| |
| |||||||
Log-Analyse und Auswertung: Windows 7: Win32.downloader.gen InfektionWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
31.08.2013, 14:51
| #1 |
 |  Windows 7: Win32.downloader.gen Infektion So ich habe alles gemacht: Die Logfiles: Combofix: Code:
ATTFilter Combofix Logfile: AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.001 - Report created 31/08/2013 at 15:10:12
# Updated 24/08/2013 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : SV - SV-PC
# Running from : C:\Users\SV\Desktop\adwcleaner.exe
# Option : Clean
***** [ Services ] *****
***** [ Files / Folders ] *****
Folder Deleted : C:\SearchProtect
Folder Deleted : C:\Program Files (x86)\Conduit
Folder Deleted : C:\Program Files (x86)\entrusted
Folder Deleted : C:\Users\SV\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Simon\AppData\Local\Conduit
Folder Deleted : C:\Users\Simon\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Simon\AppData\LocalLow\entrusted
Folder Deleted : C:\Users\Simon\AppData\Roaming\OpenCandy
Folder Deleted : C:\Users\Simon\AppData\Roaming\pdfforge
Folder Deleted : C:\Users\SV\AppData\Roaming\Mozilla\Firefox\Profiles\t06aumas.default\Conduit
Folder Deleted : C:\Users\SV\AppData\Roaming\Mozilla\Firefox\Profiles\t06aumas.default\jetpack
Folder Deleted : C:\Users\Simon\AppData\Roaming\Mozilla\Firefox\Profiles\85kdgvgr.default\Smartbar
File Deleted : C:\END
File Deleted : C:\Users\Simon\AppData\Roaming\Mozilla\Firefox\Profiles\85kdgvgr.default\searchplugins\Conduit.xml
***** [ Shortcuts ] *****
***** [ Registry ] *****
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@checkpoint.com/FFApi
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E44A1809-4D10-4AB8-B343-3326B64C7CDD}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{01335480-2AED-4070-AFF3-B4C8BC22FF35}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E44A1809-4D10-4AB8-B343-3326B64C7CDD}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{01335480-2AED-4070-AFF3-B4C8BC22FF35}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{10DDF518-1689-4108-A172-FF4CB7E39303}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7688381-0540-43CF-B38E-D1426DAAD4C6}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{25A3A431-30BB-47C8-AD6A-E1063801134F}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{E44A1809-4D10-4AB8-B343-3326B64C7CDD}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{E44A1809-4D10-4AB8-B343-3326B64C7CDD}]
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\entrusted
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\entrusted Toolbar
***** [ Browsers ] *****
-\\ Internet Explorer v9.0.8112.16502
-\\ Mozilla Firefox v23.0.1 (de)
[ File : C:\Users\SV\AppData\Roaming\Mozilla\Firefox\Profiles\t06aumas.default\prefs.js ]
Line Deleted : user_pref("CT2613550.DialogsAlignMode", "LTR");
Line Deleted : user_pref("CT2613550.EMailNotifierPollDate", "Mon Mar 21 2011 13:49:48 GMT+0100");
Line Deleted : user_pref("CT2613550.FeedLastCount3082739963941193807", 395);
Line Deleted : user_pref("CT2613550.FeedPollDate129254982599602533", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Deleted : user_pref("CT2613550.FeedPollDate129254982599602539", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Deleted : user_pref("CT2613550.FeedPollDate129254982599602545", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Deleted : user_pref("CT2613550.FeedPollDate129254982599602551", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Deleted : user_pref("CT2613550.FeedPollDate129254982599602557", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Deleted : user_pref("CT2613550.FeedPollDate129254982599602563", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Deleted : user_pref("CT2613550.FeedPollDate129254982599602569", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Deleted : user_pref("CT2613550.FeedPollDate129254982599602575", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Deleted : user_pref("CT2613550.FeedPollDate129254982599602581", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Deleted : user_pref("CT2613550.FeedPollDate129254982599602587", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Deleted : user_pref("CT2613550.FeedPollDate129254982599602593", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Deleted : user_pref("CT2613550.FeedPollDate129254982599602599", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Deleted : user_pref("CT2613550.FeedPollDate129254982599602605", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Deleted : user_pref("CT2613550.FeedPollDate129254982599602611", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Deleted : user_pref("CT2613550.FeedPollDate129254982599602617", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Deleted : user_pref("CT2613550.FeedPollDate129254982599602623", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Deleted : user_pref("CT2613550.FeedPollDate129254982599602629", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Deleted : user_pref("CT2613550.FeedTTL129254982599602545", 5);
Line Deleted : user_pref("CT2613550.FeedTTL129254982599602551", 5);
Line Deleted : user_pref("CT2613550.FeedTTL129254982599602575", 2);
Line Deleted : user_pref("CT2613550.FeedTTL129254982599602605", 5);
Line Deleted : user_pref("CT2613550.FeedTTL129254982599602617", 30);
Line Deleted : user_pref("CT2613550.FirstTimeFF3", true);
Line Deleted : user_pref("CT2613550.FirstTimeSettingsDone", true);
Line Deleted : user_pref("CT2613550.Initialize", true);
Line Deleted : user_pref("CT2613550.InitializeCommonPrefs", true);
Line Deleted : user_pref("CT2613550.InstallationType", "UnknownIntegration");
Line Deleted : user_pref("CT2613550.InstalledDate", "Mon Mar 21 2011 13:39:48 GMT+0100");
Line Deleted : user_pref("CT2613550.IsGrouping", false);
Line Deleted : user_pref("CT2613550.IsMulticommunity", false);
Line Deleted : user_pref("CT2613550.IsOpenThankYouPage", false);
Line Deleted : user_pref("CT2613550.IsOpenUninstallPage", true);
Line Deleted : user_pref("CT2613550.LanguagePackLastCheckTime", "Mon Mar 21 2011 13:40:20 GMT+0100");
Line Deleted : user_pref("CT2613550.Locale", "de-de");
Line Deleted : user_pref("CT2613550.MCDetectTooltipHeight", "83");
Line Deleted : user_pref("CT2613550.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Line Deleted : user_pref("CT2613550.MCDetectTooltipWidth", "295");
Line Deleted : user_pref("CT2613550.SHRINK_TOOLBAR", 1);
Line Deleted : user_pref("CT2613550.SearchEngine", "Suchen||hxxp://search.conduit.com/Results.aspx?q=UCM_SEARCH_TERM&ctid=CT2613550&octid=EB_ORIGINAL_CTID&SearchSource=1");
Line Deleted : user_pref("CT2613550.SearchFromAddressBarIsInit", true);
Line Deleted : user_pref("CT2613550.SettingsCheckIntervalMin", 120);
Line Deleted : user_pref("CT2613550.SettingsLastCheckTime", "Mon Mar 21 2011 13:39:47 GMT+0100");
Line Deleted : user_pref("CT2613550.SettingsLastUpdate", "1298419708");
Line Deleted : user_pref("CT2613550.ThirdPartyComponentsInterval", 504);
Line Deleted : user_pref("CT2613550.ThirdPartyComponentsLastCheck", "Mon Mar 21 2011 13:39:44 GMT+0100");
Line Deleted : user_pref("CT2613550.ThirdPartyComponentsLastUpdate", "1255348257");
Line Deleted : user_pref("CT2613550.Uninstall", true);
Line Deleted : user_pref("CT2613550.alertChannelId", "1006347");
Line Deleted : user_pref("CommunityToolbar.ToolbarsList", "CT2613550");
Line Deleted : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Mon Mar 21 2011 13:39:49 GMT+0100");
[ File : C:\Users\Simon\AppData\Roaming\Mozilla\Firefox\Profiles\85kdgvgr.default\prefs.js ]
Line Deleted : user_pref("CT3281675.1000082.isPlayDisplay", "true");
Line Deleted : user_pref("CT3281675.1000082.state", "{\"state\":\"stopped\",\"text\":\"Californi...\",\"description\":\"California Rock - Rock\",\"url\":\"hxxp://www.feedlive.net/california.asx\"}");
Line Deleted : user_pref("CT3281675.1000234.TWC_TMP_city", "DORTMUND");
Line Deleted : user_pref("CT3281675.1000234.TWC_TMP_country", "DE");
Line Deleted : user_pref("CT3281675.1000234.TWC_country", "GERMANY");
Line Deleted : user_pref("CT3281675.1000234.TWC_locId", "GMXX0024");
Line Deleted : user_pref("CT3281675.1000234.TWC_location", "Dortmund, Germany");
Line Deleted : user_pref("CT3281675.1000234.TWC_region", "DE");
Line Deleted : user_pref("CT3281675.1000234.TWC_temp_dis", "c");
Line Deleted : user_pref("CT3281675.1000234.TWC_wind_dis", "kmh");
Line Deleted : user_pref("CT3281675.1000234.weatherData", "{\"icon\":\"33.png\",\"temperature\":\"5°C\",\"temperatureClear\":\"5°C\",\"highTemperature\":\"5°C\",\"lowTemperature\":\"1°C\",\"feelsLike\":\"1°C\",\"con[...]
