| |
| |||||||
Log-Analyse und Auswertung: Windows 7: Trojaner und Filescout.exe, immer wieder neue VirenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
05.12.2013, 23:43
| #1 |
| |  Windows 7: Trojaner und Filescout.exe, immer wieder neue Viren Hallo, ich habe seit ein paar Tagen einen starken Virenbefall auf meinem PC (Windows 7 Home Premium, 64bit, Service Pack 1). Mithilfe von AVIRA Antivir, Dr. Web, CCleaner, Malwarebytes, SuperAntiSpyware und Co. habe ich versucht, sie loszuwerden, sie kommen aber immer wieder aufs Neue. Die letzten Funde: TR/Sefnit.BO und Trojan.PUP.Optional.FileScout.A! Ich habe das Gefühl, ich habe einen Downloader-Virus. Ich kann das Problem nicht manuell lösen und wollte euch, bevor ich einen ESET Scanner benutze, fragen, was ich am besten machen soll? Ich würde mich über eure Hilfe sehr freuen, danke. Paul PS: Aufgrund der Zeichenkapazität konnte ich nur die AVIRA, SuperAntiSpyware und OTL log files posten, Malwarebytes ist zu groß, kann aber nachgereicht werden... Code:
ATTFilter
Avira Free Antivirus
Erstellungsdatum der Reportdatei: Mittwoch, 4. Dezember 2013 20:11
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : Avira Free Antivirus
Seriennummer : 0000149996-ADJIE-0000001
Plattform : Windows 7 Home Premium
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : paul
Computername : CHE-PC
Versionsinformationen:
BUILD.DAT : 14.0.1.749 55392 Bytes 22.11.2013 12:01:00
AVSCAN.EXE : 14.0.1.645 1030712 Bytes 01.12.2013 23:22:46
AVSCANRC.DLL : 14.0.1.641 62008 Bytes 01.12.2013 23:22:46
LUKE.DLL : 14.0.1.641 65080 Bytes 01.12.2013 23:22:54
AVSCPLR.DLL : 14.0.1.641 124472 Bytes 01.12.2013 23:22:46
AVREG.DLL : 14.0.1.641 250424 Bytes 01.12.2013 23:22:46
avlode.dll : 14.0.1.681 517176 Bytes 01.12.2013 23:22:45
avlode.rdf : 13.0.1.48 27867 Bytes 01.12.2013 23:22:57
VBASE000.VDF : 7.11.70.0 66736640 Bytes 04.04.2013 19:48:11
VBASE001.VDF : 7.11.74.226 2201600 Bytes 30.04.2013 13:26:21
VBASE002.VDF : 7.11.80.60 2751488 Bytes 28.05.2013 16:33:33
VBASE003.VDF : 7.11.85.214 2162688 Bytes 21.06.2013 06:52:47
VBASE004.VDF : 7.11.91.176 3903488 Bytes 23.07.2013 06:52:50
VBASE005.VDF : 7.11.98.186 6822912 Bytes 29.08.2013 21:43:41
VBASE006.VDF : 7.11.103.230 2293248 Bytes 24.09.2013 18:05:24
VBASE007.VDF : 7.11.116.38 5485568 Bytes 28.11.2013 23:22:38
VBASE008.VDF : 7.11.116.39 2048 Bytes 28.11.2013 23:22:38
VBASE009.VDF : 7.11.116.40 2048 Bytes 28.11.2013 23:22:38
VBASE010.VDF : 7.11.116.41 2048 Bytes 28.11.2013 23:22:38
VBASE011.VDF : 7.11.116.42 2048 Bytes 28.11.2013 23:22:39
VBASE012.VDF : 7.11.116.43 2048 Bytes 28.11.2013 23:22:39
VBASE013.VDF : 7.11.116.44 2048 Bytes 28.11.2013 23:22:39
VBASE014.VDF : 7.11.116.195 149504 Bytes 30.11.2013 23:22:39
VBASE015.VDF : 7.11.117.180 271872 Bytes 04.12.2013 13:14:04
VBASE016.VDF : 7.11.117.181 2048 Bytes 04.12.2013 13:14:04
VBASE017.VDF : 7.11.117.182 2048 Bytes 04.12.2013 13:14:04
VBASE018.VDF : 7.11.117.183 2048 Bytes 04.12.2013 13:14:04
VBASE019.VDF : 7.11.117.184 2048 Bytes 04.12.2013 13:14:04
VBASE020.VDF : 7.11.117.185 2048 Bytes 04.12.2013 13:14:04
VBASE021.VDF : 7.11.117.186 2048 Bytes 04.12.2013 13:14:07
VBASE022.VDF : 7.11.117.187 2048 Bytes 04.12.2013 13:14:07
VBASE023.VDF : 7.11.117.188 2048 Bytes 04.12.2013 13:14:07
VBASE024.VDF : 7.11.117.189 2048 Bytes 04.12.2013 13:14:07
VBASE025.VDF : 7.11.117.190 2048 Bytes 04.12.2013 13:14:08
VBASE026.VDF : 7.11.117.191 2048 Bytes 04.12.2013 13:14:13
VBASE027.VDF : 7.11.117.192 2048 Bytes 04.12.2013 13:14:14
VBASE028.VDF : 7.11.117.193 2048 Bytes 04.12.2013 13:14:14
VBASE029.VDF : 7.11.117.194 2048 Bytes 04.12.2013 13:14:14
VBASE030.VDF : 7.11.117.195 2048 Bytes 04.12.2013 13:14:15
VBASE031.VDF : 7.11.117.220 111104 Bytes 04.12.2013 13:14:15
Engineversion : 8.2.12.158
AEVDF.DLL : 8.1.3.4 102774 Bytes 12.08.2013 06:52:58
AESCRIPT.DLL : 8.1.4.172 520574 Bytes 02.12.2013 18:13:11
AESCN.DLL : 8.1.10.4 131446 Bytes 26.03.2013 23:41:45
AESBX.DLL : 8.2.16.26 1245560 Bytes 23.08.2013 13:40:51
AERDL.DLL : 8.2.0.138 704888 Bytes 02.12.2013 18:13:11
AEPACK.DLL : 8.3.3.6 762232 Bytes 02.12.2013 18:13:10
AEOFFICE.DLL : 8.1.2.76 205181 Bytes 12.08.2013 06:52:58
AEHEUR.DLL : 8.1.4.790 6328698 Bytes 02.12.2013 18:13:10
AEHELP.DLL : 8.1.27.10 266618 Bytes 01.12.2013 23:22:40
AEGEN.DLL : 8.1.7.20 446839 Bytes 01.12.2013 23:22:40
AEEXP.DLL : 8.4.1.114 381304 Bytes 01.12.2013 23:22:42
AEEMU.DLL : 8.1.3.2 393587 Bytes 29.07.2012 10:43:18
AECORE.DLL : 8.1.32.2 201081 Bytes 01.12.2013 23:22:40
AEBB.DLL : 8.1.1.4 53619 Bytes 05.11.2012 18:54:14
AVWINLL.DLL : 14.0.1.641 23608 Bytes 01.12.2013 23:22:26
AVPREF.DLL : 14.0.1.641 48696 Bytes 01.12.2013 23:22:45
AVREP.DLL : 14.0.1.641 175672 Bytes 01.12.2013 23:22:46
AVARKT.DLL : 14.0.1.641 257080 Bytes 01.12.2013 23:22:43
AVEVTLOG.DLL : 14.0.1.641 165944 Bytes 01.12.2013 23:22:44
SQLITE3.DLL : 3.7.0.1 397704 Bytes 25.02.2013 07:48:28
AVSMTP.DLL : 14.0.1.641 60472 Bytes 01.12.2013 23:22:46
NETNT.DLL : 14.0.1.641 13368 Bytes 01.12.2013 23:22:54
RCIMAGE.DLL : 14.0.1.641 4786744 Bytes 01.12.2013 23:22:26
RCTEXT.DLL : 14.0.1.641 67128 Bytes 01.12.2013 23:22:26
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\Program Files (x86)\Avira\AntiVir Desktop\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: Interaktiv
Sekundäre Aktion......................: Ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, Q:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Prüfe alle Dateien....................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Beginn des Suchlaufs: Mittwoch, 4. Dezember 2013 20:11
Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'HDD0(C:, Q:)'
[INFO] Es wurde kein Virus gefunden!
