| |
| |||||||
Log-Analyse und Auswertung: Windows 7: Im Text sind wahllos Wörter grün unterstrichen, welche Werbelinks sindWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
05.02.2014, 22:51
| #1 |
| |  Windows 7: Im Text sind wahllos Wörter grün unterstrichen, welche Werbelinks sind Im Text sind wahllos Wörter grün unterstrichen, welche Werbelinks sind. Dieses Problem scheinen viele User zu haben. Warum ist das so? "Reicht es", wenn ich Eure Hinweise (Firewall, nur ein Virenprogramm, etc.) beachte? Darf ich spezielle Seiten gar nicht erst ansteuern? Ich benutze als Virenprogramm AVG (kostenlos). Zudem scheint mir der Rechner etwas langsamer zu werden. Vielen Dank vorab! Es folgen nun meine logs: Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-02-05 21:23:29
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 TOSHIBA_ rev.GJ20 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\Kruse\AppData\Local\Temp\ugloqpoc.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff80002fb3000 45 bytes [00, 00, 10, 02, 4D, 6D, 43, ...]
INITKDBG C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575 fffff80002fb302f 16 bytes [00, 01, 00, 00, 00, 00, 00, ...]
.text C:\windows\System32\win32k.sys!W32pServiceTable fffff96000163e00 7 bytes [00, 96, F3, FF, 01, A1, F0]
.text C:\windows\System32\win32k.sys!W32pServiceTable + 8 fffff96000163e08 3 bytes [C0, 06, 02]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe[1756] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077361465 2 bytes [36, 77]
.text C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe[1756] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000773614bb 2 bytes [36, 77]
.text ... * 2
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[2928] C:\windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000077361465 2 bytes [36, 77]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[2928] C:\windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000773614bb 2 bytes [36, 77]
.text ... * 2
.text C:\Users\Kruse\AppData\Roaming\Dropbox\bin\Dropbox.exe[3344] C:\windows\syswow64\Psapi.dll!GetModuleInformation + 69 0000000077361465 2 bytes [36, 77]
.text C:\Users\Kruse\AppData\Roaming\Dropbox\bin\Dropbox.exe[3344] C:\windows\syswow64\Psapi.dll!GetModuleInformation + 155 00000000773614bb 2 bytes [36, 77]
.text ... * 2
---- Threads - GMER 2.1 ----
Thread C:\windows\system32\AUDIODG.EXE [1144:4272] 0000000067cb5658
Thread C:\windows\system32\AUDIODG.EXE [1144:4200] 0000000067ca2104
Thread C:\windows\System32\svchost.exe [1064:1188] 000007fefcfba808
---- Processes - GMER 2.1 ----
Process C:\Users\Kruse\AppData\LocalLow\AdobeAir\IE\AdobeAirUpdater.exe (*** suspicious ***) @ C:\Users\Kruse\AppData\LocalLow\AdobeAir\IE\AdobeAirUpdater.exe [1676](2011-11-03 14:24:56) 0000000000080000
Library C:\Users\Kruse\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll (*** suspicious ***) @ C:\Users\Kruse\AppData\Roaming\Dropbox\bin\Dropbox.exe [3344](2014-01-03 00:45:04) 0000000004020000
Library C:\Users\Kruse\AppData\Roaming\Dropbox\bin\libcef.dll (*** suspicious ***) @ C:\Users\Kruse\AppData\Roaming\Dropbox\bin\Dropbox.exe [3344](2013-10-18 23:55:02) 0000000069680000
Library C:\Users\Kruse\AppData\Roaming\Dropbox\bin\icudt.dll (*** suspicious ***) @ C:\Users\Kruse\AppData\Roaming\Dropbox\bin\Dropbox.exe [3344] (ICU Data DLL/The ICU Project)(2013-10-18 23:55:00) 0000000068360000
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0c6076fc1a13
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0c6076fc1a13 (not active ControlSet)
---- EOF - GMER 2.1 ----
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-02-2014
Ran by Kruse (administrator) on KRUSE-PC on 05-02-2014 20:41:45