Line Deleted : user_pref("CT3281675.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
Line Deleted : user_pref("CT3281675.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"true\"}");
Line Deleted : user_pref("CT3281675.FF19Solved", "true");
Line Deleted : user_pref("CT3281675.FirstTime", "true");
Line Deleted : user_pref("CT3281675.FirstTimeFF3", "true");
Line Deleted : user_pref("CT3281675.PG_ENABLE", "dHJ1ZQ==");
Line Deleted : user_pref("CT3281675.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3281675&SearchSource=2&CUI=UN91253949298019266&UM=2&q=");
Line Deleted : user_pref("CT3281675.UserID", "UN91253949298019266");
Line Deleted : user_pref("CT3281675.addressBarTakeOverEnabledInHidden", "true");
Line Deleted : user_pref("CT3281675.amazonNew_All.enc", "MjM1MDgxLDIzNTA2MSwyMzUwOTEsMzgyODM1MSwyMDEzMDczTGg0dC9NU0VRaks5UXRrbjJIam0wQSwyMDEzMDc1NjY5ZDRLSmFUV1duRjFaNmFRK2JtQSwzNzk2MzcxLDM4NTk5OTEsMjM0OTUxLDM4NTk5OD[...]
Line Deleted : user_pref("CT3281675.appButtonDisablenull.enc", "MA==");
Line Deleted : user_pref("CT3281675.autoDisableScopes", -1);
Line Deleted : user_pref("CT3281675.browser.search.defaultthis.engineName", "true");
Line Deleted : user_pref("CT3281675.defaultSearch", "true");
Line Deleted : user_pref("CT3281675.embeddedsData", "[{\"appId\":\"130036105453116013\",\"apiPermissions\":{\"crossDomainAjax\":true,\"getMainFrameTitle\":true,\"getMainFrameUrl\":true,\"getSearchTerm\":true,\"insta[...]
Line Deleted : user_pref("CT3281675.enableAlerts", "always");
Line Deleted : user_pref("CT3281675.enableFix404ByUser", "FALSE");
Line Deleted : user_pref("CT3281675.enableSearchFromAddressBar", "true");
Line Deleted : user_pref("CT3281675.firstTimeDialogOpened", "true");
Line Deleted : user_pref("CT3281675.fixPageNotFoundError", "true");
Line Deleted : user_pref("CT3281675.fixPageNotFoundErrorByUser", "true");
Line Deleted : user_pref("CT3281675.fixPageNotFoundErrorInHidden", "true");
Line Deleted : user_pref("CT3281675.fixUrls", true);
Line Deleted : user_pref("CT3281675.hxxp___pinterest_aot_im.isEnabled.enc", "WQ==");
Line Deleted : user_pref("CT3281675.installDate", "16/3/2013 19:18:10");
Line Deleted : user_pref("CT3281675.installId", "conduitinstaller.exe");
Line Deleted : user_pref("CT3281675.installType", "conduitnsisintegration");
Line Deleted : user_pref("CT3281675.isCheckedStartAsHidden", true);
Line Deleted : user_pref("CT3281675.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
Line Deleted : user_pref("CT3281675.isFirstTimeToolbarLoading", "false");
Line Deleted : user_pref("CT3281675.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
Line Deleted : user_pref("CT3281675.keyword", "true");
Line Deleted : user_pref("CT3281675.lastNewTabSettings", "{\"isEnabled\":true,\"newTabUrl\":\"hxxp://search.conduit.com/?ctid=CT3281675&octid=CT3281675&SearchSource=15&CUI=UN91253949298019266&SSPV=NT_FF_RD&Lay=1&UM=[...]
Line Deleted : user_pref("CT3281675.lastVersion", "10.14.65.43");
Line Deleted : user_pref("CT3281675.mam_gk_installer_preapproved.enc", "ZmFsc2U=");
Line Deleted : user_pref("CT3281675.migrateAppsAndComponents", true);
Line Deleted : user_pref("CT3281675.navigationAliasesJson", "{\"EB_MAIN_FRAME_URL\":\"hxxp%3A%2F%2Fsearch.conduit.com%2F%3Fctid%3DCT3281675%26octid%3DCT3281675%26SearchSource%3D61%26CUI%3DUN91253949298019266%26UM%3D[...]
Line Deleted : user_pref("CT3281675.openThankYouPage", "false");
Line Deleted : user_pref("CT3281675.openUninstallPage", "true");
Line Deleted : user_pref("CT3281675.price-gong.isManagedApp", "true");
Line Deleted : user_pref("CT3281675.revertSettingsEnabled", "false");
Line Deleted : user_pref("CT3281675.search.searchAppId", "130036105453116013");
Line Deleted : user_pref("CT3281675.search.searchCount", "0");
Line Deleted : user_pref("CT3281675.searchFromAddressBarEnabledByUser", "true");
Line Deleted : user_pref("CT3281675.searchInNewTabEnabledByUser", "true");
Line Deleted : user_pref("CT3281675.searchInNewTabEnabledInHidden", "true");
Line Deleted : user_pref("CT3281675.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
Line Deleted : user_pref("CT3281675.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"data\":\"true\"}");
Line Deleted : user_pref("CT3281675.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"2\"}");
Line Deleted : user_pref("CT3281675.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"data\":\"CT3281675\"}");
Line Deleted : user_pref("CT3281675.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"string\",\"data\":\"hxxp://entrusted.OurToolbar.com//xpi\"}");
Line Deleted : user_pref("CT3281675.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"entrusted\"}");
Line Deleted : user_pref("CT3281675.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data\":\"true\"}");
Line Deleted : user_pref("CT3281675.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1363458012649");
Line Deleted : user_pref("CT3281675.serviceLayer_services_appsMetadata_lastUpdate", "1363458012542");
Line Deleted : user_pref("CT3281675.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1363458012498");
Line Deleted : user_pref("CT3281675.serviceLayer_services_location_lastUpdate", "1363458011770");
Line Deleted : user_pref("CT3281675.serviceLayer_services_login_10.14.65.43_lastUpdate", "1363458012862");
Line Deleted : user_pref("CT3281675.serviceLayer_services_menu_bfd1c71334f926ecd0bf043e0f822c7e_lastUpdate", "1363458012657");
Line Deleted : user_pref("CT3281675.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1363458012457");
Line Deleted : user_pref("CT3281675.serviceLayer_services_searchAPI_lastUpdate", "1363458011775");
Line Deleted : user_pref("CT3281675.serviceLayer_services_serviceMap_lastUpdate", "1363458011237");
Line Deleted : user_pref("CT3281675.serviceLayer_services_setupAPI_lastUpdate", "1363458012986");
Line Deleted : user_pref("CT3281675.serviceLayer_services_toolbarContextMenu_lastUpdate", "1363458012392");
Line Deleted : user_pref("CT3281675.serviceLayer_services_toolbarSettings_lastUpdate", "1363458011568");
Line Deleted : user_pref("CT3281675.serviceLayer_services_translation_lastUpdate", "1363458012570");
Line Deleted : user_pref("CT3281675.settingsINI", true);
Line Deleted : user_pref("CT3281675.shouldFirstTimeDialog", "false");
Line Deleted : user_pref("CT3281675.smartbar.CTID", "CT3281675");
Line Deleted : user_pref("CT3281675.smartbar.Uninstall", "0");
Line Deleted : user_pref("CT3281675.smartbar.homepage", true);
Line Deleted : user_pref("CT3281675.smartbar.toolbarName", "entrusted ");
Line Deleted : user_pref("CT3281675.startPage", "true");
Line Deleted : user_pref("CT3281675.toolbarBornServerTime", "16-3-2013");
Line Deleted : user_pref("CT3281675.toolbarCurrentServerTime", "16-3-2013");
Line Deleted : user_pref("CT3281675.toolbarDisabled", "true");
Line Deleted : user_pref("CT3281675.twitter_v1.8.0_twitter_app_open_t_f.enc", "ZmFsc2U=");
Line Deleted : user_pref("CT3281675_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1363458010400,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");
Line Deleted : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3281675&octid=CT3281675&SearchSource=61&CUI=UN91253949298019266&UM=2&UP=SP42A54C5C-9B42-4FF0-B806-419410DE0BAB");
Line Deleted : user_pref("Smartbar.ConduitSearchEngineList", "entrusted Customized Web Search");
Line Deleted : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3281675&SearchSource=2&CUI=UN91253949298019266&UM=2&q=");
Line Deleted : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "");
Line Deleted : user_pref("Smartbar.keywordURLSelectedCTID", "CT3281675");
Line Deleted : user_pref("browser.search.defaultthis.engineName", "entrusted Customized Web Search");
Line Deleted : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3281675&CUI=UN91253949298019266&UM=2&SearchSource=3&q={searchTerms}");
Line Deleted : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3281675&SearchSource=2&CUI=UN91253949298019266&UM=2&q=");
Line Deleted : user_pref("smartBar.searchInNewTabOwner", "CT3281675");
Line Deleted : user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT3281675&octid=CT3281675&SearchSource=61&CUI=UN91253949298019266&UM=2&UP=SP42A54C5C-9B42-4FF0-B806-419410DE0BAB,hxxp://searc[...]