Der Suchlauf nach versteckten Objekten wird begonnen.
c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll c:\progra~3\bitguard\271769~1.27\{c16c1~1\loader.dll
[HINWEIS] Der Registrierungseintrag ist nicht sichtbar.
HKEY_USERS\S-1-5-20\Software\Microsoft\MediaPlayer\Health\{CB210C21-665F-4F40-AA38-09B0132FC5A3}
[HINWEIS] Der Registrierungseintrag ist nicht sichtbar.
Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvSCPAPISvr.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'atiesrxx.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '51' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '106' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '139' Modul(e) wurden durchsucht
Durchsuche Prozess 'UMVPFSrv.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '58' Modul(e) wurden durchsucht
Durchsuche Prozess 'atieclxx.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvxdsync.exe' - '54' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '65' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '55' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '58' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '104' Modul(e) wurden durchsucht
Durchsuche Prozess 'adminservice.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'PSIService.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'sftvsa.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'umbrella.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'sftlist.exe' - '75' Modul(e) wurden durchsucht
Durchsuche Prozess 'CVHSVC.EXE' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'WUDFHost.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'TrustedInstaller.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '51' Modul(e) wurden durchsucht
Durchsuche Prozess 'daemonu.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '55' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '115' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '67' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '162' Modul(e) wurden durchsucht
Durchsuche Prozess 'AthBtTray.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dropbox.exe' - '86' Modul(e) wurden durchsucht
Durchsuche Prozess 'VDeck.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'LWS.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '89' Modul(e) wurden durchsucht
Durchsuche Prozess 'nusb3mon.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvtray.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '117' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '111' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchProtocolHost.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchFilterHost.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '31' Modul(e) wurden durchsucht
Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '10722' Dateien ).
Der Suchlauf über die ausgewählten Dateien wird begonnen:
Beginne mit der Suche in 'C:\' <Windows7>
C:\Users\paul\AppData\Roaming\File Scout\filescout.exe
[FUND] Ist das Trojanische Pferd TR/Sefnit.BO
Beginne mit der Suche in 'Q:\'
Der zu durchsuchende Pfad Q:\ konnte nicht geöffnet werden!
Systemfehler [5]: Zugriff verweigert
Beginne mit der Desinfektion:
C:\Users\paul\AppData\Roaming\File Scout\filescout.exe
[FUND] Ist das Trojanische Pferd TR/Sefnit.BO
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5a5109e6.qua' verschoben!
Ende des Suchlaufs: Mittwoch, 4. Dezember 2013 23:13
Benötigte Zeit: 54:26 Minute(n)
Der Suchlauf wurde vollständig durchgeführt.
28694 Verzeichnisse wurden überprüft
596827 Dateien wurden geprüft
1 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
1 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
596826 Dateien ohne Befall
6658 Archive wurden durchsucht
0 Warnungen
3 Hinweise
857811 Objekte wurden beim Rootkitscan durchsucht
2 Versteckte Objekte wurden gefunden
Code:
ATTFilter OTL logfile created on: 05.12.2013 23:10:42 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\paul\Downloads 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 7,73 Gb Total Physical Memory | 5,41 Gb Available Physical Memory | 70,01% Memory free 15,46 Gb Paging File | 12,83 Gb Available in Paging File | 82,97% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 931,41 Gb Total Space | 660,75 Gb Free Space | 70,94% Space Free | Partition Type: NTFS Computer Name: CHE-PC | User Name: paul | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\paul\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Common Files\Umbrella\umbrella.exe (Iminent) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) PRC - C:\PROGRA~2\SearchProtect\SearchProtect\bin\cltmng.exe (Conduit) PRC - C:\PROGRA~2\SearchProtect\UI\bin\cltmngui.exe (Conduit) PRC - C:\PROGRA~2\SearchProtect\Main\bin\CltMngSvc.exe (Conduit) PRC - C:\Program Files (x86)\Wajam\Updater\WajamUpdaterV3.exe (Wajam) PRC - C:\Users\paul\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe (Adobe Systems, Inc.) PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.) PRC - C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.) PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation) PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) PRC - C:\Program Files (x86)\Common Files\Protexis\License Service\PSIService.exe () ========== Modules (No Company Name) ========== MOD - C:\Users\paul\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll () MOD - C:\Users\paul\AppData\Roaming\Dropbox\bin\libcef.dll () MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll () MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll () MOD - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll () MOD - C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtXml4.dll () MOD - C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QJpeg4.dll () MOD - C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QGif4.dll () MOD - C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtGui4.dll () MOD - C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtCore4.dll () ========== Services (SafeList) ========== SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD) SRV - (SProtection) -- C:\Program Files (x86)\Common Files\Umbrella\umbrella.exe (Iminent) SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) SRV - (CltMngSvc) -- C:\PROGRA~2\SearchProtect\Main\bin\CltMngSvc.exe (Conduit) SRV - (WajamUpdaterV3) -- C:\Program Files (x86)\Wajam\Updater\WajamUpdaterV3.exe (Wajam) SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies) SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) SRV - (UMVPFSrv) -- C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.) SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation) SRV - (AtherosSvc) -- C:\Program Files (x86)\Bluetooth Suite\adminservice.exe (Atheros Commnucations) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (osppsvc) -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation) SRV - (sftvsa) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) SRV - (sftlist) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (ProtexisLicensing) -- C:\Program Files (x86)\Common Files\Protexis\License Service\PSIService.exe () ========== Driver Services (SafeList) ========== DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG) DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira Operations GmbH & Co. KG) DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG) DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation) DRV:64bit: - (dtsoftbus01) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys (DT Soft Ltd) DRV:64bit: - (LVUVC64) -- C:\Windows\SysNative\drivers\lvuvc64.sys (Logitech Inc.) DRV:64bit: - (LVRS64) -- C:\Windows\SysNative\drivers\lvrs64.sys (Logitech Inc.) DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.) DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.) DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek ) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (asmtxhci) -- C:\Windows\SysNative\drivers\asmtxhci.sys (ASMedia Technology Inc) DRV:64bit: - (asmthub3) -- C:\Windows\SysNative\drivers\asmthub3.sys (ASMedia Technology Inc) DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation) DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation) DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation) DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices) DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation) DRV:64bit: - (VIAHdAudAddService) -- C:\Windows\SysNative\drivers\viahduaa.sys (VIA Technologies, Inc.) DRV:64bit: - (BTATH_A2DP) -- C:\Windows\SysNative\drivers\btath_a2dp.sys (Atheros) DRV:64bit: - (BtFilter) -- C:\Windows\SysNative\drivers\btfilter.sys (Atheros) DRV:64bit: - (BTATH_HCRP) -- C:\Windows\SysNative\drivers\btath_hcrp.sys (Atheros) DRV:64bit: - (BTATH_RCP) -- C:\Windows\SysNative\drivers\btath_rcp.sys (Atheros) DRV:64bit: - (BTATH_LWFLT) -- C:\Windows\SysNative\drivers\btath_lwflt.sys (Atheros) DRV:64bit: - (ATHDFU) -- C:\Windows\SysNative\drivers\AthDfu.sys (Windows (R) Win 7 DDK provider) DRV:64bit: - (AthBTPort) -- C:\Windows\SysNative\drivers\btath_flt.sys (Atheros) DRV:64bit: - (BTATH_BUS) -- C:\Windows\SysNative\drivers\btath_bus.sys (Atheros) DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.) DRV:64bit: - (AtiPcie) -- C:\Windows\SysNative\drivers\AtiPcie.sys (Advanced Micro Devices Inc.) DRV:64bit: - (athur) -- C:\Windows\SysNative\drivers\athurx.sys (Atheros Communications, Inc.) DRV:64bit: - (CVirtA) -- C:\Windows\SysNative\drivers\CVirtA64.sys (Cisco Systems, Inc.) DRV:64bit: - (Sftvol) -- C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation) DRV:64bit: - (Sftredir) -- C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation) DRV:64bit: - (Sftplay) -- C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation) DRV:64bit: - (Sftfs) -- C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation) DRV:64bit: - (MTsensor) -- C:\Windows\SysNative\drivers\ASACPI.sys () DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (RTL85n64) -- C:\Windows\SysNative\drivers\RTL85n64.sys (Realtek) DRV:64bit: - (NVENETFD) -- C:\Windows\SysNative\drivers\nvm62x64.sys (NVIDIA Corporation) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (DNE) -- C:\Windows\SysNative\drivers\dne64x.sys (Deterministic Networks, Inc.) DRV - (SASDIFSV) -- C:\Programme\SUPERAntiSpyware\sasdifsv64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com) DRV - (SASKUTIL) -- C:\Programme\SUPERAntiSpyware\saskutil64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{438CB363-A94D-4AE3-8F99-E93393D46036}: "URL" = hxxp://www.bing.com/?cc=de IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\URLSearchHook: {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - No CLSID value found IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b} IE - HKLM\..\SearchScopes\{BFFED5CA-8BDF-47CC-AED0-23F4E6D77732}: "URL" = hxxp://start.iminent.com/?appId=F3A2E3F6-7989-4E97-8C28-7538D0CC4052&ref=toolbox&q={searchTerms} IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2260964575-2753946872-1401531445-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snap.do/?publisher=QuickOC&dpid=QuickOC&co=DE&userid=6397795e-2cb8-4c1d-8103-856e3cb53086&searchtype=ds&q={searchTerms}&installDate={installDate} IE - HKU\S-1-5-21-2260964575-2753946872-1401531445-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snap.do/?publisher=QuickOC&dpid=QuickOC&co=DE&userid=6397795e-2cb8-4c1d-8103-856e3cb53086&searchtype=ds&q={searchTerms}&installDate={installDate} IE - HKU\S-1-5-21-2260964575-2753946872-1401531445-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com/?ctid=CT3317742&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SP03EB5211-1FEF-4EB1-BF3D-777004BED076&SSPV= IE - HKU\S-1-5-21-2260964575-2753946872-1401531445-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\S-1-5-21-2260964575-2753946872-1401531445-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKU\S-1-5-21-2260964575-2753946872-1401531445-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 04 85 E3 DC 40 DD CC 01 [binary data] IE - HKU\S-1-5-21-2260964575-2753946872-1401531445-1001\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://feed.snap.do/?publisher=QuickOC&dpid=QuickOC&co=DE&userid=6397795e-2cb8-4c1d-8103-856e3cb53086&searchtype=ds&q={searchTerms}&installDate={installDate} IE - HKU\S-1-5-21-2260964575-2753946872-1401531445-1001\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://feed.snap.do/?publisher=QuickOC&dpid=QuickOC&co=DE&userid=6397795e-2cb8-4c1d-8103-856e3cb53086&searchtype=ds&q={searchTerms}&installDate={installDate} IE - HKU\S-1-5-21-2260964575-2753946872-1401531445-1001\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) IE - HKU\S-1-5-21-2260964575-2753946872-1401531445-1001\..\URLSearchHook: {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - No CLSID value found IE - HKU\S-1-5-21-2260964575-2753946872-1401531445-1001\..\SearchScopes,DefaultScope = {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} IE - HKU\S-1-5-21-2260964575-2753946872-1401531445-1001\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.snap.do/?publisher=QuickOC&dpid=QuickOC&co=DE&userid=6397795e-2cb8-4c1d-8103-856e3cb53086&searchtype=ds&q={searchTerms}&installDate={installDate} IE - HKU\S-1-5-21-2260964575-2753946872-1401531445-1001\..\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}: "URL" = hxxp://search.conduit.com/Results.aspx?ctid=CT3317742&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP03EB5211-1FEF-4EB1-BF3D-777004BED076&q={searchTerms}&SSPV= IE - HKU\S-1-5-21-2260964575-2753946872-1401531445-1001\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=117114&tt=4712_2&babsrc=SP_ss_cr&mntrId=6cae971d000000000000f2ec3881af2e IE - HKU\S-1-5-21-2260964575-2753946872-1401531445-1001\..\SearchScopes\{9B69882A-0837-44D9-AEA4-2130BA6A6305}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^U3&apn_dtid=^OSJ000^YY^DE&apn_uid=A6BEC914-923C-4DAA-A3AE-0FAC80638739&apn_sauid=E3683B44-5C82-40C3-B692-1B896F42B4DE IE - HKU\S-1-5-21-2260964575-2753946872-1401531445-1001\..\SearchScopes\{BFFED5CA-8BDF-47CC-AED0-23F4E6D77732}: "URL" = hxxp://start.iminent.com/?appId=F3A2E3F6-7989-4E97-8C28-7538D0CC4052&ref=toolbox&q={searchTerms} IE - HKU\S-1-5-21-2260964575-2753946872-1401531445-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..CT2625848.browser.search.defaultthis.engineName: true FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.suggest.enabled: false FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://search.conduit.com/?ctid=CT3317742&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SP03EB5211-1FEF-4EB1-BF3D-777004BED076&SSPV=" FF - prefs.js..extensions.enabledAddons: %7B6397795e-2cb8-4c1d-8103-856e3cb53086%7D:1.1 FF - prefs.js..extensions.enabledAddons: 7f404ccc-b0a9-4faf-b3c0-89ceea949aea%40a6724a05-9380-4ebe-be02-e67e35a3402c.com:0.93.162 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:24.0 FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll () FF - HKLM\Software\MozillaPlugins\@cambridgesoft.com/Chem3D,version=12.0: C:\Program Files (x86)\CambridgeSoft\ChemOffice2010\Chem3D\npChem3DPlugin.dll (CambridgeSoft Corp.) FF - HKLM\Software\MozillaPlugins\@cambridgesoft.com/Chem3D,version=13.0: C:\Program Files (x86)\CambridgeSoft\ChemOffice2013\Chem3D\npChem3DPlugin.dll (CambridgeSoft Corp.) FF - HKLM\Software\MozillaPlugins\@cambridgesoft.com/ChemDraw,version=12.0: C:\Program Files (x86)\CambridgeSoft\ChemOffice2010\ChemDraw\npcdp32.dll (CambridgeSoft Corp.) FF - HKLM\Software\MozillaPlugins\@cambridgesoft.com/ChemDraw,version=13.0: C:\Program Files (x86)\CambridgeSoft\ChemOffice2013\ChemDraw\npcdp32.dll (CambridgeSoft Corp.) