| |
| |||||||
Log-Analyse und Auswertung: Es öffnen sich einach Fenster Win 7 FirefoxWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
06.10.2014, 09:57
| #1 |
| |  Es öffnen sich einach Fenster Win 7 Firefox Hallo Leute, mein Problem ist, daß sich einfach neue Fenster im Firefox öffnen auch wenn der Browser gar nicht gestartet ist. Ausserdem hab ich in meiner Taskleiste den Button von Browse Safe. Norton erkennt nichts und sagt alles sauber. Habe von Trend Micro den HouseCallLauncher drüber laufen lassen. Er hat ein paar Sachen entfernt aber das Problem besteht immer noch. Browse Safe ist auch noch da. Könnt ihr mir bitte helfen. Wollte den Defogger downloaden aber geht irgendwie nicht. zeigt mir dan im Downloadordner an :defogger_disable by jpshortstuff (23.02.10.1) Log created at 10:34 on 06/10/2014 (Ralph) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- Auch beim Download von Farbar Recovery Scan Tool FRST blockiert Norton den Download. Gmer hat funktioniert. Was mach ich jetzt? Mfg Ralph |
|
06.10.2014, 10:15
| #2 |
| /// TB-Ausbilder   | Es öffnen sich einach Fenster Win 7 Firefox Hallo offiziant
__________________ Mein Name ist Timo und ich werde Dir bei deinem Problem behilflich sein.
 Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist immer der sicherste Weg. Wir "arbeiten" hier alle freiwillig und in unserer Freizeit *hust*. Daher kann es bei Antworten zu Verzögerungen kommen. Solltest du innerhalb 48 Std keine Antwort von mir erhalten, dann schreib mit eine PM Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis ich oder jemand vom Team sagt, dass Du clean bist. Schalt Norton ab, lad FRST runter und scan !
__________________ |
|
06.10.2014, 11:30
| #3 |
| | Es öffnen sich einach Fenster Win 7 Firefox Users shortcut scan result (x86) Version: 06-10-2014
__________________Ran by Ralph at 2014-10-06 12:28:11 Running from C:\Users\Ralph\Downloads Boot Mode: Normal ==================== Shortcuts ============================= (The entries could be listed to be restored or removed.) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk -> C:\Windows\Installer\{AC76BA86-7AD7-1031-7B44-AB0000000001}\SC_Reader.ico () Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk -> C:\Windows\Installer\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}\AppleSoftwareUpdateIco.exe () Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk -> C:\Program Files\CDBurnerXP\cdbxpp.exe (Canneverbe Limited) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk -> C:\Windows\ehome\ehshell.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk -> C:\Program Files\Windows Live\Photo Gallery\MovieMaker.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk -> C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk -> C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk -> C:\Windows\System32\WindowsAnytimeUpgradeUI.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk -> C:\Program Files\DVD Maker\DVDMaker.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk -> C:\Windows\System32\WFS.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk -> C:\Program Files\Windows Live\Mail\wlmail.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk -> C:\Program Files\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk -> C:\Windows\System32\xpsrchvw.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live\Windows Live Family Safety.lnk -> C:\Windows\Installer\{84B11E58-A3BC-404F-AA08-23062374CBD2}\fssicon.ico () Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live\Windows Live Writer.lnk -> C:\Program Files\Windows Live\Writer\WindowsLiveWriter.exe (Microsoft Corp.) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\Documentation.lnk -> C:\Program Files\VideoLAN\VLC\Documentation.url () Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\Release Notes.lnk -> C:\Program Files\VideoLAN\VLC\NEWS.txt () Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VideoLAN Website.lnk -> C:\Program Files\VideoLAN\VLC\VideoLAN Website.url () Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VLC media player.lnk -> C:\Program Files\VideoLAN\VLC\vlc.exe (VideoLAN) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vertus Play With Pictures\Play With Pictures.lnk -> C:\Program Files\Vertus Play With Pictures\PlayWithPictures.exe (I.T.Lab) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UseNeXT\UseNeXT.lnk -> C:\Program Files\UseNeXT\UseNeXT.exe () Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ulead PhotoImpact 8\PhotoImpact 8.lnk -> C:\Program Files\Ulead Systems\Ulead PhotoImpact 8\Iedit.exe (Ulead Systems, Inc.) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ulead PhotoImpact 8\PhotoImpact Album 8.lnk -> C:\Program Files\Ulead Systems\Ulead PhotoImpact 8\Album.exe (Ulead Systems, Inc.) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ulead PhotoImpact 8\Ulead GIF Animator 5.lnk -> C:\Program Files\Ulead Systems\Ulead PhotoImpact 8\AnyGif\ga_main.exe (Ulead Systems, Inc.) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TomTom\TomTom HOME 2.lnk -> C:\Windows\Installer\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}\NewShortcut1_BB5D96B1D05B428EBAD4A437B7244768.exe (Flexera Software, Inc.) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SopCast\SopCast web site.lnk -> C:\Program Files\SopCast\SopCast web site.url (No File) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SopCast\Uninstall.lnk -> C:\Program Files\SopCast\uninst.exe (No File) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime\QuickTime - Bitte lesen.lnk -> C:\Windows\Installer\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}\RichText.ico () Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime\QuickTime Player.lnk -> C:\Windows\Installer\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}\QTPlayer.ico () Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.0.1\OpenOffice Base.lnk -> C:\Program Files\OpenOffice 4\program\sbase.exe (Apache Software Foundation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.0.1\OpenOffice Calc.lnk -> C:\Program Files\OpenOffice 4\program\scalc.exe (Apache Software Foundation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.0.1\OpenOffice Draw.lnk -> C:\Program Files\OpenOffice 4\program\sdraw.exe (Apache Software Foundation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.0.1\OpenOffice Impress.lnk -> C:\Program Files\OpenOffice 4\program\simpress.exe (Apache Software Foundation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.0.1\OpenOffice Math.lnk -> C:\Program Files\OpenOffice 4\program\smath.exe (Apache Software Foundation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.0.1\OpenOffice Writer.lnk -> C:\Program Files\OpenOffice 4\program\swriter.exe (Apache Software Foundation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.0.1\OpenOffice.lnk -> C:\Program Files\OpenOffice 4\program\soffice.exe (Apache Software Foundation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation\GeForce Experience.lnk -> C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\GFExperience.exe (NVIDIA) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation\3D Vision\3D Vision Photo Viewer.lnk -> C:\Program Files\NVIDIA Corporation\3D Vision\nvstview.exe (NVIDIA Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360\Norton 360.lnk -> C:\Program Files\Norton 360\Engine\21.6.0.32\uistub.exe (Symantec Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight\Microsoft Silverlight.lnk -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\Silverlight.Configuration.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Create Recovery Disc.lnk -> C:\Windows\System32\recdisc.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Remote Assistance.lnk -> C:\Windows\System32\msra.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Configure Java.lnk -> C:\Program Files\Java\jre7\bin\javacpl.exe (Oracle Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes\iTunes.lnk -> C:\Program Files\iTunes\iTunes.exe (Apple Inc.) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes\Über iTunes.lnk -> C:\Program Files\iTunes\iTunes.Resources\de.lproj\About iTunes.rtf () Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IncrediMail\IncrediMail Gallery.lnk -> C:\Program Files\IncrediMail\Bin\IncrediGalleryStart.url () Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IncrediMail\IncrediMail.lnk -> C:\Program Files\IncrediMail\Bin\IncMail.exe (IncrediMail, Ltd.) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IncrediMail\Letter Creator.lnk -> C:\Program Files\IncrediMail\Bin\ImLc.exe (IncrediMail, Ltd.) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud\iCloud-Fotos.lnk -> C:\Program Files\Common Files\Apple\Internet Services\ShellStreamsShortcut.exe (Apple Inc.) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud\iCloud.lnk -> C:\Program Files\Common Files\Apple\Internet Services\iCloud.exe (Apple Inc.) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth\Google Earth.lnk -> C:\Program Files\Google\Google Earth\client\googleearth.exe (Google) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\More Games.lnk -> C:\Program Files\IncrediMail\Bin\IncrediGamesStart.url () Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FREESOFTTODAY\Freesofttoday.lnk -> C:\Program Files\fst_de_103\freeSoftToday_widget.exe (No File) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON Scan\EPSON Scan.lnk -> C:\Windows\twain_32\escndv\escndv.exe (SEIKO EPSON CORP.) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON Creativity Suite\EPSON Easy Photo Print.lnk -> C:\Program Files\epson\Creativity Suite\Easy Photo Print\EEasyPhotoPrint.exe (SEIKO EPSON CORPORATION) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON Creativity Suite\EPSON File Manager.lnk -> C:\Program Files\epson\Creativity Suite\File Manager\EFileManager.exe (SEIKO EPSON CORPORATION) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON Creativity Suite\Scan Assistant\Scan Assistant.lnk -> C:\Program Files\epson\Creativity Suite\Scan Assistant\EScanAssist.exe () Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON Creativity Suite\File Manager\EPSON File Manager.lnk -> C:\Program Files\epson\Creativity Suite\File Manager\EFileManager.exe (SEIKO EPSON CORPORATION) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON Creativity Suite\File Manager\Liesmich.lnk -> C:\Program Files\epson\Creativity Suite\File Manager\DspReadMe.exe (SEIKO EPSON CORPORATION) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON Creativity Suite\Easy Photo Print\EPSON Easy Photo Print.lnk -> C:\Program Files\epson\Creativity Suite\Easy Photo Print\EEasyPhotoPrint.exe (SEIKO EPSON CORPORATION) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON Creativity Suite\Easy Photo Print\Liesmich.lnk -> C:\Program Files\epson\Creativity Suite\Easy Photo Print\DspReadMe.exe (SEIKO EPSON CORPORATION) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON Creativity Suite\Attach To Email\EPSON Attach To Email.lnk -> C:\Program Files\epson\Creativity Suite\Attach To Email\AttachToEmail.exe (SEIKO EPSON Corp.) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON Creativity Suite\Attach To Email\Read Me.lnk -> C:\Program Files\epson\Creativity Suite\Attach To Email\DspReadMe.exe (SEIKO EPSON CORPORATION) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON\CX4300_5500_DX4400 Handbuch.lnk -> C:\Program Files\epson\Creativity Suite\INDEX.HTM () Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Deluxe Pacman\Deluxe Pacman.lnk -> C:\Users\Ralph\Deluxe Pacman\Deluxe_Pacman.exe (No File) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Deluxe Pacman\Level Editor.lnk -> C:\Users\Ralph\Deluxe Pacman\PACEdit.exe (No File) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Deluxe Pacman\Uninstall.lnk -> C:\Users\Ralph\Deluxe Pacman\unins000.exe (No File) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Deluxe Pacman\Documentation\Journal.lnk -> C:\Users\Ralph\Deluxe Pacman\docs\journal.txt (No File) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Deluxe Pacman\Documentation\Licence.lnk -> C:\Users\Ralph\Deluxe Pacman\docs\license.txt (No File) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Deluxe Pacman\Documentation\Manual.lnk -> C:\Users\Ralph\Deluxe Pacman\docs\manual.txt (No File) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Deluxe Pacman\Documentation\Old Log.lnk -> C:\Users\Ralph\Deluxe Pacman\docs\old log.txt (No File) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Deluxe Pacman\Documentation\Troubleshooting.lnk -> C:\Users\Ralph\Deluxe Pacman\docs\troubleshooting.txt (No File) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner\CCleaner.lnk -> C:\Program Files\CCleaner\CCleaner.exe (Piriform Ltd) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre - E-book Management\calibre - E-book management.lnk -> C:\Program Files\Calibre2\calibre.exe () Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre - E-book Management\E-book viewer.lnk -> C:\Program Files\Calibre2\ebook-viewer.exe () Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre - E-book Management\Edit E-book.lnk -> C:\Program Files\Calibre2\ebook-edit.exe () Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre - E-book Management\LRF viewer.lnk -> C:\Program Files\Calibre2\lrfviewer.exe () Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Component Services.lnk -> C:\Windows\System32\comexp.msc () Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Data Sources (ODBC).lnk -> C:\Windows\System32\odbcad32.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\iSCSI Initiator.lnk -> C:\Windows\System32\iscsicpl.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Memory Diagnostics Tool.lnk -> C:\Windows\System32\MdSched.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Print Management.lnk -> C:\Windows\System32\printmanagement.msc () Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk -> C:\Windows\System32\services.msc () Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration.lnk -> C:\Windows\System32\msconfig.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Windows Firewall with Advanced Security.lnk -> C:\Windows\System32\WF.msc () Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Calculator.lnk -> C:\Windows\System32\calc.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\displayswitch.lnk -> C:\Windows\System32\displayswitch.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Math Input Panel.lnk -> C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\NetworkProjection.lnk -> C:\Windows\System32\NetProj.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk -> C:\Windows\System32\mspaint.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Remote Desktop Connection.lnk -> C:\Windows\System32\mstsc.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Snipping Tool.lnk -> C:\Windows\System32\SnippingTool.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sound Recorder.lnk -> C:\Windows\System32\SoundRecorder.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sticky Notes.lnk -> C:\Windows\System32\StikyNot.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sync Center.lnk -> C:\Windows\System32\mobsync.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Wordpad.lnk -> C:\Program Files\Windows NT\Accessories\wordpad.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell ISE.lnk -> C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell_ISE.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk -> C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\ShapeCollector.lnk -> C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\TabTip.lnk -> C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Windows Journal.lnk -> C:\Program Files\Windows Journal\Journal.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Character Map.lnk -> C:\Windows\System32\charmap.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\dfrgui.lnk -> C:\Windows\System32\dfrgui.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Disk Cleanup.lnk -> C:\Windows\System32\cleanmgr.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\System Information.lnk -> C:\Windows\System32\msinfo32.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\System Restore.lnk -> C:\Windows\System32\rstrui.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Windows Easy Transfer Reports.lnk -> C:\Windows\System32\migwiz\PostMig.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Windows Easy Transfer.lnk -> C:\Windows\System32\migwiz\migwiz.exe (Microsoft Corporation) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip File Manager.lnk -> C:\Program Files\7-Zip\7zFM.exe (Igor Pavlov) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip Help.lnk -> C:\Program Files\7-Zip\7-zip.chm () Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Command Prompt.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation) Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk -> C:\Windows\System32\notepad.exe (Microsoft Corporation) Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk -> C:\Windows\explorer.exe (Microsoft Corporation) Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Private Character Editor.lnk -> C:\Windows\System32\eudcedit.exe (Microsoft Corporation) Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Magnify.lnk -> C:\Windows\System32\Magnify.exe (Microsoft Corporation) Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk -> C:\Windows\System32\Narrator.exe (Microsoft Corporation) Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk -> C:\Windows\System32\osk.exe (Microsoft Corporation) Shortcut: C:\Users\Eileen\Links\Desktop.lnk -> C:\Users\Ralph\Desktop () Shortcut: C:\Users\Eileen\Links\Downloads.lnk -> C:\Users\Ralph\Downloads () Shortcut: C:\Users\Eileen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) Shortcut: C:\Users\Eileen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Command Prompt.