Line Deleted : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3281675&SearchSource=2&CUI=UN91253949298019266&UM=2&q=");
Line Deleted : user_pref("smartbar.originalHomepage", "about:home");
Line Deleted : user_pref("smartbar.originalSearchAddressUrl", "");
Line Deleted : user_pref("smartbar.originalSearchEngine", "");
*************************
AdwCleaner[R0].txt - [19427 octets] - [31/08/2013 15:07:46]
AdwCleaner[S0].txt - [19666 octets] - [31/08/2013 15:10:12]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [19727 octets] ##########
[/code] AdWare (R0): AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.001 - Report created 31/08/2013 at 15:07:46
# Updated 24/08/2013 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : SV - SV-PC
# Running from : C:\Users\SV\Desktop\adwcleaner.exe
# Option : Scan
***** [ Services ] *****
***** [ Files / Folders ] *****
File Found : C:\END
File Found : C:\Users\Simon\AppData\Roaming\Mozilla\Firefox\Profiles\85kdgvgr.default\searchplugins\Conduit.xml
Folder Found C:\Program Files (x86)\Conduit
Folder Found C:\Program Files (x86)\entrusted
Folder Found C:\SearchProtect
Folder Found C:\Users\Simon\AppData\Local\Conduit
Folder Found C:\Users\Simon\AppData\LocalLow\Conduit
Folder Found C:\Users\Simon\AppData\LocalLow\entrusted
Folder Found C:\Users\Simon\AppData\Roaming\Mozilla\Firefox\Profiles\85kdgvgr.default\Smartbar
Folder Found C:\Users\Simon\AppData\Roaming\OpenCandy
Folder Found C:\Users\Simon\AppData\Roaming\pdfforge
Folder Found C:\Users\SV\AppData\LocalLow\Conduit
Folder Found C:\Users\SV\AppData\Roaming\Mozilla\Firefox\Profiles\t06aumas.default\Conduit
Folder Found C:\Users\SV\AppData\Roaming\Mozilla\Firefox\Profiles\t06aumas.default\jetpack
***** [ Shortcuts ] *****
***** [ Registry ] *****
Key Found : HKCU\Software\AppDataLow\Software\Conduit
Key Found : HKCU\Software\AppDataLow\Software\SmartBar
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{01335480-2AED-4070-AFF3-B4C8BC22FF35}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E44A1809-4D10-4AB8-B343-3326B64C7CDD}
Key Found : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Key Found : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Key Found : HKLM\Software\Conduit
Key Found : HKLM\Software\entrusted
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{10DDF518-1689-4108-A172-FF4CB7E39303}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7688381-0540-43CF-B38E-D1426DAAD4C6}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E44A1809-4D10-4AB8-B343-3326B64C7CDD}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{01335480-2AED-4070-AFF3-B4C8BC22FF35}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\entrusted Toolbar
Key Found : HKLM\SOFTWARE\MozillaPlugins\@checkpoint.com/FFApi
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{25A3A431-30BB-47C8-AD6A-E1063801134F}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{E44A1809-4D10-4AB8-B343-3326B64C7CDD}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{E44A1809-4D10-4AB8-B343-3326B64C7CDD}]
***** [ Browsers ] *****
-\\ Internet Explorer v9.0.8112.16502
-\\ Mozilla Firefox v23.0.1 (de)
[ File : C:\Users\SV\AppData\Roaming\Mozilla\Firefox\Profiles\t06aumas.default\prefs.js ]
Line Found : user_pref("CT2613550.DialogsAlignMode", "LTR");
Line Found : user_pref("CT2613550.EMailNotifierPollDate", "Mon Mar 21 2011 13:49:48 GMT+0100");
Line Found : user_pref("CT2613550.FeedLastCount3082739963941193807", 395);
Line Found : user_pref("CT2613550.FeedPollDate129254982599602533", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Found : user_pref("CT2613550.FeedPollDate129254982599602539", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Found : user_pref("CT2613550.FeedPollDate129254982599602545", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Found : user_pref("CT2613550.FeedPollDate129254982599602551", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Found : user_pref("CT2613550.FeedPollDate129254982599602557", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Found : user_pref("CT2613550.FeedPollDate129254982599602563", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Found : user_pref("CT2613550.FeedPollDate129254982599602569", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Found : user_pref("CT2613550.FeedPollDate129254982599602575", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Found : user_pref("CT2613550.FeedPollDate129254982599602581", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Found : user_pref("CT2613550.FeedPollDate129254982599602587", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Found : user_pref("CT2613550.FeedPollDate129254982599602593", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Found : user_pref("CT2613550.FeedPollDate129254982599602599", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Found : user_pref("CT2613550.FeedPollDate129254982599602605", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Found : user_pref("CT2613550.FeedPollDate129254982599602611", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Found : user_pref("CT2613550.FeedPollDate129254982599602617", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Found : user_pref("CT2613550.FeedPollDate129254982599602623", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Found : user_pref("CT2613550.FeedPollDate129254982599602629", "Mon Mar 21 2011 13:40:18 GMT+0100");
Line Found : user_pref("CT2613550.FeedTTL129254982599602545", 5);
Line Found : user_pref("CT2613550.FeedTTL129254982599602551", 5);
Line Found : user_pref("CT2613550.FeedTTL129254982599602575", 2);
Line Found : user_pref("CT2613550.FeedTTL129254982599602605", 5);
Line Found : user_pref("CT2613550.FeedTTL129254982599602617", 30);
Line Found : user_pref("CT2613550.FirstTimeFF3", true);
Line Found : user_pref("CT2613550.FirstTimeSettingsDone", true);
Line Found : user_pref("CT2613550.Initialize", true);
Line Found : user_pref("CT2613550.InitializeCommonPrefs", true);
Line Found : user_pref("CT2613550.InstallationType", "UnknownIntegration");
Line Found : user_pref("CT2613550.InstalledDate", "Mon Mar 21 2011 13:39:48 GMT+0100");
Line Found : user_pref("CT2613550.IsGrouping", false);
Line Found : user_pref("CT2613550.IsMulticommunity", false);
Line Found : user_pref("CT2613550.IsOpenThankYouPage", false);
Line Found : user_pref("CT2613550.IsOpenUninstallPage", true);
Line Found : user_pref("CT2613550.LanguagePackLastCheckTime", "Mon Mar 21 2011 13:40:20 GMT+0100");
Line Found : user_pref("CT2613550.Locale", "de-de");
Line Found : user_pref("CT2613550.MCDetectTooltipHeight", "83");
Line Found : user_pref("CT2613550.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Line Found : user_pref("CT2613550.MCDetectTooltipWidth", "295");
Line Found : user_pref("CT2613550.SHRINK_TOOLBAR", 1);
Line Found : user_pref("CT2613550.SearchEngine", "Suchen||hxxp://search.conduit.com/Results.aspx?q=UCM_SEARCH_TERM&ctid=CT2613550&octid=EB_ORIGINAL_CTID&SearchSource=1");
Line Found : user_pref("CT2613550.SearchFromAddressBarIsInit", true);
Line Found : user_pref("CT2613550.SettingsCheckIntervalMin", 120);
Line Found : user_pref("CT2613550.SettingsLastCheckTime", "Mon Mar 21 2011 13:39:47 GMT+0100");
Line Found : user_pref("CT2613550.SettingsLastUpdate", "1298419708");
Line Found : user_pref("CT2613550.ThirdPartyComponentsInterval", 504);
Line Found : user_pref("CT2613550.ThirdPartyComponentsLastCheck", "Mon Mar 21 2011 13:39:44 GMT+0100");
Line Found : user_pref("CT2613550.ThirdPartyComponentsLastUpdate", "1255348257");
Line Found : user_pref("CT2613550.Uninstall", true);
Line Found : user_pref("CT2613550.alertChannelId", "1006347");
Line Found : user_pref("CommunityToolbar.ToolbarsList", "CT2613550");
Line Found : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Mon Mar 21 2011 13:39:49 GMT+0100");
[ File : C:\Users\Simon\AppData\Roaming\Mozilla\Firefox\Profiles\85kdgvgr.default\prefs.js ]
Line Found : user_pref("CT3281675.1000082.isPlayDisplay", "true");
Line Found : user_pref("CT3281675.1000082.state", "{\"state\":\"stopped\",\"text\":\"Californi...\",\"description\":\"California Rock - Rock\",\"url\":\"hxxp://www.feedlive.net/california.asx\"}");
Line Found : user_pref("CT3281675.1000234.TWC_TMP_city", "DORTMUND");
Line Found : user_pref("CT3281675.1000234.TWC_TMP_country", "DE");
Line Found : user_pref("CT3281675.1000234.TWC_country", "GERMANY");
Line Found : user_pref("CT3281675.1000234.TWC_locId", "GMXX0024");
Line Found : user_pref("CT3281675.1000234.TWC_location", "Dortmund, Germany");
Line Found : user_pref("CT3281675.1000234.TWC_region", "DE");
Line Found : user_pref("CT3281675.1000234.TWC_temp_dis", "c");
Line Found : user_pref("CT3281675.1000234.TWC_wind_dis", "kmh");
Line Found : user_pref("CT3281675.1000234.weatherData", "{\"icon\":\"33.png\",\"temperature\":\"5°C\",\"temperatureClear\":\"5°C\",\"highTemperature\":\"5°C\",\"lowTemperature\":\"1°C\",\"feelsLike\":\"1°C\",\"con[...]
Line Found : user_pref("CT3281675.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
Line Found : user_pref("CT3281675.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"true\"}");
Line Found : user_pref("CT3281675.FF19Solved", "true");
Line Found : user_pref("CT3281675.FirstTime", "true");
Line Found : user_pref("CT3281675.FirstTimeFF3", "true");
Line Found : user_pref("CT3281675.PG_ENABLE", "dHJ1ZQ==");
Line Found : user_pref("CT3281675.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3281675&SearchSource=2&CUI=UN91253949298019266&UM=2&q=");
Line Found : user_pref("CT3281675.UserID", "UN91253949298019266");
Line Found : user_pref("CT3281675.addressBarTakeOverEnabledInHidden", "true");
Line Found : user_pref("CT3281675.amazonNew_All.enc", "MjM1MDgxLDIzNTA2MSwyMzUwOTEsMzgyODM1MSwyMDEzMDczTGg0dC9NU0VRaks5UXRrbjJIam0wQSwyMDEzMDc1NjY5ZDRLSmFUV1duRjFaNmFRK2JtQSwzNzk2MzcxLDM4NTk5OTEsMjM0OTUxLDM4NTk5OD[...]