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.40.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.40.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 24.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 24.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.12.04 23:45:10 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}: C:\Program Files (x86)\Wajam\Firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi [2013.10.03 19:59:34 | 000,037,909 | ---- | M] () FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 24.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 24.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.12.04 23:45:10 | 000,000,000 | ---D | M] [2011.12.11 11:21:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\paul\AppData\Roaming\mozilla\Extensions [2013.12.04 23:36:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\paul\AppData\Roaming\mozilla\Firefox\Profiles\d1c5aufo.default\extensions [2013.04.25 21:07:04 | 000,000,000 | ---D | M] ("QuickShare Widget") -- C:\Users\paul\AppData\Roaming\mozilla\Firefox\Profiles\d1c5aufo.default\extensions\{6397795e-2cb8-4c1d-8103-856e3cb53086} [2013.12.02 23:32:40 | 000,000,000 | ---D | M] ("Plus-HD-2.6") -- C:\Users\paul\AppData\Roaming\mozilla\Firefox\Profiles\d1c5aufo.default\extensions\7f404ccc-b0a9-4faf-b3c0-89ceea949aea@a6724a05-9380-4ebe-be02-e67e35a3402c.com [2012.11.21 20:45:09 | 000,000,000 | ---D | M] (Browser Companion Helper) -- C:\Users\paul\AppData\Roaming\mozilla\Firefox\Profiles\d1c5aufo.default\extensions\bbrs_002@blabbers.com [2012.01.29 22:58:34 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\paul\AppData\Roaming\mozilla\Firefox\Profiles\d1c5aufo.default\extensions\engine@conduit.com [2013.10.13 17:48:30 | 000,000,000 | ---D | M] (Iminent Toolbar) -- C:\Users\paul\AppData\Roaming\mozilla\Firefox\Profiles\d1c5aufo.default\extensions\ffxtlbr@iminent.com [2013.08.18 10:05:13 | 000,000,000 | ---D | M] (Ask Toolbar) -- C:\Users\paul\AppData\Roaming\mozilla\Firefox\Profiles\d1c5aufo.default\extensions\toolbar@ask.com [2013.12.05 22:42:46 | 000,000,000 | ---D | M] (No name found) -- C:\Users\paul\AppData\Roaming\mozilla\Firefox\Profiles\d1c5aufo.default\extensions\7f404ccc-b0a9-4faf-b3c0-89ceea949aea@a6724a05-9380-4ebe-be02-e67e35a3402c.com\extensionData [2013.12.05 22:42:46 | 000,000,000 | ---D | M] (No name found) -- C:\Users\paul\AppData\Roaming\mozilla\Firefox\Profiles\d1c5aufo.default\extensions\7f404ccc-b0a9-4faf-b3c0-89ceea949aea@a6724a05-9380-4ebe-be02-e67e35a3402c.com\extensionData\plugins [2013.12.05 22:42:47 | 000,000,000 | ---D | M] (No name found) -- C:\Users\paul\AppData\Roaming\mozilla\Firefox\Profiles\d1c5aufo.default\extensions\7f404ccc-b0a9-4faf-b3c0-89ceea949aea@a6724a05-9380-4ebe-be02-e67e35a3402c.com\extensionData\userCode [2013.11.19 19:03:44 | 000,053,945 | ---- | M] () (No name found) -- C:\Users\paul\AppData\Roaming\mozilla\firefox\profiles\d1c5aufo.default\extensions\pricepeep@getpricepeep.com.xpi [2013.12.02 20:18:10 | 000,625,665 | ---- | M] () (No name found) -- C:\Users\paul\AppData\Roaming\mozilla\firefox\profiles\d1c5aufo.default\extensions\webbooster@iminent.com.xpi [2012.12.15 16:19:43 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\paul\AppData\Roaming\mozilla\firefox\profiles\d1c5aufo.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\0324adea3b6ec02af09ea4ae9424591b_expire [2012.12.15 16:19:17 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\paul\AppData\Roaming\mozilla\firefox\profiles\d1c5aufo.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\2564f7e98c52af18d264c607088851e3_expire [2012.12.15 16:19:44 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\paul\AppData\Roaming\mozilla\firefox\profiles\d1c5aufo.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\292124057d00cb0fa73db6b90d079658_expire [2012.12.15 16:19:37 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\paul\AppData\Roaming\mozilla\firefox\profiles\d1c5aufo.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\2a86ac4f3322238b4f27d14a09839275_expire [2012.12.15 16:19:37 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\paul\AppData\Roaming\mozilla\firefox\profiles\d1c5aufo.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\4d3d10bd28ff623813254a49b26be41f_expire [2012.12.15 16:19:56 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\paul\AppData\Roaming\mozilla\firefox\profiles\d1c5aufo.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\8a8dc36effa0a0300d6fb1a383936a49_expire [2012.12.15 16:19:45 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\paul\AppData\Roaming\mozilla\firefox\profiles\d1c5aufo.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\a38dbdd1af07f4236d43e8fd995f57a6_expire [2012.12.15 16:19:42 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\paul\AppData\Roaming\mozilla\firefox\profiles\d1c5aufo.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\b92b6346ad59377c5d7e59749af61f23_expire [2012.12.15 16:19:45 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\paul\AppData\Roaming\mozilla\firefox\profiles\d1c5aufo.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\bf73732e1f0b76bac435293ba3880579_expire [2012.12.15 16:19:37 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\paul\AppData\Roaming\mozilla\firefox\profiles\d1c5aufo.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\bf74fca65afab1e78673669dcdcba263_expire [2012.12.15 16:19:51 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\paul\AppData\Roaming\mozilla\firefox\profiles\d1c5aufo.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\d89bfd841403290d610bcf662008b443_expire [2012.12.15 16:19:36 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\paul\AppData\Roaming\mozilla\firefox\profiles\d1c5aufo.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\e919434ec29526b28593c426e4264271_expire [2012.12.15 16:19:37 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\paul\AppData\Roaming\mozilla\firefox\profiles\d1c5aufo.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\f03527c67e08602d2e4c18ae7867300d_expire [2012.12.15 16:19:36 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\paul\AppData\Roaming\mozilla\firefox\profiles\d1c5aufo.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\fa74672918974682c82b8d91dfbe0d6b_expire [2012.12.15 16:19:23 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\paul\AppData\Roaming\mozilla\firefox\profiles\d1c5aufo.