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation) Shortcut: C:\Users\Eileen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk -> C:\Windows\System32\notepad.exe (Microsoft Corporation) Shortcut: C:\Users\Eileen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk -> C:\Windows\explorer.exe (Microsoft Corporation) Shortcut: C:\Users\Eileen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Private Character Editor.lnk -> C:\Windows\System32\eudcedit.exe (Microsoft Corporation) Shortcut: C:\Users\Eileen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Magnify.lnk -> C:\Windows\System32\Magnify.exe (Microsoft Corporation) Shortcut: C:\Users\Eileen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk -> C:\Windows\System32\Narrator.exe (Microsoft Corporation) Shortcut: C:\Users\Eileen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk -> C:\Windows\System32\osk.exe (Microsoft Corporation) Shortcut: C:\Users\Eileen\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) Shortcut: C:\Users\Eileen\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) Shortcut: C:\Users\Eileen\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk -> C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) Shortcut: C:\Users\Eileen\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk -> C:\Windows\explorer.exe (Microsoft Corporation) Shortcut: C:\Users\Public\Desktop\Adobe Digital Editions.lnk -> C:\Program Files\Adobe\Adobe Digital Editions\digitaleditions.exe (Adobe Systems, Inc.) Shortcut: C:\Users\Public\Desktop\calibre - E-book management.lnk -> C:\Program Files\Calibre2\calibre.exe () Shortcut: C:\Users\Public\Desktop\CCleaner.lnk -> C:\Program Files\CCleaner\CCleaner.exe (Piriform Ltd) Shortcut: C:\Users\Public\Desktop\CDBurnerXP.lnk -> C:\Program Files\CDBurnerXP\cdbxpp.exe (Canneverbe Limited) Shortcut: C:\Users\Public\Desktop\EPSON File Manager.lnk -> C:\Program Files\epson\Creativity Suite\File Manager\EFileManager.exe (SEIKO EPSON CORPORATION) Shortcut: C:\Users\Public\Desktop\Google Earth.lnk -> C:\Program Files\Google\Google Earth\client\googleearth.exe (Google) Shortcut: C:\Users\Public\Desktop\iTunes.lnk -> C:\Program Files\iTunes\iTunes.exe (Apple Inc.) Shortcut: C:\Users\Public\Desktop\Mozilla Firefox.lnk -> C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) Shortcut: C:\Users\Public\Desktop\Norton 360.lnk -> C:\Program Files\Norton 360\Engine\21.6.0.32\uistub.exe (Symantec Corporation) Shortcut: C:\Users\Public\Desktop\OpenOffice 4.0.1.lnk -> C:\Program Files\OpenOffice 4\program\soffice.exe (Apache Software Foundation) Shortcut: C:\Users\Public\Desktop\PhotoImpact 8.lnk -> C:\Program Files\Ulead Systems\Ulead PhotoImpact 8\Iedit.exe (Ulead Systems, Inc.) Shortcut: C:\Users\Public\Desktop\PhotoImpact Album 8.lnk -> C:\Program Files\Ulead Systems\Ulead PhotoImpact 8\Album.exe (Ulead Systems, Inc.) Shortcut: C:\Users\Public\Desktop\QuickTime Player.lnk -> C:\Program Files\QuickTime\QuickTimePlayer.exe (Apple Inc.) Shortcut: C:\Users\Public\Desktop\VLC media player.lnk -> C:\Program Files\VideoLAN\VLC\vlc.exe (VideoLAN) Shortcut: C:\Users\Ralph\Links\CnMemory (F  .lnk -> E:\ (No File)Shortcut: C:\Users\Ralph\Links\Desktop.lnk -> C:\Users\Ralph\Desktop () Shortcut: C:\Users\Ralph\Links\Downloads.lnk -> C:\Users\Ralph\Downloads () Shortcut: C:\Users\Ralph\Desktop\CopyTransManager - Verknüpfung.lnk -> C:\Users\Ralph\Documents\CopyTransManagerDEv0.995\CopyTransManager.exe (WindSolutions) Shortcut: C:\Users\Ralph\Desktop\Format Factory.lnk -> C:\Program Files\FreeTime\FormatFactory\FormatFactory.exe (Free Time) Shortcut: C:\Users\Ralph\Desktop\Norton-Installationsdateien.lnk -> C:\Users\Public\Downloads\Norton\{N360P211018-SHPD-FSD40014} () Shortcut: C:\Users\Ralph\Desktop\OpenOffice 4.0.1 - Verknüpfung.lnk -> C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.0.1 () Shortcut: C:\Users\Ralph\Desktop\Spotify.lnk -> C:\Users\Ralph\AppData\Roaming\Spotify\spotify.exe (Spotify Ltd) Shortcut: C:\Users\Ralph\Desktop\UseNeXT.lnk -> C:\Program Files\UseNeXT\UseNeXT.exe () Shortcut: C:\Users\Ralph\Desktop\Video Converter.lnk -> C:\Program Files\VideoConverter\VideoConverter.exe () Shortcut: C:\Users\Ralph\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk -> C:\Users\Ralph\AppData\Roaming\Spotify\spotify.exe (Spotify Ltd) Shortcut: C:\Users\Ralph\AppData\Roaming\Microsoft\Windows\SendTo\Format Factory.lnk -> C:\Program Files\FreeTime\FormatFactory\FormatFactory.exe (Free Time) Shortcut: C:\Users\Ralph\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\IncrediMail 2.0.lnk -> C:\Program Files\IncrediMail\Bin\IncMail.exe (IncrediMail, Ltd.) Shortcut: C:\Users\Ralph\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) Shortcut: C:\Users\Ralph\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Video Converter.lnk -> C:\Program Files\VideoConverter\VideoConverter.exe () Shortcut: C:\Users\Ralph\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\IncrediMail.lnk -> C:\Program Files\IncrediMail\Bin\IncMail.exe (IncrediMail, Ltd.) Shortcut: C:\Users\Ralph\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk -> C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) Shortcut: C:\Users\Ralph\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk -> C:\Windows\explorer.exe (Microsoft Corporation) Shortcut: C:\Users\Ralph\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\7e4dca80246863e3\pinned.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.DefaultPrograms ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk -> C:\Windows\System32\wuapp.exe (Microsoft Corporation) -> startmenu ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk -> C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation) -> /showgadgets ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk -> C:\Program Files\Windows Media Player\wmplayer.exe (Microsoft Corporation) -> /prefetch:1 ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Mobile Device Center.lnk -> C:\Windows\Installer\{904CCF62-818D-4675-BC76-D37EB399F917}\wmdc.exe (Microsoft Corporation) -> /show ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VLC media player - reset preferences and cache files.lnk -> C:\Program Files\VideoLAN\VLC\vlc.exe (VideoLAN) -> --reset-config --reset-plugins-cache vlc://quit ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VLC media player skinned.lnk -> C:\Program Files\VideoLAN\VLC\vlc.exe (VideoLAN) -> -Iskins ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TomTom\Entfernen TomTom HOME 2.lnk -> C:\Windows\System32\msiexec.exe (Microsoft Corporation) -> /x {7A2BB1C8-903D-4585-9F3B-CADD67D07D37} ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime\QuickTime deinstallieren.lnk -> C:\Windows\System32\msiexec.exe (Microsoft Corporation) -> /i {111EE7DF-FC45-40C7-98A7-753AC46B12FB} /qf ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation\3D Vision\3D Vision preview pack 1.lnk -> C:\Program Files\NVIDIA Corporation\3D Vision\nvstlink.exe (NVIDIA Corporation) -> /show ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation\3D Vision\Disable 3D Vision Discover.lnk -> C:\Program Files\NVIDIA Corporation\3D Vision\nvstlink.exe (NVIDIA Corporation) -> /disable ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation\3D Vision\Enable 3D Vision Discover.lnk -> C:\Program Files\NVIDIA Corporation\3D Vision\nvstlink.exe (NVIDIA Corporation) -> /enable ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360\LiveUpdate.lnk -> C:\Program Files\Norton 360\Engine\21.6.0.32\uistub.exe (Symantec Corporation) -> /lu ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360\Support.lnk -> C:\Program Files\Norton 360\Engine\21.6.0.32\symerr.exe (Symantec Corporation) -> /support ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360\Uninstall Norton 360.lnk -> C:\Program Files\NortonInstaller\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360\562C4DD5\21.6.0.32\inststub.exe (Symantec Corporation) -> /X /shortcut ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Backup and Restore Center.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.BackupAndRestore ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\About Java.lnk -> C:\Program Files\Java\jre7\bin\javacpl.exe (Oracle Corporation) -> -tab about ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Check For Updates.lnk -> C:\Program Files\Java\jre7\bin\javacpl.exe (Oracle Corporation) -> -tab update ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IncrediMail\Photo Animation Creator.lnk -> C:\Program Files\Photo Notifier and Animation Creator\Application\Bin\pnac.exe () -> /animationcreator ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IncrediMail\Photo Notifier Creator.lnk -> C:\Program Files\Photo Notifier and Animation Creator\Application\Bin\pnac.exe () -> /notifiercreator ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IncrediMail\Uninstall IncrediMail.lnk -> C:\Program Files\IncrediMail\Bin\ImSetup.exe () -> /uninstallProduct /addon:incredimail ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud\E-Mails.lnk -> C:\Program Files\Common Files\Apple\Internet Services\iCloudWeb.exe (Apple Inc.) -> mail ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud\Erinnerungen.lnk -> C:\Program Files\Common Files\Apple\Internet Services\iCloudWeb.exe (Apple Inc.) -> reminders ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud\iPhone suchen.lnk -> C:\Program Files\Common Files\Apple\Internet Services\iCloudWeb.exe (Apple Inc.) -> find ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud\Kalender.lnk -> C:\Program Files\Common Files\Apple\Internet Services\iCloudWeb.exe (Apple Inc.) -> calendar ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud\Kontakte.lnk -> C:\Program Files\Common Files\Apple\Internet Services\iCloudWeb.exe (Apple Inc.) -> contacts ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud\Notizen.lnk -> C:\Program Files\Common Files\Apple\Internet Services\iCloudWeb.exe (Apple Inc.) -> notes ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth\Google Earth deinstallieren.lnk -> C:\Windows\System32\msiexec.exe (Microsoft Corporation) -> /x {4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E} ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth\Google Earth im DirectX-Modus starten.lnk -> C:\Program Files\Google\Google Earth\client\googleearth.exe (Google) -> -setDX ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth\Google Earth im OpenGL-Modus starten.lnk -> C:\Program Files\Google\Google Earth\client\googleearth.exe (Google) -> -setOGL ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON Creativity Suite\File Manager\EPSON File Manager Deinstallation.lnk -> C:\Windows\System32\rundll32.exe (Microsoft Corporation) -> C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2EB81825-E9EE-44F4-8F51-1240C3898DC6}\Setup.exe" -l0x7 UNINST ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON Creativity Suite\Easy Photo Print\EPSON Easy Photo Print Deinstallation.lnk -> C:\Windows\System32\rundll32.exe (Microsoft Corporation) -> C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B66E665A-DF96-4C38-9422-C7F74BC1B4E5}\SETUP.EXE" -l0x7 UNINST ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON Creativity Suite\Attach To Email\Uninstall EPSON Attach To Email.lnk -> C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe () -> /M{20C45B32-5AB6-46A4-94EF-58950CAF05E5} /x ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON\EPSON Stylus DX4400 Series Technischer Support.lnk -> C:\Windows\System32\rundll32.exe (Microsoft Corporation) -> .\SPOOL\DRIVERS\W32X86\3\E_FGEPCAE.DLL,GE_OpenELINK "Stylus DX4400" ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON\EPSON Stylus DX4400 Series Treiberaktualisierung.lnk -> C:\Windows\System32\spool\drivers\w32x86\3\E_DUPA20.EXE (SEIKO EPSON CORP.) -> /P "EPSON Stylus DX4400 Series" /R E_DUPA2E.DLL ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON\EPSON-Druckersoftware deinstallieren.lnk -> C:\Windows\System32\spool\drivers\w32x86\3\EPUPDATE.EXE (SEIKO EPSON CORPORATION) -> /R ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Computer Management.lnk -> C:\Windows\System32\compmgmt.msc () -> /s ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Event Viewer.lnk -> C:\Windows\System32\eventvwr.msc () -> /s ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Performance Monitor.lnk -> C:\Windows\System32\perfmon.msc () -> /s ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Security Configuration Management.lnk -> C:\Windows\System32\secpol.msc () -> /s ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Task Scheduler.lnk -> C:\Windows\System32\taskschd.msc () -> /s ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Windows PowerShell Modules.lnk -> C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (Microsoft Corporation) -> -NoExit -ImportSystemModules ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Mobility Center.lnk -> C:\Windows\System32\mblctr.exe (Microsoft Corporation) -> /open ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Welcome Center.lnk -> C:\Windows\System32\rundll32.exe (Microsoft Corporation) -> %SystemRoot%\system32\OobeFldr.dll,ShowWelcomeCenter LaunchedBy_StartMenuShortcut ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Resource Monitor.lnk -> C:\Windows\System32\perfmon.exe (Microsoft Corporation) -> /res ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Task Scheduler.lnk -> C:\Windows\System32\taskschd.msc () -> /s ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Speech Recognition.lnk -> C:\Windows\Speech\Common\sapisvr.exe (Microsoft Corporation) -> -SpeechUX ShortcutWithArgument: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Ease of Access.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.EaseOfAccessCenter ShortcutWithArgument: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk -> C:\Windows\System32\WFS.exe (Microsoft Corporation) -> /SendTo ShortcutWithArgument: C:\Users\Eileen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -extoff ShortcutWithArgument: C:\Users\Eileen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Ease of Access.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.EaseOfAccessCenter ShortcutWithArgument: C:\Users\Eileen\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk -> C:\Windows\System32\WFS.exe (Microsoft Corporation) -> /SendTo ShortcutWithArgument: C:\Users\Eileen\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Media Player.lnk -> C:\Program Files\Windows Media Player\wmplayer.exe (Microsoft Corporation) -> /prefetch:1 ShortcutWithArgument: C:\Users\Ralph\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk -> C:\Windows\System32\WFS.exe (Microsoft Corporation) -> /SendTo InternetURL: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Deluxe Pacman\Deluxe Pacman website.url -> hxxp://home.cogeco.ca/~nroy15/games_index.html InternetURL: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner\CCleaner Homepage.url -> hxxp://www.piriform.com/ccleaner InternetURL: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre - E-book Management\Get Involved.url -> hxxp://calibre-ebook.com/get-involved InternetURL: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre - E-book Management\User Manual.url -> hxxp://manual.calibre-ebook.com/ InternetURL: C:\Users\Eileen\Favorites\Links\Vorgeschlagene Sites.url -> https://ieonline.microsoft.com/#ieslice InternetURL: C:\Users\Eileen\Favorites\Links\Web Slice-Katalog.url -> hxxp://go.microsoft.com/fwlink/?LinkId=121315 InternetURL: C:\Users\Ralph\Favorites\Windows Live\Windows Live Gallery.url -> hxxp://go.microsoft.com/fwlink/?LinkId=70742 InternetURL: C:\Users\Ralph\Favorites\Windows Live\Windows Live Ideas.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72700 InternetURL: C:\Users\Ralph\Favorites\Windows Live\Windows Live Mail.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72681 InternetURL: C:\Users\Ralph\Favorites\Windows Live\Windows Live Spaces.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72682 InternetURL: C:\Users\Ralph\Favorites\MSN-Websites\MSN Auto.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72680 InternetURL: C:\Users\Ralph\Favorites\MSN-Websites\MSN Fernsehen.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72659 InternetURL: C:\Users\Ralph\Favorites\MSN-Websites\MSN Money.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72640 InternetURL: C:\Users\Ralph\Favorites\MSN-Websites\MSN Nachrichten.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72636 InternetURL: C:\Users\Ralph\Favorites\MSN-Websites\MSN Sport.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72635 InternetURL: C:\Users\Ralph\Favorites\MSN-Websites\MSN.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72630 InternetURL: C:\Users\Ralph\Favorites\Microsoft-Websites\IE-Site auf Microsoft.com.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72186 InternetURL: C:\Users\Ralph\Favorites\Microsoft-Websites\Microsoft Deutschland GmbH.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72520 InternetURL: C:\Users\Ralph\Favorites\Microsoft-Websites\Microsoft Store.url -> hxxp://go.microsoft.com/fwlink/?linkid=140813 InternetURL: C:\Users\Ralph\Favorites\Microsoft-Websites\Microsoft Windows - Start.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72629 InternetURL: C:\Users\Ralph\Favorites\Microsoft-Websites\Microsoft zu Hause.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72406 InternetURL: C:\Users\Ralph\Favorites\Microsoft-Websites\Microsoft.com durchsuchen.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72893 InternetURL: C:\Users\Ralph\Favorites\Microsoft-Websites\Site für IE Add-Ons.url -> hxxp://go.microsoft.com/fwlink/?LinkId=50893 InternetURL: C:\Users\Ralph\Favorites\Links\Vorgeschlagene Sites (2).url -> https://ieonline.microsoft.com/#ieslice InternetURL: C:\Users\Ralph\Favorites\Links\Vorgeschlagene Sites.url -> 0 ==================== End of log ============================= Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Norton 360 Premier Edition (Disabled - Up to date) {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB} AS: Norton 360 Premier Edition (Enabled - Up to date) {631E4324-D31C-783F-EC5C-35AD42B18466} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FW: Norton 360 Premier Edition (Enabled) {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) 7-Zip 9.20 (HKLM\...\7-Zip) (Version: - ) Adobe Digital Editions (HKLM\...\Digital Editions) (Version: - ) Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated) Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated) Adobe Reader XI (11.0.09) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated) Adobe Shockwave Player 12.1 (HKLM\...\Adobe Shockwave Player) (Version: 12.1.0.150 - Adobe Systems, Inc.) Amazon 1Button App (HKLM\...\Amazon Browser Settings) (Version: 3.0 - Amazon) Apple Application Support (HKLM\...\{D9DAD0FF-495A-472B-9F10-BAE430A26682}) (Version: 3.0.3 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{18D47FA1-0440-48D3-A7E0-DA09537FF471}) (Version: 7.1.1.3 - Apple Inc.) Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.) calibre (HKLM\...\{DD649DA2-BBD9-4247-85DD-E04F7C1E8552}) (Version: 1.48.0 - Kovid Goyal) Camera RAW Plug-In for EPSON Creativity Suite (HKLM\...\{8DAC1AE4-33D1-4A78-8A42-00E09EDECC3E}) (Version: 2.1.0.0 - ) CCleaner (HKLM\...\CCleaner) (Version: 4.15 - Piriform) CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.4852 - CDBurnerXP) CX4300_5500_DX4400 Handbuch (HKLM\...\CX4300_5500_DX4400 Handbuch) (Version: - ) D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden EPSON Attach To Email (HKLM\...\InstallShield_{20C45B32-5AB6-46A4-94EF-58950CAF05E5}) (Version: 1.01.0000 - SEIKO EPSON) EPSON Attach To Email (Version: 1.01.0000 - SEIKO EPSON) Hidden EPSON Easy Photo Print (HKLM\...\{B66E665A-DF96-4C38-9422-C7F74BC1B4E5}) (Version: 1.4.2.0 - ) EPSON File Manager (HKLM\...\{2EB81825-E9EE-44F4-8F51-1240C3898DC6}) (Version: 1.3.0.0 - ) EPSON Scan (HKLM\...\EPSON Scanner) (Version: - ) EPSON Scan Assistant (HKLM\...\{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}) (Version: 1.10.00 - ) EPSON-Drucker-Software (HKLM\...\EPSON Printer and Utilities) (Version: - SEIKO EPSON Corporation) FormatFactory 3.2.1.0 (HKLM\...\FormatFactory) (Version: 3.2.1.0 - Free Time) Fotogalerie (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden FreeSoftToday 014.103 (HKLM\...\fst_de_103_is1) (Version: - FREESOFTTODAY) <==== ATTENTION FreeSoftToday 014.173 (HKLM\...