Line Found : user_pref("CT3281675.appButtonDisablenull.enc", "MA==");
Line Found : user_pref("CT3281675.autoDisableScopes", -1);
Line Found : user_pref("CT3281675.browser.search.defaultthis.engineName", "true");
Line Found : user_pref("CT3281675.defaultSearch", "true");
Line Found : user_pref("CT3281675.embeddedsData", "[{\"appId\":\"130036105453116013\",\"apiPermissions\":{\"crossDomainAjax\":true,\"getMainFrameTitle\":true,\"getMainFrameUrl\":true,\"getSearchTerm\":true,\"insta[...]
Line Found : user_pref("CT3281675.enableAlerts", "always");
Line Found : user_pref("CT3281675.enableFix404ByUser", "FALSE");
Line Found : user_pref("CT3281675.enableSearchFromAddressBar", "true");
Line Found : user_pref("CT3281675.firstTimeDialogOpened", "true");
Line Found : user_pref("CT3281675.fixPageNotFoundError", "true");
Line Found : user_pref("CT3281675.fixPageNotFoundErrorByUser", "true");
Line Found : user_pref("CT3281675.fixPageNotFoundErrorInHidden", "true");
Line Found : user_pref("CT3281675.fixUrls", true);
Line Found : user_pref("CT3281675.hxxp___pinterest_aot_im.isEnabled.enc", "WQ==");
Line Found : user_pref("CT3281675.installDate", "16/3/2013 19:18:10");
Line Found : user_pref("CT3281675.installId", "conduitinstaller.exe");
Line Found : user_pref("CT3281675.installType", "conduitnsisintegration");
Line Found : user_pref("CT3281675.isCheckedStartAsHidden", true);
Line Found : user_pref("CT3281675.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
Line Found : user_pref("CT3281675.isFirstTimeToolbarLoading", "false");
Line Found : user_pref("CT3281675.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
Line Found : user_pref("CT3281675.keyword", "true");
Line Found : user_pref("CT3281675.lastNewTabSettings", "{\"isEnabled\":true,\"newTabUrl\":\"hxxp://search.conduit.com/?ctid=CT3281675&octid=CT3281675&SearchSource=15&CUI=UN91253949298019266&SSPV=NT_FF_RD&Lay=1&UM=[...]
Line Found : user_pref("CT3281675.lastVersion", "10.14.65.43");
Line Found : user_pref("CT3281675.mam_gk_installer_preapproved.enc", "ZmFsc2U=");
Line Found : user_pref("CT3281675.migrateAppsAndComponents", true);
Line Found : user_pref("CT3281675.navigationAliasesJson", "{\"EB_MAIN_FRAME_URL\":\"hxxp%3A%2F%2Fsearch.conduit.com%2F%3Fctid%3DCT3281675%26octid%3DCT3281675%26SearchSource%3D61%26CUI%3DUN91253949298019266%26UM%3D[...]
Line Found : user_pref("CT3281675.openThankYouPage", "false");
Line Found : user_pref("CT3281675.openUninstallPage", "true");
Line Found : user_pref("CT3281675.price-gong.isManagedApp", "true");
Line Found : user_pref("CT3281675.revertSettingsEnabled", "false");
Line Found : user_pref("CT3281675.search.searchAppId", "130036105453116013");
Line Found : user_pref("CT3281675.search.searchCount", "0");
Line Found : user_pref("CT3281675.searchFromAddressBarEnabledByUser", "true");
Line Found : user_pref("CT3281675.searchInNewTabEnabledByUser", "true");
Line Found : user_pref("CT3281675.searchInNewTabEnabledInHidden", "true");
Line Found : user_pref("CT3281675.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
Line Found : user_pref("CT3281675.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"data\":\"true\"}");
Line Found : user_pref("CT3281675.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"2\"}");
Line Found : user_pref("CT3281675.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"data\":\"CT3281675\"}");
Line Found : user_pref("CT3281675.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"string\",\"data\":\"hxxp://entrusted.OurToolbar.com//xpi\"}");
Line Found : user_pref("CT3281675.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"entrusted\"}");
Line Found : user_pref("CT3281675.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data\":\"true\"}");
Line Found : user_pref("CT3281675.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1363458012649");
Line Found : user_pref("CT3281675.serviceLayer_services_appsMetadata_lastUpdate", "1363458012542");
Line Found : user_pref("CT3281675.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1363458012498");
Line Found : user_pref("CT3281675.serviceLayer_services_location_lastUpdate", "1363458011770");
Line Found : user_pref("CT3281675.serviceLayer_services_login_10.14.65.43_lastUpdate", "1363458012862");
Line Found : user_pref("CT3281675.serviceLayer_services_menu_bfd1c71334f926ecd0bf043e0f822c7e_lastUpdate", "1363458012657");
Line Found : user_pref("CT3281675.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1363458012457");
Line Found : user_pref("CT3281675.serviceLayer_services_searchAPI_lastUpdate", "1363458011775");
Line Found : user_pref("CT3281675.serviceLayer_services_serviceMap_lastUpdate", "1363458011237");
Line Found : user_pref("CT3281675.serviceLayer_services_setupAPI_lastUpdate", "1363458012986");
Line Found : user_pref("CT3281675.serviceLayer_services_toolbarContextMenu_lastUpdate", "1363458012392");
Line Found : user_pref("CT3281675.serviceLayer_services_toolbarSettings_lastUpdate", "1363458011568");
Line Found : user_pref("CT3281675.serviceLayer_services_translation_lastUpdate", "1363458012570");
Line Found : user_pref("CT3281675.settingsINI", true);
Line Found : user_pref("CT3281675.shouldFirstTimeDialog", "false");
Line Found : user_pref("CT3281675.smartbar.CTID", "CT3281675");
Line Found : user_pref("CT3281675.smartbar.Uninstall", "0");
Line Found : user_pref("CT3281675.smartbar.homepage", true);
Line Found : user_pref("CT3281675.smartbar.toolbarName", "entrusted ");
Line Found : user_pref("CT3281675.startPage", "true");
Line Found : user_pref("CT3281675.toolbarBornServerTime", "16-3-2013");
Line Found : user_pref("CT3281675.toolbarCurrentServerTime", "16-3-2013");
Line Found : user_pref("CT3281675.toolbarDisabled", "true");
Line Found : user_pref("CT3281675.twitter_v1.8.0_twitter_app_open_t_f.enc", "ZmFsc2U=");
Line Found : user_pref("CT3281675_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1363458010400,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");
Line Found : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3281675&octid=CT3281675&SearchSource=61&CUI=UN91253949298019266&UM=2&UP=SP42A54C5C-9B42-4FF0-B806-419410DE0BAB");
Line Found : user_pref("Smartbar.ConduitSearchEngineList", "entrusted Customized Web Search");
Line Found : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3281675&SearchSource=2&CUI=UN91253949298019266&UM=2&q=");
Line Found : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "");
Line Found : user_pref("Smartbar.keywordURLSelectedCTID", "CT3281675");
Line Found : user_pref("browser.search.defaultthis.engineName", "entrusted Customized Web Search");
Line Found : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3281675&CUI=UN91253949298019266&UM=2&SearchSource=3&q={searchTerms}");
Line Found : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3281675&SearchSource=2&CUI=UN91253949298019266&UM=2&q=");
Line Found : user_pref("smartBar.searchInNewTabOwner", "CT3281675");
Line Found : user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT3281675&octid=CT3281675&SearchSource=61&CUI=UN91253949298019266&UM=2&UP=SP42A54C5C-9B42-4FF0-B806-419410DE0BAB,hxxp://searc[...]
Line Found : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3281675&SearchSource=2&CUI=UN91253949298019266&UM=2&q=");
Line Found : user_pref("smartbar.originalHomepage", "about:home");
Line Found : user_pref("smartbar.originalSearchAddressUrl", "");
Line Found : user_pref("smartbar.originalSearchEngine", "");
*************************
AdwCleaner[R0].txt - [19281 octets] - [31/08/2013 15:07:46]
########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [19342 octets] ##########
JRT: Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.5.6 (08.30.2013:1)
OS: Windows 7 Home Premium x64
Ran by SV on 31.08.2013 at 15:17:00,70
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Toolbar.CT2613550
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Toolbar.CT3281675
~~~ Files
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\SV\AppData\Roaming\mozilla\firefox\profiles\t06aumas.default\minidumps [18 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 31.08.2013 at 15:25:07,66
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-08-2013 01
Ran by SV (administrator) on SV-PC on 31-08-2013 15:36:41
Running from C:\Users\SV\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(Egis Technology Inc. ) C:\Program Files (x86)\EgisTec BioExcess\EgisService.exe
(Egis Technology Inc. ) C:\Program Files (x86)\EgisTec Port Locker\Egishlpsvc.exe
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\windows\system32\WLANExt.exe
() C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
(Microsoft Corporation) C:\windows\SysWOW64\svchost.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
(Egis Technology Inc. ) C:\Program Files (x86)\EgisTec BioExcess\EgisDSService.exe
(Lenovo Group Limited) C:\Program Files (x86)\Lenovo\ReadyComm\common\IGRS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
() c:\Program Files\Ocster Backup\bin\backupService-ox.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtLED\RtLEDService.exe
(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtLED\RtLED.exe
(Microsoft Corporation) c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Akamai Technologies, Inc.) C:\Users\SV\AppData\Local\Akamai\netsession_win.exe
(Nokia) C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe
(Dropbox, Inc.) C:\Users\SV\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Akamai Technologies, Inc.) C:\Users\SV\AppData\Local\Akamai\netsession_win.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() c:\Program Files\Ocster Backup\bin\oxHelper.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclUSBSrv64.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [IAAnotif] - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)
HKLM\...\Run: [NvCplDaemon] - C:\windows\system32\NvCpl.dll [17412200 2010-04-07] (NVIDIA Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10821224 2010-06-02] (Realtek Semiconductor)
HKLM\...\Policies\Explorer: [NoDrives] 0
HKCU\...\Run: [Akamai NetSession Interface] - C:\Users\SV\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.)
