| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Entfernung von greygray, lollipop und nation zoomWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
06.01.2014, 00:14
| #1 |
| |  Entfernung von greygray, lollipop und nation zoom Hallo, seit ein paar Tagen habe ich ein (anscheinend weit verbreitetes) Problem mit Nation Zoom, welche sich beim öffnen eines neuen Tabs bei Firefox immer als Startseite öffnet. Außerdem habe ich auch dieses extreme Werbung Problem trotz eingeschaltetem ADblock add-on. Ich habe mir beim Installieren von irgendwas folgendes eingefangen: greygray und lollipop. Klingt niedlich, ist es aber anscheinend nicht. Zu greygray habe ich folgende Infos gefunden: hxxp://www.loschenspywarevirus.com/entfernen-greygray-wie-greygray-entfernen (ist anscheinend mit einem Computerprogramm übersetzt wurden). Nachdem ich das las, bekam ich schon angst um meinen PC und die teils wichtigen Daten darauf. Ist dieses Programm tatsächlich so schädlich wie dort geschildert? Ich habe mir dieses Tool nicht herunter geladen, da ich nicht weiß wie sicher die Seite/der Download ist. Unternommen habe ich bis jetz: -Versuch Lollipop und greygray über Systemsteuerung-> "Programme und Funktionen" zu löschen. Dort ist es auch nicht mehr aufgeführt. Dann habe ich das System mit mbam (Quickscan) gescannt und die gefundenen Bedrohungen entfernt, danach Neustart des PCs. Voller Hoffnung öffnete ich Firefox, dann hat sich Nation Zoom wieder geöffnet..  Ich habe schon bei firefox in den ad-ons gesucht, aber da ist weder lollipop, greygray noch nation zoom zu finden. Die Startseite habe ich in firefox auch geändert, auf die Standard-Startseite von firefox, trotzdem öffnet sich Nation Zomom. Außerdem habe ich auch diverse Logs erstellt.gmer logfile Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2014-01-05 20:28:26
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD3200BEKT-60V5T1 rev.12.01A12 298,09GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\HP\AppData\Local\Temp\pxldipoc.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff80002fbe000 45 bytes [00, 00, 15, 02, 46, 69, 6C, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 574 fffff80002fbe02e 17 bytes [4B, 00, 00, 00, 00, 00, 00, ...]
.text C:\Windows\System32\win32k.sys!W32pServiceTable fffff96000163f00 7 bytes [80, 9D, F3, FF, 01, A9, F0]
.text C:\Windows\System32\win32k.sys!W32pServiceTable + 8 fffff96000163f08 3 bytes [C0, 06, 02]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Connectify\ConnectifyService.exe[1952] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000773e1465 2 bytes [3E, 77]
.text C:\Program Files (x86)\Connectify\ConnectifyService.exe[1952] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000773e14bb 2 bytes [3E, 77]
.text ... * 2
.text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2016] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000773e1465 2 bytes [3E, 77]
.text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2016] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000773e14bb 2 bytes [3E, 77]
.text ... * 2
.text C:\PROGRAM FILES (X86)\ROCCAT\PYRA MOUSE\PYRAMONITOR.EXE[3740] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000773e1465 2 bytes [3E, 77]
.text C:\PROGRAM FILES (X86)\ROCCAT\PYRA MOUSE\PYRAMONITOR.EXE[3740] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000773e14bb 2 bytes [3E, 77]
.text ... * 2
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-01-2014
Ran by HP (administrator) on HP-PC on 05-01-2014 20:02:38
Running from C:\Users\HP\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\stacsv64.exe
(Hewlett-Packard) C:\Windows\System32\hpservice.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files (x86)\Connectify\ConnectifyService.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Connectify) C:\Program Files (x86)\Connectify\Connectifyd.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(CyberLink) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
(ROCCAT) C:\Program Files (x86)\ROCCAT\Pyra Mouse\PyraMonitor.exe
(Hewlett-Packard) C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPNetworkCommunicatorCom.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
() C:\Program Files (x86)\Hewlett-Packard\Shared\HpqToaster.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
() C:\Users\HP\Downloads\adwcleaner_3.016.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPNetworkCommunicator.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1815848 2009-07-15] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [450048 2009-07-22] (IDT, Inc.)
HKLM\...\Run: [SpywareTerminatorShield] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2777736 2013-04-03] (Crawler.com)
HKLM\...\Run: [SpywareTerminatorUpdater] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe [3684488 2013-04-03] (Crawler.com)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-08-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [HPCam_Menu] - C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [60464 2009-09-02] (EasyBits Software AS)
HKLM-x32\...\Run: [WirelessAssistant] - C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [498744 2009-07-23] (Hewlett-Packard)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [ROCCAT Pyra Mouse] - C:\Program Files (x86)\ROCCAT\Pyra Mouse\PyraMonitor.exe [532480 2010-09-07] (ROCCAT)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-09] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [mobilegeni daemon] - C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
HKCU\...\Run: [RESTART_STICKY_NOTES] - C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
HKCU\...\Run: [HP Deskjet 3520 series (NET)] - C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKCU\...\Run: [lollipop_01021904] - "c:\users\hp\appdata\local\lollipop\lollipop_01021904.exe" lollipop_01021904
HKCU\...\Policies\system: [DisableLockWorkstation] 0
HKCU\...\Policies\system: [DisableChangePassword] 0
HKCU\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
Startup: C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Deskjet 1050 J410 series.lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Deskjet 1050 J410 series.lnk -> C:\Program Files\HP\HP Deskjet 1050 J410 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
Startup: C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Deskjet 3520 series (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Deskjet 3520 series (Netzwerk).lnk -> C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
==================== Internet (Whitelisted) ====================
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292&q={searchTerms}
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52272 2009-11-14] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\v7vqmpsy.default
FF user.js: detected! => C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\v7vqmpsy.default\user.js
FF NewTab: hxxp://www.nationzoom.com/newtab/?type=nt&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf - C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\HP\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\v7vqmpsy.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
FF Extension: Adblock Plus - C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\v7vqmpsy.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF StartMenuInternet: FIREFOX.EXE - firefox.exe
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
==================== Services (Whitelisted) =================
R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe [89600 2009-03-02] (Andrea Electronics Corporation)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1011768 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 Connectify; C:\Program Files (x86)\Connectify\ConnectifyService.exe [65536 2012-11-09] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [227232 2010-01-15] (McAfee, Inc.)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-07-06] ()
R2 ST2012_Svc; C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe [1149104 2013-04-03] (Crawler.com)
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\STacSV64.exe [240128 2009-07-22] (IDT, Inc.)