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\ff4d692d5e7cccbc4b3e9ef4062b1c6f_expire [2013.02.08 14:53:16 | 000,002,333 | ---- | M] () -- C:\Users\paul\AppData\Roaming\mozilla\firefox\profiles\d1c5aufo.default\searchplugins\askcom.xml [2013.12.04 23:36:59 | 000,000,975 | ---- | M] () -- C:\Users\paul\AppData\Roaming\mozilla\firefox\profiles\d1c5aufo.default\searchplugins\conduit-search.xml [2013.10.13 17:48:30 | 000,001,368 | ---- | M] () -- C:\Users\paul\AppData\Roaming\mozilla\firefox\profiles\d1c5aufo.default\searchplugins\iminent.xml [2013.05.20 22:43:30 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\Extensions [2013.05.17 15:34:52 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions [2013.10.10 21:50:25 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2013.01.10 14:08:36 | 000,002,147 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\StartWeb.xml ========== Chrome ========== CHR - homepage: hxxp://start.iminent.com/?appId=F3A2E3F6-7989-4E97-8C28-7538D0CC4052 CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter} CHR - homepage: hxxp://start.iminent.com/?appId=F3A2E3F6-7989-4E97-8C28-7538D0CC4052 CHR - Extension: QuickShare Widget = C:\Users\paul\AppData\Local\Google\Chrome\User Data\Default\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl\1.4_0\ CHR - Extension: DVDVideoSoftTB DE = C:\Users\paul\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhphemoobgnikcoofkgackkaimpfmenm\10.14.40.128_0\ CHR - Extension: YouTube = C:\Users\paul\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1\ CHR - Extension: Browser Companion Helper = C:\Users\paul\AppData\Local\Google\Chrome\User Data\Default\Extensions\bodddioamolcibagionmmobehnbhiakf\1.0.5_0\ CHR - Extension: Google-Suche = C:\Users\paul\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\ CHR - Extension: Iminent = C:\Users\paul\AppData\Local\Google\Chrome\User Data\Default\Extensions\igdhbblpcellaljokkpfhcjlagemhgjl\7.41.2.1_0\ CHR - Extension: PricePeep = C:\Users\paul\AppData\Local\Google\Chrome\User Data\Default\Extensions\licjnkifamhpbaefhdpacpmihicfbomb\2.2.0.6_0\ CHR - Extension: Plus-HD-2.6 = C:\Users\paul\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpfeggemggokijeahnacacopejaabljl\1.24.50_0\crossrider CHR - Extension: Plus-HD-2.6 = C:\Users\paul\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpfeggemggokijeahnacacopejaabljl\1.24.50_0\ CHR - Extension: No name found = C:\Users\paul\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\ CHR - Extension: Iminent Chrome Toolbar = C:\Users\paul\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0\ CHR - Extension: Iminent Chrome Toolbar = C:\Users\paul\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\ O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Plus-HD-2.6) - {11111111-1111-1111-1111-110311341140} - C:\Program Files (x86)\Plus-HD-2.6\Plus-HD-2.6-bho64.dll (Plus HD) O2 - BHO: (no name) - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - No CLSID value found. O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (CIESpeechBHO Class) - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations) O2 - BHO: (Wajam) - {A7A6995D-6EE1-4FD1-A258-49395D5BF99C} - C:\Program Files (x86)\Wajam\IE\priam_bho.dll (Wajam) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKU\S-1-5-21-2260964575-2753946872-1401531445-1001\..\Toolbar\WebBrowser: (no name) - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - No CLSID value found. O3 - HKU\S-1-5-21-2260964575-2753946872-1401531445-1001\..\Toolbar\WebBrowser: (no name) - {A1E75A0E-4397-4BA8-BB50-E19FB66890F4} - No CLSID value found. O3 - HKU\S-1-5-21-2260964575-2753946872-1401531445-1001\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O4:64bit: - HKLM..\Run: [AthBtTray] C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe (Atheros Commnucations) O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA) O4 - HKLM..\Run: [LWS] C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.) O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-2260964575-2753946872-1401531445-1000..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-2260964575-2753946872-1401531445-1001..\Run: [ISUSPM Startup] C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup File not found O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-21-2260964575-2753946872-1401531445-1000..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - Startup: C:\Users\paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\paul\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 File not found O9:64bit: - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - Reg Error: Value error. File not found O9 - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations) O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F668B87A-704F-4C1E-B9CE-9C934109E16E}: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\base64 - No CLSID value found O18:64bit: - Protocol\Handler\chrome - No CLSID value found O18:64bit: - Protocol\Handler\gopher - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found O18:64bit: - Protocol\Handler\mso-offdap - No CLSID value found O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found O18:64bit: - Protocol\Handler\prox - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18 - Protocol\Handler\base64 {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files (x86)\BrowserCompanion\tdataprotocol.dll (Blabbers Communications Ltd) O18 - Protocol\Handler\chrome {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files (x86)\BrowserCompanion\tdataprotocol.dll (Blabbers Communications Ltd) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\prox {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files (x86)\BrowserCompanion\tdataprotocol.dll (Blabbers Communications Ltd) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18:64bit: - Protocol\Filter\text/xml - No CLSID value found O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll) - C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll (Conduit) O20:64bit: - AppInit_DLLs: (c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll) - File not found O20:64bit: - AppInit_DLLs: (c:\progra~3\bitguard\271769~1.27\{c16c1~1\loader.dll) - File not found O20 - AppInit_DLLs: (C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll) - C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll (Conduit) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{79b08fa9-24ee-11e1-b05c-14dae92ea7cc}\Shell - "" = AutoRun O33 - MountPoints2\{79b08fa9-24ee-11e1-b05c-14dae92ea7cc}\Shell\AutoRun\command - "" = K:\INTRO.EXE O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.12.04 23:44:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe [2013.12.04 23:39:24 | 000,264,616 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe [2013.12.04 23:37:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MyPC Backup [2013.12.04 23:36:22 | 000,000,000 | ---D | C] -- C:\Users\paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam [2013.12.04 23:36:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Wajam [2013.12.04 23:36:12 | 000,000,000 | ---D | C] -- C:\Users\paul\AppData\Roaming\Systweak [2013.12.04 23:36:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PricePeep [2013.12.04 23:36:10 | 000,020,312 | ---- | C] (Systweak Inc., (www.systweak.com)) -- C:\Windows\SysNative\roboot64.exe [2013.12.04 23:35:51 | 000,000,000 | ---D | C] -- C:\Users\paul\AppData\Local\SearchProtect [2013.12.04 23:35:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SearchProtect [2013.12.04 08:12:37 | 000,000,000 | ---D | C] -- C:\Users\paul\AppData\Roaming\Malwarebytes [2013.12.04 08:12:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2013.12.04 08:12:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2013.12.04 08:12:18 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2013.12.04 08:12:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2013.12.03 09:34:01 | 000,000,000 | ---D | C] -- C:\Users\paul\Doctor Web [2013.12.03 09:19:24 | 000,000,000 | ---D | C] -- C:\ProgramData\SecTaskMan [2013.12.03 