Running from C:\Users\Kruse\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
() C:\Users\Kruse\AppData\LocalLow\AdobeAir\IE\AdobeAirUpdater.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Vimicro) C:\Program Files (x86)\USB Camera2\VM332_STI.EXE
(CyberLink) C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
() C:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe
(Dropbox, Inc.) C:\Users\Kruse\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe
() C:\Program Files (x86)\AVG\AVG2014\Tuneup\TUMicroScanner.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2741544 2011-04-08] (Synaptics Incorporated)
HKLM\...\Run: [Lenovo EE Boot Optimizer] - C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe [114688 2011-10-24] (Lenovo)
HKLM\...\Run: [EnergyUtility] - C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [5908928 2011-10-24] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [332BigDog] - C:\Program Files (x86)\USB Camera2\VM332_STI.EXE [536576 2010-01-19] (Vimicro)
HKLM-x32\...\Run: [YouCam Mirage] - C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [136488 2011-01-29] (CyberLink)
HKLM-x32\...\Run: [YouCam Tray] - C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe [228448 2011-01-29] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdatePRCShortCut] - C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe [222504 2009-05-13] (CyberLink Corp.)
HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [310640 2013-03-28] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [AVG_UI] - C:\Program Files (x86)\AVG\AVG2014\avgui.exe [4956176 2013-11-07] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [3830224 2013-05-16] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2467686847-4161017723-4110476100-1001\...\Run: [KiesPDLR] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [1106288 2013-03-28] (Samsung)
HKU\S-1-5-21-2467686847-4161017723-4110476100-1001\...\Run: [KiesPreload] - C:\Program Files (x86)\Samsung\Kies\Kies.exe [1511792 2013-03-28] (Samsung)
HKU\S-1-5-21-2467686847-4161017723-4110476100-1001\...\Run: [KiesAirMessage] - C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe [578560 2013-03-20] (Samsung Electronics)
HKU\S-1-5-21-2467686847-4161017723-4110476100-1001\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [1106288 2013-03-28] (Samsung)
HKU\S-1-5-21-2467686847-4161017723-4110476100-1001\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20587168 2013-11-18] (Skype Technologies S.A.)
HKU\S-1-5-21-2467686847-4161017723-4110476100-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
Startup: C:\Users\Kruse\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Kruse\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=LENN&bmod=LENN
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.welt.de/
HKLM\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://startsear.ch/?aff=1&src=sp&cf=80136327-08c1-11e1-837e-dc0ea1626284&q={searchTerms}
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: AdobeAir - {DCA971EE-CB86-4592-AE52-A45B2E257A12} - C:\Users\Kruse\AppData\LocalLow\AdobeAir\IE\AdobeAir.dll (Adobe Systems Inc.)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {F92A9FE4-2850-4198-B9D5-279880E49B16} - No File
DPF: HKLM {8FEFF364-6A5F-4966-A917-A3AC28411659} hxxp://download.sopcast.com/download/SOPCORE.CAB
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Kruse\AppData\Roaming\Mozilla\Firefox\Profiles\w06s99lu.default