\fst_de_173_is1) (Version: - FREESOFTTODAY) <==== ATTENTION FreeSoftToday 014.187 (HKLM\...\fst_de_187_is1) (Version: - FREESOFTTODAY) <==== ATTENTION GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google) Google+ Auto Backup (HKLM\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google) iCloud (HKLM\...\{00A61104-74B5-4056-AD00-4397EF4FB141}) (Version: 3.1.0.40 - Apple Inc.) IncrediMail (Version: 6.6.0.5288 - IncrediMail) Hidden IncrediMail 2.5 (HKLM\...\IncrediMail) (Version: 6.6.0.5288 - IncrediMail Ltd.) iTunes (HKLM\...\{A9B3F8D5-DF4F-462B-81B7-4B69EBEDBC5B}) (Version: 11.2.0.115 - Apple Inc.) Java 7 Update 51 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.510 - Oracle) Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden Junk Mail filter update (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden LPT System Updater Service (Version: 1.0.0.0 - LPT) Hidden <==== ATTENTION Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation) Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden Microsoft .NET Framework 4 Extended DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Extended DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation) Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation) Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden Movie Maker (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden Mozilla Firefox 32.0.3 (x86 de) (HKLM\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla) Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 32.0.3 - Mozilla) MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden MSVCRT110 (Version: 16.4.1108.0727 - Microsoft) Hidden Norton 360 (HKLM\...\N360) (Version: 21.6.0.32 - Symantec Corporation) NVIDIA 3D Vision Controller-Treiber 331.82 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 331.82 - NVIDIA Corporation) NVIDIA 3D Vision Treiber 331.82 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 331.82 - NVIDIA Corporation) NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 6.14.11.9713 - NVIDIA Corporation) NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.57.35 - NVIDIA Corporation) NVIDIA GeForce Experience 1.8.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.1 - NVIDIA Corporation) NVIDIA Grafiktreiber 331.82 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 331.82 - NVIDIA Corporation) NVIDIA HD-Audiotreiber 1.3.26.4 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.26.4 - NVIDIA Corporation) NVIDIA Install Application (Version: 2.1002.142.992 - NVIDIA Corporation) Hidden NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden NVIDIA PhysX (Version: 9.13.0725 - NVIDIA Corporation) Hidden NVIDIA PhysX-Systemsoftware 9.13.0725 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0725 - NVIDIA Corporation) NVIDIA ShadowPlay 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden NVIDIA Stereoscopic 3D Driver (HKLM\...\NVIDIAStereo) (Version: 7.17.11.9713 - NVIDIA Corporation) NVIDIA Systemsteuerung 331.82 (Version: 331.82 - NVIDIA Corporation) Hidden NVIDIA Update 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden NVIDIA Update Core (Version: 10.11.15 - NVIDIA Corporation) Hidden NVIDIA Virtual Audio 1.2.19 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.19 - NVIDIA Corporation) OpenOffice 4.0.1 (HKLM\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation) Photo Gallery (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden Photo Notifier and Animation Creator (HKLM\...\Photo Notifier and Animation Creator) (Version: 1.0.0.1009 - IncrediMail Ltd.) Photo Notifier and Animation Creator (Version: 1.0.0.1009 - Ihr Firmenname) Hidden QuickTime 7 (HKLM\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.) SHIELD Streaming (Version: 1.6.85 - NVIDIA Corporation) Hidden Spotify (HKCU\...\Spotify) (Version: 0.9.13.24.g5dbb3103 - Spotify AB) swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden TomTom HOME (HKLM\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname) TomTom HOME Visual Studio Merge Modules (HKLM\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.) TrekStor eReaderSuite (HKLM\...\eReaderSuite) (Version: - TrekStor GmbH) Ulead PhotoImpact 8 (HKLM\...\InstallShield_{F101C58C-15CC-42B3-83D1-536CFB960634}) (Version: 8.0 - Ulead System) Ulead PhotoImpact 8 (Version: 8.0 - Ulead System) Hidden Update for Video Converter (HKCU\...\Digital Sites) (Version: - Update for Video Converter) <==== ATTENTION UseNeXT (HKLM\...\UseNeXT_is1) (Version: - Tangysoft Ltd.) UseNeXT by Tangysoft (HKLM\...\UseNeXT by Tangysoft_is1) (Version: - Tangysoft Ltd.) Vertus Play With Pictures 1.1.4 (HKLM\...\VertusPlayWithPictures) (Version: 1.1.4 - ) Video Converter (HKCU\...\Video Converter) (Version: - ) Video Converter Packages (HKCU\...\Video Converter Packages) (Version: - ) <==== ATTENTION Visual Studio C++ 10.0 Runtime (HKLM\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.) VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN) Windows Live Communications Platform (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 16.4.3522.0110 - Microsoft Corporation) Windows Live Essentials (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden Windows Live Family Safety (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden Windows Live Installer (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden Windows Live Mail (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden Windows Live Messenger (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden Windows Live MIME IFilter (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden Windows Live Photo Common (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden Windows Live PIMT Platform (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden Windows Live SOXE (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden Windows Live SOXE Definitions (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden Windows Live UX Platform (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden Windows Live UX Platform Language Pack (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden Windows Live Writer (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden Windows Live Writer Resources (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden Windows Mobile Device Center Driver Update (HKLM\...\{E7044E25-3038-4A76-9064-344AC038043E}) (Version: 6.1.6965.0 - Microsoft Corporation) Windows Mobile-Gerätecenter (HKLM\...\{904CCF62-818D-4675-BC76-D37EB399F917}) (Version: 6.1.6965.0 - Microsoft Corporation) Windows XP Mode (HKLM\...\{1374CC63-B520-4f3f-98E8-E9020BF01CFF}) (Version: 1.3.7600.16432 - Microsoft Corporation) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) ==================== Restore Points ========================= 28-09-2014 06:12:00 Windows Update 28-09-2014 17:00:22 Windows-Sicherung 03-10-2014 13:46:09 Windows Update 04-10-2014 13:26:43 Installed SpyHunter 04-10-2014 16:42:12 Removed SpyHunter 04-10-2014 17:13:15 Norton_Power_Eraser_20141004191311961 04-10-2014 21:52:31 Installed STOPzilla 04-10-2014 22:35:22 Removed STOPzilla 06-10-2014 03:12:55 Windows-Sicherung ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-14 04:04 - 2014-10-04 23:54 - 00000860 ____A C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 localhost ::1 localhost ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {34005F63-1FA4-4FA6-9A58-6338B332F357} - System32\Tasks\bench-sys => C:\Program Files\Bench\Updater\updater.exe [2014-08-20] () <==== ATTENTION Task: {56FAB2BD-B5D2-4E2D-B5AD-3492A197C665} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {754E0AF5-13F4-4E79-8AC1-BE918D4EE2E3} - System32\Tasks\Digital Sites => C:\Users\Ralph\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION Task: {865D162F-0B46-49BC-A64E-DD2A707AD03A} - System32\Tasks\Norton WSC Integration => C:\Program Files\Norton 360\Engine\21.6.0.32\WSCStub.exe [2014-09-21] (Symantec Corporation) Task: {997B3A28-F930-4A84-B2A2-6DAEAAC3F66B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-26] (Adobe Systems Incorporated) Task: {CA9D0366-B0F6-4117-8406-4F39AD22877C} - System32\Tasks\Norton 360\Norton Error Processor => C:\Program Files\Norton 360\Engine\21.6.0.32\SymErr.exe [2014-01-30] (Symantec Corporation) Task: {CD4E44AF-9088-4693-BDD0-2C96EA101921} - System32\Tasks\FoxTab => C:\Users\Ralph\AppData\Roaming\FoxTab\UPDATE~1\UPDATE~1.EXE <==== ATTENTION Task: {D4EC5BF7-3C54-4BB3-96DF-4985FD2CCC4C} - System32\Tasks\Norton 360\Norton Error Analyzer => C:\Program Files\Norton 360\Engine\21.6.0.32\SymErr.exe [2014-01-30] (Symantec Corporation) Task: {DB34767B-CD39-4C82-A67C-15F1455EC744} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup Task: {E8B5A5DB-1873-4E60-B1FA-0CE05E7AFD2B} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-06-24] (Piriform Ltd) Task: {EB70C4AC-CA09-48A0-A8E0-D2284B38C47E} - System32\Tasks\bench-S-1-5-21-3046438628-3470693201-1580729714-1001 => C:\Program Files\Bench\Updater\updater.exe [2014-08-20] () <==== ATTENTION (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\bench-S-1-5-21-3046438628-3470693201-1580729714-1001.job => C:\Program Files\Bench\Updater\updater.exe <==== ATTENTION Task: C:\Windows\Tasks\bench-sys.job => C:\Program Files\Bench\Updater\updater.exe <==== ATTENTION Task: C:\Windows\Tasks\Digital Sites.job => C:\Users\Ralph\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION Task: C:\Windows\Tasks\FoxTab.job => C:\Users\Ralph\AppData\Roaming\FoxTab\UPDATE~1\UPDATE~1.EXE <==== ATTENTION ==================== Loaded Modules (whitelisted) ============= 2014-01-20 14:17 - 2014-01-20 14:17 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll 2014-01-20 14:16 - 2014-01-20 14:16 - 01044808 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll 2013-03-21 20:24 - 2013-03-21 20:24 - 00222368 _____ () C:\Program Files\Amazon Browser Bar\ToolbarUpdaterService.exe 2014-08-20 17:14 - 2014-08-20 17:14 - 00053248 _____ () C:\Program Files\Bench\BService\1.1\bhelper.dll 2014-07-18 12:41 - 2014-07-17 13:05 - 03321312 _____ () C:\Users\Ralph\AppData\Local\fst_de_103\upfst_de_103.exe 2014-08-20 17:14 - 2014-08-20 17:14 - 00052736 _____ () C:\Program Files\Bench\BService\1.1\bservice.exe 2014-08-20 17:15 - 2014-08-20 17:15 - 00092672 _____ () C:\Program Files\Bench\Wd\wd.exe 2014-09-05 19:42 - 2014-09-05 19:42 - 00127488 _____ () C:\Program Files\Bench\Proxy\pwdg.exe 2014-10-01 19:54 - 2014-09-29 12:38 - 03970560 _____ () C:\Program Files\fst_de_187\fst_de_187.exe 2014-10-06 10:38 - 2014-10-06 10:38 - 00380416 _____ () C:\Users\Ralph\Downloads\Gmer-19357.exe 2014-10-03 15:58 - 2014-09-24 07:09 - 03715184 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll 2014-09-11 22:03 - 2014-09-11 22:03 - 16825520 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) AlternateDataStreams: C:\Windows:nlsPreferences AlternateDataStreams: C:\ProgramData\Reprise:yhuwxvwhfkxkcqmbzxjuiqjduvsftifh AlternateDataStreams: C:\ProgramData\TEMP:CB0AACC9 ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (whitelisted) ============= (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) HKU\S-1-5-21-3046438628-3470693201-1580729714-1001\Software\Classes\.exe: exefile => <===== ATTENTION! HKU\S-1-5-21-3046438628-3470693201-1580729714-1001\Software\Classes\exefile: <===== ATTENTION! ==================== MSCONFIG/TASK MANAGER disabled items ========= (Currently there is no automatic fix for this section.) MSCONFIG\startupreg: APSDaemon => "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" MSCONFIG\startupreg: EPSON Stylus DX4400 Series => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE /FU "C:\Windows\TEMP\E_SCB59.tmp" /EF "HKCU" MSCONFIG\startupreg: eReader Suite => "C:\Program Files\TrekStor\eReaderSuite\TrekStor eReader Suite.exe" /startminimised MSCONFIG\startupreg: IncrediMail => C:\Program Files\IncrediMail\bin\IncMail.exe /c MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe" MSCONFIG\startupreg: QuickTime Task => "C:\Program Files\QuickTime\QTTask.exe" -atboottime MSCONFIG\startupreg: TomTomHOME.exe => "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe" ========================= Accounts: ========================== Administrator (S-1-5-21-3046438628-3470693201-1580729714-500 - Administrator - Disabled) Eileen (S-1-5-21-3046438628-3470693201-1580729714-1004 - Limited - Enabled) => C:\Users\Eileen Gast (S-1-5-21-3046438628-3470693201-1580729714-501 - Limited - Enabled) HomeGroupUser$ (S-1-5-21-3046438628-3470693201-1580729714-1002 - Limited - Enabled) Ralph (S-1-5-21-3046438628-3470693201-1580729714-1001 - Administrator - Enabled) => C:\Users\Ralph ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (10/06/2014 11:58:16 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 10000 Error: (10/06/2014 11:58:16 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 10000 Error: (10/06/2014 11:58:15 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (10/06/2014 08:05:20 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 9610 Error: (10/06/2014 08:05:20 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 9610 Error: (10/06/2014 08:05:20 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (10/06/2014 06:56:02 AM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: ) Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008] Error: (10/05/2014 08:47:01 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 15569 Error: (10/05/2014 08:47:01 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 15569 Error: (10/05/2014 08:47:00 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second System errors: ============= Error: (10/06/2014 10:03:41 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (10/06/2014 10:02:32 AM) (Source: Service Control Manager) (EventID: 7016) (User: ) Description: Der Dienst "NVIDIA Stereoscopic 3D Driver Service" hat einen ungültigen aktuellen Status gemeldet: 0 Error: (10/06/2014 06:58:30 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (10/06/2014 06:57:01 AM) (Source: Service Control Manager) (EventID: 7016) (User: ) Description: Der Dienst "NVIDIA Stereoscopic 3D Driver Service" hat einen ungültigen aktuellen Status gemeldet: 0 Error: (10/06/2014 06:55:28 AM) (Source: Service Control Manager) (EventID: 7030) (User: ) Description: Der Dienst "NPEService" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren. Error: (10/05/2014 07:44:26 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (10/05/2014 00:39:46 AM) (Source: Service Control Manager) (EventID: 7016) (User: ) Description: Der Dienst "NVIDIA Stereoscopic 3D Driver Service" hat einen ungültigen aktuellen Status gemeldet: 0 Error: (10/04/2014 11:54:06 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "szkgfs" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (10/04/2014 11:53:08 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "szkgfs" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (10/04/2014 11:51:56 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "NVIDIA Display Driver Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Microsoft Office Sessions: ========================= Error: (10/06/2014 11:58:16 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 10000 Error: (10/06/2014 11:58:16 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 10000 Error: (10/06/2014 11:58:15 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (10/06/2014 08:05:20 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 9610 Error: (10/06/2014 08:05:20 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 9610 Error: (10/06/2014 08:05:20 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (10/06/2014 06:56:02 AM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: ) Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008] Error: (10/05/2014 08:47:01 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 15569 Error: (10/05/2014 08:47:01 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 15569 Error: (10/05/2014 08:47:00 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second ==================== Memory info =========================== Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 5600+ Percentage of memory in use: 54% Total physical RAM: 1919.24 MB Available physical RAM: 870.54 MB Total Pagefile: 3838.48 MB Available Pagefile: 2361.78 MB Total Virtual: 2047.88 MB Available Virtual: 1894.08 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:297.99 GB) (Free:126.62 GB) NTFS Drive f: (CnMemory) (Fixed) (Total:1863.01 GB) (Free:1471.67 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 2EE32EE2) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=298 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: E0717E8E) Partition 1: (Not Active) - (Size=1863 GB) - (Type=07 NTFS) ==================== End Of Log ============================ FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 06-10-2014
Ran by Ralph (administrator) on RALPH-PC on 06-10-2014 12:26:41
Running from C:\Users\Ralph\Downloads
Loaded Profile: Ralph (Available profiles: Ralph & Eileen)
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE
(Symantec Corporation) C:\Program Files\Norton 360\Engine\21.6.0.32\n360.exe
(Nalpeiron Ltd.) C:\Windows\System32\nlssrv32.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
() C:\Program Files\Amazon Browser Bar\ToolbarUpdaterService.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Symantec Corporation) C:\Program Files\Norton 360\Engine\21.6.0.32\n360.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe
() C:\Users\Ralph\AppData\Local\fst_de_103\upfst_de_103.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
() C:\Program Files\Bench\BService\1.1\bservice.exe
() C:\Program Files\Bench\Wd\wd.exe
() C:\Program Files\Bench\Proxy\pwdg.exe
() C:\Program Files\fst_de_187\fst_de_187.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Spotify Ltd) C:\Users\Ralph\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
() C:\Users\Ralph\Downloads\Gmer-19357.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Nvtmru] => C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-14] (NVIDIA Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [BService] => C:\Program Files\Bench\BService\1.1\bservice.exe [52736 2014-08-20] ()
HKLM\...\Run: [Wd] => C:\Program Files\Bench\Wd\wd.exe [92672 2014-08-20] ()
HKLM\...\Run: [Bench Communicator Watcher] => C:\Program Files\Bench\Proxy\pwdg.exe [127488 2014-09-05] ()
HKLM\...\Run: [Bench Settings Cleaner] => C:\Program Files\Bench\Proxy\cl.exe [55296 2014-08-20] ()
HKLM\...\Run: [fst_de_187] => C:\Program Files\fst_de_187\fst_de_187.exe [3970560 2014-09-29] ()
HKLM\...\RunOnce: [upfst_de_103.exe] => C:\Users\Ralph\AppData\Local\fst_de_103\upfst_de_103.exe [3321312 2014-07-17] ()