HKCU\...\Run: [NokiaSuite.exe] - C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [1083264 2012-01-10] (Nokia)
HKCU\...\Policies\Explorer: [NoDrives] 0
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKU\Default\...\RunOnce: [WLStart] - C:\Program Files (x86)\Windows Live\Installer\wlstart.exe [786760 2009-07-26] (Microsoft Corporation)
HKU\Default User\...\RunOnce: [WLStart] - C:\Program Files (x86)\Windows Live\Installer\wlstart.exe [786760 2009-07-26] (Microsoft Corporation)
HKU\Simon\...\Run: [SearchProtect] - C:\Users\Simon\AppData\Roaming\SearchProtect\bin\cltmng.exe [x]
HKU\UpdatusUser\...\Run: [FactoryTest] - C:\Windows\Test.bat [x]
HKU\UpdatusUser\...\Run: [Power2GoExpress] - C:\Program Files (x86)\Lenovo\Power2Go\Power2GoExpress.exe [2532648 2009-07-13] (Cyberlink)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll [95848 2010-04-07] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [89704 2010-04-07] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\SV\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\SV\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR)
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO-x32: IEPwdBankBHO Class - {56CBB761-DA41-4E31-B270-B13B4B0A61D0} - C:\Program Files (x86)\EgisTec BioExcess\EgisIEPwdBank.dll (Egis Technology Inc. )
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\SV\AppData\Roaming\Mozilla\Firefox\Profiles\t06aumas.default
FF NetworkProxy: "type", 4
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\wikipedia-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\SV\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: firefox - C:\Users\SV\AppData\Roaming\Mozilla\Firefox\Profiles\t06aumas.default\Extensions\firefox@ghostery.com.xpi
FF Extension: pencil - C:\Users\SV\AppData\Roaming\Mozilla\Firefox\Profiles\t06aumas.default\Extensions\pencil@evolus.vn.xpi
FF Extension: trackmenot - C:\Users\SV\AppData\Roaming\Mozilla\Firefox\Profiles\t06aumas.default\Extensions\trackmenot@mrl.nyu.edu.xpi
FF Extension: No Name - C:\Users\SV\AppData\Roaming\Mozilla\Firefox\Profiles\t06aumas.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: No Name - C:\Users\SV\AppData\Roaming\Mozilla\Firefox\Profiles\t06aumas.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
FF HKLM-x32\...\Firefox\Extensions: [fe_8.0@nokia.com] C:\Program Files (x86)\Nokia\Nokia Suite\Connectors\Bookmarks Connector\FirefoxExtension_8.0
FF Extension: Firefox Synchronisation Extension - C:\Program Files (x86)\Nokia\Nokia Suite\Connectors\Bookmarks Connector\FirefoxExtension_8.0
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF HKLM-x32\...\Thunderbird\Extensions: [te_9.0@nokia.com] C:\Program Files (x86)\Nokia\Nokia Suite\Connectors\Thunderbird Connector\ThunderbirdExtension_9.0
FF Extension: Thunderbird Address Book Synchronisation Extension - C:\Program Files (x86)\Nokia\Nokia Suite\Connectors\Thunderbird Connector\ThunderbirdExtension_9.0
==================== Services (Whitelisted) =================
R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-02] (Akamai Technologies, Inc.)
R2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [903456 2010-04-20] (Broadcom Corporation.)
R2 EgisTec Data Security Service; C:\Program Files (x86)\EgisTec BioExcess\EgisDSService.exe [314736 2010-05-28] (Egis Technology Inc. )
R2 EgisTec Service Help; C:\Program Files (x86)\EgisTec Port Locker\Egishlpsvc.exe [322416 2010-05-19] (Egis Technology Inc. )
R2 IGRS; C:\Program Files (x86)\Lenovo\ReadyComm\common\IGRS.exe [38152 2009-07-14] (Lenovo Group Limited)
S3 Lenovo ReadyComm AppSvc; C:\Program Files\Lenovo\ReadyComm\AppSvc.exe [509192 2009-08-14] (Lenovo Group Limited)
S3 Lenovo ReadyComm ConnSvc; C:\Program Files\Lenovo\ReadyComm\ConnSvc.exe [579400 2009-09-22] (Lenovo Group Limited)
R2 ocster_backup; c:\Program Files\Ocster Backup\bin\backupService-ox.exe [21280 2011-06-29] ()
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR)
S3 PS_MDP; C:\Program Files (x86)\Lenovo\ReadyComm\PS_MDP.dll [276296 2009-07-16] (Lenovo Group Limited)
S2 ReadyComm.DirectRouter; C:\Program Files (x86)\Lenovo\ReadyComm\common\router.dll [103688 2009-07-14] (Lenovo Group Limited)
R2 RtLedService; C:\Program Files\Realtek\RtLED\RtLEDService.exe [311296 2010-02-05] (Realtek Semiconductor Corp.)
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
==================== Drivers (Whitelisted) ====================
S3 Bridge0; C:\Windows\System32\drivers\WDBridge.sys [79376 2009-07-16] (Lenovo)
R3 JmUsbCcgp; C:\Windows\System32\DRIVERS\jmccgp.sys [17520 2009-12-03] (JMicron Technology Corp.)
R3 JmUsbVideo; C:\Windows\System32\Drivers\jmcam.sys [54000 2009-12-03] (JMicron Technology Corp.)
R3 JmUsbVideo2; C:\Windows\System32\Drivers\jmcam_lo.sys [28656 2009-12-03] (JMicron Technology Corp.)
R3 wdmirror; C:\Windows\System32\DRIVERS\WDMirror.sys [11280 2009-07-16] (Lenovo)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-31 15:25 - 2013-08-31 15:25 - 00001042 _____ C:\Users\SV\Desktop\JRT.txt
2013-08-31 15:16 - 2013-08-31 15:16 - 00000000 ____D C:\windows\ERUNT
2013-08-31 15:13 - 2013-08-31 15:13 - 00019808 _____ C:\Users\SV\Desktop\AdwCleaner[S0].txt
2013-08-31 15:13 - 2013-08-31 15:13 - 00019427 _____ C:\Users\SV\Desktop\AdwCleaner[R0].txt
2013-08-31 15:07 - 2013-08-31 15:10 - 00000000 ____D C:\AdwCleaner
2013-08-31 14:59 - 2013-08-31 14:59 - 00026309 _____ C:\ComboFix.txt
2013-08-31 14:31 - 2011-06-26 08:45 - 00256000 _____ C:\windows\PEV.exe
2013-08-31 14:31 - 2010-11-07 19:20 - 00208896 _____ C:\windows\MBR.exe
2013-08-31 14:31 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2013-08-31 14:31 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2013-08-31 14:31 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2013-08-31 14:31 - 2000-08-31 02:00 - 00098816 _____ C:\windows\sed.exe
2013-08-31 14:31 - 2000-08-31 02:00 - 00080412 _____ C:\windows\grep.exe
2013-08-31 14:31 - 2000-08-31 02:00 - 00068096 _____ C:\windows\zip.exe
2013-08-31 14:30 - 2013-08-31 15:00 - 00000000 ____D C:\Qoobox
2013-08-31 14:29 - 2013-08-31 14:55 - 00000000 ____D C:\windows\erdnt
2013-08-31 14:27 - 2013-08-31 14:27 - 01027511 _____ (Thisisu) C:\Users\SV\Desktop\JRT.exe
2013-08-31 14:26 - 2013-08-31 14:26 - 00994642 _____ C:\Users\SV\Desktop\adwcleaner.exe
2013-08-31 14:23 - 2013-08-31 14:24 - 05117322 ____R (Swearware) C:\Users\SV\Desktop\ComboFix.exe
2013-08-31 12:01 - 2013-08-31 12:01 - 00377856 _____ C:\Users\SV\Desktop\gmer_2.1.19163.exe
2013-08-31 11:36 - 2013-08-31 11:36 - 01587214 _____ (Farbar) C:\Users\SV\Desktop\FRST64.exe
2013-08-31 11:12 - 2013-08-31 11:12 - 00000000 _____ C:\Users\SV\defogger_reenable
2013-08-31 11:04 - 2013-08-31 11:04 - 00050477 _____ C:\Users\SV\Desktop\Defogger.exe
2013-08-30 20:18 - 2013-08-30 20:18 - 00000000 ____D C:\FRST
2013-08-30 08:32 - 2013-08-30 08:39 - 00000000 ____D C:\windows\system32\MRT
2013-08-30 08:25 - 2013-07-25 05:54 - 17830400 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-08-30 08:25 - 2013-07-25 05:37 - 02312704 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-08-30 08:25 - 2013-07-25 05:35 - 10926080 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-08-30 08:25 - 2013-07-25 05:31 - 01346560 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-08-30 08:25 - 2013-07-25 05:30 - 01392128 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-08-30 08:25 - 2013-07-25 05:29 - 01494528 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2013-08-30 08:25 - 2013-07-25 05:29 - 00237056 _____ (Microsoft Corporation) C:\windows\system32\url.dll