FF Homepage: hxxp://www.bild.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @veetle.com/veetleCorePlugin,version=0.9.18 - C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF Plugin-x32: @veetle.com/veetlePlayerPlugin,version=0.9.18 - C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: FreeHDSport TV V6.0 - C:\Users\Kruse\AppData\Roaming\Mozilla\Firefox\Profiles\w06s99lu.default\Extensions\01e89cb1-f65e-4d01-9a8c-16784b40f1e3@2579a6e9-6ce6-413f-94ce-37240c823447.com [2014-01-28]
FF Extension: HDvid Codec V6.0 - C:\Users\Kruse\AppData\Roaming\Mozilla\Firefox\Profiles\w06s99lu.default\Extensions\34f57b0c-8cdb-4914-818c-928df47c6c4f@3a243122-a6fc-40c9-a1e6-ba11e930da09.com [2014-01-28]
FF Extension: HTTPS-Everywhere - C:\Users\Kruse\AppData\Roaming\Mozilla\Firefox\Profiles\w06s99lu.default\Extensions\https-everywhere@eff.org [2014-01-05]
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Kruse\AppData\Roaming\Mozilla\Firefox\Profiles\w06s99lu.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2012-11-20]
FF Extension: Adblock Plus - C:\Users\Kruse\AppData\Roaming\Mozilla\Firefox\Profiles\w06s99lu.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-12-01]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2013-12-22]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011-12-25]
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013-08-24]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011-12-25]
Chrome:
=======
CHR HomePage:
CHR Extension: (No Name) - C:\Users\Kruse\AppData\Local\Google\Chrome\User Data\Default\Extensions\baodmgdpdoelldjmkhknbolcldnfjegg [2013-11-07]
CHR Extension: (No Name) - C:\Users\Kruse\AppData\Local\Google\Chrome\User Data\Default\Extensions\incpbbmbclbkhjphicahojidkcabaajc [2013-11-04]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Users\Kruse\AppData\Roaming\DVDVideoSoft\DVDVideoSoftBrowserExtension.crx [2012-11-16]
CHR HKLM-x32\...\Chrome\Extension: [gdalfokaihlahnhdieedhgfekidifmfa] - C:\Users\Kruse\AppData\LocalLow\AdobeAir\CHROME\AdobeAir.crx [2011-11-03]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2012-03-02]
==================== Services (Whitelisted) =================
R2 AdobeAirUpdater; C:\Users\Kruse\AppData\LocalLow\AdobeAir\IE\AdobeAirUpdater.exe [18432 2011-11-03] ()
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3478544 2013-11-11] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [348008 2013-09-24] (AVG Technologies CZ, s.r.o.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
==================== Drivers (Whitelisted) ====================
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [150808 2013-11-05] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [240920 2013-11-04] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [194872 2013-10-24] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [212280 2013-10-31] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [294712 2013-10-31] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123704 2013-10-01] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31544 2013-09-10] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [251192 2013-08-01] (AVG Technologies CZ, s.r.o.)
S3 FsUsbExDisk; C:\windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-03-20] ()
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
U3 BcmSqlStartupSvc;
U2 CLKMSVC10_3A60B698;
U2 CLKMSVC10_C3B3B687;
U2 DriverService;
U2 iATAgentService;
U2 idealife Update Service;
U3 IGRS;
S1 iSafeNetFilter; \??\C:\Program Files (x86)\iSafe\iSafeNetFilter.sys [X]
U2 IviRegMgr;
U2 nvUpdatusService;
U2 Oasis2Service;
U2 PCCarerService;
U2 ReadyComm.DirectRouter;
U2 RichVideo;
U2 RtLedService;
U2 SoftwareService;
U3 SQLWriter;
U2 Stereo Service;
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-02-05 20:41 - 2014-02-05 20:42 - 00019224 _____ () C:\Users\Kruse\Downloads\FRST.txt