HKU\S-1-5-21-3046438628-3470693201-1580729714-1001\...\Run: [Spotify Web Helper] => C:\Users\Ralph\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1245752 2014-09-18] (Spotify Ltd)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2014-01-02] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files\Norton 360\Engine\21.6.0.32\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: [OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files\Norton 360\Engine\21.6.0.32\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: [OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files\Norton 360\Engine\21.6.0.32\buShell.dll (Symantec Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK217RbjR1YFa37oBy_U-nTnTbDTt8PVUCrSqw53VgZypPfP5g5_GaUpT-f254PEI9nkIxcVje9WgHEF2BUJ_rn92TUe7oFzuTo4zCoJTggHsPz96d92HDadfS_Gz8mXaR9um8xNwSe32l46afPqZTyPUm1f_yfx7UJcvNlC6GhYFj_8DIaGIn6bdfnnNZKbNyJF480NyXw,,&q={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK217RbjR1YFa37oBy_U-nTnTbDTt8PVUCrSqw53VgZypPfP5g5_GaUpT-f254PEI9nkIxcVje9WgHEF2BUJ_rn92TUe7oFzuTo4zCoJTggHsPz96d92HDadfS_Gz8mXaR9um8xNwSe32l46afPqZTyPUm1f_yfx7UJcvNlC6GhYFj_8DIaGIn6bdfnnNZKbNyJF480NyXw,,&q={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google
SearchScopes: HKLM - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK217RbjR1YFa37oBy_U-nTnTbDTt8PVUCrSqw53VgZypPfP5g5_GaUpT-f254PEI9nkIxcVje9WgHEF2BUJ_rn92TUe7oFzuTo4zCoJTggHsPz96d92HDadfS_Gz8mXaR9um8xNwSe32l46afPqZTyPUm1f_yfx7UJcvNlC6GhYFj_8DIaGIn6baetBA9flaRrNPCh1g_A,,&q={searchTerms}
SearchScopes: HKLM - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK217RbjR1YFa37oBy_U-nTnTbDTt8PVUCrSqw53VgZypPfP5g5_GaUpT-f254PEI9nkIxcVje9WgHEF2BUJ_rn92TUe7oFzuTo4zCoJTggHsPz96d92HDadfS_Gz8mXaR9um8xNwSe32l46afPqZTyPUm1f_yfx7UJcvNlC6GhYFj_8DIaGIn6baetBA9flaRrNPCh1g_A,,&q={searchTerms}
SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK217RbjR1YFa37oBy_U-nTnTbDTt8PVUCrSqw53VgZypPfP5g5_GaUpT-f254PEI9nkIxcVje9WgHEF2BUJ_rn92TUe7oFzuTo4zCoJTggHsPz96d92HDadfS_Gz8mXaR9um8xNwSe32l46afPqZTyPUm1f_yfx7UJcvNlC6GhYFj_8DIaGIn6bdfnnNZKbNyJF480NyXw,,&q={searchTerms}
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK217RbjR1YFa37oBy_U-nTnTbDTt8PVUCrSqw53VgZypPfP5g5_GaUpT-f254PEI9nkIxcVje9WgHEF2BUJ_rn92TUe7oFzuTo4zCoJTggHsPz96d92HDadfS_Gz8mXaR9um8xNwSe32l46afPqZTyPUm1f_yfx7UJcvNlC6GhYFj_8DIaGIn6bdfnnNZKbNyJF480NyXw,,&q={searchTerms}
BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files\Norton 360\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation)
BHO: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files\Norton 360\Engine\21.6.0.32\IPS\IPSBHO.DLL (Symantec Corporation)
BHO: Browse Safe BHO -> {8E56A02B-46FE-4490-B169-F16E5231533B} -> C:\Program Files\Browse Safe\FrameworkBHO.dll ()
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKCU - No Name - {41564952-412D-5637-4300-7A786E7484D7} - No File
Toolbar: HKCU - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\xqrom0l5.default-1405937921458
FF NewTab: Google
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1210150.dll (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=16.4.3522.0110 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @nvidia.com/3DVision -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\xqrom0l5.default-1405937921458\user.js
FF SearchPlugin: C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\xqrom0l5.default-1405937921458\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\xqrom0l5.default-1405937921458\searchplugins\google-maps.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Cliqz Beta - C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\xqrom0l5.default-1405937921458\Extensions\cliqz@cliqz.com.xpi [2014-10-06]
FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn [2014-10-06]
FF HKCU\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\xqrom0l5.default-1405937921458\extensions\cliqz@cliqz.com
Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR RestoreOnStartup: Default -> "hxxp://www.google.com/"
CHR CustomProfile: C:\Users\Ralph\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Docs) - C:\Users\Ralph\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-13]
CHR HKLM\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files\Norton 360\Engine\21.6.0.32\Exts\Chrome.crx [2014-09-23]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 EPSON_PM_RPCV4_01; C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE [113664 2007-01-11] (SEIKO EPSON CORPORATION)
R2 N360; C:\Program Files\Norton 360\Engine\21.6.0.32\N360.exe [265040 2014-09-21] (Symantec Corporation)
R2 nlsX86cc; C:\Windows\system32\nlssrv32.exe [63488 2010-03-11] (Nalpeiron Ltd.) [File not signed]
R2 NvNetworkService; C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [14658848 2013-12-10] (NVIDIA Corporation)
R2 Updater Service for AMZN; C:\Program Files\Amazon Browser Bar\ToolbarUpdaterService.exe [222368 2013-03-21] ()
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 BHDrvx86; C:\Program Files\Norton 360\NortonData\21.1.0.18\Definitions\BASHDefs\20140912.003\BHDrvx86.sys [1137368 2014-09-13] (Symantec Corporation)
R1 ccSet_N360; C:\Windows\system32\drivers\N360\1506000.020\ccSetx86.sys [127064 2013-09-26] (Symantec Corporation)
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [378672 2014-09-09] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [111408 2014-09-09] (Symantec Corporation)
R1 IDSVix86; C:\Program Files\Norton 360\NortonData\21.1.0.18\Definitions\IPSDefs\20141003.001\IDSvix86.sys [476888 2014-08-30] (Symantec Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [5810 2004-08-13] ()
R3 NAVENG; C:\Program Files\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20141005.001\NAVENG.SYS [95704 2014-08-21] (Symantec Corporation)
R3 NAVEX15; C:\Program Files\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20141005.001\NAVEX15.SYS [1636696 2014-08-21] (Symantec Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad32v.sys [34080 2013-12-05] (NVIDIA Corporation)
R3 SRTSP; C:\Windows\System32\Drivers\N360\1506000.020\SRTSP.SYS [664792 2014-08-26] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360\1506000.020\SRTSPX.SYS [32984 2014-08-26] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\N360\1506000.020\SYMDS.SYS [367704 2013-09-10] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360\1506000.020\SYMEFA.SYS [936152 2014-03-04] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142936 2013-12-30] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360\1506000.020\Ironx86.SYS [209624 2014-08-06] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\N360\1506000.020\SYMNETS.SYS [447704 2014-02-18] (Symantec Corporation)
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S2 sbapifs; system32\DRIVERS\sbapifs.sys [X]
U3 fglorpoc; \??\C:\Users\Ralph\AppData\Local\Temp\fglorpoc.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-06 12:26 - 2014-10-06 12:27 - 00015941 _____ () C:\Users\Ralph\Downloads\FRST.txt
2014-10-06 12:25 - 2014-10-06 12:26 - 00000000 ____D () C:\FRST
2014-10-06 12:23 - 2014-10-06 12:23 - 01101312 _____ (Farbar) C:\Users\Ralph\Downloads\FRST.exe
2014-10-06 10:38 - 2014-10-06 10:38 - 00380416 _____ () C:\Users\Ralph\Downloads\Gmer-19357.exe
2014-10-06 10:01 - 2014-10-06 10:01 - 00214576 _____ (Trend Micro Inc.) C:\Windows\RegBootClean.exe
2014-10-06 09:55 - 2014-10-06 09:55 - 00260652 _____ () C:\Users\Ralph\AppData\Local\census.cache
2014-10-06 09:54 - 2014-10-06 09:54 - 00120845 _____ () C:\Users\Ralph\AppData\Local\ars.cache
2014-10-06 09:32 - 2014-10-06 09:32 - 00000036 _____ () C:\Users\Ralph\AppData\Local\housecall.guid.cache
2014-10-06 09:32 - 2011-06-21 06:09 - 00200976 _____ (Trend Micro Inc.) C:\Windows\system32\Drivers\tmcomm.sys
2014-10-06 09:31 - 2014-10-06 09:31 - 02002416 _____ (Trend Micro Inc.) C:\Users\Ralph\Downloads\HousecallLauncher.exe
2014-10-04 23:51 - 2011-05-13 12:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\system32\dhRichClient3.dll
2014-10-04 23:51 - 2011-03-25 20:42 - 00338432 _____ () C:\Windows\system32\sqlite36_engine.dll
2014-10-04 23:49 - 2014-10-04 23:49 - 01101648 _____ () C:\Users\Ralph\Downloads\Stopzilla Antivirus - CHIP-Installer.exe
2014-10-04 18:58 - 2014-10-06 06:59 - 00000000 ____D () C:\NPE
2014-10-04 18:55 - 2014-10-04 18:55 - 03077776 ____N (Symantec Corporation) C:\Users\Ralph\Downloads\NPE.exe
2014-10-04 15:26 - 2014-10-04 18:43 - 00000000 ____D () C:\Windows\AF54923662584AC6A0435B5B89C6EB61.TMP
2014-10-04 15:25 - 2014-10-04 15:25 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Ralph\Downloads\SpyHunter-Installer.exe
2014-10-04 15:11 - 2014-10-06 10:34 - 00000472 _____ () C:\Users\Ralph\Downloads\defogger_disable.log
2014-10-04 15:11 - 2014-10-04 15:11 - 00050477 _____ () C:\Users\Ralph\Downloads\Defogger.exe
2014-10-04 15:01 - 2014-10-04 15:01 - 00000000 _____ () C:\Users\Ralph\defogger_reenable
2014-10-03 15:59 - 2014-10-03 15:59 - 00001069 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-10-03 15:58 - 2014-10-03 15:59 - 00001081 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-10-03 15:58 - 2014-10-03 15:58 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-10-02 10:47 - 2014-10-02 10:47 - 00000000 ____D () C:\Users\Eileen\AppData\Local\fst_de_187
2014-10-01 19:54 - 2014-10-01 19:54 - 00000000 ____D () C:\Users\Ralph\AppData\Local\fst_de_187
2014-10-01 19:54 - 2014-10-01 19:54 - 00000000 ____D () C:\Program Files\fst_de_187
2014-09-30 10:22 - 2014-10-04 15:16 - 00003084 _____ () C:\Windows\PFRO.log
2014-09-29 09:07 - 2014-10-06 10:03 - 00003024 _____ () C:\Windows\setupact.log
2014-09-29 09:07 - 2014-09-29 09:07 - 00000000 _____ () C:\Windows\setuperr.log
2014-09-25 11:38 - 2014-10-03 15:58 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-09-25 10:23 - 2014-09-25 10:23 - 00000000 ____D () C:\Users\Ralph\AppData\Local\BenchUpdater
2014-09-25 10:22 - 2014-10-06 11:38 - 00000332 _____ () C:\Windows\Tasks\bench-sys.job
2014-09-25 10:22 - 2014-10-06 10:22 - 00000332 _____ () C:\Windows\Tasks\bench-S-1-5-21-3046438628-3470693201-1580729714-1001.job
2014-09-25 10:22 - 2014-10-05 00:32 - 00000000 ____D () C:\Program Files\Browse Safe
2014-09-25 10:22 - 2014-09-25 10:22 - 00000000 ____D () C:\Program Files\Bench
2014-09-21 20:11 - 2014-09-21 20:11 - 00000000 ____D () C:\Users\Ralph\Documents\WindowsImageBackup
2014-09-21 19:06 - 2014-09-21 19:06 - 00000000 ___RD () C:\Users\Ralph\Documents\RALPH-PC
2014-09-21 10:56 - 2014-10-06 11:58 - 00613830 _____ () C:\Windows\WindowsUpdate.log
2014-09-18 19:14 - 2014-09-19 06:53 - 00000000 ____D () C:\Users\Ralph\AppData\Local\Spotify
2014-09-18 19:14 - 2014-09-18 19:14 - 00001805 _____ () C:\Users\Ralph\Desktop\Spotify.lnk
2014-09-18 19:14 - 2014-09-18 19:14 - 00001791 _____ () C:\Users\Ralph\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2014-09-18 19:13 - 2014-09-19 11:34 - 00000000 ____D () C:\Users\Ralph\AppData\Roaming\Spotify
2014-09-18 19:06 - 2014-09-18 19:06 - 00136864 _____ (Spotify Ltd) C:\Users\Ralph\Downloads\SpotifySetup.exe
2014-09-14 19:08 - 2014-09-14 19:08 - 00000528 ____R () C:\Users\Ralph\Documents\MediaID.bin
2014-09-10 22:42 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-10 22:42 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-10 22:42 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-10 22:42 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-10 22:42 - 2014-08-18 23:57 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-10 22:42 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-10 22:42 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-10 22:42 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-10 22:42 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-10 22:42 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-10 22:42 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-10 22:42 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-10 22:42 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-10 22:42 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-10 22:42 - 2014-08-18 23:36 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-10 22:42 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-10 22:42 - 2014-08-18 23:30 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-10 22:42 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-10 22:42 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-10 22:42 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-10 22:42 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-10 22:42 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-10 22:42 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-10 22:42 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-10 22:42 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-10 22:42 - 2014-08-18 23:08 - 00673792 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-10 22:42 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-10 22:42 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-10 22:42 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-10 22:42 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-10 21:41 - 2014-09-10 22:23 - 00000000 ____D () C:\Program Files\fst_de_173
2014-09-10 07:36 - 2014-07-07 03:40 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-10 07:36 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-06 12:06 - 2014-01-05 19:06 - 00000288 _____ () C:\Windows\Tasks\FoxTab.job
2014-10-06 12:05 - 2014-01-05 19:03 - 00000292 _____ () C:\Windows\Tasks\Digital Sites.job
2014-10-06 12:03 - 2013-12-29 22:46 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-06 10:25 - 2014-07-18 12:41 - 00000000 ____D () C:\Users\Ralph\AppData\Local\fst_de_103
2014-10-06 10:11 - 2009-07-14 06:34 - 00014960 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-06 10:11 - 2009-07-14 06:34 - 00014960 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-06 10:03 - 2013-12-29 23:18 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-10-06 10:03 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-06 10:01 - 2014-07-18 12:41 - 00000000 ____D () C:\Program Files\fst_de_103
2014-10-06 10:01 - 2014-01-05 19:05 - 00000000 ____D () C:\Users\Ralph\AppData\Roaming\newnext.me
2014-10-06 07:10 - 2014-01-05 20:05 - 00000180 _____ () C:\Users\Ralph\AppData\Roaming\WB.CFG
2014-10-06 07:05 - 2014-01-02 16:20 - 00000000 ____D () C:\Users\Ralph\AppData\Local\NPE
2014-10-04 18:22 - 2014-07-18 12:46 - 00000000 ____D () C:\Program Files\LPT
2014-10-04 15:26 - 2014-01-01 20:18 - 00000000 ____D () C:\Program Files\Common Files\Wise Installation Wizard
2014-10-04 15:01 - 2013-12-29 22:27 - 00000000 ____D () C:\Users\Ralph
2014-10-02 21:37 - 2013-12-30 17:47 - 00000000 ____D () C:\Users\Ralph\AppData\Roaming\UseNeXT
2014-10-02 21:31 - 2014-01-13 11:20 - 00000000 ____D () C:\Users\Ralph\Documents\UseNeXT
2014-10-02 20:48 - 2013-12-29 22:31 - 01612484 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-02 18:46 - 2013-12-30 19:46 - 00000000 ____D () C:\Users\Ralph\AppData\Local\CrashDumps
2014-09-26 07:34 - 2013-12-29 22:46 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-09-26 07:34 - 2013-12-29 22:46 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-09-25 14:58 - 2013-12-30 12:14 - 00002201 _____ () C:\Users\Public\Desktop\Norton 360.lnk
2014-09-25 14:58 - 2013-12-30 12:14 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360
2014-09-25 14:58 - 2013-12-30 12:14 - 00000000 ____D () C:\Windows\system32\Drivers\N360
2014-09-23 07:26 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-09-19 15:21 - 2013-12-29 23:35 - 00000000 ____D () C:\Users\Ralph\AppData\Roaming\vlc
2014-09-19 06:55 - 2014-01-13 18:53 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-09-15 09:06 - 2013-12-30 12:41 - 00231568 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-09-11 20:00 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-09-11 11:30 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-09-10 22:37 - 2014-01-02 15:56 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-10 22:32 - 2014-01-02 15:56 - 98758480 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-10 07:29 - 2009-07-14 06:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-09-07 18:05 - 2014-08-11 19:29 - 00000000 ____D () C:\Users\Ralph\Documents\Calibre-Bibliothek
2014-09-07 18:01 - 2014-08-11 19:58 - 00000000 ____D () C:\Users\Ralph\Documents\My Digital Editions
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
==================== BCD ================================
Windows-Start-Manager
---------------------
Bezeichner {bootmgr}
device partition=\Device\HarddiskVolume1
description Windows Boot Manager
locale de-DE
inherit {globalsettings}
default {current}
resumeobject {903429a0-70c6-11e3-bc94-fbb47f8aba85}
displayorder {current}
toolsdisplayorder {memdiag}
timeout 30
Windows-Startladeprogramm
-------------------------
Bezeichner {current}
device partition=C:
path \Windows\system32\winload.exe
description Windows 7
locale de-DE
inherit {bootloadersettings}
recoverysequence {903429a2-70c6-11e3-bc94-fbb47f8aba85}
recoveryenabled Yes
osdevice partition=C:
systemroot \Windows
resumeobject {903429a0-70c6-11e3-bc94-fbb47f8aba85}
nx OptIn
bootlog No
Windows-Startladeprogramm
-------------------------
Bezeichner {903429a2-70c6-11e3-bc94-fbb47f8aba85}
device ramdisk=[C:]\Recovery\903429a2-70c6-11e3-bc94-fbb47f8aba85\Winre.wim,{903429a3-70c6-11e3-bc94-fbb47f8aba85}
path \windows\system32\winload.exe
description Windows Recovery Environment
inherit {bootloadersettings}
osdevice ramdisk=[C:]\Recovery\903429a2-70c6-11e3-bc94-fbb47f8aba85\Winre.wim,{903429a3-70c6-11e3-bc94-fbb47f8aba85}
systemroot \windows
nx OptIn
winpe Yes
Wiederaufnahme aus dem Ruhezustand
----------------------------------
Bezeichner {903429a0-70c6-11e3-bc94-fbb47f8aba85}
device partition=C:
path \Windows\system32\winresume.exe
description Windows Resume Application
locale de-DE
inherit {resumeloadersettings}
filedevice partition=C:
filepath \hiberfil.sys
pae Yes
debugoptionenabled No
Windows-Speichertestprogramm
----------------------------
Bezeichner {memdiag}
device partition=\Device\HarddiskVolume1
path \boot\memtest.exe
description Windows-Speicherdiagnose
locale de-DE
inherit {globalsettings}
badmemoryaccess Yes
EMS-Einstellungen
-----------------
Bezeichner {emssettings}
bootems Yes
Debuggereinstellungen
---------------------
Bezeichner {dbgsettings}
debugtype Serial
debugport 1
baudrate 115200
RAM-Defekte
-----------
Bezeichner {badmemory}
Globale Einstellungen
---------------------
Bezeichner {globalsettings}
inherit {dbgsettings}
{emssettings}
{badmemory}
Startladeprogramm-Einstellungen
-------------------------------
Bezeichner {bootloadersettings}
inherit {globalsettings}
{hypervisorsettings}
Hypervisoreinstellungen
-------------------
Bezeichner {hypervisorsettings}
hypervisordebugtype Serial
hypervisordebugport 1
hypervisorbaudrate 115200
Einstellungen zur Ladeprogrammfortsetzung
-----------------------------------------
Bezeichner {resumeloadersettings}
inherit {globalsettings}
Ger„teoptionen
--------------
Bezeichner {903429a3-70c6-11e3-bc94-fbb47f8aba85}
description Ramdisk Options
ramdisksdidevice partition=C:
ramdisksdipath \Recovery\903429a2-70c6-11e3-bc94-fbb47f8aba85\boot.sdi
LastRegBack: 2014-10-06 07:22
==================== End Of Log ============================
|
|
06.10.2014, 12:46
| #4 |
| /// TB-Ausbilder | Es öffnen sich einach Fenster Win 7 Firefox Ok. Lass den Norton erstmal aus. Adware & Co. deinstallieren
Solltest Du ein Programm nicht finden oder nicht deinstallieren können, mache bitte mit dem nächsten Schritt weiter: Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Downloade Dir bitte  Malwarebytes Anti-Malware
Starte noch einmal FRST.