R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [x]
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [84720 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 cnnctfy2; C:\Windows\System32\DRIVERS\cnnctfy2.sys [31344 2013-02-04] (Connectify)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S1 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R2 sp_rsdrv2; C:\Windows\System32\DRIVERS\stflt.sys [51496 2013-12-15] (Windows (R) Win 7 DDK provider)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-05 20:02 - 2014-01-05 20:03 - 00016934 _____ C:\Users\HP\Downloads\FRST.txt
2014-01-05 20:01 - 2014-01-05 20:01 - 00000000 ____D C:\FRST
2014-01-05 20:00 - 2014-01-05 20:00 - 01931368 _____ (Farbar) C:\Users\HP\Downloads\FRST64.exe
2014-01-05 19:55 - 2014-01-05 19:58 - 00000466 _____ C:\Users\HP\Downloads\defogger_disable.log
2014-01-05 19:55 - 2014-01-05 19:55 - 00050477 _____ C:\Users\HP\Downloads\Defogger.exe
2014-01-05 19:55 - 2014-01-05 19:55 - 00000000 _____ C:\Users\HP\defogger_reenable
2014-01-05 19:13 - 2014-01-05 19:13 - 01233962 _____ C:\Users\HP\Downloads\adwcleaner_3.016.exe
2014-01-05 19:13 - 2014-01-05 19:13 - 00000000 ____D C:\AdwCleaner
2014-01-05 18:17 - 2014-01-05 18:17 - 00003094 _____ C:\Windows\System32\Tasks\{0EC71F8B-5BB4-4732-9DA9-0DDCCEAD66D8}
2014-01-02 03:54 - 2014-01-02 03:54 - 00003104 _____ C:\Windows\System32\Tasks\{EE114A32-CFB7-4C59-9274-03C60BB1D9EA}
2014-01-02 02:08 - 2014-01-02 02:08 - 00007605 _____ C:\Users\HP\AppData\Local\Resmon.ResmonCfg
2014-01-02 02:03 - 2014-01-02 02:03 - 00821760 _____ (Browser Opt-out) C:\Users\HP\Downloads\uninstall.exe
2013-12-31 01:58 - 2013-12-31 02:04 - 00000000 ____D C:\Users\HP\Desktop\USB Stick
2013-12-31 01:13 - 2014-01-05 18:49 - 00000000 ____D C:\ProgramData\WPM
2013-12-31 01:13 - 2014-01-05 18:47 - 00000000 ____D C:\Program Files (x86)\AmiExt
2013-12-31 01:13 - 2014-01-02 20:18 - 00000000 ____D C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop
2013-12-31 01:07 - 2013-12-31 01:24 - 00000000 ____D C:\Users\HP\AppData\Local\cache
2013-12-31 01:06 - 2013-12-31 01:26 - 00000000 ____D C:\Users\HP\AppData\Local\Mobogenie
2013-12-31 01:06 - 2013-12-31 01:06 - 00000000 ____D C:\Users\HP\Documents\Mobogenie
2013-12-31 01:06 - 2013-12-31 01:06 - 00000000 _____ C:\Users\HP\daemonprocess.txt
2013-12-31 01:05 - 2014-01-02 02:03 - 00003232 _____ C:\Windows\System32\Tasks\SomotoUpdateCheckerAutoStart
2013-12-31 00:41 - 2013-12-31 00:42 - 05159030 ____R (Swearware) C:\Users\HP\Desktop\ComboFix.exe
2013-12-31 00:41 - 2013-12-31 00:42 - 00000000 ___SD C:\ComboFix
2013-12-31 00:41 - 2013-12-31 00:41 - 00000000 ____D C:\Windows\ERDNT
2013-12-27 03:15 - 2013-12-27 03:24 - 00001648 _____ C:\Windows\system32\ASOROSet.bin
2013-12-27 03:15 - 2013-12-27 03:16 - 00000000 ____D C:\Windows\system32\config\RCCBakup
2013-12-27 01:02 - 2013-12-27 01:02 - 00001194 _____ C:\Users\HP\Desktop\Amazon Cloud Player.lnk
2013-12-27 01:02 - 2013-12-27 01:02 - 00000000 ____D C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon Cloud Player
2013-12-27 01:02 - 2013-12-27 01:02 - 00000000 ____D C:\Users\HP\AppData\Local\Amazon Cloud Player
2013-12-27 00:59 - 2013-12-27 01:01 - 36152456 _____ (Amazon) C:\Users\HP\Downloads\AmazonCloudPlayerInstaller_399.exe
2013-12-27 00:40 - 2013-12-27 03:01 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-27 00:39 - 2013-12-27 03:01 - 00000000 ____D C:\Program Files\mbar
2013-12-27 00:39 - 2013-12-27 00:39 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-26 19:15 - 2013-09-04 13:12 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-12-26 19:15 - 2013-09-04 13:11 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-12-26 19:15 - 2013-09-04 13:11 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-12-26 19:15 - 2013-09-04 13:11 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-12-26 19:15 - 2013-09-04 13:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-12-26 19:15 - 2013-09-04 13:11 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-12-26 19:15 - 2013-09-04 13:11 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-12-22 20:51 - 2013-08-16 13:56 - 00216064 _____ C:\Windows\SysWOW64\gcapi_dll.dll
2013-12-22 18:26 - 2013-12-22 18:26 - 00001783 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-12-22 18:24 - 2013-12-22 18:26 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-12-22 18:24 - 2013-12-22 18:26 - 00000000 ____D C:\Program Files\iTunes
2013-12-22 18:24 - 2013-12-22 18:26 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-12-22 18:24 - 2013-12-22 18:24 - 00000000 ____D C:\Program Files\iPod
2013-12-22 18:16 - 2013-12-22 18:19 - 33893112 _____ (DVDVideoSoft Ltd. ) C:\Users\HP\Downloads\FreeYouTubeToMP3Converter(1).exe
2013-12-20 02:42 - 2013-12-20 02:42 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-15 03:46 - 2013-12-15 03:46 - 00000000 ____D C:\Users\HP\AppData\Roaming\Avira
2013-12-15 03:43 - 2013-12-15 03:43 - 00000000 ____D C:\Program Files (x86)\Avira