09:19:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security Task Manager [2013.12.03 09:19:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Security Task Manager [2013.12.03 09:06:21 | 000,000,000 | ---D | C] -- C:\Users\paul\AppData\Roaming\ParetoLogic [2013.12.03 09:06:21 | 000,000,000 | ---D | C] -- C:\Users\paul\AppData\Roaming\DriverCure [2013.12.03 09:06:18 | 000,000,000 | ---D | C] -- C:\Users\paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ParetoLogic [2013.12.03 09:06:15 | 000,000,000 | ---D | C] -- C:\ProgramData\ParetoLogic [2013.12.03 09:06:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ParetoLogic [2013.12.03 09:06:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ParetoLogic [2013.12.02 00:15:29 | 000,000,000 | ---D | C] -- C:\Users\paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitGuard [2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013.12.05 23:12:25 | 000,021,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.12.05 23:12:25 | 000,021,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.12.05 23:09:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013.12.05 23:00:42 | 000,021,559 | ---- | M] () -- C:\Users\paul\Desktop\MBAM-log-2013-12-05 (09-04-48).zip [2013.12.05 22:59:32 | 000,021,258 | ---- | M] () -- C:\Users\paul\Desktop\mbam-log-2013-12-05 (20-16-10).zip [2013.12.05 20:01:43 | 001,500,018 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2013.12.05 20:01:43 | 000,654,372 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2013.12.05 20:01:43 | 000,616,254 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2013.12.05 20:01:43 | 000,129,986 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2013.12.05 20:01:43 | 000,106,376 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2013.12.05 20:01:33 | 000,107,416 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys [2013.12.05 20:00:54 | 000,001,900 | ---- | M] () -- C:\Windows\tasks\Plus-HD-2.6-chromeinstaller.job [2013.12.05 20:00:54 | 000,001,824 | ---- | M] () -- C:\Windows\tasks\Plus-HD-2.6-firefoxinstaller.job [2013.12.05 20:00:54 | 000,001,288 | ---- | M] () -- C:\Windows\tasks\Plus-HD-2.6-updater.job [2013.12.05 20:00:53 | 000,001,192 | ---- | M] () -- C:\Windows\tasks\Plus-HD-2.6-codedownloader.job [2013.12.05 20:00:53 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\Plus-HD-2.6-enabler.job [2013.12.05 19:56:20 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.12.05 19:56:10 | 1932,091,391 | -HS- | M] () -- C:\hiberfil.sys [2013.12.05 00:28:07 | 000,233,762 | ---- | M] () -- C:\Users\paul\Desktop\cc_20131205_002753.reg [2013.12.04 23:45:10 | 000,002,027 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader XI.lnk [2013.12.04 08:12:20 | 000,001,121 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2013.12.03 09:53:55 | 000,000,466 | ---- | M] () -- C:\Windows\tasks\ParetoLogic Registration3.job [2013.12.03 09:53:55 | 000,000,440 | ---- | M] () -- C:\Windows\tasks\ParetoLogic Update Version3.job [2013.12.03 09:53:55 | 000,000,398 | ---- | M] () -- C:\Windows\tasks\PC Health Advisor Defrag.job [2013.12.03 09:53:55 | 000,000,380 | ---- | M] () -- C:\Windows\tasks\PC Health Advisor.job [2013.12.03 09:06:18 | 000,001,109 | ---- | M] () -- C:\Users\paul\Desktop\ParetoLogic PC Health Advisor.lnk [2013.12.02 00:22:57 | 000,132,600 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys [2013.12.02 00:22:57 | 000,083,160 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avnetflt.sys [2013.12.02 00:22:57 | 000,028,600 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys [2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2013.12.05 23:00:42 | 000,021,559 | ---- | C] () -- C:\Users\paul\Desktop\MBAM-log-2013-12-05 (09-04-48).zip [2013.12.05 22:59:32 | 000,021,258 | ---- | C] () -- C:\Users\paul\Desktop\mbam-log-2013-12-05 (20-16-10).zip [2013.12.05 00:27:59 | 000,233,762 | ---- | C] () -- C:\Users\paul\Desktop\cc_20131205_002753.reg [2013.12.04 23:45:10 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk [2013.12.04 23:45:10 | 000,002,027 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader XI.lnk [2013.12.04 23:36:51 | 000,001,967 | ---- | C] () -- C:\Users\paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lollipop.lnk [2013.12.04 08:12:20 | 000,001,121 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2013.12.03 09:06:26 | 000,000,466 | ---- | C] () -- C:\Windows\tasks\ParetoLogic Registration3.job [2013.12.03 09:06:18 | 000,001,109 | ---- | C] () -- C:\Users\paul\Desktop\ParetoLogic PC Health Advisor.lnk [2013.12.03 09:06:17 | 000,000,440 | ---- | C] () -- C:\Windows\tasks\ParetoLogic Update Version3.job [2013.12.03 09:06:16 | 000,000,398 | ---- | C] () -- C:\Windows\tasks\PC Health Advisor Defrag.job [2013.12.03 09:06:15 | 000,000,380 | ---- | C] () -- C:\Windows\tasks\PC Health Advisor.job [2013.10.12 23:03:34 | 000,000,261 | ---- | C] () -- C:\Windows\MAXLINK.INI [2013.10.12 23:02:09 | 000,017,376 | R--- | C] ( ) -- C:\Windows\SysWow64\drivers\Gt680x.sys [2013.10.12 23:02:09 | 000,000,613 | ---- | C] () -- C:\Windows\if40le.ini [2013.10.12 23:02:07 | 000,000,114 | ---- | C] () -- C:\Windows\SCNDRVU.INI [2013.10.12 23:01:46 | 000,001,256 | ---- | C] () -- C:\Windows\If42le.ini [2013.10.12 23:01:46 | 000,000,241 | ---- | C] () -- C:\Windows\PEXPLORE.INI [2013.10.12 23:01:45 | 000,011,776 | ---- | C] () -- C:\Windows\SysWow64\pmsbfn32.dll [2013.10.12 23:01:41 | 000,000,403 | ---- | C] () -- C:\Windows\umxaddin.ini [2013.02.11 23:02:15 | 000,004,096 | -H-- | C] () -- C:\Users\paul\AppData\Local\keyfile3.drm [2012.08.04 13:31:06 | 000,429,416 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe [2012.01.14 00:34:14 | 001,526,060 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2011.12.12 20:20:35 | 000,108,032 | ---- | C] () -- C:\Windows\SysWow64\sh33w32.dll [2011.12.12 19:37:59 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI [2011.12.12 19:22:16 | 000,327,680 | ---- | C] () -- C:\Windows\SysWow64\pythoncom25.dll [2011.12.12 19:22:16 | 000,102,400 | ---- | C] () -- C:\Windows\SysWow64\pywintypes25.dll [2011.12.12 19:14:11 | 000,002,828 | -HS- | C] () -- C:\Windows\SysWow64\KGyGaAvL.sys [2011.12.12 19:14:11 | 000,000,088 | RHS- | C] () -- C:\Windows\SysWow64\5833B39B1A.sys [2011.12.11 11:56:29 | 000,044,982 | ---- | C] () -- C:\Windows\Ascd_log.ini ========== ZeroAccess Check ========== [2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2010.11.21 04:23:55 | 014,174,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2010.11.21 04:24:02 | 012,872,192 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 04:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2012.10.26 23:34:06 | 000,000,000 | ---D | M] -- C:\Users\paul\AppData\Roaming\Activision [2012.01.29 23:59:39 | 000,000,000 | ---D | M] -- C:\Users\paul\AppData\Roaming\Ashampoo [2012.11.21 20:40:30 | 000,000,000 | ---D | M] -- C:\Users\paul\AppData\Roaming\Babylon [2012.12.26 11:21:31 | 000,000,000 | ---D | M] -- C:\Users\paul\AppData\Roaming\Canneverbe Limited [2012.01.27 00:08:48 | 000,000,000 | ---D | M] -- C:\Users\paul\AppData\Roaming\DAEMON Tools Lite [2013.12.03 09:06:21 | 000,000,000 | ---D | M] -- C:\Users\paul\AppData\Roaming\DriverCure [2013.12.05 20:01:07 | 000,000,000 | ---D | M] -- C:\Users\paul\AppData\Roaming\Dropbox [2012.12.17 00:47:06 | 000,000,000 | ---D | M] -- C:\Users\paul\AppData\Roaming\DVDVideoSoft [2012.12.10 17:57:12 | 000,000,000 | ---D | M] -- C:\Users\paul\AppData\Roaming\EndNote [2013.12.04 23:13:52 | 000,000,000 | ---D | M] -- C:\Users\paul\AppData\Roaming\File