2014-02-05 20:41 - 2014-02-05 20:41 - 00000000 ____D () C:\FRST
2014-02-05 20:39 - 2014-02-05 20:39 - 02082304 _____ (Farbar) C:\Users\Kruse\Downloads\FRST64.exe
2014-02-05 20:38 - 2014-02-05 20:39 - 01139200 _____ (Farbar) C:\Users\Kruse\Downloads\FRST.exe
2014-02-05 20:37 - 2014-02-05 20:37 - 00000472 _____ () C:\Users\Kruse\Downloads\defogger_disable.log
2014-02-05 20:37 - 2014-02-05 20:37 - 00000000 _____ () C:\Users\Kruse\defogger_reenable
2014-02-05 20:35 - 2014-02-05 20:35 - 00050477 _____ () C:\Users\Kruse\Downloads\Defogger.exe
2014-02-03 08:25 - 2014-02-03 08:25 - 00000000 __SHD () C:\found.000
2014-01-23 08:40 - 2014-01-23 08:40 - 00921000 _____ (Oracle Corporation) C:\Users\Kruse\Downloads\jxpiinstall(1).exe
2014-01-22 16:16 - 2014-01-24 22:05 - 00000000 ____D () C:\AdwCleaner
2014-01-22 16:14 - 2014-01-22 16:14 - 00614784 _____ (Chip Digital GmbH) C:\Users\Kruse\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-01-15 10:01 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbhub.sys
2014-01-15 10:01 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbport.sys
2014-01-15 10:01 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbccgp.sys
2014-01-15 10:01 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbehci.sys
2014-01-15 10:01 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbuhci.sys
2014-01-15 10:01 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbohci.sys
2014-01-15 10:01 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbd.sys
2014-01-15 10:01 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\windows\system32\Drivers\netio.sys
2014-01-15 10:01 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
==================== One Month Modified Files and Folders =======
2014-02-05 20:42 - 2014-02-05 20:41 - 00019224 _____ () C:\Users\Kruse\Downloads\FRST.txt
2014-02-05 20:41 - 2014-02-05 20:41 - 00000000 ____D () C:\FRST
2014-02-05 20:39 - 2014-02-05 20:39 - 02082304 _____ (Farbar) C:\Users\Kruse\Downloads\FRST64.exe
2014-02-05 20:39 - 2014-02-05 20:38 - 01139200 _____ (Farbar) C:\Users\Kruse\Downloads\FRST.exe
2014-02-05 20:37 - 2014-02-05 20:37 - 00000472 _____ () C:\Users\Kruse\Downloads\defogger_disable.log
2014-02-05 20:37 - 2014-02-05 20:37 - 00000000 _____ () C:\Users\Kruse\defogger_reenable
2014-02-05 20:37 - 2011-11-04 20:31 - 00000000 ____D () C:\Users\Kruse
2014-02-05 20:36 - 2009-07-14 05:45 - 00021280 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-05 20:36 - 2009-07-14 05:45 - 00021280 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-05 20:35 - 2014-02-05 20:35 - 00050477 _____ () C:\Users\Kruse\Downloads\Defogger.exe
2014-02-05 20:26 - 2011-11-04 23:01 - 00000000 ____D () C:\Users\Kruse\AppData\Roaming\Skype
2014-02-05 20:09 - 2013-09-29 17:52 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-02-05 19:49 - 2013-11-14 19:44 - 01370957 _____ () C:\windows\WindowsUpdate.log
2014-02-05 19:10 - 2013-11-23 19:05 - 00002248 _____ () C:\windows\Tasks\FreeHDSport TV V6.0-firefoxinstaller.job
2014-02-05 19:09 - 2013-09-29 17:52 - 00003822 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2014-02-05 19:09 - 2013-03-23 16:07 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-02-05 19:09 - 2011-11-05 23:21 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-05 19:05 - 2013-11-23 19:05 - 00001344 _____ () C:\windows\Tasks\FreeHDSport TV V6.0-updater.job
2014-02-05 18:58 - 2013-12-11 23:03 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-02-05 18:41 - 2013-11-23 18:36 - 00002172 _____ () C:\windows\Tasks\HDvid Codec V6.0-firefoxinstaller.job
2014-02-05 18:36 - 2013-11-23 18:36 - 00001326 _____ () C:\windows\Tasks\HDvid Codec V6.0-updater.job