2013-12-15 03:43 - 2013-12-09 11:37 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-12-15 03:43 - 2013-12-09 11:37 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-12-15 03:43 - 2013-12-09 11:37 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-12-15 03:43 - 2013-12-09 11:37 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-12-15 03:30 - 2013-12-15 03:33 - 129598176 _____ C:\Users\HP\Downloads\avira_free_antivirus_de.exe
2013-12-15 03:10 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-15 03:10 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-15 03:10 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2013-12-15 03:10 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2013-12-15 03:07 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-15 03:07 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-15 03:07 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-12-15 03:07 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-15 03:07 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-15 03:07 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-12-15 03:07 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-15 03:07 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-15 03:07 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-15 03:07 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-15 03:07 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-15 03:07 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-12-15 03:07 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-12-15 03:07 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-12-15 03:07 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-15 03:07 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-15 03:07 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-15 03:07 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-15 03:07 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-15 03:07 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-12-15 03:07 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-15 03:07 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-12-15 03:07 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-15 03:07 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-12-15 03:07 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-15 03:07 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-15 03:07 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-15 03:07 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-12-15 03:07 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-12-15 03:07 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-15 03:07 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-15 02:46 - 2014-01-05 16:54 - 00000000 ____D C:\ProgramData\Spyware Terminator
2013-12-15 02:46 - 2013-12-15 02:46 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2013-12-15 02:46 - 2013-12-15 02:46 - 00001042 _____ C:\Users\Public\Desktop\Spyware Terminator 2012.lnk
2013-12-15 02:46 - 2013-12-15 02:46 - 00000000 ____D C:\Users\HP\AppData\Roaming\Spyware Terminator
2013-12-15 02:46 - 2013-12-15 02:46 - 00000000 ____D C:\Program Files (x86)\Spyware Terminator
2013-12-15 02:45 - 2013-12-15 02:46 - 05049344 _____ (Crawler.com ) C:\Users\HP\Downloads\SpywareTerminatorSetup_3.0.0.82.exe
2013-12-15 02:30 - 2013-12-15 02:30 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-12-15 02:30 - 2013-12-15 02:30 - 00000000 ____D C:\Users\HP\AppData\Roaming\Malwarebytes
2013-12-15 02:30 - 2013-12-15 02:30 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-15 02:30 - 2013-12-15 02:30 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-15 02:30 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-12-15 02:29 - 2013-12-15 02:29 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\HP\Downloads\mbam-setup-1.75.0.1300.exe
2013-12-15 02:19 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-15 02:19 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-15 02:19 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-15 02:19 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-12-15 02:19 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-15 02:19 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-15 02:19 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-15 02:19 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-15 02:19 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-15 02:18 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-15 02:18 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-15 02:18 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-15 02:18 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-15 02:18 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-15 02:18 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2013-12-15 02:18 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-15 02:18 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-15 02:18 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-12 01:54 - 2013-12-12 01:54 - 09272200 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2013-12-12 00:38 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
==================== One Month Modified Files and Folders =======