Scout [2013.10.13 17:48:27 | 000,000,000 | ---D | M] -- C:\Users\paul\AppData\Roaming\Iminent [2011.12.30 13:42:21 | 000,000,000 | ---D | M] -- C:\Users\paul\AppData\Roaming\Leadertech [2013.08.18 23:18:05 | 000,000,000 | ---D | M] -- C:\Users\paul\AppData\Roaming\Mestrelab Research S.L [2013.08.18 11:05:06 | 000,000,000 | ---D | M] -- C:\Users\paul\AppData\Roaming\moses2 [2012.12.15 16:18:44 | 000,000,000 | ---D | M] -- C:\Users\paul\AppData\Roaming\OpenCandy [2013.01.10 00:14:15 | 000,000,000 | ---D | M] -- C:\Users\paul\AppData\Roaming\Origin [2011.12.12 20:02:25 | 000,000,000 | ---D | M] -- C:\Users\paul\AppData\Roaming\OriginLab [2013.12.03 09:06:21 | 000,000,000 | ---D | M] -- C:\Users\paul\AppData\Roaming\ParetoLogic [2013.11.01 00:58:53 | 000,000,000 | ---D | M] -- C:\Users\paul\AppData\Roaming\SoftGrid Client [2013.12.04 23:59:45 | 000,000,000 | ---D | M] -- C:\Users\paul\AppData\Roaming\Systweak [2012.01.14 00:35:08 | 000,000,000 | ---D | M] -- C:\Users\paul\AppData\Roaming\TP ========== Purity Check ========== ========== Files - Unicode (All) ========== [2013.10.16 22:24:49 | 101,406,750 | ---- | M] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\哀ή† [2013.10.16 22:24:49 | 101,406,750 | ---- | C] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\哀ή† [2013.10.14 18:33:12 | 100,975,419 | ---- | M] ()(C:\Windows\SysWow64\???) -- C:\Windows\SysWow64\첂凌 [2013.10.14 18:33:12 | 100,975,419 | ---- | C] ()(C:\Windows\SysWow64\???) -- C:\Windows\SysWow64\첂凌 [2013.09.24 19:05:48 | 097,540,783 | ---- | M] ()(C:\Windows\SysWow64\???&) -- C:\Windows\SysWow64\씗谴& [2013.09.24 19:05:48 | 097,540,783 | ---- | C] ()(C:\Windows\SysWow64\???&) -- C:\Windows\SysWow64\씗谴& < End of report > Code:
ATTFilter SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com
Generated 12/04/2013 at 07:52 PM
Application Version : 5.6.1014
Core Rules Database Version : 9627
Trace Rules Database Version: 7439
Scan type : Complete Scan
Total Scan Time : 00:33:54
Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User
Memory items scanned : 331
Memory threats detected : 0
Registry items scanned : 76671
Registry threats detected : 7
File items scanned : 64923
File threats detected : 144
PUP.bProtector
(x86) HKU\S-1-5-21-2260964575-2753946872-1401531445-1001\Software\Microsoft\Internet Explorer\Main#bProtector Start Page [ hxxp://search.babylon.com/?affID=112861&tt=4712_1&babsrc=HP_ss&mntrId=6cae971d000000000000f2ec3881af2e ]
(x86) HKU\S-1-5-21-2260964575-2753946872-1401531445-1001\Software\Microsoft\Internet Explorer\SearchScopes#bProtectorDefaultScope [ {afdbddaa-5d3f-42ee-b79c-185a7020515b} ]
(x86) HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693}
(x86) HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693}#DisplayName
(x86) HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693}#uninstallstring
(x86) HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693}#UninstalLinkPath
(x86) HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693}#Publisher
Adware.Tracking Cookie
C:\Users\paul\AppData\Roaming\Microsoft\Windows\Cookies\7C7VIAQE.txt [ /doubleclick.net ]
C:\Users\paul\AppData\Roaming\Microsoft\Windows\Cookies\TGGKGCEW.txt [ /ads.yahoo.com ]
C:\Users\paul\AppData\Roaming\Microsoft\Windows\Cookies\EOHK6B4V.txt [ /invitemedia.com ]
C:\USERS\PAUL\Cookies\7C7VIAQE.txt [ Cookie:paul@doubleclick.net/ ]
C:\USERS\PAUL\Cookies\EOHK6B4V.txt [ Cookie:paul@invitemedia.com/ ]
ad.yieldmanager.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
ad.yieldmanager.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
ad.yieldmanager.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.xiti.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
de.sitestat.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
de.sitestat.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.revsci.net [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.doubleclick.net [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.serving-sys.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.serving-sys.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.atdmt.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.atdmt.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.tracking.quisma.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adtech.de [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.unister-adservices.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.apmebf.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.mediaplex.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.banner.t-online.de [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
track.adform.net [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
accounts.google.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.revsci.net [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.revenuemax.de [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.webmasterplan.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.webmasterplan.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.apmebf.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
ad.yieldmanager.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
ad.yieldmanager.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.avazutracking.net [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.seth.avazutracking.net [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.seth.avazutracking.net [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.avazutracking.net [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.seth.avazutracking.net [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.avazutracking.net [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.invitemedia.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.webmasterplan.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.webmasterplan.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.webmasterplan.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
tomtailor.dyntracker.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.webmasterplan.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.webmasterplan.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.webmasterplan.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.webmasterplan.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.webmasterplan.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.tradedoubler.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.tradedoubler.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
track.adform.net [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adform.net [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.lucidmedia.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.doubleclick.net [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.fastclick.net [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adfarm1.adition.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adfarm1.adition.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adfarm1.adition.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adfarm1.adition.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adfarm1.adition.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.tradedoubler.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adfarm1.adition.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.im.banner.t-online.de [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adfarm1.adition.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.specificclick.net [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.invitemedia.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adtech.de [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adtech.de [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.im.banner.t-online.de [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adfarm1.adition.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
