorage, In Quarantäne, [46f8569cf98295a1b8cd8ba2a85bb54b], PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_dlnembnfbcpjnepmfjmngjenhhajpdfd_0.localstorage-journal, In Quarantäne, [e45a866c9be02b0bbfc627069073de22], PUP.Optional.MyStartSearch.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\searchplugins\MyStart Search.xml, In Quarantäne, [97a7ca2880fb75c18ddd260d867d6e92], PUP.Optional.WebSearch.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\searchplugins\Web Search.xml, In Quarantäne, [cf6fef03f487c3739d68e94d11f251af], PUP.Optional.SpeedAnalysis.A, C:\Users\Uwe\AppData\Roaming\SpeedAnalysis2\speedanalysis.crx, In Quarantäne, [bf7f9b57e398f83e3a0a30243bc910f0], PUP.Optional.SpeedAnalysis2.A, C:\Users\Uwe\AppData\Roaming\speedanalysis.ico, In Quarantäne, [52ec17db0b7087afb5651245877d28d8], PUP.Optional.BrowserDefender.A, C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_eooncjejnppfjjklapaamhcdmjbilmde_0.localstorage, In Quarantäne, [59e543af81fa1d19c29390c99f65fb05], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\l.xml, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\1.txt, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\1.xml, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\2260.txt, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\a.txt, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\a.xml, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\b.txt, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\b.xml, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\c.txt, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\c.xml, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\d.txt, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\d.xml, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\e.txt, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\e.xml, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\f.txt, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\f.xml, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\g.txt, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\g.xml, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\h.txt, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\h.xml, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\i.txt, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\i.xml, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\j.txt, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\J.xml, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\k.txt, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\k.xml, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\l.txt, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\m.txt, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\m.xml, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\mru.xml, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\n.txt, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\n.xml, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\o.txt, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\o.xml, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\p.txt, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\p.xml, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\q.txt, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\q.xml, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\r.txt, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\r.xml, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\s.txt, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\s.xml, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\t.txt, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\t.xml, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\u.txt, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\u.xml, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\v.txt, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\v.xml, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\w.txt, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\w.xml, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\wlu.txt, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\x.txt, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\x.xml, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\y.txt, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\y.xml, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\z.txt, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.PriceGong.A, C:\Users\Uwe\AppData\LocalLow\PriceGong\Data\z.xml, In Quarantäne, [98a627cb0378eb4bb086aa354cb605fb], PUP.Optional.7Go.A, C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjajpkikblccgefaibcafkfbanllpefi\1.0.0.2\background.html, In Quarantäne, [7cc24fa3de9d30067e05885843bf4eb2], PUP.Optional.7Go.A, C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjajpkikblccgefaibcafkfbanllpefi\1.0.0.2\bg.js, In Quarantäne, [7cc24fa3de9d30067e05885843bf4eb2], PUP.Optional.7Go.A, C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjajpkikblccgefaibcafkfbanllpefi\1.0.0.2\ci.bg.pack.js, In Quarantäne, [7cc24fa3de9d30067e05885843bf4eb2], PUP.Optional.7Go.A, C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjajpkikblccgefaibcafkfbanllpefi\1.0.0.2\ci.browser.helper.js, In Quarantäne, [7cc24fa3de9d30067e05885843bf4eb2], PUP.Optional.7Go.A, C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjajpkikblccgefaibcafkfbanllpefi\1.0.0.2\ci.content.pack.js, In Quarantäne, [7cc24fa3de9d30067e05885843bf4eb2], PUP.Optional.7Go.A, C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjajpkikblccgefaibcafkfbanllpefi\1.0.0.2\content.js, In Quarantäne, [7cc24fa3de9d30067e05885843bf4eb2], PUP.Optional.7Go.A, C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjajpkikblccgefaibcafkfbanllpefi\1.0.0.2\icon128.png, In Quarantäne, [7cc24fa3de9d30067e05885843bf4eb2], PUP.Optional.7Go.A, C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjajpkikblccgefaibcafkfbanllpefi\1.0.0.2\icon16.png, In Quarantäne, [7cc24fa3de9d30067e05885843bf4eb2], PUP.Optional.7Go.A, C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjajpkikblccgefaibcafkfbanllpefi\1.0.0.2\icon18.ico, In Quarantäne, [7cc24fa3de9d30067e05885843bf4eb2], PUP.Optional.7Go.A, C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjajpkikblccgefaibcafkfbanllpefi\1.0.0.2\icon18.png, In Quarantäne, [7cc24fa3de9d30067e05885843bf4eb2], PUP.Optional.7Go.A, C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjajpkikblccgefaibcafkfbanllpefi\1.0.0.2\icon24.png, In Quarantäne, [7cc24fa3de9d30067e05885843bf4eb2], PUP.Optional.7Go.A, C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjajpkikblccgefaibcafkfbanllpefi\1.0.0.2\icon32.ico, In Quarantäne, [7cc24fa3de9d30067e05885843bf4eb2], PUP.Optional.7Go.A, C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjajpkikblccgefaibcafkfbanllpefi\1.0.0.2\icon32.png, In Quarantäne, [7cc24fa3de9d30067e05885843bf4eb2], PUP.Optional.7Go.A, C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjajpkikblccgefaibcafkfbanllpefi\1.0.0.2\icon48.png, In Quarantäne, [7cc24fa3de9d30067e05885843bf4eb2], PUP.Optional.7Go.A, C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjajpkikblccgefaibcafkfbanllpefi\1.0.0.2\icon64.png, In Quarantäne, [7cc24fa3de9d30067e05885843bf4eb2], PUP.Optional.7Go.A, C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjajpkikblccgefaibcafkfbanllpefi\1.0.0.2\jquery-1.9.1.min.js, In Quarantäne, [7cc24fa3de9d30067e05885843bf4eb2], PUP.Optional.7Go.A, C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjajpkikblccgefaibcafkfbanllpefi\1.0.0.2\jquery.uuid.js, In Quarantäne, [7cc24fa3de9d30067e05885843bf4eb2], PUP.Optional.7Go.A, C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjajpkikblccgefaibcafkfbanllpefi\1.0.0.2\manifest.json, In Quarantäne, [7cc24fa3de9d30067e05885843bf4eb2], PUP.Optional.7Go.A, C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjajpkikblccgefaibcafkfbanllpefi\1.0.0.2\popup.js, In Quarantäne, [7cc24fa3de9d30067e05885843bf4eb2], PUP.Optional.7Go.A, C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjajpkikblccgefaibcafkfbanllpefi\1.0.0.2\settings.json, In Quarantäne, [7cc24fa3de9d30067e05885843bf4eb2], PUP.Optional.7Go.A, C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjajpkikblccgefaibcafkfbanllpefi\1.0.0.2\mz\background.js, In Quarantäne, [7cc24fa3de9d30067e05885843bf4eb2], PUP.Optional.7Go.A, C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjajpkikblccgefaibcafkfbanllpefi\1.0.0.2\mz\content.js, In Quarantäne, [7cc24fa3de9d30067e05885843bf4eb2], PUP.Optional.Datamngr.A, C:\Users\Uwe\AppData\LocalLow\DataMngr\{7CA1F051-A4FB-4143-B263-02B41E571EED}, In Quarantäne, [d26c6f83b9c2d264d53bffe36f93b848], PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.admin", false);), Ersetzt,[51ed3eb4552663d3080abd85d92c33cd] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.aflt", "orgnl");), Ersetzt,[ba84846e3a410d292ae80e34996c639d] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.cntry", "DE");), Ersetzt,[e05ee70b6813171f1df5ab970302c13f] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.dfltLng", "");), Ersetzt,[0f2f37bbf7841b1bb55d3e04c1449c64] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.dfltSrch", false);), Ersetzt,[221ce60ce992bc7a0210c97932d37a86] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.did", "10665");), Ersetzt,[69d5ef030e6dd26456bc0141db2a4eb2] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.envrmnt", "production");), Ersetzt,[ad9146ac3348ec4af22088ba58ad07f9] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.excTlbr", false);), Ersetzt,[3d0105edccaf2412a86a162c9d68ef11] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.hdrMd5", "6C0D538BDFF9C6BCD516B6075AF4A998");), Ersetzt,[182602f0c3b8bf7715fd083ac243847c] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.hmpg", false);), Ersetzt,[8ab4c32f8fecc373bd552c16dd28a15f] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.id", "469b7f0b0000000000000026223020e5");), Ersetzt,[192542b0c7b4ad89a2707fc3986d58a8] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.installerproductid", "26");), Ersetzt,[92ac0ce679021b1bd73b88baa2632ed2] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.instlDay", "15586");), Ersetzt,[d76708eaf487102671a1cb779f66c63a] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.instlRef", "");), Ersetzt,[bd8115dd4635c5716ea409390401b24e] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.lastVrsnTs", "1.5.11.1416:28:11");), Ersetzt,[dc62db1713680e2802104101dd28ac54] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.mntrvrsn", "1.2.0");), Ersetzt,[71cd31c1e6950e280d0597ab8d78f010] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.newTab", false);), Ersetzt,[9aa4d2203a4151e5a56d44fef51036ca] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.noFFXTlbr", false);), Ersetzt,[8eb0e111601bb6801ff3d17107fee61a] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.ppd", "");), Ersetzt,[a89604ee99e20b2be72b60e2cf369e62] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.prdct", "incredibar");), Ersetzt,[91ad72804c2f45f144ceba8808fdc838] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.productid", "26");), Ersetzt,[122c39b9a4d7ac8a71a1c77b4cb938c8] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.prtnrId", "Incredibar");), Ersetzt,[f747fcf62b50be78e92967db22e331cf] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.sg", "none");), Ersetzt,[e658ac46d6a5d363f919152d0df85ba5] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.smplGrp", "none");), Ersetzt,[3d01b042285369cdd43ecb7741c459a7] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.tlbrId", "base");), Ersetzt,[1826757d502b082e58ba6ad88382d32d] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.upn2", "6PQIwYYZqt");), Ersetzt,[0638757de09b54e218fa2b176f9648b8] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.upn2n", "92543518049666109");), Ersetzt,[0d3135bd4b30300620f2fd45a560817f] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.vrsn", "1.5.11.14");), Ersetzt,[122c41b186f50630d53d024052b32ad6] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.vrsnTs", "1.5.11.1416:28:11");), Ersetzt,[98a64ba713685ed825edd17116effc04] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.vrsni", "1.5.11.14");), Ersetzt,[42fcf7fb2b501323e1318db5b451c33d] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.aflt", "orgnl");), Ersetzt,[cc727c76dba0dd598b8785bda75e728e] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.dfltLng", "");), Ersetzt,[f04e8270daa1b08622f0f84aa16459a7] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.did", "10665");), Ersetzt,[da6479796a1131054ec4f34f6b9acb35] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.excTlbr", false);), Ersetzt,[300e17dbd4a751e57c96e26014f140c0] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.id", "469b7f0b0000000000000026223020e5");), Ersetzt,[87b7945e116ace68b55d81c137ce42be] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.installerproductid", "26");), Ersetzt,[cb732dc593e871c544ce91b107fee61a] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.instlDay", "15586");), Ersetzt,[ae90668cd0ab072f1af8b38fa461758b] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.instlRef", "");), Ersetzt,[ff3fc72b4239ad89f41efc46c045d22e] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.ms_url_id", "");), Ersetzt,[67d7b141abd0a98d66ac7cc6e81dd62a] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.newTab", false);), Ersetzt,[cb737a78e299ac8a31e14df59e672bd5] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.ppd", "");), Ersetzt,[77c7b2402a519e9832e061e1b84de719] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.prdct", "incredibar");), Ersetzt,[98a68d65146758de8989f052dc298977] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.productid", "26");), Ersetzt,[d16daa48265530065db5c57d8c7936ca] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.prtnrId", "Incredibar");), Ersetzt,[f5498d65d2a9f73f868ca59d56afd030] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.smplGrp", "none");), Ersetzt,[3e00fff32754ac8a68aaf74b8382c53b] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.tlbrId", "base");), Ersetzt,[e559c929314a95a13fd3c280d0350bf5] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.upn2", "6PQIwYYZqt");), Ersetzt,[9f9f975bbebdd165be54db6781840ff1] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.upn2n", "92543518049666109");), Ersetzt,[b688f7fbc6b564d20111ab97d53040c0] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.vrsn", "1.5.11.14");), Ersetzt,[f14d39b90c6f072fc34f6fd3b74e6a96] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1416:28:11");), Ersetzt,[6ad4c42e661551e5937f47fb3cc9d42c] PUP.Optional.Incredibar.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.vrsni", "1.5.11.14");), Ersetzt,[ea54569c5e1d171f91817dc52dd8d828] PUP.Optional.Delta.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.admin", false);), Ersetzt,[f34b00f20c6ff34372a595ad64a159a7] PUP.Optional.Delta.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.aflt", "babsst");), Ersetzt,[df5fb042e99285b1f522350d05008d73] PUP.Optional.Delta.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");), Ersetzt,[201ebd35394241f52fe8370b83822dd3] PUP.Optional.Delta.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.autoRvrt", "false");), Ersetzt,[45f912e036452115f423083a966f916f] PUP.Optional.Delta.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.dfltLng", "de");), Ersetzt,[3c02dd15c5b61e189087df633ec76c94] PUP.Optional.Delta.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.excTlbr", false);), Ersetzt,[fa4439b9c1ba48ee1afd2d15788dfd03] PUP.Optional.Delta.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.ffxUnstlRst", true);), Ersetzt,[40fecf23aecd9a9ca96e73cffc095fa1] PUP.Optional.Delta.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.id", "469b7f0b000000000000001e654bebcd");), Ersetzt,[e85648aaf5860f2775a2db6744c12ed2] PUP.Optional.Delta.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.instlDay", "15931");), Ersetzt,[69d5ed057dfeed494dca54ee32d357a9] PUP.Optional.Delta.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.instlRef", "sst");), Ersetzt,[65d980720f6c76c00b0c57eb57aecd33] PUP.Optional.Delta.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.newTab", false);), Ersetzt,[f74739b94239ca6cee295ce6798c28d8] PUP.Optional.Delta.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.prdct", "delta");), Ersetzt,[4ef0ef03502b8aac9483b48e0afbed13] PUP.Optional.Delta.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.prtnrId", "delta");), Ersetzt,[f44a07eb403b9d9939dede6441c41de3] PUP.Optional.Delta.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.rvrt", "false");), Ersetzt,[81bdc32f3a417fb7100771d1897c9967] PUP.Optional.Delta.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.smplGrp", "none");), Ersetzt,[4fef29c982f99f9727f072d00bfa827e] PUP.Optional.Delta.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.tlbrId", "base");), Ersetzt,[40fe15ddee8d61d59087370b47be05fb] PUP.Optional.Delta.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.tlbrSrchUrl", "");), Ersetzt,[43fb8a68215a092d7b9c6ed4ba4be917] PUP.Optional.Delta.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.vrsn", "1.8.22.0");), Ersetzt,[1529f7fb710a53e3b2657cc68c7936ca] PUP.Optional.Delta.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.vrsnTs", "1.8.22.017:38:51");), Ersetzt,[a39bb83af5868da939de84beca3b03fd] PUP.Optional.Delta.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.vrsni", "1.8.22.0");), Ersetzt,[52ec1bd7d2a9de5871a697abb94cd729] PUP.Optional.Delta.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta_i.babExt", "");), Ersetzt,[0c327d7591eac373fb1c033fd92c40c0] PUP.Optional.Delta.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta_i.babTrack", "affID=121299&tsp=4974");), Ersetzt,[b08e27cb57242b0b22f5b58d92736898] PUP.Optional.Delta.A, C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta_i.srcExt", "ss");), Ersetzt,[db6314de86f5da5c21f63b075fa6837d] Physische Sektoren: 0 (No malicious items detected) (end) Code:
ATTFilter # AdwCleaner v3.310 - Bericht erstellt am 26/09/2014 um 19:01:08
# Aktualisiert 12/09/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (32 bits)
# Benutzername : Uwe - UWE-PC
# Gestartet von : C:\Users\Uwe\Downloads\AdwCleaner_3.310.exe
# Option : Löschen
***** [ Dienste ] *****
[#] Dienst Gelöscht : vToolbarUpdater17.1.2
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\Program Files\Advanced System Protector
Ordner Gelöscht : C:\Program Files\AmiExt
Ordner Gelöscht : C:\Program Files\Common Files\AVG Secure Search
Ordner Gelöscht : C:\Users\Uwe\AppData\Local\AVG Secure Search
Ordner Gelöscht : C:\Users\Uwe\AppData\Local\Ilivid Player
Ordner Gelöscht : C:\Users\Uwe\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\Uwe\AppData\LocalLow\AVG Secure Search
Ordner Gelöscht : C:\Users\Uwe\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Uwe\AppData\LocalLow\ConduitEngine
Ordner Gelöscht : C:\Users\Uwe\AppData\LocalLow\Softonic_Deutsch
Ordner Gelöscht : C:\Users\Uwe\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\Uwe\AppData\Roaming\PerformerSoft
Ordner Gelöscht : C:\Users\Uwe\AppData\Roaming\Systweak
Datei Gelöscht : C:\Windows\system32\conduitEngine.tmp
Datei Gelöscht : C:\Users\Uwe\AppData\LocalLow\SkwConfig.bin
Datei Gelöscht : C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\invalidprefs.js
Datei Gelöscht : C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\searchplugins\ask-search.xml
Datei Gelöscht : C:\Program Files\Mozilla Firefox\browser\searchplugins\avg-secure-search.xml
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\gjajpkikblccgefaibcafkfbanllpefi
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Conduit.Engine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protocols\handler\viprotocol
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\speedupmypc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\toolband.eb_explorerbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\toolband.eb_explorerbar.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\toolband.ipm_printlistitem
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\toolband.ipm_printlistitem.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\toolband.pm_launcher
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\toolband.pm_launcher.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\toolband.pm_printmanager
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\toolband.pm_printmanager.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\toolband.pr_bindstatuscallback
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\toolband.pr_bindstatuscallback.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\toolband.pr_cancelbuttoneventhandler
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\toolband.pr_cancelbuttoneventhandler.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\toolband.tbtoolband
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\toolband.tbtoolband.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\toolband.useroptions
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\toolband.useroptions.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\dmwu_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\dmwu_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Searchqu Toolbar uninstall_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Searchqu Toolbar uninstall_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\systweakasp_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\systweakasp_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Schlüssel Gelöscht : HKLM\SOFTWARE\5f0d78bb36aec13
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT1351351
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT3196716
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_proficad_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_proficad_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{10E9E863-3913-40D0-903D-D46DEB18C982}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{327C2873-E90D-4C37-AA9D-10AC9BABA46C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{408CFAD9-8F13-4747-8EC7-770A339C7237}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AF175732-0D59-716D-F757-9F1492D808D9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{0F9AF7E3-3853-473F-A49B-E470A3A41501}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{10E9E863-3913-40D0-903D-D46DEB18C982}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DADF82FD-0783-4CA9-98AA-615F657A2A9E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0F9AF7E3-3853-473F-A49B-E470A3A41501}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DADF82FD-0783-4CA9-98AA-615F657A2A9E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{07CAC314-E962-4F78-89AB-DD002F2490EE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{327C2873-E90D-4C37-AA9D-10AC9BABA46C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{327C2873-E90D-4C37-AA9D-10AC9BABA46C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{327C2873-E90D-4C37-AA9D-10AC9BABA46C}]
Schlüssel Gelöscht : HKCU\Software\AmiExt
Schlüssel Gelöscht : HKCU\Software\filescout
Schlüssel Gelöscht : HKCU\Software\IM
Schlüssel Gelöscht : HKCU\Software\ImInstaller
Schlüssel Gelöscht : HKCU\Software\lollipop
Schlüssel Gelöscht : HKCU\Software\Myfree Codec
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\WNLT
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\LyricsContainer
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\searchqutoolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\AVG Security Toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Lightspark Team
Schlüssel Gelöscht : HKLM\SOFTWARE\Myfree Codec
Schlüssel Gelöscht : HKLM\SOFTWARE\systweak
Schlüssel Gelöscht : HKLM\SOFTWARE\Web Assistant
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\464AA55239C100F32AF2D438EDDC0F47
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5652BA3D5FB98AE31B337BF0AF939856
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86EB95E1AFCBABE3DB9ECCC669B99494
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17280
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
-\\ Mozilla Firefox v32.0.3 (x86 de)
[ Datei : C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js ]
Zeile gelöscht : user_pref("avg.install.extHomepage", "hxxp://isearch.avg.com?pid=avg&sg=0&cid=%7B392e4c15-d3b7-4992-af0e-325b40ba89f3%7D&mid=02591aba2bee47d0828cd16f64d4c916-cf37e65db6404a7fad8a5061a5465e955618af40&d[...]
Zeile gelöscht : user_pref("avg.install.installDirPath", "C:\\ProgramData\\AVG Secure Search\\FireFoxExt\\17.1.2.1");
Zeile gelöscht : user_pref("browser.uiCustomization.state", "{\"placements\":{\"PanelUI-contents\":[\"edit-controls\",\"zoom-controls\",\"new-window-button\",\"privatebrowsing-button\",\"save-page-button\",\"print-but[...]
Zeile gelöscht : user_pref("extensions.APN_TB.first-previous-keyword-url", "hxxp://mystart.incredibar.com/?a=6PQIwYYZqt&i=26&loc=skw&search=");
Zeile gelöscht : user_pref("extensions.ORJ-SPE.previous-keyword-url", "\"hxxp://mystart.incredibar.com/?a=6PQIwYYZqt&i=26&loc=skw&search=\"");
Zeile gelöscht : user_pref("extensions.delta.admin", false);
Zeile gelöscht : user_pref("extensions.delta.aflt", "babsst");
Zeile gelöscht : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
Zeile gelöscht : user_pref("extensions.delta.autoRvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.dfltLng", "de");
Zeile gelöscht : user_pref("extensions.delta.excTlbr", false);
Zeile gelöscht : user_pref("extensions.delta.ffxUnstlRst", true);
Zeile gelöscht : user_pref("extensions.delta.id", "469b7f0b000000000000001e654bebcd");
Zeile gelöscht : user_pref("extensions.delta.instlDay", "15931");
Zeile gelöscht : user_pref("extensions.delta.instlRef", "sst");
Zeile gelöscht : user_pref("extensions.delta.newTab", false);
Zeile gelöscht : user_pref("extensions.delta.prdct", "delta");
Zeile gelöscht : user_pref("extensions.delta.prtnrId", "delta");
Zeile gelöscht : user_pref("extensions.delta.rvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.delta.tlbrId", "base");
Zeile gelöscht : user_pref("extensions.delta.tlbrSrchUrl", "");
Zeile gelöscht : user_pref("extensions.delta.vrsn", "1.8.22.0");
Zeile gelöscht : user_pref("extensions.delta.vrsnTs", "1.8.22.017:38:51");
Zeile gelöscht : user_pref("extensions.delta.vrsni", "1.8.22.0");
Zeile gelöscht : user_pref("extensions.delta_i.babExt", "");
Zeile gelöscht : user_pref("extensions.delta_i.babTrack", "affID=121299&tsp=4974");
Zeile gelöscht : user_pref("extensions.delta_i.srcExt", "ss");
Zeile gelöscht : user_pref("extensions.incredibar.admin", false);
Zeile gelöscht : user_pref("extensions.incredibar.aflt", "orgnl");
Zeile gelöscht : user_pref("extensions.incredibar.cntry", "DE");
Zeile gelöscht : user_pref("extensions.incredibar.dfltLng", "");
Zeile gelöscht : user_pref("extensions.incredibar.dfltSrch", false);
Zeile gelöscht : user_pref("extensions.incredibar.did", "10665");
Zeile gelöscht : user_pref("extensions.incredibar.envrmnt", "production");
Zeile gelöscht : user_pref("extensions.incredibar.excTlbr", false);
Zeile gelöscht : user_pref("extensions.incredibar.hdrMd5", "6C0D538BDFF9C6BCD516B6075AF4A998");
Zeile gelöscht : user_pref("extensions.incredibar.hmpg", false);
Zeile gelöscht : user_pref("extensions.incredibar.id", "469b7f0b0000000000000026223020e5");
Zeile gelöscht : user_pref("extensions.incredibar.installerproductid", "26");
Zeile gelöscht : user_pref("extensions.incredibar.instlDay", "15586");
Zeile gelöscht : user_pref("extensions.incredibar.instlRef", "");
Zeile gelöscht : user_pref("extensions.incredibar.lastVrsnTs", "1.5.11.1416:28:11");
Zeile gelöscht : user_pref("extensions.incredibar.mntrvrsn", "1.2.0");
Zeile gelöscht : user_pref("extensions.incredibar.newTab", false);
Zeile gelöscht : user_pref("extensions.incredibar.noFFXTlbr", false);
Zeile gelöscht : user_pref("extensions.incredibar.ppd", "");
Zeile gelöscht : user_pref("extensions.incredibar.prdct", "incredibar");
Zeile gelöscht : user_pref("extensions.incredibar.productid", "26");
Zeile gelöscht : user_pref("extensions.incredibar.prtnrId", "Incredibar");
Zeile gelöscht : user_pref("extensions.incredibar.sg", "none");
Zeile gelöscht : user_pref("extensions.incredibar.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.incredibar.tlbrId", "base");
Zeile gelöscht : user_pref("extensions.incredibar.upn2", "6PQIwYYZqt");
Zeile gelöscht : user_pref("extensions.incredibar.upn2n", "92543518049666109");
Zeile gelöscht : user_pref("extensions.incredibar.vrsn", "1.5.11.14");
Zeile gelöscht : user_pref("extensions.incredibar.vrsnTs", "1.5.11.1416:28:11");
Zeile gelöscht : user_pref("extensions.incredibar.vrsni", "1.5.11.14");
Zeile gelöscht : user_pref("extensions.incredibar_i.aflt", "orgnl");
Zeile gelöscht : user_pref("extensions.incredibar_i.dfltLng", "");
Zeile gelöscht : user_pref("extensions.incredibar_i.did", "10665");
Zeile gelöscht : user_pref("extensions.incredibar_i.excTlbr", false);
Zeile gelöscht : user_pref("extensions.incredibar_i.id", "469b7f0b0000000000000026223020e5");
Zeile gelöscht : user_pref("extensions.incredibar_i.installerproductid", "26");
Zeile gelöscht : user_pref("extensions.incredibar_i.instlDay", "15586");
Zeile gelöscht : user_pref("extensions.incredibar_i.instlRef", "");
Zeile gelöscht : user_pref("extensions.incredibar_i.ms_url_id", "");
Zeile gelöscht : user_pref("extensions.incredibar_i.newTab", false);
Zeile gelöscht : user_pref("extensions.incredibar_i.ppd", "");
Zeile gelöscht : user_pref("extensions.incredibar_i.prdct", "incredibar");
Zeile gelöscht : user_pref("extensions.incredibar_i.productid", "26");
Zeile gelöscht : user_pref("extensions.incredibar_i.prtnrId", "Incredibar");
Zeile gelöscht : user_pref("extensions.incredibar_i.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.incredibar_i.tlbrId", "base");
Zeile gelöscht : user_pref("extensions.incredibar_i.upn2", "6PQIwYYZqt");
Zeile gelöscht : user_pref("extensions.incredibar_i.upn2n", "92543518049666109");
Zeile gelöscht : user_pref("extensions.incredibar_i.vrsn", "1.5.11.14");
Zeile gelöscht : user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1416:28:11");
Zeile gelöscht : user_pref("extensions.incredibar_i.vrsni", "1.5.11.14");
Zeile gelöscht : user_pref("keyword.URL", "hxxp://mystart.incredibar.com/?a=6PQIwYYZqt&i=26&loc=skw&search=");
Zeile gelöscht : user_pref("{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}.ScriptData_WSG_referrer", "hxxp://search.avira.com/?l=dis&o=APN10261&gct=hp&dc=EU&locale=de_DE/|||8641371976722287");
Zeile gelöscht : user_pref("{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}.ScriptData_WSG_temp_referer", "hxxp://search.avira.com/?l=dis&o=APN10261&gct=hp&dc=EU&locale=de_DE/|#|old_value|||8641371976722286");
-\\ Google Chrome v
[ Datei : C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [19918 octets] - [26/09/2014 18:44:02]
AdwCleaner[S0].txt - [19792 octets] - [26/09/2014 19:01:08]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [19853 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.2.2 (09.26.2014:2)
OS: Windows 7 Home Premium x86
Ran by Uwe on 26.09.2014 at 19:06:35,59
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\Softonic_DeutschAutoUpdateHelper_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\Softonic_DeutschAutoUpdateHelper_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\Softonic_DeutschToolbarHelper1_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\Softonic_DeutschToolbarHelper1_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\Softonic_DeutschToolbarHelper_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\Softonic_DeutschToolbarHelper_RASMANCS
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\apn"
Successfully deleted: [Folder] "C:\ProgramData\boost_interprocess"
Successfully deleted: [Folder] "C:\ProgramData\fighters"
Successfully deleted: [Folder] "C:\Users\Uwe\AppData\Roaming\fighters"
Successfully deleted: [Folder] "C:\Program Files\fighters"
Successfully deleted: [Folder] "C:\Program Files\myfree codec"