2014-01-05 20:03 - 2014-01-05 20:02 - 00016934 _____ C:\Users\HP\Downloads\FRST.txt
2014-01-05 20:02 - 2009-12-20 01:26 - 01289264 _____ C:\Windows\WindowsUpdate.log
2014-01-05 20:01 - 2014-01-05 20:01 - 00000000 ____D C:\FRST
2014-01-05 20:00 - 2014-01-05 20:00 - 01931368 _____ (Farbar) C:\Users\HP\Downloads\FRST64.exe
2014-01-05 20:00 - 2009-07-14 05:51 - 00414081 _____ C:\Windows\setupact.log
2014-01-05 19:58 - 2014-01-05 19:55 - 00000466 _____ C:\Users\HP\Downloads\defogger_disable.log
2014-01-05 19:55 - 2014-01-05 19:55 - 00050477 _____ C:\Users\HP\Downloads\Defogger.exe
2014-01-05 19:55 - 2014-01-05 19:55 - 00000000 _____ C:\Users\HP\defogger_reenable
2014-01-05 19:55 - 2010-12-29 18:13 - 00000000 ____D C:\Users\HP
2014-01-05 19:54 - 2012-04-18 15:56 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-05 19:54 - 2009-07-14 05:45 - 00023248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-05 19:54 - 2009-07-14 05:45 - 00023248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-05 19:13 - 2014-01-05 19:13 - 01233962 _____ C:\Users\HP\Downloads\adwcleaner_3.016.exe
2014-01-05 19:13 - 2014-01-05 19:13 - 00000000 ____D C:\AdwCleaner
2014-01-05 18:54 - 2009-11-14 09:10 - 00654400 _____ C:\Windows\system32\perfh007.dat
2014-01-05 18:54 - 2009-11-14 09:10 - 00130240 _____ C:\Windows\system32\perfc007.dat
2014-01-05 18:54 - 2009-07-14 06:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-05 18:49 - 2013-12-31 01:13 - 00000000 ____D C:\ProgramData\WPM
2014-01-05 18:49 - 2009-12-20 01:28 - 00409420 _____ C:\Windows\PFRO.log
2014-01-05 18:49 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-05 18:47 - 2013-12-31 01:13 - 00000000 ____D C:\Program Files (x86)\AmiExt
2014-01-05 18:17 - 2014-01-05 18:17 - 00003094 _____ C:\Windows\System32\Tasks\{0EC71F8B-5BB4-4732-9DA9-0DDCCEAD66D8}
2014-01-05 16:54 - 2013-12-15 02:46 - 00000000 ____D C:\ProgramData\Spyware Terminator
2014-01-02 20:18 - 2013-12-31 01:13 - 00000000 ____D C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop
2014-01-02 20:03 - 2013-08-05 12:56 - 00000298 _____ C:\Windows\Tasks\Registry Optimizer_UPDATES.job
2014-01-02 20:03 - 2013-08-05 12:56 - 00000290 _____ C:\Windows\Tasks\Registry Optimizer_DEFAULT.job
2014-01-02 20:03 - 2012-06-12 19:47 - 00001126 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3418313437-4185168109-3229983112-1000UA.job
2014-01-02 20:03 - 2012-06-12 19:47 - 00001104 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3418313437-4185168109-3229983112-1000Core.job
2014-01-02 03:54 - 2014-01-02 03:54 - 00003104 _____ C:\Windows\System32\Tasks\{EE114A32-CFB7-4C59-9274-03C60BB1D9EA}
2014-01-02 02:08 - 2014-01-02 02:08 - 00007605 _____ C:\Users\HP\AppData\Local\Resmon.ResmonCfg
2014-01-02 02:03 - 2014-01-02 02:03 - 00821760 _____ (Browser Opt-out) C:\Users\HP\Downloads\uninstall.exe
2014-01-02 02:03 - 2013-12-31 01:05 - 00003232 _____ C:\Windows\System32\Tasks\SomotoUpdateCheckerAutoStart
2014-01-02 02:03 - 2013-08-05 12:56 - 00003030 _____ C:\Windows\System32\Tasks\Registry Optimizer_UPDATES
2014-01-02 02:03 - 2013-08-05 12:56 - 00002874 _____ C:\Windows\System32\Tasks\Registry Optimizer_DEFAULT
2014-01-02 02:03 - 2012-06-12 19:47 - 00004108 _____ C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3418313437-4185168109-3229983112-1000UA
2014-01-02 02:03 - 2012-06-12 19:47 - 00003740 _____ C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3418313437-4185168109-3229983112-1000Core
2014-01-02 02:03 - 2011-06-15 22:16 - 00002976 _____ C:\Windows\System32\Tasks\{4F439D31-FE66-419E-83ED-226959865089}
2014-01-02 02:03 - 2011-06-07 13:11 - 00002944 _____ C:\Windows\System32\Tasks\{DF839B04-3AAD-4816-88AD-8681C45D346E}
2014-01-02 02:03 - 2011-06-07 13:11 - 00002944 _____ C:\Windows\System32\Tasks\{2D3F316B-D4F7-494D-B304-4DD0EB6C1F54}
2014-01-02 02:03 - 2011-06-07 13:10 - 00002944 _____ C:\Windows\System32\Tasks\{36027D2C-8F38-4FB3-AD64-AF13885712AD}
2014-01-02 02:03 - 2011-06-07 12:52 - 00002880 _____ C:\Windows\System32\Tasks\{DDAE587A-FA93-40F2-B6E0-CCD070C4E8EF}
2014-01-02 02:03 - 2011-01-16 01:05 - 00002880 _____ C:\Windows\System32\Tasks\{053EF3CB-0602-4FFD-910E-C29615802CC7}
2014-01-02 02:03 - 2010-12-29 18:27 - 00003958 _____ C:\Windows\System32\Tasks\RecoveryCDWin7
2014-01-02 02:03 - 2010-12-29 18:26 - 00003766 _____ C:\Windows\System32\Tasks\Registration
2013-12-31 02:04 - 2013-12-31 01:58 - 00000000 ____D C:\Users\HP\Desktop\USB Stick
2013-12-31 01:26 - 2013-12-31 01:06 - 00000000 ____D C:\Users\HP\AppData\Local\Mobogenie
2013-12-31 01:24 - 2013-12-31 01:07 - 00000000 ____D C:\Users\HP\AppData\Local\cache
2013-12-31 01:13 - 2010-12-29 18:27 - 00001647 _____ C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-12-31 01:06 - 2013-12-31 01:06 - 00000000 ____D C:\Users\HP\Documents\Mobogenie
2013-12-31 01:06 - 2013-12-31 01:06 - 00000000 _____ C:\Users\HP\daemonprocess.txt
2013-12-31 00:42 - 2013-12-31 00:41 - 05159030 ____R (Swearware) C:\Users\HP\Desktop\ComboFix.exe
2013-12-31 00:42 - 2013-12-31 00:41 - 00000000 ___SD C:\ComboFix
2013-12-31 00:41 - 2013-12-31 00:41 - 00000000 ____D C:\Windows\ERDNT
2013-12-27 21:44 - 2012-11-19 19:17 - 00000000 ____D C:\Users\HP\Documents\persoführung