2014-02-05 18:14 - 2013-02-12 21:47 - 00000000 ____D () C:\ProgramData\MFAData
2014-02-05 17:27 - 2012-12-01 18:15 - 00000000 ___RD () C:\Users\Kruse\Dropbox
2014-02-05 17:27 - 2012-12-01 18:11 - 00000000 ____D () C:\Users\Kruse\AppData\Roaming\Dropbox
2014-02-05 17:27 - 2012-04-15 10:04 - 00000314 _____ () C:\windows\Tasks\GlaryInitialize.job
2014-02-05 17:26 - 2013-11-14 20:58 - 00014392 _____ () C:\windows\setupact.log
2014-02-05 17:26 - 2011-10-24 17:23 - 00113433 _____ () C:\windows\system32\fastboot.set
2014-02-05 17:26 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-02-03 22:49 - 2011-10-24 08:25 - 17305588 _____ () C:\windows\system32\perfh007.dat
2014-02-03 22:49 - 2011-10-24 08:25 - 05542960 _____ () C:\windows\system32\perfc007.dat
2014-02-03 22:49 - 2009-07-14 06:13 - 00006292 _____ () C:\windows\system32\PerfStringBackup.INI
2014-02-03 08:25 - 2014-02-03 08:25 - 00000000 __SHD () C:\found.000
2014-01-31 11:13 - 2013-12-09 07:08 - 00165698 _____ () C:\windows\PFRO.log
2014-01-29 09:29 - 2012-04-30 10:11 - 00000000 ____D () C:\Users\Kruse\Documents\Mein Steuer-Sparbuch Heute
2014-01-27 23:12 - 2011-12-25 13:52 - 00000000 ____D () C:\Users\Kruse\AppData\Roaming\HpUpdate
2014-01-26 13:40 - 2011-12-07 12:34 - 00000000 ____D () C:\Users\Kruse\Documents\Beruf
2014-01-24 22:05 - 2014-01-22 16:16 - 00000000 ____D () C:\AdwCleaner
2014-01-23 08:40 - 2014-01-23 08:40 - 00921000 _____ (Oracle Corporation) C:\Users\Kruse\Downloads\jxpiinstall(1).exe
2014-01-22 21:34 - 2013-12-06 20:35 - 00000000 ____D () C:\Users\Kruse\AppData\Roaming\vlc
2014-01-22 16:14 - 2014-01-22 16:14 - 00614784 _____ (Chip Digital GmbH) C:\Users\Kruse\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-01-19 18:56 - 2012-04-15 10:04 - 00001040 _____ () C:\Users\Kruse\Desktop\Glary Utilities.lnk
2014-01-19 18:56 - 2011-11-04 20:31 - 00002255 _____ () C:\Users\Kruse\Desktop\OneKey Recovery.lnk
2014-01-16 17:03 - 2013-08-02 22:21 - 00437320 _____ () C:\windows\system32\FNTCACHE.DAT
2014-01-16 10:07 - 2011-11-08 22:22 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-01-16 10:06 - 2013-08-03 02:05 - 00000000 ____D () C:\windows\system32\MRT
2014-01-16 10:01 - 2011-11-05 21:11 - 86054176 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-01-12 13:30 - 2012-04-30 10:08 - 00000846 _____ () C:\windows\wiso.ini
2014-01-09 10:16 - 2012-12-01 18:15 - 00001017 _____ () C:\Users\Kruse\Desktop\Dropbox.lnk
2014-01-09 10:16 - 2012-12-01 18:12 - 00000000 ____D () C:\Users\Kruse\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-01-09 10:16 - 2011-11-04 20:31 - 00000000 ___RD () C:\Users\Kruse\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-01-29 16:01
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 05-02-2014
Ran by Kruse at 2014-02-05 20:42:20
Running from C:\Users\Kruse\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: AVG AntiVirus Free Edition 2014 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: AVG AntiVirus Free Edition 2014 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}
==================== Installed Programs ======================
Update for Microsoft Office 2007 (KB2508958) (x32 Version: - Microsoft)
64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
7-Zip 9.21 (x32 Version: 9.21.00.0 - Igor Pavlov)
Adobe Flash Player 12 ActiveX (x32 Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (x32 Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Reader 9.5.4 - Deutsch (x32 Version: 9.5.4 - Adobe Systems Incorporated)
Apple Application Support (x32 Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (x32 Version: 2.1.3.127 - Apple Inc.)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 1.0.0.36 - Atheros Communications Inc.)