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{00D58DFA-4DA4-405F-8DDD-AE473A10A5D9}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{018646F9-1144-4BD0-A4B3-4974508EE03E}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{0339FB8A-D421-4BCF-B261-F24AEFC8C98E}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{035E11BD-2513-4796-9EFD-529B96A4FCDB}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{04EEA434-3D26-485A-B47C-3BD65BBFA473}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{07BD222B-1F32-4CD6-A1CD-58002514BAE7}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{0888EAB4-9863-4970-B11B-36A79F600CCB}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{09E3B00F-29E1-4C0B-B42D-D86F8AF5B7A3}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{0A2A663C-CCDF-4B1A-A1C9-A6480DE10F9B}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{0BCEC854-61EF-4754-9174-EA967B9FDF67}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{0D6D613B-7720-481E-A0B2-C850905778F2}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{0EFCA909-1ED0-47E6-9874-031FA525D21E}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{108A3ED1-CD42-4A31-B3A1-0E204F4DC977}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{113337B4-795F-47D4-9E84-1836717FABA2}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{1201DC37-AF17-494C-A516-DDB41C5D87DF}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{1239E6A0-E3C7-4D27-9CAA-4AA3DD5B3220}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{1473CB49-D2DF-4EE0-AFA1-2BBC85F057BC}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{14D1532A-563A-47D9-9E0B-00E23F521F85}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{14E8E76C-3092-4081-B126-8AB71CD8A01D}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{1735E734-A902-4D2B-9DFC-1A77CA69ABC9}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{17FCFD13-8B6B-4EF7-B4E9-FB0B9CA74289}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{183657A4-B402-46A7-8013-DC59974D55E2}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{196008C0-E9A3-41AE-9821-4C2C2DC0D632}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{1996AB64-2313-40E2-A291-9E2B824F6C2A}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{1A52FA00-7B84-4039-8852-26FBDCD64FC5}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{1B3F57E8-E82F-44BD-8DE9-1E90FA13F47F}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{1B5212ED-7278-476E-8A74-2677C13390A2}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{1B79FAE7-1DF7-45A8-996F-050E31DCAD58}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{1B7E312C-87B1-452C-B56B-241471FF85C8}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{1B9993C5-FC5C-49E3-A827-FCEC12A8EED4}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{1C38FF29-BFDA-4858-9738-4474B27B35E3}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{1C88B1D7-5EFA-4019-B48B-3855AE1E825D}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{1CC748AF-F679-4D6A-8BA8-532F10B8344D}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{1D16ED61-AA20-4F2C-815D-365AE9F84CB0}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{1D7A892B-481E-42B7-8083-58EEF64EE223}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{1ECB206A-4650-4289-BF74-A87CDE4E4B0F}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{21CB6E17-C341-4566-96D6-C298B4434CA8}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{2321D76C-82E9-4F08-8398-BE3BCCC8D4E2}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{237989AB-8FEA-409E-A65F-26EE1CA7DBC5}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{23DC72BF-F37A-4020-9F0A-9E5E05BFD877}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{24354255-AF74-4F60-9617-3275FDE1080F}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{2568307F-3A29-4E77-91E4-91CF7C89BFA5}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{25A7C430-94B7-4406-81BA-259BCD86B8F6}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{265302A1-4E71-4448-AEFA-DA78A923C2F5}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{26EE00E1-AC96-4A5A-9373-F5B04071F36D}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{28AD1E39-0F98-44C1-8D2E-56677280C5BF}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{28F17852-1133-4D3E-A7BB-87888EED265A}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{29238FCD-DBC4-451C-8C1C-EAC6767E4B04}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{29434FDE-5EB1-43E1-B39C-F1B98D45E8AE}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{29E2F004-0077-481A-A1CF-7C0DC61BCAD5}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{2AE06291-A734-4B63-AFB5-C0E4E0CB67C4}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{2AF26DE1-E2D6-4DB9-AE9A-D4160B9A6DED}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{2B98E944-3BBB-4117-A868-5291BEE0C900}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{2D339911-424F-4EB7-8D5D-159F05971D11}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{2DF46A83-6102-472E-991A-06FEE947CF3F}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{3025C39E-EA4F-46A6-B2AB-FC34F0E4D7A1}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{339C37A7-218B-44A3-80F7-D44D1680BE13}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{35FBBB40-C245-4D7C-8D1B-003F8483EEC3}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{367B8BB3-A290-45D6-A439-B0637BCCF8DC}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{37450C9D-189F-4B18-8456-C6E199C86006}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{3766FF3D-6371-4531-819E-11556B649B89}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{386A8C4C-4052-4DC3-8F80-65DBA21E54D1}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{38872F1C-55D8-423B-AE69-6D6335360C14}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{391CA218-9537-4EBB-A088-27587ABAFDC1}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{3A2F4131-BFE9-45B5-A3A5-14BDF3D3B097}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{3A78B3D9-EF0A-4776-9697-070DED779F1E}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{3AC9394B-EDF8-401F-BFC1-10F2D90A2E62}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{3C14D5C2-53C8-4BDB-9E17-78D2DBE5B5BB}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{3C93EB47-9BBD-4BBE-B076-FBF6D437F165}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{3D9B3D29-BFB0-4DE2-ACFD-CD88BF7B3080}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{3DE5A7B7-5423-4474-85AF-CC547CDBDD1C}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{3F14D8E3-78FA-4D44-94CA-8BC52D78EE1C}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{3F3A022F-A496-44C9-8A13-09576A4B693C}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{3FC1A0EA-A86B-47F5-A52B-D01938BBE400}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{424386C6-D4B6-45D2-9BE1-3AD4EE2B30FF}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{428EBFB7-91FE-4FAD-9AA3-8C1D336584DA}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{42C7BCC7-9C72-4E15-B446-E807CDBBA99F}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{42D5B4A8-1882-478A-A11B-76478853C486}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{42DEE31A-AD20-4E5B-A867-FF6C80498582}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{4344F103-A2F3-453D-ABBF-AA860BD8E240}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{43A0A227-2244-48E0-8AF1-FDA73473242B}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{443DF210-A54C-4DB1-A525-ADDEB03F3333}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{450C9AF3-E8F9-4F70-B1DF-7B0FA16A14DA}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{451904AB-84B8-4167-A271-D88BDA0D7C96}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{45405FAC-629F-48E0-9099-EA98B3FBCA6E}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{458DAF99-1FD4-4FDD-B7BE-70C988D8A264}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{462C9CAF-8E63-456C-9D19-DDDF12E4B747}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{46A30B3D-D129-4581-99CA-F50714DA643E}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{46C7B31C-2AFB-4426-85FA-E1FC8079F920}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{470501CE-5907-4E8F-B59A-8D8E62784981}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{476C7911-2165-4B40-B454-B60F29FAD77B}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{47A76B9C-5EEA-4BDD-8D99-F3D6C8B9B196}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{47E0592B-C042-4DE0-8FB6-5FF60CF3E3D9}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{4820795A-C43E-448F-9C80-E09F0B5687E0}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{48233259-D636-4672-875C-0B5CD7880A4D}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{489CA1E6-D08A-4F23-BDFA-617DDC18F544}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{48B3ED61-EF80-4A38-8CA1-006CA36DE3B5}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{48F7C261-0AB8-4A87-824D-63D21CB61C80}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{490CA468-C218-4117-A358-389F8C959E1F}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{494626E3-B1E5-4501-9D3E-BFC1735A42D3}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{49C7986C-39E5-4A5B-B2E7-7EFF561550F2}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{49FBB5D2-BDDC-4968-AAA4-37C27E60028B}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{4AA5B6F4-66DF-4D43-8C49-319E6B9D443E}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{4B296652-92D1-4C5A-A36F-8EDA79B45EB9}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{4BD68291-A408-40AF-A738-DCABE39EBAF6}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{4BDBF896-5389-44D3-A427-E4542B5D5C78}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{4D25D0EB-CAE5-4895-822C-4E91BD94CF0D}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{4D613F28-6367-465F-91DA-1DF595CA9950}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{4D757220-9B36-4E8B-8715-C430F260DBEF}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{4E1394DF-BA81-4B17-A6AB-B358432E4EC2}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{4F5887E3-AEB1-4A33-9355-5151733013BB}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{4F88B1F3-80B4-4985-8984-1E7DB584F231}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{5009912C-6183-4246-9A27-72B6245B6BDD}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{511DB07A-648D-4021-80D9-42B2E644F045}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{552E8CC7-CBD4-497E-991B-EC361366A425}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{5541C20C-955B-4F6C-82EF-994BA2DF23E8}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{566CAC5D-BDCC-4608-A6F4-F17392F25BC2}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{5805A537-011E-4AC9-9165-42C812A7EC26}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{58DC456B-3C7B-4383-89FE-A4106A19B751}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{5934714D-B0A2-4E5D-ACD2-0FD9B63C8EF7}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{5957871E-5D7F-4578-B680-B2669B862F15}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{598622AF-530C-45B1-AA99-18B04470900D}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{5B7AE19F-29D7-4874-B4F7-AD3E1FF8BFF2}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{5BA406EC-1E9D-49E6-9E2C-F6E977F3E0FB}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{5BC3A7F1-1FD8-4C26-8B80-CFBB53D11EAE}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{5D58BD19-B8AB-4787-B3F6-FD28DBED6520}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{5D597C60-F386-4E3B-8F7D-7C6465A79726}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{6173727E-5E93-4DC9-8BDA-A8FA76FD76E6}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{61A07B48-B6C9-4992-A2A6-DD11EFD33BBD}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{620A0539-A60F-445C-8436-2E576CA80D1D}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{6254D0A0-3EA4-47C8-A743-9BE9F640BAF8}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{64FAA7A7-D67C-4C7A-96BA-357D37823B08}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{65E2754F-2526-46FB-B4AC-D70AFAE2D246}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{66A40E16-802A-4EB3-9D6A-B3A08AAA0274}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{69AE5972-D205-4400-BA35-462324492640}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{6A44165D-0952-49A2-ABA9-74BB6CD9FC6C}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{6BA9DD76-8B2D-4417-9478-DAD5225601CB}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{6BAD6980-82F0-4690-8DE2-26C9F775F7D9}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{6C016536-1F16-4308-95C8-2EC2536CBBAB}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{6E20A9D4-479F-46FA-8A68-008878939B1B}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{6E88FD2B-48BE-4EBB-ACAD-9A5B8050F793}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{6EA1D358-B1C8-40AA-B30F-073F8EBD3741}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{6EC6CBE8-2A7F-4B28-98DC-123B0A53F5CB}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{6ED8BEBF-C1EC-4BE3-82F1-16AF189815BE}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{6F244E35-9186-4DB0-81B5-5C5E567CAC61}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{709802F4-7E31-4737-94E3-53DC53BFE03B}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{70ADD887-B89D-48DF-BB31-E7C56F8237A3}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{71C57E9C-D35F-4FB8-8A50-274DA67C0DD4}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{7206C4F2-C8D6-4E17-939C-34B774121080}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{721448D0-3CDF-4304-B3BB-48A978EE544D}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{7269756E-F642-4AAF-BCAF-BBA16DC5F09E}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{728080C8-D650-413D-9820-B9E91CD662AA}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{72BD5AC4-7210-48E7-9C80-DB01962A6A84}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{72ED2194-BFE4-4DE7-AC75-3909FB4B0169}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{7453055F-BB61-4576-A8E8-ACB45ED1B6DE}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{7457429D-0F5D-4CD9-9B66-00013D2CA6E5}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{74597CCF-F5CA-4AB1-923B-A43A10C943F0}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{74CA0EF3-5D30-4613-A419-50F11774C78D}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{751E6B61-DD82-42DD-8F55-808A8319ED7E}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{758093E5-8316-4DE0-A6D8-64E33FE6AA88}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{7582F2F3-2250-4CF9-9915-776167689CB5}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{760DFCD6-8783-4D40-B87A-11F1C6844EC2}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{764291EF-1EA1-456F-A3FA-07FCEC5517F7}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{7677674D-CAC4-4752-A242-C6FE4A1ACCFB}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{77598EC5-3352-413F-A566-F6CDBB595A48}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{7789474A-9F75-4829-A5C7-698819C8D3DB}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{781D5737-5DE0-4B52-937D-288C1E6802FE}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{78328C2D-2180-490D-ADC2-39708AD8C8D2}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{783B08F1-A12E-4B0F-8C21-E99D12C3D344}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{7846258A-7663-42EF-BBB6-2D47F213A4A0}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{78A8FA1D-F44C-4665-8586-7659F4E7BD2E}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{7984B146-9E20-45CA-A348-5E79746C0E0B}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{7AAF4959-AA4E-449A-A71F-6C1984381EA8}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{7B3317AE-D94C-4199-9DB6-DDB222F1C542}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{7B42EC4E-2E5D-4E6C-9B23-067E721E0D73}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{7BCA8064-F653-4475-A744-BAD8B3CEE5C7}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{7E95A4AB-76DC-40BA-85FA-E74B2459BA40}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{80035709-32F8-4E31-8CBE-413919DA89E4}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{80B05516-37CF-41E4-BABE-7D5DAA6210B1}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{813D9A79-1BC5-4947-B684-D9B956205B9A}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{82A27744-D25E-4994-85B4-07E59EA1B93C}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{82B56AD7-7614-4195-9545-88663CFAA72C}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{8328B31D-8162-4A13-A293-0A2515C7B725}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{834CC345-B7A1-49E4-BCCA-9105D80645F0}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{83CF6293-87CE-43F9-9A4D-5DBAD527C8AA}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{845CA98B-C7E6-49E5-8A23-70EB9F39ECF7}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{8601DD4A-4D3C-4696-8EAF-293E3E889879}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{868EB0C5-8EC3-425F-AEB8-944B7C5B7F95}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{86976A49-846B-471E-B957-E2087D26D19D}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{86B985F9-CC65-4F92-B63E-29F9DFDE0A06}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{86FD9C16-0773-45DD-B91B-1308E817EDDE}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{87A2E2E3-AEB0-4C08-99BE-BFBFBFCABCFC}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{87E1D831-C3F5-4F5E-B013-C7B9511AD8D4}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{8A3D3033-6937-473A-A709-77092A9C7FD9}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{8AA5E630-C7E7-4244-8060-6635406816A0}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{8ABA0959-69E5-4D0C-86E1-043BD03E545B}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{8B924E60-3B8D-44FE-915F-9CC0497DE69C}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{8DFC27A1-AA5A-4A22-9BCF-1A8D2A360956}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{8E082307-4DB3-4E9E-A124-F78618CADA21}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{8EE7A362-FA62-4696-8CE6-637092A81401}