2013-12-27 21:42 - 2012-07-30 18:10 - 00000000 ____D C:\Users\HP\Documents\Auslandspraktikum
2013-12-27 08:48 - 2010-12-29 18:27 - 00000000 ___RD C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-27 08:48 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\AppCompat
2013-12-27 08:47 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration
2013-12-27 03:24 - 2013-12-27 03:15 - 00001648 _____ C:\Windows\system32\ASOROSet.bin
2013-12-27 03:24 - 2009-07-14 03:34 - 85721088 _____ C:\Windows\system32\config\software.bak
2013-12-27 03:24 - 2009-07-14 03:34 - 17301504 _____ C:\Windows\system32\config\system.bak
2013-12-27 03:24 - 2009-07-14 03:34 - 00262144 _____ C:\Windows\system32\config\security.bak
2013-12-27 03:17 - 2009-07-14 03:34 - 00262144 _____ C:\Windows\system32\config\sam.bak
2013-12-27 03:16 - 2013-12-27 03:15 - 00000000 ____D C:\Windows\system32\config\RCCBakup
2013-12-27 03:01 - 2013-12-27 00:40 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-27 03:01 - 2013-12-27 00:39 - 00000000 ____D C:\Program Files\mbar
2013-12-27 01:02 - 2013-12-27 01:02 - 00001194 _____ C:\Users\HP\Desktop\Amazon Cloud Player.lnk
2013-12-27 01:02 - 2013-12-27 01:02 - 00000000 ____D C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon Cloud Player
2013-12-27 01:02 - 2013-12-27 01:02 - 00000000 ____D C:\Users\HP\AppData\Local\Amazon Cloud Player
2013-12-27 01:01 - 2013-12-27 00:59 - 36152456 _____ (Amazon) C:\Users\HP\Downloads\AmazonCloudPlayerInstaller_399.exe
2013-12-27 00:39 - 2013-12-27 00:39 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-22 20:51 - 2011-06-24 13:47 - 00000000 ____D C:\Users\HP\AppData\Roaming\Foxit Software
2013-12-22 18:26 - 2013-12-22 18:26 - 00001783 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-12-22 18:26 - 2013-12-22 18:24 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-12-22 18:26 - 2013-12-22 18:24 - 00000000 ____D C:\Program Files\iTunes
2013-12-22 18:26 - 2013-12-22 18:24 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-12-22 18:24 - 2013-12-22 18:24 - 00000000 ____D C:\Program Files\iPod
2013-12-22 18:21 - 2011-01-20 06:19 - 00000000 ____D C:\Users\HP\AppData\Roaming\DVDVideoSoft
2013-12-22 18:21 - 2011-01-17 10:05 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
2013-12-22 18:19 - 2013-12-22 18:16 - 33893112 _____ (DVDVideoSoft Ltd. ) C:\Users\HP\Downloads\FreeYouTubeToMP3Converter(1).exe
2013-12-22 16:42 - 2012-04-25 15:38 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-21 20:28 - 2013-11-17 16:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox.bak
2013-12-20 02:42 - 2013-12-20 02:42 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-15 16:12 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-15 15:13 - 2009-07-14 05:45 - 00459128 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-15 04:45 - 2010-12-30 02:40 - 00000000 ____D C:\ProgramData\Recovery
2013-12-15 03:46 - 2013-12-15 03:46 - 00000000 ____D C:\Users\HP\AppData\Roaming\Avira
2013-12-15 03:43 - 2013-12-15 03:43 - 00000000 ____D C:\Program Files (x86)\Avira
2013-12-15 03:43 - 2013-08-05 10:58 - 00000000 ____D C:\ProgramData\Avira
2013-12-15 03:33 - 2013-12-15 03:30 - 129598176 _____ C:\Users\HP\Downloads\avira_free_antivirus_de.exe
2013-12-15 03:09 - 2009-11-14 01:24 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-15 03:06 - 2013-08-16 19:45 - 00000000 ____D C:\Windows\system32\MRT
2013-12-15 03:01 - 2011-04-18 12:03 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-12-15 02:46 - 2013-12-15 02:46 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2013-12-15 02:46 - 2013-12-15 02:46 - 00001042 _____ C:\Users\Public\Desktop\Spyware Terminator 2012.lnk
2013-12-15 02:46 - 2013-12-15 02:46 - 00000000 ____D C:\Users\HP\AppData\Roaming\Spyware Terminator
2013-12-15 02:46 - 2013-12-15 02:46 - 00000000 ____D C:\Program Files (x86)\Spyware Terminator
2013-12-15 02:46 - 2013-12-15 02:45 - 05049344 _____ (Crawler.com ) C:\Users\HP\Downloads\SpywareTerminatorSetup_3.0.0.82.exe
2013-12-15 02:30 - 2013-12-15 02:30 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-12-15 02:30 - 2013-12-15 02:30 - 00000000 ____D C:\Users\HP\AppData\Roaming\Malwarebytes
2013-12-15 02:30 - 2013-12-15 02:30 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-15 02:30 - 2013-12-15 02:30 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-15 02:29 - 2013-12-15 02:29 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\HP\Downloads\mbam-setup-1.75.0.1300.exe
2013-12-12 23:17 - 2009-12-20 10:15 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-12-12 01:54 - 2013-12-12 01:54 - 09272200 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2013-12-12 01:54 - 2012-04-18 15:56 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-12 01:54 - 2012-04-18 15:56 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-12-12 01:54 - 2011-05-25 19:47 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-09 11:37 - 2013-12-15 03:43 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-12-09 11:37 - 2013-12-15 03:43 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-12-09 11:37 - 2013-12-15 03:43 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-12-09 11:37 - 2013-12-15 03:43 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