__________________ Lerne, zurück zu schlagen und unterstütze uns! TB Akademie | Spende | Lob & Kritik |
|
06.10.2014, 14:49
| #5 |
| | Es öffnen sich einach Fenster Win 7 Firefox AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.311 - Bericht erstellt am 06/10/2014 um 14:34:30
# Aktualisiert 30/09/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (32 bits)
# Benutzername : Ralph - RALPH-PC
# Gestartet von : C:\Users\Ralph\Downloads\AdwCleaner_3.311.exe
# Option : Löschen
***** [ Dienste ] *****
Dienst Gelöscht : Updater Service for AMZN
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\apn
Ordner Gelöscht : C:\ProgramData\ParetoLogic
Ordner Gelöscht : C:\ProgramData\SpeedMaxPc
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freesofttoday
Ordner Gelöscht : C:\Program Files\Advanced System Protector
Ordner Gelöscht : C:\Program Files\Amazon Browser Bar
Ordner Gelöscht : C:\Program Files\Bench
Ordner Gelöscht : C:\Program Files\Browse Safe
Ordner Gelöscht : C:\Program Files\LPT
Ordner Gelöscht : C:\Program Files\Mobogenie
Ordner Gelöscht : C:\Program Files\MyPC Backup
Ordner Gelöscht : C:\Program Files\ParetoLogic
Ordner Gelöscht : C:\Program Files\Probit Software
Ordner Gelöscht : C:\Program Files\Systweak Support Dock
Ordner Gelöscht : C:\Program Files\VideoConverter
Ordner Gelöscht : C:\Program Files\Video-Saver
Ordner Gelöscht : C:\Program Files\fst_de_187
Ordner Gelöscht : C:\Program Files\fst_de_103
Ordner Gelöscht : C:\Users\Eileen\AppData\Local\SearchProtect
Ordner Gelöscht : C:\Users\Eileen\AppData\Local\fst_de_187
Ordner Gelöscht : C:\Users\Ralph\AppData\Local\Amazon Browser Bar
Ordner Gelöscht : C:\Users\Ralph\AppData\Local\BenchUpdater
Ordner Gelöscht : C:\Users\Ralph\AppData\Local\genienext
Ordner Gelöscht : C:\Users\Ralph\AppData\Local\Mobogenie
Ordner Gelöscht : C:\Users\Ralph\AppData\Local\SearchProtect
Ordner Gelöscht : C:\Users\Ralph\AppData\Local\fst_de_187
Ordner Gelöscht : C:\Users\Ralph\AppData\Local\fst_de_103
Ordner Gelöscht : C:\Users\Ralph\AppData\Roaming\0D0S1L2Z1P1B
Ordner Gelöscht : C:\Users\Ralph\AppData\Roaming\DigitalSites
Ordner Gelöscht : C:\Users\Ralph\AppData\Roaming\DriverCure
Ordner Gelöscht : C:\Users\Ralph\AppData\Roaming\newnext.me
Ordner Gelöscht : C:\Users\Ralph\AppData\Roaming\ParetoLogic
Ordner Gelöscht : C:\Users\Ralph\AppData\Roaming\Probit Software
Ordner Gelöscht : C:\Users\Ralph\AppData\Roaming\SpeedMaxPc
Ordner Gelöscht : C:\Users\Ralph\AppData\Roaming\Systweak
Datei Gelöscht : C:\END
Datei Gelöscht : C:\Users\Ralph\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Video Converter.lnk
Datei Gelöscht : C:\Users\Ralph\Desktop\Video Converter.lnk
Datei Gelöscht : C:\Users\Eileen\AppData\Roaming\Mozilla\Firefox\Profiles\5lfrm64o.default\searchplugins\trovi-search.xml
Datei Gelöscht : C:\Users\Eileen\AppData\Roaming\Mozilla\Firefox\Profiles\5lfrm64o.default\searchplugins\Web Search.xml
Datei Gelöscht : C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\xqrom0l5.default-1405937921458\user.js
***** [ Tasks ] *****
Task Gelöscht : bench-sys
Task Gelöscht : Digital Sites
Task Gelöscht : FoxTab
Task Gelöscht : bench-S-1-5-21-3046438628-3470693201-1580729714-1001
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.bench.nmhost
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker-1_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker-1_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskPIP_FF__RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskPIP_FF__RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\NewPlayer_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\NewPlayer_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\updateJumpFlip_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\updateJumpFlip_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Video-Saver_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Video-Saver_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WajamInternetEnhancer_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WajamInternetEnhancer_RASMANCS
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Bench Communicator Watcher]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Bench Settings Cleaner]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [BService]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Wd]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [fst_de_187]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{8E56A02B-46FE-4490-B169-F16E5231533B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E56A02B-46FE-4490-B169-F16E5231533B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8E56A02B-46FE-4490-B169-F16E5231533B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{8E56A02B-46FE-4490-B169-F16E5231533B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : HKCU\Software\distromatic
Schlüssel Gelöscht : HKCU\Software\dsiteproducts
Schlüssel Gelöscht : HKCU\Software\FreeSoftToday
Schlüssel Gelöscht : HKCU\Software\IM
Schlüssel Gelöscht : HKCU\Software\ImInstaller
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\ParetoLogic
Schlüssel Gelöscht : HKCU\Software\Proxy
Schlüssel Gelöscht : HKCU\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\SpeedMaxPC
Schlüssel Gelöscht : HKCU\Software\systweak
Schlüssel Gelöscht : HKCU\Software\Tutorials
Schlüssel Gelöscht : HKCU\Software\TutoTag
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Video-Saver-1
Schlüssel Gelöscht : HKLM\SOFTWARE\AdvertisingSupport
Schlüssel Gelöscht : HKLM\SOFTWARE\Bench
Schlüssel Gelöscht : HKLM\SOFTWARE\FreeSoftToday
Schlüssel Gelöscht : HKLM\SOFTWARE\ImInstaller
Schlüssel Gelöscht : HKLM\SOFTWARE\ParetoLogic
Schlüssel Gelöscht : HKLM\SOFTWARE\Proxy
Schlüssel Gelöscht : HKLM\SOFTWARE\SpeedMaxPC
Schlüssel Gelöscht : HKLM\SOFTWARE\systweak
Schlüssel Gelöscht : HKLM\SOFTWARE\Tutorials
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Digital Sites
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Video Converter
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BC0BF363-63AB-4FF7-8EF1-AE0D7F711B24}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Amazon Browser Settings
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fst_de_187_is1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fst_de_103_is1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17280
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Search Bar]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [SearchAssistant]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default]
-\\ Mozilla Firefox v32.0.3 (x86 de)
[ Datei : C:\Users\Eileen\AppData\Roaming\Mozilla\Firefox\Profiles\5lfrm64o.default\prefs.js ]
Zeile gelöscht : user_pref("browser.newtab.url", "hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK217RbjR1YFa37oBy_U-nTnTbDTt8PVUCrSqw53VgZypPfP5g5_GaUpT-f254PEI9nkIxcVje9WgHEF2BUJ_rn92TUe7oFzuTo4zCoJZQFF-94lfazi3r7[...]
Zeile gelöscht : user_pref("browser.search.defaultenginename", "Web Search");
Zeile gelöscht : user_pref("browser.search.selectedEngine", "Web Search");
Zeile gelöscht : user_pref("browser.startup.homepage", "hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK217RbjR1YFa37oBy_U-nTnTbDTt8PVUCrSqw53VgZypPfP5g5_GaUpT-f254PEI9nkIxcVje9WgHEF2BUJ_rn92TUe7oFzuTo4zCoJfCgum0GQD[...]
Zeile gelöscht : user_pref("keyword.URL", "hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK217RbjR1YFa37oBy_U-nTnTbDTt8PVUCrSqw53VgZypPfP5g5_GaUpT-f254PEI9nkIxcVje9WgHEF2BUJ_rn92TUe7oFzuTo4zCoJTggHsPz96d92HDadfS_Gz8[...]
[ Datei : C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\xqrom0l5.default-1405937921458\prefs.js ]
-\\ Google Chrome v
[ Datei : C:\Users\Ralph\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [12114 octets] - [06/10/2014 14:29:00]
AdwCleaner[S0].txt - [10017 octets] - [06/10/2014 14:34:30]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [10078 octets] ##########
Junkware Removal Tool (JRT) by Thisisu Version: 6.3.1 (10.06.2014:1) OS: Windows 7 Professional x86 Ran by Ralph on 06.10.2014 at 15:40:44,29 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys ~~~ Files ~~~ Folders ~~~ FireFox Successfully deleted the following from C:\Users\Ralph\AppData\Roaming\mozilla\firefox\profiles\xqrom0l5.default-1405937921458\prefs.js user_pref("extensions.cliqz.showNoResults", true); Emptied folder: C:\Users\Ralph\AppData\Roaming\mozilla\firefox\profiles\xqrom0l5.default-1405937921458\minidumps [30 files] ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 06.10.2014 at 15:43:19,60 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
|
06.10.2014, 15:57
| #6 |
| /// TB-Ausbilder | Es öffnen sich einach Fenster Win 7 Firefox Ok, da fehlt noch Malwarebytes ;-)
__________________ --> Es öffnen sich einach Fenster Win 7 Firefox |
|
06.10.2014, 16:35
| #7 |
| | Es öffnen sich einach Fenster Win 7 Firefox Malwarebytes Anti-Malware hat keine Bedrohung gefunden FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 06-10-2014 Ran by Ralph (administrator) on RALPH-PC on 06-10-2014 17:23:55 Running from C:\Users\Ralph\Downloads Loaded Profile: Ralph (Available profiles: Ralph & Eileen) Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe (Symantec Corporation) C:\Program Files\Norton 360\Engine\21.6.0.32\n360.exe (Nalpeiron Ltd.) C:\Windows\System32\nlssrv32.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Spotify Ltd) C:\Users\Ralph\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Symantec Corporation) C:\Program Files\Norton 360\Engine\21.6.0.32\n360.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe (Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe (Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Nvtmru] => C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-14] (NVIDIA Corporation) HKLM\...\Run: [NvBackend] => C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap.dll,ShadowPlayOnSystemStart HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated) HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation) HKU\S-1-5-21-3046438628-3470693201-1580729714-1001\...\Run: [Spotify Web Helper] => C:\Users\Ralph\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1245752 2014-09-18] (Spotify Ltd) HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2014-01-02] (Microsoft Corporation) ShellIconOverlayIdentifiers: [OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files\Norton 360\Engine\21.6.0.32\buShell.dll (Symantec Corporation) ShellIconOverlayIdentifiers: [OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files\Norton 360\Engine\21.6.0.32\buShell.dll (Symantec Corporation) ShellIconOverlayIdentifiers: [OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files\Norton 360\Engine\21.6.0.32\buShell.dll (Symantec Corporation) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files\Norton 360\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation) BHO: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files\Norton 360\Engine\21.6.0.32\IPS\IPSBHO.DLL (Symantec Corporation) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation) Toolbar: HKCU - No Name - {41564952-412D-5637-4300-7A786E7484D7} - No File Toolbar: HKCU - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation) Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\xqrom0l5.default-1405937921458 FF NewTab: Google FF Homepage: hxxp://www.google.de/ FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll () FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1210150.dll (Adobe Systems, Inc.) FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=16.4.3522.0110 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @nvidia.com/3DVision -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\xqrom0l5.default-1405937921458\searchplugins\google-images.xml FF SearchPlugin: C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\xqrom0l5.default-1405937921458\searchplugins\google-maps.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Cliqz Beta - C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\xqrom0l5.default-1405937921458\Extensions\cliqz@cliqz.com.xpi [2014-10-06] FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn [2014-10-06] FF HKCU\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\xqrom0l5.default-1405937921458\extensions\cliqz@cliqz.com Chrome: ======= CHR HomePage: Default -> hxxp://www.google.com/ CHR RestoreOnStartup: Default -> "hxxp://www.google.com/" CHR CustomProfile: C:\Users\Ralph\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Docs) - C:\Users\Ralph\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-13] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 EPSON_PM_RPCV4_01; C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE [113664 2007-01-11] (SEIKO EPSON CORPORATION) R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 N360; C:\Program Files\Norton 360\Engine\21.6.0.32\N360.exe [265040 2014-09-21] (Symantec Corporation) R2 nlsX86cc; C:\Windows\system32\nlssrv32.exe [63488 2010-03-11] (Nalpeiron Ltd.) [File not signed] R2 NvNetworkService; C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [14658848 2013-12-10] (NVIDIA Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R1 BHDrvx86; C:\Program Files\Norton 360\NortonData\21.1.0.18\Definitions\BASHDefs\20140912.003\BHDrvx86.sys [1137368 2014-09-13] (Symantec Corporation) R1 ccSet_N360; C:\Windows\system32\drivers\N360\1506000.020\ccSetx86.sys [127064 2013-09-26] (Symantec Corporation) R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [378672 2014-09-09] (Symantec Corporation) R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [111408 2014-09-09] (Symantec Corporation) R1 IDSVix86; C:\Program Files\Norton 360\NortonData\21.1.0.18\Definitions\IPSDefs\20141003.001\IDSvix86.sys [476888 2014-08-30] (Symantec Corporation) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-10-06] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation) R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [5810 2004-08-13] () R3 NAVENG; C:\Program Files\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20141005.001\NAVENG.SYS [95704 2014-08-21] (Symantec Corporation) R3 NAVEX15; C:\Program Files\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20141005.001\NAVEX15.SYS [1636696 2014-08-21] (Symantec Corporation) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad32v.sys [34080 2013-12-05] (NVIDIA Corporation) R1 SRTSP; C:\Windows\System32\Drivers\N360\1506000.020\SRTSP.SYS [664792 2014-08-26] (Symantec Corporation) R1 SRTSPX; C:\Windows\system32\drivers\N360\1506000.020\SRTSPX.SYS [32984 2014-08-26] (Symantec Corporation) R0 SymDS; C:\Windows\System32\drivers\N360\1506000.020\SYMDS.SYS [367704 2013-09-10] (Symantec Corporation) R0 SymEFA; C:\Windows\System32\drivers\N360\1506000.020\SYMEFA.SYS [936152 2014-03-04] (Symantec Corporation) R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142936 2013-12-30] (Symantec Corporation) R1 SymIRON; C:\Windows\system32\drivers\N360\1506000.020\Ironx86.SYS [209624 2014-08-06] (Symantec Corporation) R1 SymNetS; C:\Windows\System32\Drivers\N360\1506000.020\SYMNETS.SYS [447704 2014-02-18] (Symantec Corporation) S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X] S2 sbapifs; system32\DRIVERS\sbapifs.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-10-06 16:09 - 2014-10-06 16:09 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys 2014-10-06 15:52 - 2014-10-06 16:09 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-10-06 15:51 - 2014-10-06 15:51 - 00001024 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-10-06 15:51 - 2014-10-06 15:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-10-06 15:51 - 2014-10-06 15:51 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-10-06 15:51 - 2014-10-06 15:51 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-10-06 15:51 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-10-06 15:51 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-10-06 15:51 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-10-06 15:50 - 2014-10-06 15:50 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Ralph\Downloads\mbam-setup-2.0.2.1012.exe 2014-10-06 15:43 - 2014-10-06 15:43 - 00000962 _____ () C:\Users\Ralph\Desktop\JRT.txt 2014-10-06 15:40 - 2014-10-06 15:40 - 01705141 _____ (Thisisu) C:\Users\Ralph\Downloads\JRT.exe 2014-10-06 15:40 - 2014-10-06 15:40 - 00000000 ____D () C:\Windows\ERUNT 2014-10-06 14:29 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll 2014-10-06 14:27 - 2014-10-06 14:34 - 00000000 ____D () C:\AdwCleaner 2014-10-06 14:27 - 2014-10-06 14:27 - 01375089 _____ () C:\Users\Ralph\Downloads\AdwCleaner_3.311.exe 2014-10-06 14:15 - 2014-10-06 14:15 - 00001186 _____ () C:\Users\Ralph\Desktop\Revo Uninstaller.lnk 2014-10-06 14:15 - 2014-10-06 14:15 - 00000000 ____D () C:\Program Files\VS Revo Group 2014-10-06 14:14 - 2014-10-06 14:15 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Ralph\Downloads\revosetup95.exe 2014-10-06 12:28 - 2014-10-06 12:28 - 00041686 _____ () C:\Users\Ralph\Downloads\Shortcut.txt 2014-10-06 12:27 - 2014-10-06 12:28 - 00027095 _____ () C:\Users\Ralph\Downloads\Addition.txt 2014-10-06 12:26 - 2014-10-06 17:23 - 00013216 _____ () C:\Users\Ralph\Downloads\FRST.txt 2014-10-06 12:25 - 2014-10-06 17:23 - 00000000 ____D () C:\FRST 2014-10-06 12:23 - 2014-10-06 12:23 - 01101312 _____ (Farbar) C:\Users\Ralph\Downloads\FRST.exe 2014-10-06 10:38 - 2014-10-06 10:38 - 00380416 _____ () C:\Users\Ralph\Downloads\Gmer-19357.exe 2014-10-06 10:01 - 2014-10-06 10:01 - 00214576 _____ (Trend Micro Inc.) C:\Windows\RegBootClean.exe 2014-10-06 09:55 - 2014-10-06 09:55 - 00260652 _____ () C:\Users\Ralph\AppData\Local\census.cache 2014-10-06 09:54 - 2014-10-06 09:54 - 00120845 _____ () C:\Users\Ralph\AppData\Local\ars.cache 2014-10-06 09:32 - 2014-10-06 09:32 - 00000036 _____ () C:\Users\Ralph\AppData\Local\housecall.guid.cache 2014-10-06 09:32 - 2011-06-21 06:09 - 00200976 _____ (Trend Micro Inc.) C:\Windows\system32\Drivers\tmcomm.sys 2014-10-06 09:31 - 2014-10-06 09:31 - 02002416 _____ (Trend Micro Inc.) C:\Users\Ralph\Downloads\HousecallLauncher.exe 2014-10-04 23:51 - 2011-05-13 12:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\system32\dhRichClient3.dll 2014-10-04 23:51 - 2011-03-25 20:42 - 00338432 _____ () C:\Windows\system32\sqlite36_engine.dll 2014-10-04 23:49 - 2014-10-04 23:49 - 01101648 _____ () C:\Users\Ralph\Downloads\Stopzilla Antivirus - CHIP-Installer.exe 2014-10-04 18:58 - 2014-10-06 06:59 - 00000000 ____D () C:\NPE 2014-10-04 18:55 - 2014-10-04 18:55 - 03077776 ____N (Symantec Corporation) C:\Users\Ralph\Downloads\NPE.exe 2014-10-04 15:26 - 2014-10-04 18:43 - 00000000 ____D () C:\Windows\AF54923662584AC6A0435B5B89C6EB61.TMP 2014-10-04 15:25 - 2014-10-04 15:25 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Ralph\Downloads\SpyHunter-Installer.exe 2014-10-04 15:11 - 2014-10-06 10:34 - 00000472 _____ () C:\Users\Ralph\Downloads\defogger_disable.log 2014-10-04 15:11 - 2014-10-04 15:11 - 00050477 _____ () C:\Users\Ralph\Downloads\Defogger.exe 2014-10-04 15:01 - 2014-10-04 15:01 - 00000000 _____ () C:\Users\Ralph\defogger_reenable 2014-10-03 15:59 - 2014-10-03 15:59 - 00001069 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk 2014-10-03 15:58 - 2014-10-03 15:59 - 00001081 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2014-10-03 15:58 - 2014-10-03 15:58 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service 2014-09-30 10:22 - 2014-10-06 16:07 - 00004786 _____ () C:\Windows\PFRO.log 2014-09-29 09:07 - 2014-10-06 16:08 - 00003416 _____ () C:\Windows\setupact.log 2014-09-29 09:07 - 2014-09-29 09:07 - 00000000 _____ () C:\Windows\setuperr.log 2014-09-25 11:38 - 2014-10-03 15:58 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-09-21 20:11 - 2014-09-21 20:11 - 00000000 ____D () C:\Users\Ralph\Documents\WindowsImageBackup 2014-09-21 19:06 - 2014-09-21 19:06 - 00000000 ___RD () C:\Users\Ralph\Documents\RALPH-PC 2014-09-21 10:56 - 2014-10-06 16:11 - 00643139 _____ () C:\Windows\WindowsUpdate.log 2014-09-18 19:14 - 2014-09-19 06:53 - 00000000 ____D () C:\Users\Ralph\AppData\Local\Spotify 2014-09-18 19:14 - 2014-09-18 19:14 - 00001805 _____ () C:\Users\Ralph\Desktop\Spotify.lnk 2014-09-18 19:14 - 2014-09-18 19:14 - 00001791 _____ () C:\Users\Ralph\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk 2014-09-18 19:13 - 2014-09-19 11:34 - 00000000 ____D () C:\Users\Ralph\AppData\Roaming\Spotify 2014-09-18 19:06 - 2014-09-18 19:06 - 00136864 _____ (Spotify Ltd) C:\Users\Ralph\Downloads\SpotifySetup.exe 2014-09-14 19:08 - 2014-09-14 19:08 - 00000528 ____R () C:\Users\Ralph\Documents\MediaID.bin 2014-09-10 22:42 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-09-10 22:42 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-09-10 22:42 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-09-10 22:42 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-09-10 22:42 - 2014-08-18 23:57 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-09-10 22:42 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-09-10 22:42 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-09-10 22:42 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-09-10 22:42 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-09-10 22:42 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-09-10 22:42 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-09-10 22:42 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-09-10 22:42 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-09-10 22:42 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-09-10 22:42 - 2014-08-18 23:36 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-09-10 22:42 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-09-10 22:42 - 2014-08-18 23:30 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-09-10 22:42 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-09-10 22:42 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-09-10 22:42 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-09-10 22:42 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-09-10 22:42 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-09-10 22:42 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-09-10 22:42 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-09-10 22:42 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-09-10 22:42 - 2014-08-18 23:08 - 00673792 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-09-10 22:42 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-09-10 22:42 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-09-10 22:42 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-09-10 22:42 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-09-10 07:36 - 2014-07-07 03:40 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-09-10 07:36 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-10-06 17:03 - 2013-12-29 22:46 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-10-06 16:15 - 2009-07-14 06:34 - 00014960 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-10-06 16:15 - 2009-07-14 06:34 - 00014960 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-10-06 16:08 - 2013-12-29 23:18 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-10-06 16:07 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-10-06 16:07 - 2009-07-14 06:52 - 00000000 ____D () C:\Windows\Performance 2014-10-06 15:41 - 2013-12-30 19:46 - 00000000 ____D () C:\Users\Ralph\AppData\Local\CrashDumps 2014-10-06 07:10 - 2014-01-05 20:05 - 00000180 _____ () C:\Users\Ralph\AppData\Roaming\WB.CFG 2014-10-06 07:05 - 2014-01-02 16:20 - 00000000 ____D () C:\Users\Ralph\AppData\Local\NPE 2014-10-04 15:26 - 2014-01-01 20:18 - 00000000 ____D () C:\Program Files\Common Files\Wise Installation Wizard 2014-10-04 15:01 - 2013-12-29 22:27 - 00000000 ____D () C:\Users\Ralph 2014-10-02 21:37 - 2013-12-30 17:47 - 00000000 ____D () C:\Users\Ralph\AppData\Roaming\UseNeXT 2014-10-02 21:31 - 2014-01-13 11:20 - 00000000 ____D () C:\Users\Ralph\Documents\UseNeXT 2014-10-02 20:48 - 2013-12-29 22:31 - 01612484 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-09-26 07:34 - 2013-12-29 22:46 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2014-09-26 07:34 - 2013-12-29 22:46 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2014-09-25 14:58 - 2013-12-30 12:14 - 00002201 _____ () C:\Users\Public\Desktop\Norton 360.lnk 2014-09-25 14:58 - 2013-12-30 12:14 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360 2014-09-25 14:58 - 2013-12-30 12:14 - 00000000 ____D () C:\Windows\system32\Drivers\N360 2014-09-23 07:26 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public 2014-09-19 15:21 - 2013-12-29 23:35 - 00000000 ____D () C:\Users\Ralph\AppData\Roaming\vlc 2014-09-19 06:55 - 2014-01-13 18:53 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2014-09-15 09:06 - 2013-12-30 12:41 - 00231568 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-09-11 20:00 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache 2014-09-11 11:30 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET 2014-09-10 22:37 - 2014-01-02 15:56 - 00000000 ____D () C:\Windows\system32\MRT 2014-09-10 22:32 - 2014-01-02 15:56 - 98758480 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-09-10 07:29 - 2009-07-14 06:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-09-07 18:05 - 2014-08-11 19:29 - 00000000 ____D () C:\Users\Ralph\Documents\Calibre-Bibliothek 2014-09-07 18:01 - 2014-08-11 19:58 - 00000000 ____D () C:\Users\Ralph\Documents\My Digital Editions Some content of TEMP: ==================== C:\Users\Ralph\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-10-06 07:22 ==================== End Of Log ============================ --- --- --- |
|
06.10.2014, 19:26
| #8 |
| /// TB-Ausbilder | Es öffnen sich einach Fenster Win 7 Firefox Ja das hat schon viel schönes ^^ Eset Scan dauert lange ! ESET Online Scanner
Und bitte neue FRST Logs. Haken setzen bei addition.txt dann auf Scan klicken 
__________________ Lerne, zurück zu schlagen und unterstütze uns! TB Akademie | Spende | Lob & Kritik |
|
07.10.2014, 12:30
| #9 |
| | Es öffnen sich einach Fenster Win 7 Firefox ESETSmartInstaller@High as downloader log: all ok ESETSmartInstaller@High as downloader log: all ok # product=EOS # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.7623 # api_version=3.0.2 # EOSSerial=72bdc318b442a243b9b11a6e79579ee4 # engine=20478 # end=stopped # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2014-10-07 10:01:58 # local_time=2014-10-07 12:01:58 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1031 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode_1='Norton 360' # compatibility_mode=3598 16777213 100 100 1026192 163338613 0 0 # compatibility_mode_1='' # compatibility_mode=5893 16776573 100 94 110859 164307308 0 0 # scanned=69366 # found=29 # cleaned=0 # scan_time=5617 sh=E32ECB71CAA5BA1F62D7E28F6E7D76D226677B01 ft=1 fh=fc7b40d4e32d8af5 vn="Win32/Distromatic.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Amazon Browser Bar\search_protect.exe.vir" sh=9D44B14F10FDE6C9D45715517D1B2E193BE6CD2C ft=1 fh=4aa4805c575beef8 vn="Variante von Win32/Distromatic.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Amazon Browser Bar\uninstaller.exe.vir" sh=0FADB783C6C38284E5819BCADED2A1C50503F7AF ft=1 fh=fcdd72b19b62f8d2 vn="Win32/AdWare.SmartApps.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Bench\BService\1.1\bhelper.dll.vir" sh=CCFCD73F208F834C854E46E6F31DB11AADA5CF08 ft=1 fh=6a366370a714a51b vn="Win32/AdWare.SmartApps.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Bench\BService\1.1\bservice.exe.vir" sh=58787F33433447F2727A8811B33168C18C28DB32 ft=1 fh=c71c001199b91430 vn="Win32/AdWare.SmartApps.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Bench\NmHost\nmhost.exe.vir" sh=7BB9B28A48C61080F08A506BCE180EC51A3F36A7 ft=1 fh=973e2ab75d54163d vn="Win32/AdWare.SmartApps.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Bench\Proxy\cl.exe.vir" sh=9D085ECF4414599A6AE0E0913F41B0C42C0AFE16 ft=1 fh=c71c0011aae3df5f vn="Variante von Win32/AdWare.SmartApps.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Bench\Proxy\pwdg.exe.vir" sh=38822F744246B72AEFA8B3AF625CB63C810771EC ft=1 fh=4dc0d31d5b8edc90 vn="Win32/AdWare.SmartApps.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Bench\Updater\updater.exe.vir" sh=5D470FF7475A5B13F7BFA2F1C85A9FCD87E99AA7 ft=1 fh=7a4fd9ef27726362 vn="Win32/AdWare.SmartApps.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Bench\Updater\1.7.0.0\updater.exe.vir" sh=558B9F18F39F980BB52F023D2AEFE3522591AAE9 ft=1 fh=44b5e41c0a9f2e66 vn="Win32/AdWare.SmartApps.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Bench\Wd\wd.exe.vir" sh=7B1C9D79A789A4AC084770222AE48A2E8C9013E2 ft=1 fh=c71c00111a82f81a vn="Variante von Win32/AdWare.EoRezo.AU Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\fst_de_187\fst_de_187.exe.vir" sh=8E6A6992A3C7FEC4000FA1A4D764DD597109E0B5 ft=1 fh=c71c0011cd00713e vn="Win32/NextLive.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Mobogenie\nengine.dll.vir" sh=B018ADBCA951AC0EB0757AFFD7EAB8FC0228CA91 ft=1 fh=fda9a5748d3eb594 vn="Variante von Win32/Adware.SpeedingUpMyPC.C Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Probit Software\Easy Speed PC\ESPCSmartScan.exe.vir" sh=6F3A3B433459E6773C9FBE8CFB154DB6534EFA86 ft=1 fh=60bff0ff01dbe663 vn="Variante von Win32/InstallCore.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\VideoConverter\VideoConverter.exe.vir" sh=4E0EBFDA05108FA6814D132037C9325E6E92435A ft=1 fh=c71c0011e5bdd8ce vn="Variante von Win32/InstallCore.GZ evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\VideoConverter\Uninstall\__Uninstall_.exe.vir" sh=026727EC7D6B06AA7921A821BC1ADB2D81984D3C ft=1 fh=436f18bcc77206a1 vn="Variante von Win32/Adware.EoRezo.AJ Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ralph\AppData\Local\fst_de_103\upfst_de_103.exe.vir" sh=60BF5B7880EB06270FB4BCCCE6B4A02C8E14D0EC ft=1 fh=f8abc1b1f77880d7 vn="Win32/AdWare.EoRezo.AW Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ralph\AppData\Local\fst_de_103\Download\majfst_gentlede.exe.vir" sh=76C12DAFEEA5FB67CBEDF9504AD6A2E114527120 ft=1 fh=2cb177d2d9247b6c vn="Variante von Win32/AdWare.EoRezo.AU Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ralph\AppData\Local\fst_de_103\Download\setup_recover_fst_de_187.exe.vir" sh=8E6A6992A3C7FEC4000FA1A4D764DD597109E0B5 ft=1 fh=c71c0011cd00713e vn="Win32/NextLive.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ralph\AppData\Local\genienext\nengine.dll.vir" sh=9F82BB5DC8D4EC6B8B2BB47CB6C329B8AF1C14CE ft=1 fh=c92ed1f3ca58c043 vn="Win32/InstallCore.AZ evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ralph\AppData\Roaming\0D0S1L2Z1P1B\Video Converter Packages\uninstaller.exe.vir" sh=24EACADAF8910146B00A3B6146FAD19E11BFF03B ft=1 fh=5e1dc8d93e2d8e01 vn="Variante von Win32/Hao123.A evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst-egypt.exe" sh=34D77A23AA7C7648948E4BFAB31F33F517A785DC ft=1 fh=11cdaad78b073df2 vn="Variante von Win32/Hao123.A evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst-japan.exe" sh=D6AE522FF8806F7589D0FD0CC5D70B65B0B5E390 ft=1 fh=1211e94886f9a591 vn="Variante von Win32/Hao123.D evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst-saudi-forf.exe" sh=E5A3C100D2D0FD94482783AF2B2FF94CDFC9923F ft=1 fh=a0ddd0619a504a2e vn="Variante von Win32/Hao123.A evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst.exe" sh=CB32C6498397F3FF760EACD6D2C47D2F00C327DE ft=0 fh=0000000000000000 vn="Variante von Win32/SoftPulse.H evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Ralph\Documents\RALPH-PC\Backup Set 2014-09-21 190005\Backup Files 2014-09-21 190005\Backup files 13.zip" sh=C91745949C1C5CBE5674FA64266369051BB197D3 ft=0 fh=0000000000000000 vn="Win32/InstallCore.AZ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Ralph\Documents\RALPH-PC\Backup Set 2014-09-21 190005\Backup Files 2014-09-21 190005\Backup files 6.zip" sh=AF4F21AA9894D6706351C52333C0A6F89E4E0722 ft=0 fh=0000000000000000 vn="Win32/DealPly.M evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Ralph\Documents\RALPH-PC\Backup Set 2014-09-21 190005\Backup Files 2014-09-21 190005\Backup files 8.zip" sh=6A7517133799578512D41CFEA66CC42EEE570ED4 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\Ralph\Documents\RALPH-PC\Backup Set 2014-09-21 190005\Backup Files 2014-09-21 190005\Backup files 9.zip" sh=AABDF464C1BDA425FF063012C1F96A997E1758AE ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\Ralph\Documents\RALPH-PC\Backup Set 2014-09-21 190005\Backup Files 2014-09-28 190002\Backup files 1.zip" ESETSmartInstaller@High as downloader log: all ok # product=EOS # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.7623 # api_version=3.0.2 # EOSSerial=72bdc318b442a243b9b11a6e79579ee4 # engine=20478 # end=stopped # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2014-10-07 11:17:12 # local_time=2014-10-07 01:17:12 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1031 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode_1='Norton 360' # compatibility_mode=3598 16777213 100 100 1030707 163343128 0 0 # compatibility_mode_1='' # compatibility_mode=5893 16776573 100 94 8016 164311823 0 0 # scanned=69073 # found=25 # cleaned=0 # scan_time=3970 sh=E32ECB71CAA5BA1F62D7E28F6E7D76D226677B01 ft=1 fh=fc7b40d4e32d8af5 vn="Win32/Distromatic.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Amazon Browser Bar\search_protect.exe.vir" sh=9D44B14F10FDE6C9D45715517D1B2E193BE6CD2C ft=1 fh=4aa4805c575beef8 vn="Variante von Win32/Distromatic.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Amazon Browser Bar\uninstaller.exe.vir" sh=0FADB783C6C38284E5819BCADED2A1C50503F7AF ft=1 fh=fcdd72b19b62f8d2 vn="Win32/AdWare.SmartApps.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Bench\BService\1.1\bhelper.dll.vir" sh=CCFCD73F208F834C854E46E6F31DB11AADA5CF08 ft=1 fh=6a366370a714a51b vn="Win32/AdWare.SmartApps.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Bench\BService\1.1\bservice.exe.vir" sh=58787F33433447F2727A8811B33168C18C28DB32 ft=1 fh=c71c001199b91430 vn="Win32/AdWare.SmartApps.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Bench\NmHost\nmhost.exe.vir" sh=7BB9B28A48C61080F08A506BCE180EC51A3F36A7 ft=1 fh=973e2ab75d54163d vn="Win32/AdWare.SmartApps.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Bench\Proxy\cl.exe.vir" sh=9D085ECF4414599A6AE0E0913F41B0C42C0AFE16 ft=1 fh=c71c0011aae3df5f vn="Variante von Win32/AdWare.SmartApps.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Bench\Proxy\pwdg.exe.vir" sh=38822F744246B72AEFA8B3AF625CB63C810771EC ft=1 fh=4dc0d31d5b8edc90 vn="Win32/AdWare.SmartApps.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Bench\Updater\updater.exe.vir" sh=5D470FF7475A5B13F7BFA2F1C85A9FCD87E99AA7 ft=1 fh=7a4fd9ef27726362 vn="Win32/AdWare.SmartApps.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Bench\Updater\1.7.0.0\updater.exe.vir" sh=558B9F18F39F980BB52F023D2AEFE3522591AAE9 ft=1 fh=44b5e41c0a9f2e66 vn="Win32/AdWare.SmartApps.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Bench\Wd\wd.exe.vir" sh=7B1C9D79A789A4AC084770222AE48A2E8C9013E2 ft=1 fh=c71c00111a82f81a vn="Variante von Win32/AdWare.EoRezo.AU Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\fst_de_187\fst_de_187.exe.vir" sh=8E6A6992A3C7FEC4000FA1A4D764DD597109E0B5 ft=1 fh=c71c0011cd00713e vn="Win32/NextLive.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Mobogenie\nengine.dll.vir" sh=B018ADBCA951AC0EB0757AFFD7EAB8FC0228CA91 ft=1 fh=fda9a5748d3eb594 vn="Variante von Win32/Adware.SpeedingUpMyPC.C Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Probit Software\Easy Speed PC\ESPCSmartScan.exe.vir" sh=6F3A3B433459E6773C9FBE8CFB154DB6534EFA86 ft=1 fh=60bff0ff01dbe663 vn="Variante von Win32/InstallCore.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\VideoConverter\VideoConverter.exe.vir" sh=4E0EBFDA05108FA6814D132037C9325E6E92435A ft=1 fh=c71c0011e5bdd8ce vn="Variante von Win32/InstallCore.GZ evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\VideoConverter\Uninstall\__Uninstall_.exe.vir" sh=026727EC7D6B06AA7921A821BC1ADB2D81984D3C ft=1 fh=436f18bcc77206a1 vn="Variante von Win32/Adware.EoRezo.AJ Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ralph\AppData\Local\fst_de_103\upfst_de_103.exe.vir" sh=60BF5B7880EB06270FB4BCCCE6B4A02C8E14D0EC ft=1 fh=f8abc1b1f77880d7 vn="Win32/AdWare.EoRezo.AW Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ralph\AppData\Local\fst_de_103\Download\majfst_gentlede.exe.vir" sh=76C12DAFEEA5FB67CBEDF9504AD6A2E114527120 ft=1 fh=2cb177d2d9247b6c vn="Variante von Win32/AdWare.EoRezo.AU Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ralph\AppData\Local\fst_de_103\Download\setup_recover_fst_de_187.exe.vir" sh=8E6A6992A3C7FEC4000FA1A4D764DD597109E0B5 ft=1 fh=c71c0011cd00713e vn="Win32/NextLive.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ralph\AppData\Local\genienext\nengine.dll.vir" sh=9F82BB5DC8D4EC6B8B2BB47CB6C329B8AF1C14CE ft=1 fh=c92ed1f3ca58c043 vn="Win32/InstallCore.AZ evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ralph\AppData\Roaming\0D0S1L2Z1P1B\Video Converter Packages\uninstaller.exe.vir" sh=24EACADAF8910146B00A3B6146FAD19E11BFF03B ft=1 fh=5e1dc8d93e2d8e01 vn="Variante von Win32/Hao123.A evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst-egypt.exe" sh=34D77A23AA7C7648948E4BFAB31F33F517A785DC ft=1 fh=11cdaad78b073df2 vn="Variante von Win32/Hao123.A evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst-japan.exe" sh=D6AE522FF8806F7589D0FD0CC5D70B65B0B5E390 ft=1 fh=1211e94886f9a591 vn="Variante von Win32/Hao123.D evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst-saudi-forf.exe" sh=E5A3C100D2D0FD94482783AF2B2FF94CDFC9923F ft=1 fh=a0ddd0619a504a2e vn="Variante von Win32/Hao123.A evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst.exe" sh=CB32C6498397F3FF760EACD6D2C47D2F00C327DE ft=0 fh=0000000000000000 vn="Variante von Win32/SoftPulse.H evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Ralph\Documents\RALPH-PC\Backup Set 2014-09-21 190005\Backup Files 2014-09-21 190005\Backup files 13.zip" FRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 06-10-2014
Ran by Ralph at 2014-10-07 13:26:40
Running from C:\Users\Ralph\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Norton 360 Premier Edition (Enabled - Up to date) {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}
AS: Norton 360 Premier Edition (Enabled - Up to date) {631E4324-D31C-783F-EC5C-35AD42B18466}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Norton 360 Premier Edition (Enabled) {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (HKLM\...\7-Zip) (Version: - )
Adobe Digital Editions (HKLM\...\Digital Editions) (Version: - )
Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM\...\Adobe Shockwave Player) (Version: 12.1.0.150 - Adobe Systems, Inc.)