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{8F3EFB13-B5E1-4C27-87C2-557D7891F095}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{8FD6E16E-875C-4BFB-9481-562133818FB2}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{90C64EB5-AC91-4DA2-A17D-3506C32AA263}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{9278000F-61BF-4D39-A5A8-2A89EE375DAA}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{927D45B9-B2C8-41E7-8BBA-F1DF1F541AB0}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{92E4E08F-8099-428F-A02B-B97AA54D04B4}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{9554576A-A6D6-4B3D-8011-55C299D5F1CE}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{957D8950-0310-4D97-9E34-034751923B43}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{959FADE6-7F6B-4057-8278-1E98410FA64D}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{95C52188-CC47-4908-B0F9-5AB370C6AD9A}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{963EB485-8F62-496B-9B11-C4F0F654417F}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{9695FF34-CF11-4291-870F-771F75903A8E}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{9704F190-BB56-435D-A358-85C07E5F4462}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{973C6F94-02FE-4998-A8F2-F26BFCBE1101}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{976339BD-DA1A-4CD3-A9EB-6F8CD325A609}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{97AAFC98-FBE1-4D67-B564-0716F23D2FFD}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{99030836-DA41-49D6-A069-531F10296215}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{994CB47C-AA73-47E6-91BE-66E948643FF0}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{994E3481-8238-44FD-A2F8-4415A093190C}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{9C0A2B08-B34A-44C2-9E92-8580DA8423C7}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{9C290F42-5028-4F21-95BF-152EB5DEE219}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{9E197FAE-D19C-437E-9EAE-D302B3DD92D5}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{9EBC00CC-715C-4152-9E0F-71DD644996A1}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{9EBE937B-9591-4DC2-AB37-5BED2DB73F73}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{9EE68C9D-31CC-48C1-A1F3-4FFFB9598E80}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{9F1452B5-B241-4340-9E4F-C83D52F5200D}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{A014266B-D2B8-4C02-A163-12CA7FFCCEC5}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{A0492F6C-F293-48E6-ABCF-A38C8E7A1571}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{A06351CA-D024-4511-970E-3D9C316E50D5}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{A0A3A6E8-732D-4DDD-A0FB-DA7F07F30340}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{A123451F-F4E9-4518-9FD5-EF250B75C037}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{A1C9CB23-8178-4C82-B1B4-2E65D9259E0F}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{A200BE79-F3BA-4242-875E-72AEDF363428}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{A28F55A2-0386-4B9B-9D45-6A3BC4E24B80}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{A2D8E8DF-0177-43D3-9F52-5B5BFCD3FC0D}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{A3DF2749-0A53-4C8B-B35F-C057414CD8EE}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{A3F5D9EC-CD4A-4AFB-82F7-19BEFAF79ED2}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{A41D3A0C-5E0A-4F65-A22D-93F8857A5E99}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{A4411E3B-1E86-48C1-972E-B5C3CA86BAB7}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{A50F888E-9650-4EB5-8911-F3C1D94CAAC3}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{A552D1D8-554E-417B-A77B-BE94F0643CB6}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{A5B8DAE9-4FD1-4FF7-89E7-05D81ABFDBFC}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{A76ACE08-D503-4223-9877-8B74B84EB2BA}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{A7BA3629-EC48-4EC4-B6E3-DC29B2049DCF}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{A8644CC4-6EF6-4558-A212-DC969121F549}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{A93C712B-27B0-4F3D-B477-8A8AB07B0883}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{A96608F9-7A95-424C-837B-D93645072410}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{AA2D98A2-C11D-4F4B-85CA-392B58B567EA}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{AC529F88-E6B7-4EB3-9A5E-D1F8FBC4F258}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{AE137391-4818-43DF-BE89-D8F468ADA767}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{AEF57D96-CBAC-4084-BC09-8D8D54D989C0}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{B019C101-9172-40FB-A25E-0B64900FE32E}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{B0D44956-6BDE-4108-9A67-5959A418A757}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{B0E07D7A-6B0E-432B-AB5C-858320431D00}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{B238B02E-9E40-4E98-80FB-33E8999466A7}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{B273FE72-45BE-40DF-8236-6F1B1EBE847C}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{B4461746-9787-4FEF-86CC-2C543B024457}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{B609FE81-9E82-4EEA-9EEA-92D7554B2A37}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{B68893C9-6E84-450F-9DEB-24EF66617DBA}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{B70B5FC3-4953-4395-A116-B8BBEBC40031}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{B7F192F2-0D3A-42B1-9878-5A1127C567E1}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{B83F51C9-6E94-4A5F-9FF4-BBCDD9B1729F}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{B8DAAF6C-043F-4087-941F-A60C3A3996A8}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{B977CB78-5F31-4B79-80C6-4732063B832B}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{B98B227C-8770-401C-9D9D-E6A2FB2249BB}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{BB75D02C-F73E-4B4A-8D13-941D9A29789B}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{BBE5637D-C757-4184-BF8A-8729746C802D}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{BC9C4F2D-7F22-4FF7-902B-215B5DBC0B3D}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{BF502D74-78DA-4532-8BEE-3BA2897B5A33}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{BF7B0E84-DC3C-45D4-972D-B7D0DB450A0B}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{BFB0D9F3-1FF5-4CEB-84B5-21384DD9AD9E}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{C0DC209A-6A2F-44AF-9B95-EB3C4F50D80D}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{C0F13918-EAC0-4C96-A409-74C39F9CE00C}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{C324E6C7-DE90-4D4D-9334-88EA1D233C68}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{C42F4223-4390-477C-A08D-A2E1CB721495}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{C4EBFA0A-24F5-4499-8D87-AB9085979C04}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{C4FAE90F-FC4F-4F61-B08C-054DF8785F9C}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{C4FEA5DE-F197-4BAF-B373-7E74A1FF09BB}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{C6D68CE9-7AAA-424C-A5D0-DB5DEDCEF514}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{C7353DE3-2278-4336-88E2-DA85BA6A9D7C}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{C7C8B719-7622-4AEB-BD3B-3D7E2186171D}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{C897F19F-A4F7-4623-A188-6AAEA2875F20}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{C8C1716A-4D3C-409F-9680-13ADFF1245F4}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{C8E43EAA-0468-4CE9-AB33-A30D9957F582}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{C97BE539-DB72-4815-AF46-A656A90B0D59}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{CCD70C61-3D00-48C9-A474-E38217F0EDB3}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{CD09D8AE-F61B-4024-9D3F-E3929820983F}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{CDD01A39-DBA4-4E37-AB48-D8115C1A20C7}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{CECDF069-6AA1-4366-B0D9-B960EE8F5BEB}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{CF2AAD2B-7DF0-4775-B728-204DA24D3D83}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{CF4B778F-37FA-4400-A19C-51F3228FE01A}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{D1166BE5-E3AF-4FE9-B56E-BB84D5A30E16}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{D275D9F3-3BC2-481F-A080-2F0B9762B8C0}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{D370228D-D197-441C-86FB-1F04ABAB5100}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{D3D992D5-D9CD-410D-AA7C-C393A9FB3BA9}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{D40E36B8-AE37-42DB-AE66-8AB6FEB8FA83}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{D53D8228-691D-4F94-819E-C474CB751DC7}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{D58887A2-5CBE-41A9-8C54-2A1B9840E79B}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{D5D469C2-A07E-42D8-8057-4125D4AC7231}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{D84F4D90-027D-45D7-833A-0C60745F6B20}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{D8559ED7-BA7B-45FF-9D6E-3039591FA489}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{D8D801A4-CFEA-43A6-B33D-BA65FFD6BE82}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{DAAF73D5-C2AE-4C59-97DF-FE299FD47444}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{DDBB2725-9B7D-4E09-A198-55BBC802BABE}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{DDDE1E76-4BEA-493A-B6AF-CCD539F0FAD6}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{DFC9BCD0-564B-41B7-B3DA-2F350B99218B}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{E009F814-EE9E-454E-AC6C-9921E3D44616}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{E0BE44B2-8F47-4367-BDA6-78F588477622}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{E244D2FD-9956-4D71-B52D-95211C496337}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{E49D8415-D557-4224-867C-DE116ECAF5A7}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{E5A4D0BB-B9AF-43BA-A09A-9869F1CE1E52}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{E5D30C3C-DD91-4755-A020-2C14269A6774}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{E604E6B6-9288-4DA8-BF03-968544A7B985}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{E63F1ED2-467A-4137-BBBD-A25CE099F851}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{E81ADF91-8C10-4B16-A08C-6AA1296F8050}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{E83BF36E-DABD-4E93-B94B-243A08DFD7C2}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{E8927B6E-8929-4000-B91C-81D1847A3B39}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{E8A08461-F525-46B1-9D33-E45A4ADC1169}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{E96118CA-15F4-47FA-AEDD-F6384A430048}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{EA220D77-C269-4CD5-B2B9-0CD591E1CD8F}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{EB8B5956-8CDF-4016-9AF5-11B4959CC250}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{EC08619A-84B3-490D-8819-A7EA23965EDA}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{ECDADF06-DA36-463E-82A5-D6E0BCE501BA}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{ECE66AA4-F4F2-4B97-94F4-998E7D0DE0D1}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{ED3092B5-43D0-44B4-B7D2-F76AC9EC5737}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{ED4B886D-E418-4B6A-B255-6F51DE801B85}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{EDE6D7D4-B073-4A2F-897B-A3FBA92DF20E}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{EE3AF768-855B-4A36-87C5-F5F02D6C8EEA}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{EE6B7CBB-2C5D-4AF6-A4E0-40C61486E3E7}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{EEC1D6E8-9B25-45E0-8163-4AE2B460AAFA}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{F0015E76-5E48-4700-ABF0-D717BE8FB1B0}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{F128D9B3-29C2-497F-84AD-8F1926EED331}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{F18CD6C9-0D6B-4F02-96D2-2ECCEEDA3280}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{F37C3088-5FFE-4F1A-8177-44275BACEC00}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{F44B4FEC-4829-4A61-88C0-9327D29AE26D}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{F614176B-5E53-4319-807F-9E38DB2C7AE1}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{F6543784-18F6-4B8F-AF97-481B071FD479}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{F65F9FFE-B829-43E8-ADBB-D09E1C11BEBE}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{F73BDF11-9019-4577-B147-65C7150E188F}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{F816640A-B6A5-49F0-BDB9-9BFB92F4443A}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{F9767B14-8D71-4C69-B006-2FFFA6682748}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{FA3C016E-BC89-4B36-BC41-062A8EFE8C04}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{FB0982D5-6E6B-44BA-A75D-82E788023AE3}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{FC68F006-02C1-45E5-8D6E-2DCDCCC73679}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{FCC4D633-E6D4-403F-8FAF-1E5BEC3B67DB}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{FCFFBD32-A2E5-49F6-A954-FDB3FE258CDA}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{FD2D3CB1-DCE1-4C44-B3B2-48B082D44D9F}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{FD9B1508-211F-4596-9551-7862391FEAC6}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{FF363FE5-FCE0-4485-9A45-E24D2B7DD922}
Successfully deleted: [Empty Folder] C:\Users\Uwe\appdata\local\{FF3D72BF-C865-4EFF-BA05-494CE1791BCA}
~~~ FireFox
Successfully deleted: [File] C:\user.js
Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions\\ext@flash-enhancer.com
Successfully deleted the following from C:\Users\Uwe\AppData\Roaming\mozilla\firefox\profiles\x7g4ebcp.default\prefs.js
user_pref("browser.uiCustomization.state", "{\"placements\":{\"PanelUI-contents\":[\"edit-controls\",\"zoom-controls\",\"new-window-button\",\"privatebrowsing-button\",\"save-
user_pref("extensions.ORJ-SPE.domain", "\"www.search.ask.com\"");
user_pref("extensions.ORJ-SPE.hpr_ff", "\"hxxp://www.search.ask.com/?tpid=ORJ-SPE&o=APN11409&pf=V7&trgb=FF&p2=%5EBBH%5EOSJ000%5EYY%5EDE&gct=hp&apn_ptnrs=BBH&apn_dtid=%5EOSJ000
Emptied folder: C:\Users\Uwe\AppData\Roaming\mozilla\firefox\profiles\x7g4ebcp.default\minidumps [50 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 26.09.2014 at 19:09:11,51
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
27.09.2014, 13:19
| #6 |
| | Zbot.A.1193 eingefangen, lässt sich nicht löschen FRST FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 25-09-2014 01
Ran by Uwe (administrator) on UWE-PC on 26-09-2014 19:12:16
Running from C:\Users\Uwe\Downloads
Loaded Profile: Uwe (Available profiles: Uwe)
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Bayer Healthcare LLC) C:\Program Files\Bayer HealthCare SmartLaunch\bin\BayerHCService.exe
(B.H.A Corporation) C:\Windows\System32\bgsvcgen.exe
(TOSHIBA) C:\Program Files\TOSHIBA\TOSHIBA Web Camera Application\TWebCameraSrv.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
() C:\Program Files\Canon\IJPLM\ijplmsvc.exe
(Toshiba Europe GmbH) C:\Program Files\Toshiba TEMPRO\TemproSvc.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\hidfind.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
(TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TEco.exe
(Avira) C:\Program Files\Avira\AviraSpeedup\avira_system_speedup.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
(Toshiba Europe GmbH) C:\Program Files\Toshiba TEMPRO\TemproTray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(CANON INC.) C:\Program Files\Canon\Quick Menu\CNQMMAIN.EXE
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(TOSHIBA) C:\Program Files\TOSHIBA\Toshiba Online Product Information\TOPI.exe
(Samsung) C:\Program Files\Samsung\Kies\Kies.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPoint\SetPoint.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(CANON INC.) C:\Program Files\Canon\Quick Menu\CNQMUPDT.EXE
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Farbar) C:\Users\Uwe\Downloads\FRST(1).exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [184320 2009-03-29] (Alps Electric Co., Ltd.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7625248 2009-07-28] (Realtek Semiconductor)
HKLM\...\Run: [00TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [729088 2009-03-23] (TOSHIBA Corporation)
HKLM\...\Run: [HSON] => C:\Program Files\TOSHIBA\TBS\HSON.exe [55160 2009-03-09] (TOSHIBA Corporation)
HKLM\...\Run: [HWSetup] => C:\Program Files\TOSHIBA\Utilities\HWSetup.exe [421888 2007-04-16] (TOSHIBA Electronics, Inc.)