Some content of TEMP:
====================
C:\Users\HP\AppData\Local\Temp\7z920.exe
C:\Users\HP\AppData\Local\Temp\AskSLib.dll
C:\Users\HP\AppData\Local\Temp\avgnt.exe
C:\Users\HP\AppData\Local\Temp\Checkupdate.exe
C:\Users\HP\AppData\Local\Temp\contentDATs.exe
C:\Users\HP\AppData\Local\Temp\DivXSetup.exe
C:\Users\HP\AppData\Local\Temp\drm_dyndata_7340016.dll
C:\Users\HP\AppData\Local\Temp\DSETUP.dll
C:\Users\HP\AppData\Local\Temp\dsetup32.dll
C:\Users\HP\AppData\Local\Temp\DWPUpgradeInstaller.exe
C:\Users\HP\AppData\Local\Temp\DXSETUP.exe
C:\Users\HP\AppData\Local\Temp\Foxit Reader Updater.exe
C:\Users\HP\AppData\Local\Temp\Foxit Updater.exe
C:\Users\HP\AppData\Local\Temp\gcapi_dll.dll
C:\Users\HP\AppData\Local\Temp\gtapi_signed.dll
C:\Users\HP\AppData\Local\Temp\HPQSi.exe
C:\Users\HP\AppData\Local\Temp\jre-6u23-windows-i586-iftw-rv.exe
C:\Users\HP\AppData\Local\Temp\jre-6u24-windows-i586-iftw-rv.exe
C:\Users\HP\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe
C:\Users\HP\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe
C:\Users\HP\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\HP\AppData\Local\Temp\jre-6u32-windows-i586-iftw.exe
C:\Users\HP\AppData\Local\Temp\libProcessAccess641076667910485972521.dll
C:\Users\HP\AppData\Local\Temp\libProcessAccess648285416856447600650.dll
C:\Users\HP\AppData\Local\Temp\Mobogenie_Setup_2.1.23_515.exe
C:\Users\HP\AppData\Local\Temp\PCSpeedMaximizer.exe
C:\Users\HP\AppData\Local\Temp\Quarantine.exe
C:\Users\HP\AppData\Local\Temp\RewardsArcade-Bunndle_1.0.11.34_20111010.exe
C:\Users\HP\AppData\Local\Temp\scs.exe
C:\Users\HP\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\HP\AppData\Local\Temp\Show-Password_1030-8101.exe
C:\Users\HP\AppData\Local\Temp\SIntf16.dll
C:\Users\HP\AppData\Local\Temp\SIntf32.dll
C:\Users\HP\AppData\Local\Temp\SIntfNT.dll
C:\Users\HP\AppData\Local\Temp\SkypeSetup.exe
C:\Users\HP\AppData\Local\Temp\vzf-3124094598866748190.dll
C:\Users\HP\AppData\Local\Temp\vzf-6336627702037037531.dll
C:\Users\HP\AppData\Local\Temp\winziprosetup-WZRO6_20130221.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-12-21 21:47
==================== End Of Log ============================
dann noch mbam Code:
ATTFilter 2013/12/31 00:38:04 +0100 HP-PC HP MESSAGE Starting protection
2013/12/31 00:38:04 +0100 HP-PC HP MESSAGE Protection started successfully
2013/12/31 00:38:04 +0100 HP-PC HP MESSAGE Starting IP protection
2013/12/31 00:38:15 +0100 HP-PC HP MESSAGE IP Protection started successfully
2013/12/31 00:43:37 +0100 HP-PC HP IP-BLOCK 41.203.69.3 (Type: outgoing, Port: 6881, Process: spywareterminatorupdate.exe)
2013/12/31 00:44:21 +0100 HP-PC HP MESSAGE Executing scheduled update: Daily
2013/12/31 00:45:06 +0100 HP-PC HP MESSAGE Scheduled update executed successfully: database updated from version v2013.12.27.06 to version v2013.12.30.09
2013/12/31 00:45:06 +0100 HP-PC HP MESSAGE Starting database refresh
2013/12/31 00:45:06 +0100 HP-PC HP MESSAGE Stopping IP protection
2013/12/31 00:45:07 +0100 HP-PC HP MESSAGE IP Protection stopped successfully
2013/12/31 00:45:39 +0100 HP-PC HP MESSAGE Database refreshed successfully
2013/12/31 00:45:39 +0100 HP-PC HP MESSAGE Starting IP protection
2013/12/31 00:45:48 +0100 HP-PC HP MESSAGE IP Protection started successfully
2013/12/31 00:59:44 +0100 HP-PC HP IP-BLOCK 213.186.115.247 (Type: outgoing, Port: 6881, Process: spywareterminatorupdate.exe)
2013/12/31 01:02:09 +0100 HP-PC HP IP-BLOCK 91.205.157.43 (Type: outgoing, Port: 50245, Process: firefox.exe)
2013/12/31 01:02:09 +0100 HP-PC HP IP-BLOCK 91.205.157.43 (Type: outgoing, Port: 50246, Process: firefox.exe)
2013/12/31 01:03:21 +0100 HP-PC HP IP-BLOCK 41.203.69.3 (Type: outgoing, Port: 6881, Process: spywareterminatorupdate.exe)
2013/12/31 01:11:40 +0100 HP-PC HP IP-BLOCK 41.203.69.3 (Type: outgoing, Port: 51135, Process: spywareterminatorupdate.exe)
2013/12/31 01:14:21 +0100 HP-PC HP IP-BLOCK 50.112.112.223 (Type: outgoing, Port: 51278, Process: firefox.exe)
2013/12/31 01:14:22 +0100 HP-PC HP IP-BLOCK 50.112.112.223 (Type: outgoing, Port: 51279, Process: firefox.exe)
2013/12/31 01:28:36 +0100 HP-PC HP IP-BLOCK 89.28.120.57 (Type: outgoing, Port: 6881, Process: spywareterminatorupdate.exe)
2013/12/31 01:35:33 +0100 HP-PC HP IP-BLOCK 88.85.71.176 (Type: outgoing, Port: 6881, Process: spywareterminatorupdate.exe)
2013/12/31 01:42:31 +0100 HP-PC HP IP-BLOCK 66.45.56.109 (Type: outgoing, Port: 52803, Process: firefox.exe)
2013/12/31 01:42:31 +0100 HP-PC HP IP-BLOCK 66.45.56.109 (Type: outgoing, Port: 52804, Process: firefox.exe)
2013/12/31 01:48:48 +0100 HP-PC HP IP-BLOCK 91.188.34.151 (Type: outgoing, Port: 6881, Process: spywareterminatorupdate.exe)
2013/12/31 01:50:01 +0100 HP-PC HP IP-BLOCK 88.85.71.176 (Type: outgoing, Port: 6881, Process: spywareterminatorupdate.exe)
2013/12/31 01:50:25 +0100 HP-PC HP IP-BLOCK 89.28.18.125 (Type: outgoing, Port: 6881, Process: spywareterminatorupdate.exe)