adfarm1.adition.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adfarm1.adition.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adfarm1.adition.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adfarm1.adition.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adfarm1.adition.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adfarm1.adition.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
ad4.adfarm1.adition.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adfarm1.adition.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adfarm1.adition.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adfarm1.adition.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adfarm1.adition.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.mediaplex.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
ad.zanox.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.revsci.net [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.revsci.net [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.revsci.net [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.revsci.net [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.olympiaverlag.122.2o7.net [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.im.banner.t-online.de [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.invitemedia.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.invitemedia.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.invitemedia.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.invitemedia.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
ad2.adfarm1.adition.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adfarm1.adition.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.invitemedia.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.invitemedia.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
ad.yieldmanager.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.serving-sys.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.serving-sys.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.serving-sys.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adtech.de [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
ad.yieldmanager.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
ad.yieldmanager.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
ad.yieldmanager.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
ad1.adfarm1.adition.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.zanox.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adfarm1.adition.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
ad3.adfarm1.adition.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adfarm1.adition.com [ C:\USERS\PAUL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.vinsight.de [ C:\USERS\PAUL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D1C5AUFO.DEFAULT\COOKIES.SQLITE ]
.doubleclick.net [ C:\USERS\PAUL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D1C5AUFO.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\PAUL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D1C5AUFO.DEFAULT\COOKIES.SQLITE ]
.lucidmedia.com [ C:\USERS\PAUL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D1C5AUFO.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\PAUL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D1C5AUFO.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\PAUL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D1C5AUFO.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\PAUL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D1C5AUFO.DEFAULT\COOKIES.SQLITE ]
.apmebf.com [ C:\USERS\PAUL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D1C5AUFO.DEFAULT\COOKIES.SQLITE ]
.zanox.com [ C:\USERS\PAUL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D1C5AUFO.DEFAULT\COOKIES.SQLITE ]
ad.zanox.com [ C:\USERS\PAUL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D1C5AUFO.DEFAULT\COOKIES.SQLITE ]
.rambler.ru [ C:\USERS\PAUL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D1C5AUFO.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\PAUL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D1C5AUFO.DEFAULT\COOKIES.SQLITE ]
ad2.adfarm1.adition.com [ C:\USERS\PAUL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D1C5AUFO.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\PAUL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D1C5AUFO.DEFAULT\COOKIES.SQLITE ]
.questionmarket.com [ C:\USERS\PAUL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D1C5AUFO.DEFAULT\COOKIES.SQLITE ]
.questionmarket.com [ C:\USERS\PAUL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D1C5AUFO.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\PAUL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D1C5AUFO.DEFAULT\COOKIES.SQLITE ]
adfarm1.adition.com [ C:\USERS\PAUL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D1C5AUFO.DEFAULT\COOKIES.SQLITE ]
adx.chip.de [ C:\USERS\PAUL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D1C5AUFO.DEFAULT\COOKIES.SQLITE ]
track.adform.net [ C:\USERS\PAUL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D1C5AUFO.DEFAULT\COOKIES.SQLITE ]
.tradedoubler.com [ C:\USERS\PAUL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D1C5AUFO.DEFAULT\COOKIES.SQLITE ]
.tradedoubler.com [ C:\USERS\PAUL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D1C5AUFO.DEFAULT\COOKIES.SQLITE ]
.tradedoubler.com [ C:\USERS\PAUL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D1C5AUFO.DEFAULT\COOKIES.SQLITE ]
track.adform.net [ C:\USERS\PAUL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D1C5AUFO.DEFAULT\COOKIES.SQLITE ]
.adform.net [ C:\USERS\PAUL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D1C5AUFO.DEFAULT\COOKIES.SQLITE ]
tracking.mlsat02.de [ C:\USERS\PAUL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D1C5AUFO.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\PAUL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D1C5AUFO.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\PAUL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D1C5AUFO.DEFAULT\COOKIES.SQLITE ]
adx.chip.de [ C:\USERS\PAUL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D1C5AUFO.DEFAULT\COOKIES.SQLITE ]
.rambler.ru [ C:\USERS\PAUL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D1C5AUFO.DEFAULT\COOKIES.SQLITE ]
Trojan.Agent/Gen-FakeAlert
C:\$RECYCLE.BIN\S-1-5-21-2260964575-2753946872-1401531445-1001\$R2VN76R\PAGEABC\PAGEABC\LEADIN.EXE
Trojan.Agent/Gen-AutoRun
C:\PROGRAM FILES (X86)\ORIGINLAB\ORIGIN75G\SAMPLES\AUTOMATIONSERVER\VB\FFTFILTERING\FFTFILTERING.EXE
C:\PROGRAM FILES (X86)\ORIGINLAB\ORIGIN75G\SAMPLES\AUTOMATIONSERVER\VB\SENDTEXTDATATOWKS\SENDTEXTDATATOWKS.EXE
Geändert von paule8686 (05.12.2013 um 23:48 Uhr) |
| Themen zu Windows 7: Trojaner und Filescout.exe, immer wieder neue Viren |
| avira, desktop, filescout.exe, hdd0(c:, lsass.exe, lws.exe, malwarebytes, microsoft, plug-in, problem, programm, prozesse, scan, services.exe, superantispyware, svchost.exe, taskhost.exe, tr/sefnit.bo, trojan activity detected. system data security is at risk, trojan.agent/gen-autorun, trojan.agent/gen-fakealert, trojaner, wajam, windows, winlogon.exe |
Baum-Darstellung