HKLM\...\Run: [KeNotify] => C:\Program Files\TOSHIBA\Utilities\KeNotify.exe [34088 2009-01-13] (TOSHIBA CORPORATION)
HKLM\...\Run: [SmartFaceVWatcher] => C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatcher.exe [163840 2009-03-24] (TOSHIBA Corporation)
HKLM\...\Run: [SmoothView] => C:\Program Files\Toshiba\SmoothView\SmoothView.exe [503808 2009-03-31] (TOSHIBA Corporation)
HKLM\...\Run: [Teco] => C:\Program Files\TOSHIBA\TECO\Teco.exe [1323008 2009-04-24] (TOSHIBA Corporation)
HKLM\...\Run: [ToshibaServiceStation] => C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [1295736 2011-02-11] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe [1011712 2009-04-23] (TOSHIBA Corporation)
HKLM\...\Run: [TPCHWMsg] => C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe [570736 2009-04-15] (TOSHIBA Corporation)
HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [468320 2009-03-06] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba TEMPRO] => C:\Program Files\Toshiba TEMPRO\TemproTray.exe [1050072 2010-10-26] (Toshiba Europe GmbH)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-04] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] => C:\Windows\KHALMNPR.EXE [55824 2009-06-17] (Logitech, Inc.)
HKLM\...\Run: [CanonQuickMenu] => C:\Program Files\Canon\Quick Menu\CNQMMAIN.EXE [1279120 2012-09-27] (CANON INC.)
HKLM\...\Run: [spup] => C:\Users\Uwe\AppData\Roaming\ShinyProfile\spup.exe [197664 2013-07-10] ()
HKLM\...\Run: [KiesTrayAgent] => C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [310064 2014-06-14] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [164656 2014-08-27] (Avira Operations GmbH & Co. KG)
HKLM\...\Policies\Explorer: [TaskbarNoNotification] 0
HKLM\...\Policies\Explorer: [HideSCAHealth] 0
HKU\S-1-5-21-2242340406-3198609139-1784460280-1000\...\Run: [TOSHIBA Online Product Information] => C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe [6158240 2009-03-16] (TOSHIBA)
HKU\S-1-5-21-2242340406-3198609139-1784460280-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1563440 2014-06-14] (Samsung)
HKU\S-1-5-21-2242340406-3198609139-1784460280-1000\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\S-1-5-18\...\Run: [AviraSpeedup] => C:\Program Files\Avira\AviraSpeedup\avira_system_speedup.exe [5085416 2014-09-14] (Avira)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Logitech SetPoint.lnk
ShortcutTarget: Logitech SetPoint.lnk -> C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x372D99EA78BDCA01
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
URLSearchHook: HKLM - (No Name) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - No File
BHO: RealPlayer Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
BHO: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO: SSVHelper Class -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_IKEA_Win32.cab
DPF: {6E718D87-6909-4FCE-92D4-EDCB2F725727} hxxp://navigram.com/engine/v1026/Navigram.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_67-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0067-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_67-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_67-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default
FF NewTab: google.de
FF Homepage: hxxp://www.google.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin: @canon.com/EPPEX -> C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin: @google.com/npPicasa2,version=2.0.0 -> C:\Program Files\Picasa2\npPicasa2.dll (Google, Inc.)
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=6.0.12.775 -> C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprjplug;version=1.0.3.775 -> C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprphtml5videoshim;version=1.0.0.0 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpjplug;version=6.0.12.775 -> C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF Plugin: @SonyCreativeSoftware.com/Media Go,version=1.0 -> C:\Program Files\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @lightspark.github.com/Lightspark;version=1 -> C:\Program Files\Lightspark 0.5.3-git\nplightsparkplugin.dll No File
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira Browser Safety - C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\Extensions\abs@avira.com [2014-09-05]
FF Extension: Block site - C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\Extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc} [2014-02-04]
FF Extension: Adblock Plus - C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-02-03]
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010-09-08]
Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR RestoreOnStartup: Default -> "hxxp://www.google.com/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR CustomProfile: C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-07-28]
CHR Extension: (Google Search) - C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-07-28]
CHR Extension: (ShinyProfile) - C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmmoilmbogfommjccikojnfgbmjknefc [2013-11-28]
CHR Extension: (RealPlayer HTML5Video Downloader Extension) - C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk [2013-07-28]
CHR Extension: (Gmail) - C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-07-28]
CHR HKLM\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx [2010-09-08]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-08-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-04] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [160048 2014-08-27] (Avira Operations GmbH & Co. KG)
R2 BayerHealthcareService; C:\Program Files\Bayer HealthCare SmartLaunch\bin\BayerHCService.exe [134584 2012-09-18] (Bayer Healthcare LLC)
R2 bgsvcgen; C:\Windows\System32\bgsvcgen.exe [145504 2007-06-15] (B.H.A Corporation)
R2 camsvc; C:\Program Files\TOSHIBA\TOSHIBA Web Camera Application\TWebCameraSrv.exe [20544 2009-04-16] (TOSHIBA)
R2 FsUsbExService; C:\Windows\system32\FsUsbExService.Exe [233472 2013-04-18] (Teruten) [File not signed]
S3 GameConsoleService; C:\Program Files\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe [242424 2009-02-11] (WildTangent, Inc.)
R2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [138192 2011-02-07] ()
R2 TemproMonitoringService; C:\Program Files\Toshiba TEMPRO\TemproSvc.exe [124368 2010-10-26] (Toshiba Europe GmbH)
R3 TMachInfo; C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [54136 2011-02-11] (TOSHIBA Corporation)
R2 TOSHIBA eco Utility Service; C:\Program Files\TOSHIBA\TECO\TecoService.exe [176128 2009-04-24] (TOSHIBA Corporation) [File not signed]
R2 TOSHIBA HDD SSD Alert Service; C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [73728 2009-03-17] (TOSHIBA Corporation) [File not signed]
R2 TPCHSrv; C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe [656752 2009-04-15] (TOSHIBA Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-07-03] (Avira Operations GmbH & Co. KG)
R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [37664 2013-11-11] (AVG Technologies)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-06-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-25] (Avira Operations GmbH & Co. KG)
R1 cdrbsdrv; C:\Windows\system32\Drivers\cdrbsdrv.sys [33408 2006-02-20] (B.H.A Corporation) [File not signed]
R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [37344 2013-04-18] () [File not signed]
R3 PGEffect; C:\Windows\System32\DRIVERS\pgeffect.sys [22272 2009-03-18] (TOSHIBA Corporation)
R3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [157536 2009-05-20] (Realtek Semiconductor Corp.)
S3 s0017bus; C:\Windows\System32\DRIVERS\s0017bus.sys [86824 2008-10-21] (MCCI Corporation)
S3 s0017mdfl; C:\Windows\System32\DRIVERS\s0017mdfl.sys [15016 2008-10-21] (MCCI Corporation)
S3 s0017mdm; C:\Windows\System32\DRIVERS\s0017mdm.sys [114600 2008-10-21] (MCCI Corporation)
S3 s0017mgmt; C:\Windows\System32\DRIVERS\s0017mgmt.sys [108328 2008-10-21] (MCCI Corporation)
S3 s0017nd5; C:\Windows\System32\DRIVERS\s0017nd5.sys [26024 2008-10-21] (MCCI Corporation)
S3 s0017obex; C:\Windows\System32\DRIVERS\s0017obex.sys [104616 2008-10-21] (MCCI Corporation)
S3 s0017unic; C:\Windows\System32\DRIVERS\s0017unic.sys [109736 2008-10-21] (MCCI Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R2 TVALZFL; C:\Windows\System32\DRIVERS\TVALZFL.sys [12920 2009-03-21] (TOSHIBA Corporation)
R3 WinDriver6; C:\Windows\System32\drivers\windrvr6.sys [195424 2012-07-16] (Jungo)
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Uwe\AppData\Local\Temp\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-26 19:12 - 2014-09-26 19:12 - 00021169 _____ () C:\Users\Uwe\Downloads\FRST.txt
2014-09-26 19:09 - 2014-09-26 19:09 - 00038982 _____ () C:\Users\Uwe\Desktop\JRT.txt
2014-09-26 19:06 - 2014-09-26 19:06 - 00000000 ____D () C:\Windows\ERUNT
2014-09-26 19:04 - 2014-09-26 19:05 - 00019934 _____ () C:\Users\Uwe\Desktop\ADW.txt
2014-09-26 18:43 - 2014-09-26 19:01 - 00000000 ____D () C:\AdwCleaner
2014-09-26 18:43 - 2014-09-26 18:43 - 00039807 _____ () C:\Users\Uwe\Desktop\mbam.txt
2014-09-26 18:42 - 2014-09-26 18:42 - 01699118 _____ (Thisisu) C:\Users\Uwe\Downloads\JRT.exe
2014-09-26 18:42 - 2014-09-26 18:42 - 01373475 _____ () C:\Users\Uwe\Downloads\AdwCleaner_3.310.exe
2014-09-26 17:52 - 2014-09-26 18:42 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-26 17:50 - 2014-09-26 17:50 - 00001064 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-26 17:50 - 2014-09-26 17:50 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-26 17:50 - 2014-09-26 17:50 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-09-26 17:50 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-09-26 17:50 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-26 17:50 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-26 17:49 - 2014-09-26 17:49 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Uwe\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-25 20:53 - 2014-09-09 23:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-25 20:49 - 2014-09-25 20:49 - 00024413 _____ () C:\ComboFix.txt
2014-09-25 20:19 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-09-25 20:19 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-09-25 20:19 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-09-25 20:19 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-09-25 20:19 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-09-25 20:19 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-09-25 20:19 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-09-25 20:19 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-09-25 20:16 - 2014-09-25 20:49 - 00000000 ____D () C:\Qoobox
2014-09-25 20:16 - 2014-09-25 20:46 - 00000000 ____D () C:\Windows\erdnt
2014-09-25 20:14 - 2014-09-25 20:14 - 05580995 ____R (Swearware) C:\Users\Uwe\Desktop\ComboFix.exe
2014-09-25 20:04 - 2014-09-25 20:04 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Uwe\Downloads\revosetup95.exe
2014-09-25 20:04 - 2014-09-25 20:04 - 00001226 _____ () C:\Users\Uwe\Desktop\Revo Uninstaller.lnk
2014-09-25 20:04 - 2014-09-25 20:04 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-09-25 19:14 - 2014-09-25 19:14 - 00380416 _____ () C:\Users\Uwe\Downloads\Gmer-19357.exe
2014-09-25 19:07 - 2014-09-26 19:12 - 00000000 ____D () C:\FRST
2014-09-25 19:04 - 2014-09-25 19:05 - 01100800 _____ (Farbar) C:\Users\Uwe\Downloads\FRST(1).exe
2014-09-25 18:44 - 2014-09-25 18:45 - 03640880 _____ () C:\Users\Uwe\Downloads\avg_remover_zbot.exe
2014-09-25 18:43 - 2014-09-25 18:43 - 01100800 _____ (Farbar) C:\Users\Uwe\Downloads\FRST.exe
2014-09-25 18:28 - 2014-09-25 18:28 - 00122976 _____ (Kaspersky Lab ZAO) C:\Users\Uwe\Downloads\zbotkiller.exe
2014-09-25 18:27 - 2014-09-25 18:27 - 00000000 ___HD () C:\Windows\PIF
2014-09-25 17:58 - 2014-09-25 17:58 - 01101648 _____ () C:\Users\Uwe\Downloads\BitDefender ZBot Removal Tool - CHIP-Installer.exe
2014-09-22 17:16 - 2014-09-26 19:02 - 00035336 _____ () C:\Windows\PFRO.log
2014-09-22 01:00 - 2014-09-26 19:02 - 00032382 _____ () C:\Windows\setupact.log
2014-09-22 01:00 - 2014-09-22 01:00 - 00000000 _____ () C:\Windows\setuperr.log
2014-09-19 14:12 - 2014-09-25 18:42 - 00000000 ____D () C:\Users\Uwe\AppData\Roaming\Avambu
2014-09-14 10:55 - 2014-09-14 11:06 - 00000000 ____D () C:\Users\Uwe\AppData\Local\AviraSpeedup
2014-09-14 10:55 - 2014-09-14 10:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviraSpeedup
2014-09-14 10:53 - 2014-09-14 10:53 - 00001100 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-09-10 22:46 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-10 22:46 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-10 22:46 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-10 22:46 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-10 22:46 - 2014-08-18 23:57 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-10 22:46 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-10 22:46 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-10 22:46 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-10 22:46 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-10 22:46 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-10 22:46 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-10 22:46 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-10 22:46 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-10 22:46 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-10 22:46 - 2014-08-18 23:36 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-10 22:46 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-10 22:46 - 2014-08-18 23:30 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-10 22:46 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-10 22:46 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-10 22:46 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-10 22:46 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-10 22:46 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-10 22:46 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-10 22:46 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-10 22:46 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-10 22:46 - 2014-08-18 23:08 - 00673792 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-10 22:46 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-10 22:46 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-10 22:46 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-10 22:46 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-10 22:45 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-10 19:05 - 2014-07-07 03:40 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-10 19:05 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-10 19:04 - 2014-09-05 03:52 - 00445952 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-10 19:04 - 2014-09-05 03:47 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-10 19:04 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-10 19:04 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-10 18:44 - 2014-09-10 18:44 - 01054912 _____ (Adobe) C:\Users\Uwe\Downloads\install_flashplayer15x32au_mssd_aaa_aih.exe
2014-08-31 12:20 - 2014-08-31 12:28 - 00010565 _____ () C:\Users\Uwe\Documents\Materialliste FC WC 2014.08.31.xlsx
2014-08-31 12:09 - 2014-08-31 12:09 - 00029450 _____ () C:\Users\Uwe\Documents\Materialliste 2014.08.31.xlsx
2014-08-30 20:01 - 2014-08-30 20:01 - 01058200 _____ (Adobe) C:\Users\Uwe\Downloads\install_flashplayer14x32au_mssd_aaa_aih.exe
2014-08-29 17:12 - 2014-08-23 03:46 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-29 17:12 - 2014-08-23 02:42 - 02352640 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-26 19:13 - 2014-09-26 19:12 - 00021169 _____ () C:\Users\Uwe\Downloads\FRST.txt
2014-09-26 19:12 - 2014-09-25 19:07 - 00000000 ____D () C:\FRST
2014-09-26 19:11 - 2010-03-06 22:09 - 00019440 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-26 19:11 - 2010-03-06 22:09 - 00019440 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-26 19:09 - 2014-09-26 19:09 - 00038982 _____ () C:\Users\Uwe\Desktop\JRT.txt
2014-09-26 19:07 - 2010-03-06 20:17 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-26 19:06 - 2014-09-26 19:06 - 00000000 ____D () C:\Windows\ERUNT
2014-09-26 19:05 - 2014-09-26 19:04 - 00019934 _____ () C:\Users\Uwe\Desktop\ADW.txt
2014-09-26 19:02 - 2014-09-22 17:16 - 00035336 _____ () C:\Windows\PFRO.log
2014-09-26 19:02 - 2014-09-22 01:00 - 00032382 _____ () C:\Windows\setupact.log
2014-09-26 19:02 - 2010-03-06 20:17 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-26 19:02 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-26 19:01 - 2014-09-26 18:43 - 00000000 ____D () C:\AdwCleaner
2014-09-26 19:01 - 2010-03-06 22:25 - 01262803 _____ () C:\Windows\WindowsUpdate.log
2014-09-26 18:43 - 2014-09-26 18:43 - 00039807 _____ () C:\Users\Uwe\Desktop\mbam.txt
2014-09-26 18:42 - 2014-09-26 18:42 - 01699118 _____ (Thisisu) C:\Users\Uwe\Downloads\JRT.exe
2014-09-26 18:42 - 2014-09-26 18:42 - 01373475 _____ () C:\Users\Uwe\Downloads\AdwCleaner_3.310.exe
2014-09-26 18:42 - 2014-09-26 17:52 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-26 18:37 - 2012-07-04 17:14 - 00000000 ____D () C:\Windows\pss
2014-09-26 18:02 - 2012-04-02 17:54 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-26 17:50 - 2014-09-26 17:50 - 00001064 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-26 17:50 - 2014-09-26 17:50 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-26 17:50 - 2014-09-26 17:50 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-09-26 17:49 - 2014-09-26 17:49 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Uwe\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-26 15:34 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-09-26 03:00 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-09-25 20:49 - 2014-09-25 20:49 - 00024413 _____ () C:\ComboFix.txt
2014-09-25 20:49 - 2014-09-25 20:16 - 00000000 ____D () C:\Qoobox
2014-09-25 20:49 - 2009-07-14 04:37 - 00000000 __RHD () C:\Users\Default
2014-09-25 20:49 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-09-25 20:46 - 2014-09-25 20:16 - 00000000 ____D () C:\Windows\erdnt
2014-09-25 20:40 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini
2014-09-25 20:39 - 2012-04-22 13:38 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-09-25 20:14 - 2014-09-25 20:14 - 05580995 ____R (Swearware) C:\Users\Uwe\Desktop\ComboFix.exe
2014-09-25 20:04 - 2014-09-25 20:04 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Uwe\Downloads\revosetup95.exe
2014-09-25 20:04 - 2014-09-25 20:04 - 00001226 _____ () C:\Users\Uwe\Desktop\Revo Uninstaller.lnk
2014-09-25 20:04 - 2014-09-25 20:04 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-09-25 19:47 - 2014-05-11 18:24 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-09-25 19:14 - 2014-09-25 19:14 - 00380416 _____ () C:\Users\Uwe\Downloads\Gmer-19357.exe
2014-09-25 19:05 - 2014-09-25 19:04 - 01100800 _____ (Farbar) C:\Users\Uwe\Downloads\FRST(1).exe
2014-09-25 18:45 - 2014-09-25 18:44 - 03640880 _____ () C:\Users\Uwe\Downloads\avg_remover_zbot.exe
2014-09-25 18:43 - 2014-09-25 18:43 - 01100800 _____ (Farbar) C:\Users\Uwe\Downloads\FRST.exe
2014-09-25 18:42 - 2014-09-19 14:12 - 00000000 ____D () C:\Users\Uwe\AppData\Roaming\Avambu
2014-09-25 18:29 - 2010-03-06 22:34 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-25 18:28 - 2014-09-25 18:28 - 00122976 _____ (Kaspersky Lab ZAO) C:\Users\Uwe\Downloads\zbotkiller.exe
2014-09-25 18:27 - 2014-09-25 18:27 - 00000000 ___HD () C:\Windows\PIF
2014-09-25 17:58 - 2014-09-25 17:58 - 01101648 _____ () C:\Users\Uwe\Downloads\BitDefender ZBot Removal Tool - CHIP-Installer.exe
2014-09-25 17:38 - 2012-04-02 17:54 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-09-25 17:38 - 2011-05-14 09:43 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-09-24 18:12 - 2012-01-29 12:20 - 00000000 ____D () C:\Users\Uwe\AppData\Local\Windows Live
2014-09-24 18:01 - 2010-03-07 12:17 - 00006656 _____ () C:\Users\Uwe\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-09-22 17:21 - 2011-06-19 01:25 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-09-22 17:20 - 2010-03-06 22:09 - 00000000 ____D () C:\Users\Uwe
2014-09-22 01:00 - 2014-09-22 01:00 - 00000000 _____ () C:\Windows\setuperr.log
2014-09-16 16:20 - 2012-09-03 16:28 - 00632656 _____ (Microsoft Corporation) C:\Windows\system32\msvcr80.dll
2014-09-16 16:20 - 2012-09-03 16:28 - 00554832 _____ (Microsoft Corporation) C:\Windows\system32\msvcp80.dll
2014-09-16 16:20 - 2012-09-03 16:28 - 00479232 _____ (Microsoft Corporation) C:\Windows\system32\msvcm80.dll
2014-09-16 16:20 - 2012-09-03 16:28 - 00001870 _____ () C:\Windows\system32\Microsoft.VC80.CRT.manifest
2014-09-16 16:20 - 2011-06-11 01:58 - 00421200 _____ (Microsoft Corporation) C:\Windows\system32\msvcp100.dll
2014-09-15 09:06 - 2013-11-19 18:44 - 00231568 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-09-14 13:57 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-09-14 11:06 - 2014-09-14 10:55 - 00000000 ____D () C:\Users\Uwe\AppData\Local\AviraSpeedup
2014-09-14 11:06 - 2013-01-22 20:57 - 00000000 ____D () C:\Users\Uwe\AppData\Roaming\TeamViewer
2014-09-14 11:06 - 2012-04-28 16:37 - 00000000 ____D () C:\Windows\Minidump
2014-09-14 11:06 - 2010-03-13 17:02 - 00000000 ____D () C:\Windows\IP4000,3000
2014-09-14 11:06 - 2010-03-06 23:50 - 00000000 ____D () C:\Users\Uwe\AppData\Roaming\skypePM
2014-09-14 10:55 - 2014-09-14 10:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviraSpeedup
2014-09-14 10:55 - 2012-11-04 13:16 - 00000000 ____D () C:\Program Files\Avira
2014-09-14 10:53 - 2014-09-14 10:53 - 00001100 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-09-14 10:53 - 2014-08-04 12:19 - 00000000 ____D () C:\ProgramData\Package Cache
2014-09-14 10:53 - 2012-11-04 13:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-09-10 22:46 - 2009-06-09 11:35 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-09-10 22:45 - 2013-08-14 18:18 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-10 22:35 - 2014-05-06 17:45 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-10 22:35 - 2010-03-16 19:28 - 98758480 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-10 18:44 - 2014-09-10 18:44 - 01054912 _____ (Adobe) C:\Users\Uwe\Downloads\install_flashplayer15x32au_mssd_aaa_aih.exe
2014-09-09 23:47 - 2014-09-25 20:53 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-05 03:52 - 2014-09-10 19:04 - 00445952 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-05 03:47 - 2014-09-10 19:04 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-03 18:29 - 2011-11-18 19:03 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-08-31 12:28 - 2014-08-31 12:20 - 00010565 _____ () C:\Users\Uwe\Documents\Materialliste FC WC 2014.08.31.xlsx
2014-08-31 12:10 - 2010-07-04 16:45 - 00000000 ____D () C:\Users\Uwe\Allerlei
2014-08-31 12:09 - 2014-08-31 12:09 - 00029450 _____ () C:\Users\Uwe\Documents\Materialliste 2014.08.31.xlsx
2014-08-30 20:01 - 2014-08-30 20:01 - 01058200 _____ (Adobe) C:\Users\Uwe\Downloads\install_flashplayer14x32au_mssd_aaa_aih.exe
2014-08-30 19:59 - 2009-07-14 06:33 - 00397344 _____ () C:\Windows\system32\FNTCACHE.DAT
Some content of TEMP:
====================
C:\Users\Uwe\AppData\Local\temp\avgnt.exe
C:\Users\Uwe\AppData\Local\temp\Quarantine.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-09-26 00:02
==================== End Of Log ============================
--- --- --- sagt mal kann der auch auf einen USB Stick übertragen werden wenn man Bilder darauf kopiert ? |
|
28.09.2014, 09:40
| #7 |
| /// the machine /// TB-Ausbilder | Zbot.A.1193 eingefangen, lässt sich nicht löschen Eher weniger, warum? ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
29.09.2014, 10:35
| #8 |
| | Zbot.A.1193 eingefangen, lässt sich nicht löschen Weil mein Vater Bilder auf einen USB Stick gemacht hat ... Und poste den rest nachher ESET: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=44005296369b4743b9ba6ddb19ae7d1d
# engine=20337
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-09-28 08:45:05
# local_time=2014-09-28 10:45:05 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 26951 277356795 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 104285 163568296 0 0
# scanned=214218
# found=36
# cleaned=0
# scan_time=26510
sh=E63BE9D21844CB7665972B549930B12DB46A99C1 ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Backup\C\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs_26_09_2014_19_01_25.js"
sh=AF2A09062B79711D5D92F58251EE238DF2E5E9F9 ft=1 fh=ea86b3a42b031233 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Uwe\AppData\LocalLow\ConduitEngine\ConduitEngin0.dll.vir"
sh=57CD8DEAF43DF3A2F4703E5219A69935B119D0DB ft=1 fh=311781f1ea21501f vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Uwe\AppData\LocalLow\ConduitEngine\ConduitEngine.dll.vir"
sh=AF2A09062B79711D5D92F58251EE238DF2E5E9F9 ft=1 fh=ea86b3a42b031233 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Uwe\AppData\LocalLow\Softonic_Deutsch\tbSof0.dll.vir"
sh=3664B7B546B41FBFB469128DEA194DBA1AF556AC ft=1 fh=532d857584187cdc vn="Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Uwe\AppData\LocalLow\Softonic_Deutsch\tbSof1.dll.vir"
sh=57CD8DEAF43DF3A2F4703E5219A69935B119D0DB ft=1 fh=311781f1ea21501f vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Uwe\AppData\LocalLow\Softonic_Deutsch\tbSof2.dll.vir"
sh=BFD72C046A3341D9273AF47B05EEB50A66725FF7 ft=1 fh=00f7a1e350b89a9e vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Uwe\AppData\LocalLow\Softonic_Deutsch\tbSoft.dll.vir"
sh=7A5B168BB2B8C06B2A9134B656BBF195830D21C2 ft=1 fh=55d4f387d8566cf4 vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Uwe\AppData\LocalLow\Softonic_Deutsch\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.1.1\bin\PriceGongIE.dll.vir"
sh=6A2F7743C1F730E625009C909AFE710F3F154BA3 ft=1 fh=b939cabf4891a488 vn="Variante von Win32/InstallBrain.AN evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\Uninstall Information\Ib\34\4019\ib_uninstall.exe"
sh=0A4987AE6FFCE254670783E1BE880C291C8D9357 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\Uwe\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35\7ec70563-675dad41-temp"
sh=7CDBDEC910F5985CBF220EF3B263694DDE3DD98B ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js"
sh=53B38F6B8D8BF25B8151028930F70BAA6940EA1C ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\prefs.js.BAK"