2013/12/31 01:55:54 +0100 HP-PC HP IP-BLOCK 66.45.56.109 (Type: outgoing, Port: 53607, Process: firefox.exe)
2013/12/31 01:55:54 +0100 HP-PC HP IP-BLOCK 66.45.56.109 (Type: outgoing, Port: 53608, Process: firefox.exe)
2013/12/31 01:55:54 +0100 HP-PC HP IP-BLOCK 66.45.56.109 (Type: outgoing, Port: 53609, Process: firefox.exe)
2013/12/31 01:56:02 +0100 HP-PC HP IP-BLOCK 66.45.56.109 (Type: outgoing, Port: 53646, Process: firefox.exe)
2013/12/31 01:56:02 +0100 HP-PC HP IP-BLOCK 66.45.56.109 (Type: outgoing, Port: 53647, Process: firefox.exe)
2013/12/31 01:56:35 +0100 HP-PC HP IP-BLOCK 8.26.70.22 (Type: outgoing, Port: 53680, Process: firefox.exe)
2013/12/31 01:56:35 +0100 HP-PC HP IP-BLOCK 8.26.70.22 (Type: outgoing, Port: 53681, Process: firefox.exe)
2013/12/31 01:56:51 +0100 HP-PC HP IP-BLOCK 8.26.70.22 (Type: outgoing, Port: 53706, Process: firefox.exe)
2013/12/31 01:56:51 +0100 HP-PC HP IP-BLOCK 8.26.70.22 (Type: outgoing, Port: 53707, Process: firefox.exe)
2013/12/31 01:58:59 +0100 HP-PC HP IP-BLOCK 121.10.87.218 (Type: outgoing, Port: 6881, Process: spywareterminatorupdate.exe)
2013/12/31 01:59:08 +0100 HP-PC HP IP-BLOCK 109.163.235.202 (Type: outgoing, Port: 6881, Process: spywareterminatorupdate.exe)
2013/12/31 01:59:33 +0100 HP-PC HP MESSAGE Stopping IP protection
2013/12/31 01:59:33 +0100 HP-PC HP MESSAGE IP Protection stopped successfully
Code:
ATTFilter # AdwCleaner v3.016 - Bericht erstellt am 05/01/2014 um 19:13:15
# Aktualisiert 23/12/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : HP - HP-PC
# Gestartet von : C:\Users\HP\Downloads\adwcleaner_3.016.exe
# Option : Suchen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Datei Gefunden : C:\END
Datei Gefunden : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
Datei Gefunden : C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\v7vqmpsy.default\user.js
Datei Gefunden : C:\Windows\System32\roboot64.exe
Ordner Gefunden C:\Program Files (x86)\Common Files\DVDVideoSoft\TB
Ordner Gefunden C:\Program Files (x86)\Common Files\Plasmoo
Ordner Gefunden C:\Program Files (x86)\WinZip Registry Optimizer
Ordner Gefunden C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Registry Optimizer
Ordner Gefunden C:\ProgramData\WPM
Ordner Gefunden C:\Users\HP\AppData\Local\Mobogenie
Ordner Gefunden C:\Users\HP\AppData\Local\Temp\boost_interprocess
Ordner Gefunden C:\Users\HP\AppData\LocalLow\boost_interprocess
Ordner Gefunden C:\Users\HP\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gefunden C:\Users\HP\AppData\Roaming\pdfforge
Ordner Gefunden C:\Users\HP\Documents\Mobogenie
***** [ Verknüpfungen ] *****
Verknüpfung Gefunden : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk ( hxxp://www.nationzoom.com/?type=sc&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292 )
Verknüpfung Gefunden : C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk ( hxxp://www.nationzoom.com/?type=sc&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292 )
Verknüpfung Gefunden : C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk ( hxxp://www.nationzoom.com/?type=sc&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292 )
Verknüpfung Gefunden : C:\Users\HP\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk ( hxxp://www.nationzoom.com/?type=sc&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292 )
Verknüpfung Gefunden : C:\Users\HP\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk ( hxxp://www.nationzoom.com/?type=sc&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292 )
Verknüpfung Gefunden : C:\Users\HP\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk ( hxxp://www.nationzoom.com/?type=sc&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292 )
Verknüpfung Gefunden : C:\Users\HP\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk ( hxxp://www.nationzoom.com/?type=sc&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292 )
***** [ Registrierungsdatenbank ] *****
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\RewardsArcade
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\Show-Password
Schlüssel Gefunden : HKCU\Software\Classes\Applications\lollipop.exe
Schlüssel Gefunden : HKCU\Software\Conduit
Schlüssel Gefunden : HKCU\Software\Cr_Installer
Schlüssel Gefunden : HKCU\Software\lollipop
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gefunden : HKCU\Software\Softonic
Schlüssel Gefunden : HKCU\Software\Somoto
Schlüssel Gefunden : HKCU\Software\YahooPartnerToolbar
Schlüssel Gefunden : [x64] HKCU\Software\Conduit
Schlüssel Gefunden : [x64] HKCU\Software\Cr_Installer
Schlüssel Gefunden : [x64] HKCU\Software\lollipop
Schlüssel Gefunden : [x64] HKCU\Software\Softonic
Schlüssel Gefunden : [x64] HKCU\Software\Somoto
Schlüssel Gefunden : [x64] HKCU\Software\YahooPartnerToolbar
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{761F6A83-F007-49E4-8EAC-CDB6808EF06F}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{76C45B18-A29E-43EA-AAF8-AF55C2E1AE17}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{7CD74AFF-3433-4E34-92E2-D98DFDB30754}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{96EF404C-24C7-43D0-9096-4CCC8BB7CCAC}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{97720195-206A-42AE-8E65-260B9BA5589F}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{986F7A5A-9676-47E1-8642-F41F8C3FCF82}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{B18788A4-92BD-440E-A4D1-380C36531119}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\RewardsArcade.BHO