Apple Application Support (HKLM\...\{D9DAD0FF-495A-472B-9F10-BAE430A26682}) (Version: 3.0.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{18D47FA1-0440-48D3-A7E0-DA09537FF471}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
calibre (HKLM\...\{DD649DA2-BBD9-4247-85DD-E04F7C1E8552}) (Version: 1.48.0 - Kovid Goyal)
Camera RAW Plug-In for EPSON Creativity Suite (HKLM\...\{8DAC1AE4-33D1-4A78-8A42-00E09EDECC3E}) (Version: 2.1.0.0 - )
CCleaner (HKLM\...\CCleaner) (Version: 4.15 - Piriform)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.4852 - CDBurnerXP)
CX4300_5500_DX4400 Handbuch (HKLM\...\CX4300_5500_DX4400 Handbuch) (Version: - )
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
EPSON Attach To Email (HKLM\...\InstallShield_{20C45B32-5AB6-46A4-94EF-58950CAF05E5}) (Version: 1.01.0000 - SEIKO EPSON)
EPSON Attach To Email (Version: 1.01.0000 - SEIKO EPSON) Hidden
EPSON Easy Photo Print (HKLM\...\{B66E665A-DF96-4C38-9422-C7F74BC1B4E5}) (Version: 1.4.2.0 - )
EPSON File Manager (HKLM\...\{2EB81825-E9EE-44F4-8F51-1240C3898DC6}) (Version: 1.3.0.0 - )
EPSON Scan (HKLM\...\EPSON Scanner) (Version: - )
EPSON Scan Assistant (HKLM\...\{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}) (Version: 1.10.00 - )
EPSON-Drucker-Software (HKLM\...\EPSON Printer and Utilities) (Version: - SEIKO EPSON Corporation)
ESET Online Scanner v3 (HKLM\...\ESET Online Scanner) (Version: - )
FormatFactory 3.2.1.0 (HKLM\...\FormatFactory) (Version: 3.2.1.0 - Free Time)
Fotogalerie (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google+ Auto Backup (HKLM\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google)
iCloud (HKLM\...\{00A61104-74B5-4056-AD00-4397EF4FB141}) (Version: 3.1.0.40 - Apple Inc.)
IncrediMail (Version: 6.6.0.5288 - IncrediMail) Hidden
IncrediMail 2.5 (HKLM\...\IncrediMail) (Version: 6.6.0.5288 - IncrediMail Ltd.)
iTunes (HKLM\...\{A9B3F8D5-DF4F-462B-81B7-4B69EBEDBC5B}) (Version: 11.2.0.115 - Apple Inc.)
Java 7 Update 51 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Junk Mail filter update (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Extended DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden
Movie Maker (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Mozilla Firefox 32.0.3 (x86 de) (HKLM\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 32.0.3 - Mozilla)
MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (Version: 16.4.1108.0727 - Microsoft) Hidden
Norton 360 (HKLM\...\N360) (Version: 21.6.0.32 - Symantec Corporation)
NVIDIA 3D Vision Controller-Treiber 331.82 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 331.82 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 331.82 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 331.82 - NVIDIA Corporation)
NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 6.14.11.9713 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.57.35 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 331.82 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 331.82 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.26.4 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.26.4 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.142.992 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (Version: 9.13.0725 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.0725 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA ShadowPlay 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (HKLM\...\NVIDIAStereo) (Version: 7.17.11.9713 - NVIDIA Corporation)
NVIDIA Systemsteuerung 331.82 (Version: 331.82 - NVIDIA Corporation) Hidden
NVIDIA Update 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.19 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.19 - NVIDIA Corporation)
OpenOffice 4.0.1 (HKLM\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
Photo Gallery (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Photo Notifier and Animation Creator (HKLM\...\Photo Notifier and Animation Creator) (Version: 1.0.0.1009 - IncrediMail Ltd.)
Photo Notifier and Animation Creator (Version: 1.0.0.1009 - Ihr Firmenname) Hidden
QuickTime 7 (HKLM\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
SHIELD Streaming (Version: 1.6.85 - NVIDIA Corporation) Hidden
Spotify (HKCU\...\Spotify) (Version: 0.9.13.24.g5dbb3103 - Spotify AB)
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TomTom HOME (HKLM\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
TrekStor eReaderSuite (HKLM\...\eReaderSuite) (Version: - TrekStor GmbH)
Ulead PhotoImpact 8 (HKLM\...\InstallShield_{F101C58C-15CC-42B3-83D1-536CFB960634}) (Version: 8.0 - Ulead System)
Ulead PhotoImpact 8 (Version: 8.0 - Ulead System) Hidden
UseNeXT (HKLM\...\UseNeXT_is1) (Version: - Tangysoft Ltd.)
UseNeXT by Tangysoft (HKLM\...\UseNeXT by Tangysoft_is1) (Version: - Tangysoft Ltd.)
Vertus Play With Pictures 1.1.4 (HKLM\...\VertusPlayWithPictures) (Version: 1.1.4 - )
Video Converter Packages (HKCU\...\Video Converter Packages) (Version: - ) <==== ATTENTION
Visual Studio C++ 10.0 Runtime (HKLM\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN)
Windows Live Communications Platform (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 16.4.3522.0110 - Microsoft Corporation)
Windows Live Essentials (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live Messenger (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live Photo Common (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live SOXE (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live UX Platform (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live Writer (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live Writer Resources (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Mobile Device Center Driver Update (HKLM\...\{E7044E25-3038-4A76-9064-344AC038043E}) (Version: 6.1.6965.0 - Microsoft Corporation)
Windows Mobile-Gerätecenter (HKLM\...\{904CCF62-818D-4675-BC76-D37EB399F917}) (Version: 6.1.6965.0 - Microsoft Corporation)
Windows XP Mode (HKLM\...\{1374CC63-B520-4f3f-98E8-E9020BF01CFF}) (Version: 1.3.7600.16432 - Microsoft Corporation)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
03-10-2014 13:46:09 Windows Update
04-10-2014 13:26:43 Installed SpyHunter
04-10-2014 16:42:12 Removed SpyHunter
04-10-2014 17:13:15 Norton_Power_Eraser_20141004191311961
04-10-2014 21:52:31 Installed STOPzilla
04-10-2014 22:35:22 Removed STOPzilla
06-10-2014 03:12:55 Windows-Sicherung
07-10-2014 09:02:25 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:04 - 2014-10-04 23:54 - 00000860 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {56FAB2BD-B5D2-4E2D-B5AD-3492A197C665} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {865D162F-0B46-49BC-A64E-DD2A707AD03A} - System32\Tasks\Norton WSC Integration => C:\Program Files\Norton 360\Engine\21.6.0.32\WSCStub.exe [2014-09-21] (Symantec Corporation)
Task: {997B3A28-F930-4A84-B2A2-6DAEAAC3F66B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-26] (Adobe Systems Incorporated)
Task: {CA9D0366-B0F6-4117-8406-4F39AD22877C} - System32\Tasks\Norton 360\Norton Error Processor => C:\Program Files\Norton 360\Engine\21.6.0.32\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {D4EC5BF7-3C54-4BB3-96DF-4985FD2CCC4C} - System32\Tasks\Norton 360\Norton Error Analyzer => C:\Program Files\Norton 360\Engine\21.6.0.32\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {DB34767B-CD39-4C82-A67C-15F1455EC744} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {E8B5A5DB-1873-4E60-B1FA-0CE05E7AFD2B} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-06-24] (Piriform Ltd)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2014-01-20 14:17 - 2014-01-20 14:17 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2014-01-20 14:16 - 2014-01-20 14:16 - 01044808 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2014-10-03 15:58 - 2014-09-24 07:09 - 03715184 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2014-09-11 22:03 - 2014-09-11 22:03 - 16825520 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Windows:nlsPreferences
AlternateDataStreams: C:\ProgramData\Reprise:yhuwxvwhfkxkcqmbzxjuiqjduvsftifh
AlternateDataStreams: C:\ProgramData\TEMP:CB0AACC9
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
HKU\S-1-5-21-3046438628-3470693201-1580729714-1001\Software\Classes\.exe: exefile => <===== ATTENTION!
HKU\S-1-5-21-3046438628-3470693201-1580729714-1001\Software\Classes\exefile: <===== ATTENTION!
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\startupreg: APSDaemon => "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: EPSON Stylus DX4400 Series => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE /FU "C:\Windows\TEMP\E_SCB59.tmp" /EF "HKCU"
MSCONFIG\startupreg: eReader Suite => "C:\Program Files\TrekStor\eReaderSuite\TrekStor eReader Suite.exe" /startminimised
MSCONFIG\startupreg: IncrediMail => C:\Program Files\IncrediMail\bin\IncMail.exe /c
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: TomTomHOME.exe => "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"
========================= Accounts: ==========================
Administrator (S-1-5-21-3046438628-3470693201-1580729714-500 - Administrator - Disabled)
Eileen (S-1-5-21-3046438628-3470693201-1580729714-1004 - Limited - Enabled) => C:\Users\Eileen
Gast (S-1-5-21-3046438628-3470693201-1580729714-501 - Limited - Enabled)
HomeGroupUser$ (S-1-5-21-3046438628-3470693201-1580729714-1002 - Limited - Enabled)
Ralph (S-1-5-21-3046438628-3470693201-1580729714-1001 - Administrator - Enabled) => C:\Users\Ralph
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (10/06/2014 05:15:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 9609
Error: (10/06/2014 05:15:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 9609
Error: (10/06/2014 05:15:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
System errors:
=============
Error: (10/07/2014 00:06:21 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (10/07/2014 00:04:59 PM) (Source: Service Control Manager) (EventID: 7016) (User: )
Description: Der Dienst "NVIDIA Stereoscopic 3D Driver Service" hat einen ungültigen aktuellen Status gemeldet: 0
Error: (10/07/2014 10:16:06 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (10/06/2014 09:36:53 PM) (Source: Service Control Manager) (EventID: 7016) (User: )
Description: Der Dienst "NVIDIA Stereoscopic 3D Driver Service" hat einen ungültigen aktuellen Status gemeldet: 0
Error: (10/06/2014 04:07:53 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (10/06/2014 04:06:53 PM) (Source: Service Control Manager) (EventID: 7016) (User: )
Description: Der Dienst "NVIDIA Stereoscopic 3D Driver Service" hat einen ungültigen aktuellen Status gemeldet: 0
Microsoft Office Sessions:
=========================
Error: (10/06/2014 05:15:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 9609
Error: (10/06/2014 05:15:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 9609
Error: (10/06/2014 05:15:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
==================== Memory info ===========================
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 5600+
Percentage of memory in use: 55%
Total physical RAM: 1919.24 MB
Available physical RAM: 844.82 MB
Total Pagefile: 3838.48 MB
Available Pagefile: 2349.29 MB
Total Virtual: 2047.88 MB
Available Virtual: 1911.52 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:297.99 GB) (Free:129.52 GB) NTFS
Drive f: (CnMemory) (Fixed) (Total:1863.01 GB) (Free:1471.67 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 2EE32EE2)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=298 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: E0717E8E)
Partition 1: (Not Active) - (Size=1863 GB) - (Type=07 NTFS)
==================== End Of Log ============================
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 06-10-2014 Ran by Ralph (administrator) on RALPH-PC on 07-10-2014 13:25:39 Running from C:\Users\Ralph\Downloads Loaded Profile: Ralph (Available profiles: Ralph & Eileen) Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe (Symantec Corporation) C:\Program Files\Norton 360\Engine\21.6.0.32\n360.exe (Nalpeiron Ltd.) C:\Windows\System32\nlssrv32.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Spotify Ltd) C:\Users\Ralph\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Symantec Corporation) C:\Program Files\Norton 360\Engine\21.6.0.32\n360.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe (Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe (Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Nvtmru] => C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-14] (NVIDIA Corporation) HKLM\...\Run: [NvBackend] => C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap.dll,ShadowPlayOnSystemStart HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated) HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation) HKU\S-1-5-21-3046438628-3470693201-1580729714-1001\...\Run: [Spotify Web Helper] => C:\Users\Ralph\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1245752 2014-09-18] (Spotify Ltd) HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2014-01-02] (Microsoft Corporation) ShellIconOverlayIdentifiers: [OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files\Norton 360\Engine\21.6.0.32\buShell.dll (Symantec Corporation) ShellIconOverlayIdentifiers: [OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files\Norton 360\Engine\21.6.0.32\buShell.dll (Symantec Corporation) ShellIconOverlayIdentifiers: [OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files\Norton 360\Engine\21.6.0.32\buShell.dll (Symantec Corporation) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files\Norton 360\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation) BHO: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files\Norton 360\Engine\21.6.0.32\IPS\IPSBHO.DLL (Symantec Corporation) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation) Toolbar: HKCU - No Name - {41564952-412D-5637-4300-7A786E7484D7} - No File Toolbar: HKCU - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation) Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\xqrom0l5.default-1405937921458 FF NewTab: Google FF Homepage: hxxp://www.google.de/ FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll () FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1210150.dll (Adobe Systems, Inc.) FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=16.4.3522.0110 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @nvidia.com/3DVision -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\xqrom0l5.default-1405937921458\searchplugins\google-images.xml FF SearchPlugin: C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\xqrom0l5.default-1405937921458\searchplugins\google-maps.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Cliqz Beta - C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\xqrom0l5.default-1405937921458\Extensions\cliqz@cliqz.com.xpi [2014-10-06] FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn [2014-10-07] FF HKCU\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\xqrom0l5.default-1405937921458\extensions\cliqz@cliqz.com Chrome: ======= CHR HomePage: Default -> hxxp://www.google.com/ CHR RestoreOnStartup: Default -> "hxxp://www.google.com/" CHR CustomProfile: C:\Users\Ralph\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Docs) - C:\Users\Ralph\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-13] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 EPSON_PM_RPCV4_01; C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE [113664 2007-01-11] (SEIKO EPSON CORPORATION) R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 N360; C:\Program Files\Norton 360\Engine\21.6.0.32\N360.exe [265040 2014-09-21] (Symantec Corporation) R2 nlsX86cc; C:\Windows\system32\nlssrv32.exe [63488 2010-03-11] (Nalpeiron Ltd.) [File not signed] R2 NvNetworkService; C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [14658848 2013-12-10] (NVIDIA Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R1 BHDrvx86; C:\Program Files\Norton 360\NortonData\21.1.0.18\Definitions\BASHDefs\20141003.001\BHDrvx86.sys [1138392 2014-10-03] (Symantec Corporation) R1 ccSet_N360; C:\Windows\system32\drivers\N360\1506000.020\ccSetx86.sys [127064 2013-09-26] (Symantec Corporation) R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [378672 2014-09-09] (Symantec Corporation) R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [111408 2014-09-09] (Symantec Corporation) R1 IDSVix86; C:\Program Files\Norton 360\NortonData\21.1.0.18\Definitions\IPSDefs\20141006.001\IDSvix86.sys [476888 2014-08-30] (Symantec Corporation) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-10-07] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation) R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [5810 2004-08-13] () R3 NAVENG; C:\Program Files\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20141006.016\NAVENG.SYS [95704 2014-08-21] (Symantec Corporation) R3 NAVEX15; C:\Program Files\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20141006.016\NAVEX15.SYS [1636696 2014-08-21] (Symantec Corporation) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad32v.sys [34080 2013-12-05] (NVIDIA Corporation) R3 SRTSP; C:\Windows\System32\Drivers\N360\1506000.020\SRTSP.SYS [664792 2014-08-26] (Symantec Corporation) R1 SRTSPX; C:\Windows\system32\drivers\N360\1506000.020\SRTSPX.SYS [32984 2014-08-26] (Symantec Corporation) R0 SymDS; C:\Windows\System32\drivers\N360\1506000.020\SYMDS.SYS [367704 2013-09-10] (Symantec Corporation) R0 SymEFA; C:\Windows\System32\drivers\N360\1506000.020\SYMEFA.SYS [936152 2014-03-04] (Symantec Corporation) R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142936 2013-12-30] (Symantec Corporation) R1 SymIRON; C:\Windows\system32\drivers\N360\1506000.020\Ironx86.SYS [209624 2014-08-06] (Symantec Corporation) R1 SymNetS; C:\Windows\System32\Drivers\N360\1506000.020\SYMNETS.SYS [447704 2014-02-18] (Symantec Corporation) S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X] S2 sbapifs; system32\DRIVERS\sbapifs.