sh=42F005F09BB900C778CAF5769460A4B543A67B4F ft=1 fh=bf2609c2104fe69b vn="Win32/SweetIM.J evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SkywalkerSetup2HWGIZL5.exe"
sh=8FA31D404EB10BC9F30269690729A3DC35985569 ft=1 fh=227d60e5dd063b5d vn="Win32/SweetIM.J evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SkywalkerSetupCEDIMPB9.exe"
sh=C799FC90F4FDD9AEAB7A5B06F9E65FC57CC573A3 ft=1 fh=3e1da09b71c04b76 vn="Win32/SweetIM.J evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SkywalkerSetup[10].exe"
sh=3FCDDDFFA523FD30995BD7F1EE90AD1DAFF05C22 ft=1 fh=eb68e71596000e50 vn="Win32/SweetIM.J evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SkywalkerSetup[1].exe"
sh=58FD5BFD5621171F4F1C69389E3ACA9BC3C80F64 ft=1 fh=ee2985aba3d07ac3 vn="Win32/SweetIM.J evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SkywalkerSetup[2].exe"
sh=D9EE6B80A0799254672CEDD44F173BD38A604757 ft=1 fh=28f332d88c5a495a vn="Win32/SweetIM.J evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SkywalkerSetup[3].exe"
sh=8FCBAF3302FDF837B5D05AD5DCB8EFA77AA012CB ft=1 fh=7575fa339b0b916e vn="Win32/SweetIM.J evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SkywalkerSetup[4].exe"
sh=45220AC873FDECCE7D7C1FA13CFB5A0848ACF7D3 ft=1 fh=4af3bf89a981d880 vn="Win32/SweetIM.J evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SkywalkerSetup[5].exe"
sh=3D4C6F1D551DD7D687FC99B6C12E684C64DA6F07 ft=1 fh=82b6f2f3276cd17c vn="Win32/SweetIM.J evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SkywalkerSetup[6].exe"
sh=2CD7CF96496328C1F8D0AA8D4839D2D0B58162EA ft=1 fh=fd98d23c40259b22 vn="Win32/SweetIM.J evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SkywalkerSetup[7].exe"
sh=23B71244CFC714BA197B204E327B42F775F656F9 ft=1 fh=bef73288930d8b6a vn="Win32/SweetIM.J evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SkywalkerSetup[8].exe"
sh=38DB9C56E56CD021A250A560D94C4941C607B6D0 ft=1 fh=6af60ea619a4c409 vn="Win32/SweetIM.J evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SkywalkerSetup[9].exe"
sh=6402AB811BF4ED47697633F469535EB07AF7A4A1 ft=1 fh=b437c462bc5aee3a vn="Variante von Win32/Toolbar.Perion.G evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WSSetup[1].exe"
sh=1A739914A874A42A4520CE05D8B8761A884ADFB7 ft=1 fh=de394184ef561da5 vn="Variante von Win32/Toolbar.Perion.G evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WSSetup[2].exe"
sh=5231F5FE9C8DE774E535131B790FEDA46A028932 ft=1 fh=7f7c24e44b2f6753 vn="Variante von Win32/Toolbar.Perion.G evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WSSetup[3].exe"
sh=1824CFBB24861E0953082C9DB55CC549F9571FE6 ft=1 fh=5345ab72387b0575 vn="Variante von Win32/Toolbar.Perion.G evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WSSetup[4].exe"
sh=8EEC2F3EC9E824FC4D7E561C8C22B1A5C4546640 ft=1 fh=89f68a07f7f8a43c vn="Variante von Win32/Toolbar.Perion.G evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7AKLDFCS\update[1]"
sh=C8D09EDF4B276759AE98F62253492A70F1CBF333 ft=1 fh=a39f2738cae3dad4 vn="Variante von Win32/Toolbar.Perion.A evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BWW7YU3V\update[1]"
sh=6D970EEB9659EC51AD4AA0566E1C817B6078C6EE ft=1 fh=6997e40d6b6b5d8a vn="Variante von Win32/Toolbar.Perion.G evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BWW7YU3V\WSSetup[1].exe"
sh=432BD2A275783208671CD1DD289C39B98DBCB270 ft=1 fh=3c9d1dccdf052d27 vn="Variante von Win32/Toolbar.Perion.G evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FI9AN21O\PersgSetup[1].exe"
sh=694A6C4A6C09151E896340FBD6597A3DF837CBAF ft=1 fh=439deba0b906930a vn="Variante von Win32/Toolbar.Perion.G evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TOQN1V1I\WSSetup[1].exe"
sh=5A03EC2E26177906BB4595B65D9AA2D62024C944 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="E:\UWE-PC\Backup Set 2014-06-10 165257\Backup Files 2014-06-10 165257\Backup files 8.zip"
sh=370FCCB6535C5A804E0712AAB61D1B61993175D2 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="E:\UWE-PC\Backup Set 2014-08-24 190003\Backup Files 2014-08-24 190003\Backup files 10.zip"
sh=6C45B102BE4D884E90DDC33E1A59F9BAE511F8A8 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="E:\UWE-PC\Backup Set 2014-08-24 190003\Backup Files 2014-08-24 190003\Backup files 9.zip"
UNSUPPORTED OPERATING SYSTEM! ABORTED! |
|
30.09.2014, 09:05
| #9 |
| /// the machine /// TB-Ausbilder | Zbot.A.1193 eingefangen, lässt sich nicht löschen dann noch den Rest bitte
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
30.09.2014, 11:28
| #10 |
| | Zbot.A.1193 eingefangen, lässt sich nicht löschen des security geht net... Und ich glaub der ist weg bin mir aber net sicher FRST: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 29-09-2014
Ran by Uwe (administrator) on UWE-PC on 30-09-2014 10:15:28
Running from C:\Users\Uwe\Desktop
Loaded Profile: Uwe (Available profiles: Uwe)
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Bayer Healthcare LLC) C:\Program Files\Bayer HealthCare SmartLaunch\bin\BayerHCService.exe
(B.H.A Corporation) C:\Windows\System32\bgsvcgen.exe
(TOSHIBA) C:\Program Files\TOSHIBA\TOSHIBA Web Camera Application\TWebCameraSrv.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
() C:\Program Files\Canon\IJPLM\ijplmsvc.exe
(Toshiba Europe GmbH) C:\Program Files\Toshiba TEMPRO\TemproSvc.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\hidfind.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
(TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TEco.exe
(Avira) C:\Program Files\Avira\AviraSpeedup\avira_system_speedup.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
(Toshiba Europe GmbH) C:\Program Files\Toshiba TEMPRO\TemproTray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(CANON INC.) C:\Program Files\Canon\Quick Menu\CNQMMAIN.EXE
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(TOSHIBA) C:\Program Files\TOSHIBA\Toshiba Online Product Information\TOPI.exe
(Samsung) C:\Program Files\Samsung\Kies\Kies.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPoint\SetPoint.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(CANON INC.) C:\Program Files\Canon\Quick Menu\CNQMUPDT.EXE
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft® Corporation) C:\Program Files\Microsoft Works\WkCalRem.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(RealNetworks, Inc.) C:\Program Files\Common Files\Real\Update_OB\realsched.exe
(Microsoft Corporation) C:\Windows\System32\PrintIsolationHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [184320 2009-03-29] (Alps Electric Co., Ltd.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7625248 2009-07-28] (Realtek Semiconductor)
HKLM\...\Run: [00TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [729088 2009-03-23] (TOSHIBA Corporation)
HKLM\...\Run: [HSON] => C:\Program Files\TOSHIBA\TBS\HSON.exe [55160 2009-03-09] (TOSHIBA Corporation)
HKLM\...\Run: [HWSetup] => C:\Program Files\TOSHIBA\Utilities\HWSetup.exe [421888 2007-04-16] (TOSHIBA Electronics, Inc.)
HKLM\...\Run: [KeNotify] => C:\Program Files\TOSHIBA\Utilities\KeNotify.exe [34088 2009-01-13] (TOSHIBA CORPORATION)
HKLM\...\Run: [SmartFaceVWatcher] => C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatcher.exe [163840 2009-03-24] (TOSHIBA Corporation)
HKLM\...\Run: [SmoothView] => C:\Program Files\Toshiba\SmoothView\SmoothView.exe [503808 2009-03-31] (TOSHIBA Corporation)
HKLM\...\Run: [Teco] => C:\Program Files\TOSHIBA\TECO\Teco.exe [1323008 2009-04-24] (TOSHIBA Corporation)
HKLM\...\Run: [ToshibaServiceStation] => C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [1295736 2011-02-11] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe [1011712 2009-04-23] (TOSHIBA Corporation)
HKLM\...\Run: [TPCHWMsg] => C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe [570736 2009-04-15] (TOSHIBA Corporation)
HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [468320 2009-03-06] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba TEMPRO] => C:\Program Files\Toshiba TEMPRO\TemproTray.exe [1050072 2010-10-26] (Toshiba Europe GmbH)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-04] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] => C:\Windows\KHALMNPR.EXE [55824 2009-06-17] (Logitech, Inc.)
HKLM\...\Run: [CanonQuickMenu] => C:\Program Files\Canon\Quick Menu\CNQMMAIN.EXE [1279120 2012-09-27] (CANON INC.)
HKLM\...\Run: [spup] => C:\Users\Uwe\AppData\Roaming\ShinyProfile\spup.exe [197664 2013-07-10] ()
HKLM\...\Run: [KiesTrayAgent] => C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [310064 2014-06-14] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [164656 2014-08-27] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [TkBellExe] => C:\Program Files\Common Files\Real\Update_OB\realsched.exe [202256 2010-09-08] (RealNetworks, Inc.)
HKLM\...\Policies\Explorer: [TaskbarNoNotification] 0
HKLM\...\Policies\Explorer: [HideSCAHealth] 0
HKU\S-1-5-21-2242340406-3198609139-1784460280-1000\...\Run: [TOSHIBA Online Product Information] => C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe [6158240 2009-03-16] (TOSHIBA)
HKU\S-1-5-21-2242340406-3198609139-1784460280-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1563440 2014-06-14] (Samsung)
HKU\S-1-5-21-2242340406-3198609139-1784460280-1000\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\S-1-5-18\...\Run: [AviraSpeedup] => C:\Program Files\Avira\AviraSpeedup\avira_system_speedup.exe [5085416 2014-09-14] (Avira)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Logitech SetPoint.lnk
ShortcutTarget: Logitech SetPoint.lnk -> C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x372D99EA78BDCA01
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
URLSearchHook: HKLM - (No Name) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - No File
BHO: RealPlayer Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
BHO: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO: SSVHelper Class -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_IKEA_Win32.cab
DPF: {6E718D87-6909-4FCE-92D4-EDCB2F725727} hxxp://navigram.com/engine/v1026/Navigram.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_67-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0067-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_67-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_67-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default
FF NewTab: google.de
FF Homepage: hxxp://www.google.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin: @canon.com/EPPEX -> C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin: @google.com/npPicasa2,version=2.0.0 -> C:\Program Files\Picasa2\npPicasa2.dll (Google, Inc.)
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=6.0.12.775 -> C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprjplug;version=1.0.3.775 -> C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprphtml5videoshim;version=1.0.0.0 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpjplug;version=6.0.12.775 -> C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF Plugin: @SonyCreativeSoftware.com/Media Go,version=1.0 -> C:\Program Files\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @lightspark.github.com/Lightspark;version=1 -> C:\Program Files\Lightspark 0.5.3-git\nplightsparkplugin.dll No File
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira Browser Safety - C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\Extensions\abs@avira.com [2014-09-05]
FF Extension: Block site - C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\Extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc} [2014-02-04]
FF Extension: Adblock Plus - C:\Users\Uwe\AppData\Roaming\Mozilla\Firefox\Profiles\x7g4ebcp.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-02-03]
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010-09-08]
Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR RestoreOnStartup: Default -> "hxxp://www.google.com/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR CustomProfile: C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-07-28]
CHR Extension: (Google Search) - C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-07-28]
CHR Extension: (ShinyProfile) - C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmmoilmbogfommjccikojnfgbmjknefc [2013-11-28]
CHR Extension: (RealPlayer HTML5Video Downloader Extension) - C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk [2013-07-28]
CHR Extension: (Gmail) - C:\Users\Uwe\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-07-28]
CHR HKLM\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx [2010-09-08]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-08-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-04] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [160048 2014-08-27] (Avira Operations GmbH & Co. KG)
R2 BayerHealthcareService; C:\Program Files\Bayer HealthCare SmartLaunch\bin\BayerHCService.exe [134584 2012-09-18] (Bayer Healthcare LLC)
R2 bgsvcgen; C:\Windows\System32\bgsvcgen.exe [145504 2007-06-15] (B.H.A Corporation)
R2 camsvc; C:\Program Files\TOSHIBA\TOSHIBA Web Camera Application\TWebCameraSrv.exe [20544 2009-04-16] (TOSHIBA)
R2 FsUsbExService; C:\Windows\system32\FsUsbExService.Exe [233472 2013-04-18] (Teruten) [File not signed]
S3 GameConsoleService; C:\Program Files\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe [242424 2009-02-11] (WildTangent, Inc.)