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\RewardsArcade.Sandbox
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\RewardsArcade.Sandbox.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{0C58B7D1-D415-492B-A149-E976156BD3B8}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_sweet-home-3d_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_sweet-home-3d_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_winrar_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_winrar_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gefunden : HKLM\Software\supWPM
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{6427058B-217C-4C7F-A6CE-C7934C0BDCEB}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Wert Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [lollipop_01021904]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [mobilegeni daemon]
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16428
Einstellung Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL] - hxxp://www.nationzoom.com/web/?type=ds&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292&q={searchTerms}
Einstellung Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL] - hxxp://www.nationzoom.com/?type=hp&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292
Einstellung Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] - hxxp://www.nationzoom.com/?type=hp&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292
Einstellung Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page] - hxxp://www.nationzoom.com/web/?type=ds&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292&q={searchTerms}
-\\ Mozilla Firefox v26.0 (de)
[ Datei : C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\v7vqmpsy.default\prefs.js ]
Zeile gefunden : user_pref("browser.newtab.url", "hxxp://www.nationzoom.com/newtab/?type=nt&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292");
Zeile gefunden : user_pref("extensions.crossrider.bic", "133a3868bc2826bd82f76db6a0cb55a0");
Zeile gefunden : user_pref("extensions.crossriderapp498.bic", "133a3868bc2826bd82f76db6a0cb55a0");
Zeile gefunden : user_pref("extensions.crossriderapp498.firstrun", false);
Zeile gefunden : user_pref("extensions.crossriderapp498.installationdate", 1321298464);
Zeile gefunden : user_pref("extensions.crossriderapp498.jsver", 3);
Zeile gefunden : user_pref("extensions.crossriderapp498.lastcheck", 22234849);
Zeile gefunden : user_pref("extensions.crossriderapp498.lastcheckitem", 22234859);
Zeile gefunden : user_pref("extensions.crossriderapp498.misc.lastBgWorkerTimer", "1334091583121");
Zeile gefunden : user_pref("extensions.crossriderapp498.misc.lastDomWorkerTimer", "1334091583103");
Zeile gefunden : user_pref("extensions.crossriderapp498@crossrider.com.install-event-fired", true);
Zeile gefunden : user_pref("extensions.enabledItems", "{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:2.0.3,{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23,{ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1,fmdownloader@gmail.com:1.0[...]
*************************
AdwCleaner[R0].txt - [8986 octets] - [05/01/2014 19:13:15]
########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [9046 octets] ##########
Beginne mit der Suche in 'C:\Users\HP\AppData\Local\Lollipop\lollipop_01021904.exe' C:\Users\HP\AppData\Local\Lollipop\lollipop_01021904.exe [FUND] Enthält Erkennungsmuster der Adware ADWARE/Symmi.36673.4 [HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '3c723b9b.qua' verschoben! Zur vollständigkeit halber: Nach dem Neustart habe ich mbam nochmal drüber laufen lassen und es hat (angeblich) nichts mehr von greygray gefunden. Das nation zoom Problem ist weiterhin beständig. zu guter letzt noch ein Bericht vom Spyware Terminator: Code:
ATTFilter ------
Säubern
------
Reinigungsstart um: 05.01.2014 17:06:17.
Browser schließt.
Affiliate tracking cookie (Tracking cookie):
Gelöscht FireFox® Cookie: amazon.de - FireFox®
Gelöscht FireFox® Cookie: dealtime.com - FireFox®
Gelöscht FireFox® Cookie: liveperson.net - FireFox®
Gelöscht FireFox® Cookie: statcounter.com - FireFox®
Gelöscht FireFox® Cookie: stat.dealtime.com - FireFox®
Gelöscht FireFox® Cookie: statse.webtrendslive.com - FireFox®
------
Report Ende
------
|
| Themen zu Entfernung von greygray, lollipop und nation zoom |
| ad-ons, adblock, adware/symmi.36673.4, antivir, antivirus, appdatalow, askbar, converter, desktop, dvdvideosoft ltd., explorer, firefox, flash player, greygray, homepage, iexplore.exe, launch, lollipop, mobogenie, mobogenie entfernen, mozilla, mp3, nation zoom, nationzoom, nationzoom entfernen, netzwerk, neustart, newtab, plug-in, programme und funktionen, registrierungsdatenbank, security, services.exe, show-password, software, werbung, win32k.sys |
Baum-Darstellung