2013-08-30 08:25 - 2013-07-25 05:29 - 00086016 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-08-30 08:25 - 2013-07-25 05:28 - 02147840 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-08-30 08:25 - 2013-07-25 05:28 - 00816640 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-08-30 08:25 - 2013-07-25 05:28 - 00729088 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-08-30 08:25 - 2013-07-25 05:28 - 00599040 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2013-08-30 08:25 - 2013-07-25 05:28 - 00173056 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2013-08-30 08:25 - 2013-07-25 05:27 - 02382848 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-08-30 08:25 - 2013-07-25 05:27 - 00096768 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2013-08-30 08:25 - 2013-07-25 05:26 - 00248320 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-08-30 08:25 - 2013-07-25 04:40 - 12334080 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-08-30 08:25 - 2013-07-25 04:32 - 01800704 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-08-30 08:25 - 2013-07-25 04:30 - 09738752 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-08-30 08:25 - 2013-07-25 04:26 - 01129472 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-08-30 08:25 - 2013-07-25 04:26 - 01104384 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-08-30 08:25 - 2013-07-25 04:25 - 01427968 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2013-08-30 08:25 - 2013-07-25 04:24 - 00231936 _____ (Microsoft Corporation) C:\windows\SysWOW64\url.dll
2013-08-30 08:25 - 2013-07-25 04:24 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-08-30 08:25 - 2013-07-25 04:23 - 01796096 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-08-30 08:25 - 2013-07-25 04:23 - 00717824 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-08-30 08:25 - 2013-07-25 04:23 - 00607744 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-08-30 08:25 - 2013-07-25 04:23 - 00420864 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2013-08-30 08:25 - 2013-07-25 04:23 - 00142848 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2013-08-30 08:25 - 2013-07-25 04:22 - 02382848 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-08-30 08:25 - 2013-07-25 04:22 - 00176640 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-08-30 08:25 - 2013-07-25 04:22 - 00073216 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2013-08-29 13:06 - 2013-08-29 13:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-29 12:45 - 2013-08-31 11:55 - 00000000 ____D C:\ProgramData\Avira
2013-08-29 11:45 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL
2013-08-29 11:45 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL
2013-08-29 11:45 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
2013-08-29 11:45 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll
2013-08-29 11:45 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\windows\system32\wintrust.dll
2013-08-29 11:45 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
2013-08-29 11:45 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2013-08-29 11:45 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\windows\system32\cryptsvc.dll
2013-08-29 11:45 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\windows\system32\cryptnet.dll
2013-08-29 11:45 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll
2013-08-29 11:45 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\windows\SysWOW64\wintrust.dll
2013-08-29 11:45 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
2013-08-29 11:45 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsvc.dll
2013-08-29 11:45 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptnet.dll
2013-08-29 11:45 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys
2013-08-29 11:45 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tssecsrv.sys
==================== One Month Modified Files and Folders =======
2013-08-31 15:25 - 2013-08-31 15:25 - 00001042 _____ C:\Users\SV\Desktop\JRT.txt
2013-08-31 15:24 - 2010-08-25 14:19 - 01976928 _____ C:\windows\WindowsUpdate.log
2013-08-31 15:20 - 2009-07-14 06:45 - 00013632 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-31 15:20 - 2009-07-14 06:45 - 00013632 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-31 15:16 - 2013-08-31 15:16 - 00000000 ____D C:\windows\ERUNT
2013-08-31 15:13 - 2013-08-31 15:13 - 00019808 _____ C:\Users\SV\Desktop\AdwCleaner[S0].txt
2013-08-31 15:13 - 2013-08-31 15:13 - 00019427 _____ C:\Users\SV\Desktop\AdwCleaner[R0].txt
2013-08-31 15:13 - 2011-01-22 12:38 - 00000000 ____D C:\Users\SV\AppData\Roaming\Dropbox
2013-08-31 15:12 - 2011-01-22 12:39 - 00000000 ___RD C:\Users\SV\Dropbox
2013-08-31 15:11 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-08-31 15:11 - 2009-07-14 06:51 - 00092687 _____ C:\windows\setupact.log
2013-08-31 15:10 - 2013-08-31 15:07 - 00000000 ____D C:\AdwCleaner
2013-08-31 15:00 - 2013-08-31 14:30 - 00000000 ____D C:\Qoobox
2013-08-31 14:59 - 2013-08-31 14:59 - 00026309 _____ C:\ComboFix.txt
2013-08-31 14:59 - 2012-04-27 20:58 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-08-31 14:55 - 2013-08-31 14:29 - 00000000 ____D C:\windows\erdnt
2013-08-31 14:50 - 2009-07-14 04:34 - 00000215 _____ C:\windows\system.ini
2013-08-31 14:49 - 2010-08-25 14:37 - 00595400 _____ C:\windows\PFRO.log
2013-08-31 14:48 - 2009-07-14 04:34 - 78118912 _____ C:\windows\system32\config\software.bak
2013-08-31 14:48 - 2009-07-14 04:34 - 22020096 _____ C:\windows\system32\config\system.bak
2013-08-31 14:48 - 2009-07-14 04:34 - 00262144 _____ C:\windows\system32\config\security.bak
2013-08-31 14:48 - 2009-07-14 04:34 - 00262144 _____ C:\windows\system32\config\sam.bak
2013-08-31 14:48 - 2009-07-14 04:34 - 00262144 _____ C:\windows\system32\config\default.bak
2013-08-31 14:27 - 2013-08-31 14:27 - 01027511 _____ (Thisisu) C:\Users\SV\Desktop\JRT.exe
2013-08-31 14:26 - 2013-08-31 14:26 - 00994642 _____ C:\Users\SV\Desktop\adwcleaner.exe
2013-08-31 14:24 - 2013-08-31 14:23 - 05117322 ____R (Swearware) C:\Users\SV\Desktop\ComboFix.exe
2013-08-31 12:17 - 2009-07-14 05:20 - 00000000 ____D C:\windows\system32\NDF
2013-08-31 12:01 - 2013-08-31 12:01 - 00377856 _____ C:\Users\SV\Desktop\gmer_2.1.19163.exe
2013-08-31 11:55 - 2013-08-29 12:45 - 00000000 ____D C:\ProgramData\Avira
2013-08-31 11:36 - 2013-08-31 11:36 - 01587214 _____ (Farbar) C:\Users\SV\Desktop\FRST64.exe
2013-08-31 11:12 - 2013-08-31 11:12 - 00000000 _____ C:\Users\SV\defogger_reenable
2013-08-31 11:12 - 2011-01-19 19:05 - 00000000 ____D C:\Users\SV
2013-08-31 11:04 - 2013-08-31 11:04 - 00050477 _____ C:\Users\SV\Desktop\Defogger.exe
2013-08-30 20:18 - 2013-08-30 20:18 - 00000000 ____D C:\FRST
2013-08-30 17:35 - 2012-04-26 20:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-30 08:51 - 2011-01-19 21:45 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-30 08:46 - 2010-08-25 22:04 - 00657910 _____ C:\windows\system32\perfh007.dat
2013-08-30 08:46 - 2010-08-25 22:04 - 00131250 _____ C:\windows\system32\perfc007.dat
2013-08-30 08:46 - 2009-07-14 07:13 - 01529334 _____ C:\windows\system32\PerfStringBackup.INI
2013-08-30 08:39 - 2013-08-30 08:32 - 00000000 ____D C:\windows\system32\MRT
2013-08-30 08:31 - 2011-02-23 22:19 - 78161360 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-08-29 17:16 - 2009-07-14 05:20 - 00000000 ____D C:\windows\rescache
2013-08-29 13:06 - 2013-08-29 13:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-29 11:59 - 2012-04-27 20:58 - 00692104 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-08-29 11:59 - 2012-04-27 20:58 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-08-29 11:59 - 2011-06-29 18:48 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-07 04:22 - 2011-01-19 19:19 - 00278800 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
Files to move or delete:
====================
C:\Users\SV\AppData\Local\Temp\NOSEventMessages.dll
C:\Users\SV\AppData\Local\Temp\Quarantine.exe
C:\Users\SV\AppData\Local\Temp\jrt\erunt\ERUNT.EXE
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-29 17:03
==================== End Of Log ============================
Addition.txt: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 30-08-2013 01
Ran by SV at 2013-08-31 15:37:35
Running from C:\Users\SV\Desktop
Boot Mode: Normal
==========================================================