R2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [138192 2011-02-07] ()
R2 TemproMonitoringService; C:\Program Files\Toshiba TEMPRO\TemproSvc.exe [124368 2010-10-26] (Toshiba Europe GmbH)
R3 TMachInfo; C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [54136 2011-02-11] (TOSHIBA Corporation)
R2 TOSHIBA eco Utility Service; C:\Program Files\TOSHIBA\TECO\TecoService.exe [176128 2009-04-24] (TOSHIBA Corporation) [File not signed]
R2 TOSHIBA HDD SSD Alert Service; C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [73728 2009-03-17] (TOSHIBA Corporation) [File not signed]
R2 TPCHSrv; C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe [656752 2009-04-15] (TOSHIBA Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-07-03] (Avira Operations GmbH & Co. KG)
R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [37664 2013-11-11] (AVG Technologies)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-06-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-25] (Avira Operations GmbH & Co. KG)
R1 cdrbsdrv; C:\Windows\system32\Drivers\cdrbsdrv.sys [33408 2006-02-20] (B.H.A Corporation) [File not signed]
R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [37344 2013-04-18] () [File not signed]
R3 PGEffect; C:\Windows\System32\DRIVERS\pgeffect.sys [22272 2009-03-18] (TOSHIBA Corporation)
R3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [157536 2009-05-20] (Realtek Semiconductor Corp.)
S3 s0017bus; C:\Windows\System32\DRIVERS\s0017bus.sys [86824 2008-10-21] (MCCI Corporation)
S3 s0017mdfl; C:\Windows\System32\DRIVERS\s0017mdfl.sys [15016 2008-10-21] (MCCI Corporation)
S3 s0017mdm; C:\Windows\System32\DRIVERS\s0017mdm.sys [114600 2008-10-21] (MCCI Corporation)
S3 s0017mgmt; C:\Windows\System32\DRIVERS\s0017mgmt.sys [108328 2008-10-21] (MCCI Corporation)
S3 s0017nd5; C:\Windows\System32\DRIVERS\s0017nd5.sys [26024 2008-10-21] (MCCI Corporation)
S3 s0017obex; C:\Windows\System32\DRIVERS\s0017obex.sys [104616 2008-10-21] (MCCI Corporation)
S3 s0017unic; C:\Windows\System32\DRIVERS\s0017unic.sys [109736 2008-10-21] (MCCI Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R2 TVALZFL; C:\Windows\System32\DRIVERS\TVALZFL.sys [12920 2009-03-21] (TOSHIBA Corporation)
R3 WinDriver6; C:\Windows\System32\drivers\windrvr6.sys [195424 2012-07-16] (Jungo)
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Uwe\AppData\Local\Temp\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-30 10:15 - 2014-09-30 10:15 - 01100288 _____ (Farbar) C:\Users\Uwe\Desktop\FRST.exe
2014-09-30 10:15 - 2014-09-30 10:15 - 00021726 _____ () C:\Users\Uwe\Desktop\FRST.txt
2014-09-30 10:15 - 2014-09-30 10:15 - 00000000 ____D () C:\Users\Uwe\Desktop\FRST-OlderVersion
2014-09-30 10:14 - 2014-09-30 10:14 - 00000368 _____ () C:\Windows\Tasks\RNUpgradeHelperLogonPrompt_Uwe.job
2014-09-30 10:14 - 2014-09-30 10:14 - 00000362 _____ () C:\Windows\Tasks\ReclaimerUpdateFiles_Uwe.job
2014-09-30 10:14 - 2014-09-30 10:14 - 00000358 _____ () C:\Windows\Tasks\ReclaimerUpdateXML_Uwe.job
2014-09-28 15:16 - 2014-09-28 15:17 - 02347384 _____ (ESET) C:\Users\Uwe\Downloads\esetsmartinstaller_deu.exe
2014-09-26 19:06 - 2014-09-26 19:06 - 00000000 ____D () C:\Windows\ERUNT
2014-09-26 18:43 - 2014-09-26 19:01 - 00000000 ____D () C:\AdwCleaner
2014-09-26 18:42 - 2014-09-26 18:42 - 01699118 _____ (Thisisu) C:\Users\Uwe\Downloads\JRT.exe
2014-09-26 18:42 - 2014-09-26 18:42 - 01373475 _____ () C:\Users\Uwe\Downloads\AdwCleaner_3.310.exe
2014-09-26 17:50 - 2014-09-29 11:37 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-09-26 17:50 - 2014-09-26 17:50 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-26 17:49 - 2014-09-26 17:49 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Uwe\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-25 20:53 - 2014-09-09 23:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-25 20:49 - 2014-09-25 20:49 - 00024413 _____ () C:\ComboFix.txt
2014-09-25 20:19 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-09-25 20:19 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-09-25 20:19 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-09-25 20:19 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-09-25 20:19 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-09-25 20:19 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-09-25 20:19 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-09-25 20:19 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-09-25 20:16 - 2014-09-25 20:49 - 00000000 ____D () C:\Qoobox
2014-09-25 20:16 - 2014-09-25 20:46 - 00000000 ____D () C:\Windows\erdnt
2014-09-25 20:04 - 2014-09-25 20:04 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Uwe\Downloads\revosetup95.exe
2014-09-25 20:04 - 2014-09-25 20:04 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-09-25 19:14 - 2014-09-25 19:14 - 00380416 _____ () C:\Users\Uwe\Downloads\Gmer-19357.exe
2014-09-25 19:07 - 2014-09-30 10:15 - 00000000 ____D () C:\FRST
2014-09-25 18:44 - 2014-09-25 18:45 - 03640880 _____ () C:\Users\Uwe\Downloads\avg_remover_zbot.exe
2014-09-25 18:43 - 2014-09-25 18:43 - 01100800 _____ (Farbar) C:\Users\Uwe\Downloads\FRST.exe
2014-09-25 18:28 - 2014-09-25 18:28 - 00122976 _____ (Kaspersky Lab ZAO) C:\Users\Uwe\Downloads\zbotkiller.exe
2014-09-25 18:27 - 2014-09-25 18:27 - 00000000 ___HD () C:\Windows\PIF
2014-09-25 17:58 - 2014-09-25 17:58 - 01101648 _____ () C:\Users\Uwe\Downloads\BitDefender ZBot Removal Tool - CHIP-Installer.exe
2014-09-22 17:16 - 2014-09-26 19:02 - 00035336 _____ () C:\Windows\PFRO.log
2014-09-22 01:00 - 2014-09-26 19:02 - 00032382 _____ () C:\Windows\setupact.log
2014-09-22 01:00 - 2014-09-22 01:00 - 00000000 _____ () C:\Windows\setuperr.log
2014-09-19 14:12 - 2014-09-25 18:42 - 00000000 ____D () C:\Users\Uwe\AppData\Roaming\Avambu
2014-09-14 10:55 - 2014-09-14 11:06 - 00000000 ____D () C:\Users\Uwe\AppData\Local\AviraSpeedup
2014-09-14 10:55 - 2014-09-14 10:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviraSpeedup
2014-09-14 10:53 - 2014-09-14 10:53 - 00001100 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-09-10 22:46 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-10 22:46 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-10 22:46 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-10 22:46 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-10 22:46 - 2014-08-18 23:57 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-10 22:46 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-10 22:46 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-10 22:46 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-10 22:46 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-10 22:46 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-10 22:46 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-10 22:46 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-10 22:46 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-10 22:46 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-10 22:46 - 2014-08-18 23:36 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-10 22:46 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-10 22:46 - 2014-08-18 23:30 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-10 22:46 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-10 22:46 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-10 22:46 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-10 22:46 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-10 22:46 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-10 22:46 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-10 22:46 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-10 22:46 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-10 22:46 - 2014-08-18 23:08 - 00673792 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-10 22:46 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-10 22:46 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-10 22:46 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-10 22:46 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-10 22:45 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-10 19:05 - 2014-07-07 03:40 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-10 19:05 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-10 19:04 - 2014-09-05 03:52 - 00445952 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-10 19:04 - 2014-09-05 03:47 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-10 19:04 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-10 19:04 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-10 18:44 - 2014-09-10 18:44 - 01054912 _____ (Adobe) C:\Users\Uwe\Downloads\install_flashplayer15x32au_mssd_aaa_aih.exe
2014-08-31 12:20 - 2014-08-31 12:28 - 00010565 _____ () C:\Users\Uwe\Documents\Materialliste FC WC 2014.08.31.xlsx
2014-08-31 12:09 - 2014-08-31 12:09 - 00029450 _____ () C:\Users\Uwe\Documents\Materialliste 2014.08.31.xlsx
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-30 10:14 - 2012-04-02 17:54 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-30 10:14 - 2010-03-06 20:17 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-30 06:59 - 2010-03-06 22:25 - 01297964 _____ () C:\Windows\WindowsUpdate.log
2014-09-30 06:59 - 2010-03-06 20:17 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-27 18:10 - 2010-12-19 17:06 - 00000686 _____ () C:\Users\Uwe\AppData\Roaming\wklnhst.dat
2014-09-27 18:10 - 2010-07-04 16:45 - 00000000 ____D () C:\Users\Uwe\Allerlei
2014-09-27 18:02 - 2012-05-04 19:55 - 00029696 ___SH () C:\Users\Uwe\Thumbs.db
2014-09-27 17:51 - 2011-11-18 19:03 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-09-27 16:41 - 2010-03-06 22:09 - 00019440 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-27 16:41 - 2010-03-06 22:09 - 00019440 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-26 19:02 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-26 18:37 - 2012-07-04 17:14 - 00000000 ____D () C:\Windows\pss
2014-09-26 15:34 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-09-26 03:00 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-09-25 20:49 - 2009-07-14 04:37 - 00000000 __RHD () C:\Users\Default
2014-09-25 20:49 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-09-25 20:40 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini
2014-09-25 20:39 - 2012-04-22 13:38 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-09-25 19:47 - 2014-05-11 18:24 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-09-25 18:29 - 2010-03-06 22:34 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-25 17:38 - 2012-04-02 17:54 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-09-25 17:38 - 2011-05-14 09:43 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-09-24 18:12 - 2012-01-29 12:20 - 00000000 ____D () C:\Users\Uwe\AppData\Local\Windows Live
2014-09-24 18:01 - 2010-03-07 12:17 - 00006656 _____ () C:\Users\Uwe\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-09-22 17:21 - 2011-06-19 01:25 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-09-22 17:20 - 2010-03-06 22:09 - 00000000 ____D () C:\Users\Uwe
2014-09-16 16:20 - 2012-09-03 16:28 - 00632656 _____ (Microsoft Corporation) C:\Windows\system32\msvcr80.dll
2014-09-16 16:20 - 2012-09-03 16:28 - 00554832 _____ (Microsoft Corporation) C:\Windows\system32\msvcp80.dll
2014-09-16 16:20 - 2012-09-03 16:28 - 00479232 _____ (Microsoft Corporation) C:\Windows\system32\msvcm80.dll
2014-09-16 16:20 - 2012-09-03 16:28 - 00001870 _____ () C:\Windows\system32\Microsoft.VC80.CRT.manifest
2014-09-16 16:20 - 2011-06-11 01:58 - 00421200 _____ (Microsoft Corporation) C:\Windows\system32\msvcp100.dll
2014-09-15 09:06 - 2013-11-19 18:44 - 00231568 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-09-14 13:57 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-09-14 11:06 - 2013-01-22 20:57 - 00000000 ____D () C:\Users\Uwe\AppData\Roaming\TeamViewer
2014-09-14 11:06 - 2012-04-28 16:37 - 00000000 ____D () C:\Windows\Minidump
2014-09-14 11:06 - 2010-03-13 17:02 - 00000000 ____D () C:\Windows\IP4000,3000
2014-09-14 11:06 - 2010-03-06 23:50 - 00000000 ____D () C:\Users\Uwe\AppData\Roaming\skypePM
2014-09-14 10:55 - 2012-11-04 13:16 - 00000000 ____D () C:\Program Files\Avira
2014-09-14 10:53 - 2014-08-04 12:19 - 00000000 ____D () C:\ProgramData\Package Cache
2014-09-14 10:53 - 2012-11-04 13:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-09-10 22:46 - 2009-06-09 11:35 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-09-10 22:45 - 2013-08-14 18:18 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-10 22:35 - 2014-05-06 17:45 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-10 22:35 - 2010-03-16 19:28 - 98758480 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
Some content of TEMP:
====================
C:\Users\Uwe\AppData\Local\temp\avgnt.exe
C:\Users\Uwe\AppData\Local\temp\Quarantine.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-09-26 00:02
==================== End Of Log ============================
|
|
01.10.2014, 07:38
| #11 |
| /// the machine /// TB-Ausbilder | Zbot.A.1193 eingefangen, lässt sich nicht löschen Alle Passwörter ändern. ESET Online Scanner
Downloade Dir bitte SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
Revo Uninstaller herunter.
dann auf 
und dann auf 
.
WARNUNG an die MITLESER: 