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-10-07 10:22 - 2014-10-07 10:22 - 02347384 _____ (ESET) C:\Users\Ralph\Downloads\esetsmartinstaller_deu.exe 2014-10-07 10:22 - 2014-10-07 10:22 - 00000000 ____D () C:\Program Files\ESET 2014-10-06 16:09 - 2014-10-06 16:09 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys 2014-10-06 15:52 - 2014-10-07 12:39 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-10-06 15:51 - 2014-10-06 15:51 - 00001024 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-10-06 15:51 - 2014-10-06 15:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-10-06 15:51 - 2014-10-06 15:51 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-10-06 15:51 - 2014-10-06 15:51 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-10-06 15:51 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-10-06 15:51 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-10-06 15:51 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-10-06 15:50 - 2014-10-06 15:50 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Ralph\Downloads\mbam-setup-2.0.2.1012.exe 2014-10-06 15:43 - 2014-10-06 15:43 - 00000962 _____ () C:\Users\Ralph\Desktop\JRT.txt 2014-10-06 15:40 - 2014-10-06 15:40 - 01705141 _____ (Thisisu) C:\Users\Ralph\Downloads\JRT.exe 2014-10-06 15:40 - 2014-10-06 15:40 - 00000000 ____D () C:\Windows\ERUNT 2014-10-06 14:29 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll 2014-10-06 14:27 - 2014-10-06 14:34 - 00000000 ____D () C:\AdwCleaner 2014-10-06 14:27 - 2014-10-06 14:27 - 01375089 _____ () C:\Users\Ralph\Downloads\AdwCleaner_3.311.exe 2014-10-06 14:15 - 2014-10-06 14:15 - 00001186 _____ () C:\Users\Ralph\Desktop\Revo Uninstaller.lnk 2014-10-06 14:15 - 2014-10-06 14:15 - 00000000 ____D () C:\Program Files\VS Revo Group 2014-10-06 14:14 - 2014-10-06 14:15 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Ralph\Downloads\revosetup95.exe 2014-10-06 12:28 - 2014-10-06 12:28 - 00041686 _____ () C:\Users\Ralph\Downloads\Shortcut.txt 2014-10-06 12:27 - 2014-10-06 12:28 - 00027095 _____ () C:\Users\Ralph\Downloads\Addition.txt 2014-10-06 12:26 - 2014-10-07 13:26 - 00013136 _____ () C:\Users\Ralph\Downloads\FRST.txt 2014-10-06 12:25 - 2014-10-07 13:25 - 00000000 ____D () C:\FRST 2014-10-06 12:23 - 2014-10-06 12:23 - 01101312 _____ (Farbar) C:\Users\Ralph\Downloads\FRST.exe 2014-10-06 10:38 - 2014-10-06 10:38 - 00380416 _____ () C:\Users\Ralph\Downloads\Gmer-19357.exe 2014-10-06 10:01 - 2014-10-06 10:01 - 00214576 _____ (Trend Micro Inc.) C:\Windows\RegBootClean.exe 2014-10-06 09:55 - 2014-10-06 09:55 - 00260652 _____ () C:\Users\Ralph\AppData\Local\census.cache 2014-10-06 09:54 - 2014-10-06 09:54 - 00120845 _____ () C:\Users\Ralph\AppData\Local\ars.cache 2014-10-06 09:32 - 2014-10-06 09:32 - 00000036 _____ () C:\Users\Ralph\AppData\Local\housecall.guid.cache 2014-10-06 09:32 - 2011-06-21 06:09 - 00200976 _____ (Trend Micro Inc.) C:\Windows\system32\Drivers\tmcomm.sys 2014-10-06 09:31 - 2014-10-06 09:31 - 02002416 _____ (Trend Micro Inc.) C:\Users\Ralph\Downloads\HousecallLauncher.exe 2014-10-04 23:51 - 2011-05-13 12:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\system32\dhRichClient3.dll 2014-10-04 23:51 - 2011-03-25 20:42 - 00338432 _____ () C:\Windows\system32\sqlite36_engine.dll 2014-10-04 23:49 - 2014-10-04 23:49 - 01101648 _____ () C:\Users\Ralph\Downloads\Stopzilla Antivirus - CHIP-Installer.exe 2014-10-04 18:58 - 2014-10-06 06:59 - 00000000 ____D () C:\NPE 2014-10-04 18:55 - 2014-10-04 18:55 - 03077776 ____N (Symantec Corporation) C:\Users\Ralph\Downloads\NPE.exe 2014-10-04 15:26 - 2014-10-04 18:43 - 00000000 ____D () C:\Windows\AF54923662584AC6A0435B5B89C6EB61.TMP 2014-10-04 15:25 - 2014-10-04 15:25 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Ralph\Downloads\SpyHunter-Installer.exe 2014-10-04 15:11 - 2014-10-06 10:34 - 00000472 _____ () C:\Users\Ralph\Downloads\defogger_disable.log 2014-10-04 15:11 - 2014-10-04 15:11 - 00050477 _____ () C:\Users\Ralph\Downloads\Defogger.exe 2014-10-04 15:01 - 2014-10-04 15:01 - 00000000 _____ () C:\Users\Ralph\defogger_reenable 2014-10-03 15:59 - 2014-10-03 15:59 - 00001069 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk 2014-10-03 15:58 - 2014-10-03 15:59 - 00001081 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2014-10-03 15:58 - 2014-10-03 15:58 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service 2014-09-30 10:22 - 2014-10-07 12:06 - 00005446 _____ () C:\Windows\PFRO.log 2014-09-29 09:07 - 2014-10-07 12:06 - 00003752 _____ () C:\Windows\setupact.log 2014-09-29 09:07 - 2014-09-29 09:07 - 00000000 _____ () C:\Windows\setuperr.log 2014-09-25 11:38 - 2014-10-07 10:42 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-09-21 20:11 - 2014-09-21 20:11 - 00000000 ____D () C:\Users\Ralph\Documents\WindowsImageBackup 2014-09-21 19:06 - 2014-09-21 19:06 - 00000000 ___RD () C:\Users\Ralph\Documents\RALPH-PC 2014-09-21 10:56 - 2014-10-07 12:10 - 00718553 _____ () C:\Windows\WindowsUpdate.log 2014-09-18 19:14 - 2014-09-19 06:53 - 00000000 ____D () C:\Users\Ralph\AppData\Local\Spotify 2014-09-18 19:14 - 2014-09-18 19:14 - 00001805 _____ () C:\Users\Ralph\Desktop\Spotify.lnk 2014-09-18 19:14 - 2014-09-18 19:14 - 00001791 _____ () C:\Users\Ralph\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk 2014-09-18 19:13 - 2014-09-19 11:34 - 00000000 ____D () C:\Users\Ralph\AppData\Roaming\Spotify 2014-09-18 19:06 - 2014-09-18 19:06 - 00136864 _____ (Spotify Ltd) C:\Users\Ralph\Downloads\SpotifySetup.exe 2014-09-14 19:08 - 2014-09-14 19:08 - 00000528 ____R () C:\Users\Ralph\Documents\MediaID.bin 2014-09-10 22:42 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-09-10 22:42 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-09-10 22:42 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-09-10 22:42 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-09-10 22:42 - 2014-08-18 23:57 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-09-10 22:42 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-09-10 22:42 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-09-10 22:42 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-09-10 22:42 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-09-10 22:42 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-09-10 22:42 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-09-10 22:42 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-09-10 22:42 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-09-10 22:42 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-09-10 22:42 - 2014-08-18 23:36 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-09-10 22:42 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-09-10 22:42 - 2014-08-18 23:30 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-09-10 22:42 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-09-10 22:42 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-09-10 22:42 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-09-10 22:42 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-09-10 22:42 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-09-10 22:42 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-09-10 22:42 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-09-10 22:42 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-09-10 22:42 - 2014-08-18 23:08 - 00673792 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-09-10 22:42 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-09-10 22:42 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-09-10 22:42 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-09-10 22:42 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-09-10 07:36 - 2014-07-07 03:40 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-09-10 07:36 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-10-07 13:03 - 2013-12-29 22:46 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-10-07 12:14 - 2009-07-14 06:34 - 00014960 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-10-07 12:14 - 2009-07-14 06:34 - 00014960 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-10-07 12:06 - 2013-12-29 23:18 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-10-07 12:06 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-10-06 16:07 - 2009-07-14 06:52 - 00000000 ____D () C:\Windows\Performance 2014-10-06 15:41 - 2013-12-30 19:46 - 00000000 ____D () C:\Users\Ralph\AppData\Local\CrashDumps 2014-10-06 07:10 - 2014-01-05 20:05 - 00000180 _____ () C:\Users\Ralph\AppData\Roaming\WB.CFG 2014-10-06 07:05 - 2014-01-02 16:20 - 00000000 ____D () C:\Users\Ralph\AppData\Local\NPE 2014-10-04 15:26 - 2014-01-01 20:18 - 00000000 ____D () C:\Program Files\Common Files\Wise Installation Wizard 2014-10-04 15:01 - 2013-12-29 22:27 - 00000000 ____D () C:\Users\Ralph 2014-10-02 21:37 - 2013-12-30 17:47 - 00000000 ____D () C:\Users\Ralph\AppData\Roaming\UseNeXT 2014-10-02 21:31 - 2014-01-13 11:20 - 00000000 ____D () C:\Users\Ralph\Documents\UseNeXT 2014-10-02 20:48 - 2013-12-29 22:31 - 01612484 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-09-26 07:34 - 2013-12-29 22:46 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2014-09-26 07:34 - 2013-12-29 22:46 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2014-09-25 14:58 - 2013-12-30 12:14 - 00002201 _____ () C:\Users\Public\Desktop\Norton 360.lnk 2014-09-25 14:58 - 2013-12-30 12:14 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360 2014-09-25 14:58 - 2013-12-30 12:14 - 00000000 ____D () C:\Windows\system32\Drivers\N360 2014-09-23 07:26 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public 2014-09-19 15:21 - 2013-12-29 23:35 - 00000000 ____D () C:\Users\Ralph\AppData\Roaming\vlc 2014-09-19 06:55 - 2014-01-13 18:53 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2014-09-15 09:06 - 2013-12-30 12:41 - 00231568 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-09-11 20:00 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache 2014-09-11 11:30 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET 2014-09-10 22:37 - 2014-01-02 15:56 - 00000000 ____D () C:\Windows\system32\MRT 2014-09-10 22:32 - 2014-01-02 15:56 - 98758480 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-09-10 07:29 - 2009-07-14 06:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-09-07 18:05 - 2014-08-11 19:29 - 00000000 ____D () C:\Users\Ralph\Documents\Calibre-Bibliothek 2014-09-07 18:01 - 2014-08-11 19:58 - 00000000 ____D () C:\Users\Ralph\Documents\My Digital Editions Some content of TEMP: ==================== C:\Users\Ralph\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-10-06 07:22 ==================== End Of Log ============================ --- --- --- |
|
07.10.2014, 13:50
| #10 |
| /// TB-Ausbilder | Es öffnen sich einach Fenster Win 7 Firefox Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter "C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst-egypt.exe"
"C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst-japan.exe"
"C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst-saudi-forf.exe"
"C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst.exe"
HKU\S-1-5-21-3046438628-3470693201-1580729714-1001\Software\Classes\.exe: exefile => <===== ATTENTION!
HKU\S-1-5-21-3046438628-3470693201-1580729714-1001\Software\Classes\exefile: <===== ATTENTION!
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Gibts noch Spuren vom Browser Save oder sonstigem ? Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
Ansonsten sind die Logs sauber !  Die Reihenfolge ist hier entscheidend.
Abschließend habe ich noch ein paar Tipps zur Absicherung deines Systems. Ändere regelmäßig alle deine Passwörter, jetzt, nach der Bereinigung ist ein idealer Zeitpunkt dafür
Ich kann gar nicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti-Viren-Programm und zusätzlicher Schutz
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden. Mozilla Firefox
Performance
Was du vermeiden solltest:
Nun bleibt mir nur noch dir viel Spaß beim sicheren Surfen zu wünschen... ... und vielleicht möchtest du ja das Trojaner-Board unterstützen? Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann.
__________________ Lerne, zurück zu schlagen und unterstütze uns! TB Akademie | Spende | Lob & Kritik |
|
07.10.2014, 14:13
| #11 |
| | Es öffnen sich einach Fenster Win 7 Firefox Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 06-10-2014 Ran by Ralph at 2014-10-07 15:12:10 Run:1 Running from C:\Users\Ralph\Downloads Loaded Profile: Ralph (Available profiles: Ralph & Eileen) Boot Mode: Normal ============================================== Content of fixlist: ***************** "C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst-egypt.exe" "C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst-japan.exe" "C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst-saudi-forf.exe" "C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst.exe" HKU\S-1-5-21-3046438628-3470693201-1580729714-1001\Software\Classes\.exe: exefile => <===== ATTENTION! HKU\S-1-5-21-3046438628-3470693201-1580729714-1001\Software\Classes\exefile: <===== ATTENTION! ***************** C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst-egypt.exe => Moved successfully. C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst-japan.exe => Moved successfully. C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst-saudi-forf.exe => Moved successfully. C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst.exe => Moved successfully. "HKU\S-1-5-21-3046438628-3470693201-1580729714-1001\Software\Classes\exefile" => Key deleted successfully. "HKU\S-1-5-21-3046438628-3470693201-1580729714-1001\Software\Classes\.exe" => Key deleted successfully. "HKU\S-1-5-21-3046438628-3470693201-1580729714-1001\Software\Classes\exefile" => Key not found. ==== End of Fixlog ==== |
|
07.10.2014, 14:14
| #12 |
| /// TB-Ausbilder | Es öffnen sich einach Fenster Win 7 Firefox Ok, der Rechner ist soweit ok ?
__________________ Lerne, zurück zu schlagen und unterstütze uns! TB Akademie | Spende | Lob & Kritik |
|
07.10.2014, 16:27
| #13 |
| | Es öffnen sich einach Fenster Win 7 Firefox Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 06-10-2014 Ran by Ralph at 2014-10-07 15:23:03 Run:2 Running from C:\Users\Ralph\Downloads Loaded Profile: Ralph (Available profiles: Ralph & Eileen) Boot Mode: Normal ============================================== Content of fixlist: ***************** "C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst-egypt.exe" "C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst-japan.exe" "C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst-saudi-forf.exe" "C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst.exe" HKU\S-1-5-21-3046438628-3470693201-1580729714-1001\Software\Classes\.exe: exefile => <===== ATTENTION! HKU\S-1-5-21-3046438628-3470693201-1580729714-1001\Software\Classes\exefile: <===== ATTENTION! ***************** "C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst-egypt.exe" => File/Directory not found. "C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst-japan.exe" => File/Directory not found. "C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst-saudi-forf.exe" => File/Directory not found. "C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst.exe" => File/Directory not found. "HKU\S-1-5-21-3046438628-3470693201-1580729714-1001\Software\Classes\.exe" => Key not found. "HKU\S-1-5-21-3046438628-3470693201-1580729714-1001\Software\Classes\exefile" => Key not found. ==== End of Fixlog ==== Vielen Dank So alles erledigt. Rechner sauber und Deine Ratschläge beachtet. Vielen Dank, hast mir sehr geholfen. Ihr macht wirklich gute arbeit. Dann hoffentlich nicht bis zum nächsten mal |
|
| Themen zu Es öffnen sich einach Fenster Win 7 Firefox |
| autostart, blockiert, browser, button, downloaden, einfach, entfernt, erkennt, fenster, firefox, gestartet, leute, micro, neue, nichts, problem, recovery, sache, sachen, scan, taskleiste, tool, trend, win, öffnen |
Revo Uninstaller herunter.
dann auf 
und dann auf 
.
Linear-Darstellung