==================== Installed Programs =======================
Update for Microsoft Office 2007 (KB2508958) (x32)
AAVUpdateManager (x32 Version: 18.00.0000)
Adobe AIR (x32 Version: 3.0.0.4080)
Adobe Community Help (x32 Version: 3.4.980)
Adobe Content Viewer (x32 Version: 1.4.0)
Adobe Download Assistant (x32 Version: 1.0.6)
Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.94)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)
Adobe InDesign CS5.5 (x32 Version: 7.5)
Adobe Media Player (x32 Version: 1.8)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
Akamai NetSession Interface (HKCU)
Akamai NetSession Interface Service (x32)
Allway Sync version 11.3.11 (x32)
ANNO 1602 (x32)
Apple Application Support (x32 Version: 2.3.4)
Apple Mobile Device Support (Version: 3.4.1.2)
Apple Software Update (x32 Version: 2.1.3.127)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 1.0.0.26)
Bing Bar (x32 Version: 7.0.850.0)
BioExcess (x32 Version: 6.0.48.175)
Bonjour (Version: 3.0.0.2)
Broadcom 802.11 Wireless Driver (x32 Version: 1.0.0.0)
CyberLink YouCam (x32 Version: 3.0.2626)
Die Siedler IV (x32)
dm-Fotowelt (x32)
dows-Treiberpaket - Lenovo (ACPIVPC) System (10/19/2009 5.4.0.1) (Version: 10/19/2009 5.4.0.1)
Dropbox (HKCU Version: 2.0.22)
Dungeon Keeper 2 (x32 Version: 2.0.0.32)
Energy Management (x32 Version: 5.4.1.9)
ETDWare PS/2-x64 7.0.4.17_WHQL (Version: 7.0.4.17)
GIMP 2.8.0 (Version: 2.8.0)
GOG.com Dungeon Keeper 2
Intel(R) Control Center (x32 Version: 1.2.1.1007)
Intel(R) Graphics Media Accelerator Driver (x32 Version: 8.15.10.2104)
Intel(R) Management Engine Components (x32 Version: 6.0.0.1179)
Intel(R) Matrix Storage Manager
iTunes (Version: 10.4.1.10)
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
Junk Mail filter update (x32 Version: 14.0.8089.726)
Lenovo Bluetooth with Enhanced Data Rate Software (Version: 6.2.1.1900)
Lenovo EasyCamera (x32 Version: 1.0.7.1)
Lenovo OneKey Recovery (Version: 7.0.1628)
Lenovo OneKey Recovery (x32 Version: 7.0.1628)
Lenovo ReadyComm 5 (x32 Version: 5.1.1.20)
Lenovo ReadyComm 5.0 Service (x32 Version: 5.0.0.1)
Lenovo Security Suite (x32 Version: 2.0.10.0)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Choice Guard (x32 Version: 2.0.48.0)
Microsoft IntelliPoint 8.0 (Version: 8.01.249.0)
Microsoft Office 2003 Web Components (x32 Version: 11.0.8003.0)
Microsoft Office 2007 Primary Interop Assemblies (x32 Version: 12.0.4518.1014)
Microsoft Office 2007 Service Pack 3 (SP3) (x32)
Microsoft Office 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Small Business 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Small Business Connectivity Components (x32 Version: 2.0.7024.0)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft SQL Server Native Client (Version: 9.00.4035.00)
Microsoft SQL Server VSS Writer (Version: 9.00.4035.00)
Microsoft Sync Framework Runtime Native v1.0 (x86) (x32 Version: 1.0.1215.0)
Microsoft Sync Framework Services Native v1.0 (x86) (x32 Version: 1.0.1215.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft_VC100_CRT_SP1_x64 (Version: 10.0.40219.1)
Microsoft_VC100_CRT_SP1_x86 (x32 Version: 10.0.40219.1)
Microsoft_VC80_ATL_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_ATL_x86_x64 (Version: 8.0.50727.4053)
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_CRT_x86_x64 (Version: 8.0.50727.4053)
Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_MFC_x86_x64 (Version: 8.0.50727.4053)
Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_MFCLOC_x86_x64 (Version: 80.50727.4053)
Microsoft_VC90_ATL_x86 (x32 Version: 1.00.0000)
Microsoft_VC90_ATL_x86_x64 (Version: 1.00.0000)
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000)
Microsoft_VC90_CRT_x86_x64 (Version: 1.00.0000)
Microsoft_VC90_MFC_x86 (x32 Version: 1.00.0000)
Microsoft_VC90_MFC_x86_x64 (Version: 1.00.0000)
Microsoft_VC90_MFCLOC_x86 (x32 Version: 1.00.0000)
Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1)
Mozilla Maintenance Service (x32 Version: 23.0.1)
MSVC80_x64_v2 (Version: 1.0.3.0)
MSVC80_x86_v2 (x32 Version: 1.0.3.0)
MSVC90_x64 (Version: 1.0.1.2)
MSVC90_x86 (x32 Version: 1.0.1.2)
MSVCRT (x32 Version: 14.0.1468.721)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
Nokia Connectivity Cable Driver (x32 Version: 7.1.69.0)
Nokia Suite (x32 Version: 3.3.86.0)
NVIDIA Drivers (Version: 1.10.59.37)
NVIDIA Updatus (x32 Version: 1.0.3)
Ocster Backup: Freeware Windows Edition (Version: 1.71)
PC Connectivity Solution (x32 Version: 11.5.29.0)
PDF Architect (x32 Version: 1.0.52.8917)
PDF Settings CS5 (x32 Version: 10.0)
PDFCreator (x32 Version: 1.6.2)
PDFTK Builder 3.5.3 (x32)
Port Locker (Version: 1.0.5.20)
Port Locker (x32 Version: 1.0.5.20)
Power2Go (x32 Version: 5.6.0.4809d4)
QuickTime (x32 Version: 7.74.80.86)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6128)
Realtek USB 2.0 Card Reader (x32 Version: 6.1.7600.30117)
RtLED (Version: 1.0.2)
Skype Click to Call (x32 Version: 5.6.8442)
Skype™ 5.10 (x32 Version: 5.10.116)
Spybot - Search & Destroy (x32 Version: 1.6.2)
Steuer-Spar-Erklärung 2013 (x32 Version: 18.08)
Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch) (x32 Version: 9.00.4035.00)
Update for 2007 Microsoft Office System (KB967642) (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32)
Update for Microsoft Office Outlook 2007 (KB2768023) 32-Bit Edition (x32)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817642) 32-Bit Edition (x32)
Update für Microsoft Office Excel 2007 Help (KB963678) (x32)
Update für Microsoft Office Outlook 2007 Help (KB963677) (x32)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32)
Update für Microsoft Office Word 2007 Help (KB963665) (x32)
VLC media player 2.0.7 (x32 Version: 2.0.7)
Windows Driver Package - Broadcom (BTHUSB) Bluetooth (04/08/2010 6.3.5.430) (Version: 04/08/2010 6.3.5.430)
Windows Driver Package - Broadcom HIDClass (07/28/2009 6.2.0.9800) (Version: 07/28/2009 6.2.0.9800)
Windows Live Anmelde-Assistent (x32 Version: 5.000.818.5)
Windows Live Call (x32 Version: 14.0.8064.0206)
Windows Live Communications Platform (x32 Version: 14.0.8064.206)
Windows Live Essentials (x32 Version: 14.0.8089.0726)
Windows Live Essentials (x32 Version: 14.0.8089.726)
Windows Live Fotogalerie (x32 Version: 14.0.8081.709)
Windows Live Mail (x32 Version: 14.0.8089.0726)
Windows Live Messenger (x32 Version: 14.0.8089.0726)
Windows Live Movie Maker (x32 Version: 14.0.8091.0730)
Windows Live Sync (x32 Version: 14.0.8089.726)
Windows Live Writer (x32 Version: 14.0.8089.0726)
Windows Live-Uploadtool (x32 Version: 14.0.8014.1029)
Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0) (Version: 08/22/2008 7.0.0.0)
==================== Restore Points =========================
20-07-2013 05:40:14 Windows Update
22-07-2013 18:09:30 Installed QuickTime
24-07-2013 17:52:48 Windows Update
27-07-2013 19:59:17 Windows Update
29-08-2013 09:44:53 Windows Update
30-08-2013 06:22:34 Windows Update
==================== Hosts content: ==========================
2009-07-14 04:34 - 2013-08-31 14:50 - 00000027 ____A C:\windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {08884F61-0407-4643-9EF0-C2C12ABC51AC} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => c:\Program Files\Microsoft IntelliPoint\IPoint.exe [2011-01-07] (Microsoft Corporation)
Task: {0F3AF71D-D0CB-400E-A230-BBB27A5D4258} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: {168438C0-F13D-40C8-90A4-467F62037569} - System32\Tasks\WPD\SqmUpload_S-1-5-21-771582602-4057858738-3947029243-1002 => C:\Windows\System32\portabledeviceapi.dll [2010-11-20] (Microsoft Corporation)
Task: {724E1C32-436F-468E-B39A-63AB4815972E} - System32\Tasks\{FE86DCAC-4D1D-4437-8903-F891E9BAC1B7} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2012-07-13] (Skype Technologies S.A.)
Task: {A4FB338E-B23C-448D-B409-C6D369E8B618} - System32\Tasks\{2344DDD3-C7B3-40C4-95C3-646859A92794} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2012-07-13] (Skype Technologies S.A.)
Task: {D9DC6A1A-E785-41A1-8123-20E1022E6515} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation)
Task: {E66E79BD-C63B-4624-B81D-0556634807DC} - System32\Tasks\AdobeAAMUpdater-1.0-SV-PC-SV => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2011-03-15] (Adobe Systems Incorporated)
Task: {FFE4E2DE-C374-4F2A-BF45-ACA2C8D590EF} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-29] (Adobe Systems Incorporated)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2009-07-14 02:22 - 2009-07-14 03:38 - 00081408 _____ (Fraunhofer Institut Integrierte Schaltungen IIS) C:\Windows\System32\l3codeca.acm
2010-05-27 09:55 - 2012-01-10 22:06 - 09528832 _____ (Intel Corporation) C:\windows\system32\igd10umd64.dll
2010-04-20 15:29 - 2010-04-20 15:29 - 00391456 _____ (Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btmmhook.dll
2009-07-14 01:42 - 2009-07-14 03:41 - 01039872 _____ (Microsoft Corporation) C:\windows\system32\OPENGL32.dll
2009-07-14 01:42 - 2009-07-14 03:40 - 00165376 _____ (Microsoft Corporation) C:\windows\system32\GLU32.dll
2009-07-14 01:41 - 2009-07-14 03:40 - 00569344 _____ (Microsoft Corporation) C:\windows\system32\DDRAW.dll
2009-07-14 01:38 - 2009-07-14 03:40 - 00014336 _____ (Microsoft Corporation) C:\windows\system32\DCIMAN32.dll
2010-05-27 09:55 - 2012-01-10 21:19 - 00110080 _____ (Intel Corporation) C:\Windows\System32\hccutils.DLL
2010-05-27 09:55 - 2012-01-10 21:19 - 00062464 _____ (Intel Corporation) C:\windows\system32\igfxsrvc.dll
2012-01-10 21:20 - 2012-01-10 21:20 - 00286720 _____ (Intel Corporation) C:\windows\system32\igfxrDEU.lrc
2010-05-27 09:55 - 2012-01-10 21:18 - 09014784 _____ (Intel Corporation) C:\Windows\System32\igfxress.dll
2012-01-10 21:12 - 2012-01-10 21:12 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2010-04-20 15:29 - 2010-04-20 15:29 - 00717088 _____ (Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwapi.dll
2011-06-17 20:24 - 2011-06-17 20:24 - 01658368 _____ (Microsoft Corporation) C:\windows\WinSxS\amd64_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.6195_none_8448b2bd328df189\MFC80.DLL
2010-04-20 15:29 - 2010-04-20 15:29 - 00349472 _____ (Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btosif.dll
2010-04-20 15:29 - 2010-04-20 15:29 - 00504608 _____ (Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwhidcs.DLL
2009-07-14 02:09 - 2009-07-14 03:38 - 00425984 _____ (Microsoft Corporation) C:\windows\system32\irprops.cpl
2010-08-25 14:45 - 2010-04-20 07:29 - 00139040 _____ (Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BtBalloon.dll
2011-06-17 20:24 - 2011-06-17 20:24 - 00054272 _____ (Microsoft Corporation) C:\windows\WinSxS\amd64_microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.6195_none_bc20f59b0bdd1acd\MFC80DEU.DLL
2010-04-20 15:29 - 2010-04-20 15:29 - 23913760 _____ (Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btrez.dll
2013-03-16 12:52 - 2010-11-20 15:27 - 00047104 _____ (Microsoft Corporation) C:\windows\System32\wshBth.dll
2010-04-20 15:29 - 2010-04-20 15:29 - 00393504 _____ (Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BtwCP.DLL
2011-06-29 18:04 - 2011-06-29 18:04 - 03249952 _____ () c:\Program Files\Ocster Backup\bin\ox.dll
2011-06-26 01:40 - 2011-06-26 01:40 - 00641024 _____ (wxWidgets development team) c:\Program Files\Ocster Backup\bin\wxmsw28u_xrc_vc_ox.dll
2011-06-26 01:40 - 2011-06-26 01:40 - 00622592 _____ (wxWidgets development team) c:\Program Files\Ocster Backup\bin\wxmsw28u_html_vc_ox.dll
2011-06-26 01:39 - 2011-06-26 01:39 - 03663872 _____ (wxWidgets development team) c:\Program Files\Ocster Backup\bin\wxmsw28u_core_vc_ox.dll
2011-06-26 01:38 - 2011-06-26 01:38 - 01488384 _____ (wxWidgets development team) c:\Program Files\Ocster Backup\bin\wxbase28u_vc_ox.dll
2011-06-26 01:39 - 2011-06-26 01:39 - 00875520 _____ (wxWidgets development team) c:\Program Files\Ocster Backup\bin\wxmsw28u_adv_vc_ox.dll
2011-06-26 01:40 - 2011-06-26 01:40 - 00157696 _____ (wxWidgets development team) c:\Program Files\Ocster Backup\bin\wxbase28u_xml_vc_ox.dll
2011-06-26 01:38 - 2011-06-26 01:38 - 00152576 _____ (wxWidgets development team) c:\Program Files\Ocster Backup\bin\wxbase28u_net_vc_ox.dll
2009-07-14 01:53 - 2009-07-14 03:40 - 00267776 _____ (Microsoft Corporation) C:\windows\system32\ACTIVEDS.dll
2009-07-14 01:53 - 2009-07-14 03:40 - 00236544 _____ (Microsoft Corporation) C:\windows\system32\adsldpc.dll
2012-06-28 18:19 - 2012-06-03 00:15 - 02622464 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2013-03-16 12:52 - 2010-11-20 15:25 - 00094720 _____ (Microsoft Corporation) C:\windows\system32\Cabinet.dll
2012-06-28 18:19 - 2012-06-03 00:19 - 00044056 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2013-01-11 19:04 - 2012-12-07 15:20 - 00441856 _____ (Microsoft Corporation) C:\windows\System32\Wpc.dll
2010-04-20 15:29 - 2010-04-20 15:29 - 00557344 _____ (Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btncopy.dll
2009-07-14 02:17 - 2009-07-14 03:40 - 00024576 _____ (Microsoft Corporation) C:\windows\System32\drprov.dll
2013-03-16 12:53 - 2010-11-20 15:27 - 00129536 _____ (Microsoft Corporation) C:\windows\System32\ntlanman.dll
2013-03-16 13:00 - 2010-11-20 15:26 - 00100864 _____ (Microsoft Corporation) C:\windows\System32\davclnt.dll
2009-07-14 01:23 - 2009-07-14 03:40 - 00025600 _____ (Microsoft Corporation) C:\windows\System32\DAVHLPR.dll
2010-04-07 09:14 - 2010-04-07 09:14 - 00244840 _____ (NVIDIA Corporation) C:\windows\system32\nvshext.dll
2010-05-17 14:08 - 2010-04-07 11:26 - 01329768 _____ (NVIDIA Corporation) C:\windows\system32\nvapi64.dll
2010-08-25 20:04 - 2012-01-10 21:20 - 00375808 _____ (Intel Corporation) C:\windows\system32\igfxpph.dll
2010-05-27 09:55 - 2012-01-10 21:19 - 00110080 _____ (Intel Corporation) C:\windows\system32\hccutils.DLL
2009-07-14 02:08 - 2009-07-14 03:41 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\NetworkItemFactory.dll
2009-07-14 02:08 - 2009-07-14 03:40 - 00036352 _____ (Microsoft Corporation) C:\windows\system32\dtsh.dll
2009-07-14 02:08 - 2009-07-14 03:40 - 00748032 _____ (Microsoft Corporation) C:\windows\system32\FirewallAPI.dll
2009-07-14 01:35 - 2009-07-14 03:40 - 00194560 _____ (Microsoft Corporation) C:\Windows\system32\FunDisc.dll
2013-03-16 12:52 - 2010-11-20 15:26 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\fdproxy.dll
2009-07-14 02:08 - 2009-07-14 03:40 - 00101376 _____ (Microsoft Corporation) C:\windows\System32\fdwcn.dll
2009-07-14 02:08 - 2009-07-14 03:41 - 00120832 _____ (Microsoft Corporation) C:\windows\System32\wcnapi.dll
2009-07-14 01:35 - 2009-07-14 03:40 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\fdWNet.dll
2009-07-14 01:53 - 2009-07-14 03:40 - 00062976 _____ (Microsoft Corporation) C:\windows\system32\dfscli.dll
2012-08-28 20:13 - 2012-07-05 00:13 - 00059392 _____ (Microsoft Corporation) C:\windows\system32\browcli.dll
2011-07-12 11:33 - 2011-07-12 11:33 - 00132968 _____ (Apple Inc.) C:\Program Files\Bonjour\mdnsNSP.dll
==================== Alternate Data Streams (whitelisted) ==========
==================== Faulty Device Manager Devices =============
Name: Broadcom BCM2070 Bluetooth 2.1+EDR USB Device
Description: Broadcom BCM2070 Bluetooth 2.1+EDR USB Device
Class Guid: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974}
Manufacturer: Broadcom
Service: BTHUSB
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
System errors:
=============
Microsoft Office Sessions:
=========================
Error: (08/27/2011 00:40:45 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 16212 seconds with 1680 seconds of active time. This session ended with a crash.
CodeIntegrity Errors:
===================================
Date: 2013-08-31 14:46:10.200
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-08-31 14:46:10.032
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2011-03-21 20:27:50.799
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-03-21 19:55:10.086
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-03-21 18:29:11.865
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-03-21 18:11:39.837
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-03-21 17:51:16.982
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-03-21 17:43:33.794
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-03-21 17:31:11.629
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-03-21 17:17:53.056
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 81%
Total physical RAM: 1844.43 MB
Available physical RAM: 340.77 MB
Total Pagefile: 3688.86 MB
Available Pagefile: 1861.98 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:421.81 GB) (Free:316.73 GB) NTFS
Drive d: (LENOVO) (Fixed) (Total:29 GB) (Free:27.85 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: 1C58B5AE)
Partition 1: (Active) - (Size=200 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=422 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=29 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=15 GB) - (Type=12)
==================== End Of Log ============================
Muss ich sonst noch was machen? Kann ich irgendwie auch die externen Platten / Sticks prüfen? Danke. |
|
31.08.2013, 15:46
| #2 | ||
| /// TB-Ausbilder   | Windows 7: Win32.downloader.gen Infektion Servus,
__________________Zitat:
 Zitat:
 Wir spüren die letzten Reste auf, damit wir sie später entfernen können: Schritt 1 Lade SystemLook von jpshortstuff vom folgenden Spiegel herunter und speichere das Tool auf dem Desktop. SystemLook (64 bit)
Gibt es noch Probleme mit Malware? Wenn ja, welche? Wie läuft der Rechner derzeit? Bitte poste mit deiner nächsten Antwort
|
|
| Themen zu Windows 7: Win32.downloader.gen Infektion |
| 4d36e972-e325-11ce-bfc1-08002be10318, akamai, antivir, antivirus, avira, bho, bingbar, bonjour, browser, converter, desktop, email, error, excel, farbar, farbar recovery scan tool, firefox, firefox 23.0.1, flash player, iexplore.exe, mozilla, object, plug-in, realtek, registry, richtlinie, safer networking, server, services.exe, software, system, unlock, vista, win32.downloader.gen, windows, wsearch |
Hybrid-Darstellung