AVG 2014 (Version: 14.0.3684 - AVG Technologies) Hidden
AVG 2014 (Version: 14.0.4259 - AVG Technologies) Hidden
AVG 2014 (Version: 2014.0.4259 - AVG Technologies)
B010 (x32 Version: 140.0.344.000 - Hewlett-Packard) Hidden
Benutzerhandbuch (x32 Version: 1.0.0.6 - Lenovo) Hidden
Bonjour (Version: 3.0.0.10 - Apple Inc.)
BufferChm (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden
Conexant HD Audio (Version: 8.54.1.0 - Conexant)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Destinations (x32 Version: 140.0.167.000 - Hewlett-Packard) Hidden
DeviceDiscovery (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden
DMUninstaller (x32 Version: - )
Dropbox (HKCU Version: 2.4.11 - Dropbox, Inc.)
Energy Management (x32 Version: 6.0.2.0 - Lenovo)
Energy Management (x32 Version: 6.0.2.0 - Lenovo) Hidden
Free YouTube to MP3 Converter version 3.11.37.1212 (x32 Version: 3.11.37.1212 - DVDVideoSoft Ltd.)
FreeHDSport TV V6.0 (x32 Version: 1.31.153.0 - installdaddy) <==== ATTENTION
GIMP 2.8.6 (Version: 2.8.6 - The GIMP Team)
Glary Utilities 2.44.0.1450 (x32 Version: 2.44.0.1450 - Glarysoft Ltd)
GPBaseService2 (x32 Version: 140.0.211.000 - Hewlett-Packard) Hidden
HDvid Codec V6.0 (x32 Version: 1.31.153.0 - installdaddy) <==== ATTENTION
HP Customer Participation Program 14.0 (Version: 14.0 - HP)
HP Imaging Device Functions 14.0 (Version: 14.0 - HP)
HP Photosmart B010 All-In-One Driver Software 14.0 Rel. 7 (Version: 14.0 - HP)
HP Smart Web Printing 4.60 (Version: 4.60 - HP)
HP Solution Center 14.0 (Version: 14.0 - HP)
HP Update (x32 Version: 5.005.000.001 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0000 - Microsoft) Hidden
HPPhotoGadget (x32 Version: 140.0.524.000 - Hewlett-Packard) Hidden
HPProductAssistant (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden
HPSSupply (x32 Version: 140.0.211.000 - Hewlett-Packard) Hidden
Intel(R) Control Center (x32 Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Processor Graphics (x32 Version: 8.15.10.2342 - Intel Corporation)
Intel(R) Rapid Storage Technology (x32 Version: 10.1.5.1001 - Intel Corporation)
iTunes (Version: 11.1.3.8 - Apple Inc.)
Java 7 Update 45 (x32 Version: 7.0.450 - Oracle)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Lenovo EasyCamera (x32 Version: 1.10.1209.1 - Lenovo EasyCamera)
Lenovo EE Boot Optimizer (Version: 0.0.1.6 - Lenovo)
Lenovo OneKey Recovery (Version: 7.0.1628 - CyberLink Corp.) Hidden
Lenovo OneKey Recovery (x32 Version: 7.0.1628 - CyberLink Corp.)
Lenovo YouCam (x32 Version: 3.1.3728 - CyberLink Corp.)
Lenovo YouCam (x32 Version: 3.1.3728 - CyberLink Corp.) Hidden
Lenovo_Wireless_Driver (x32 Version: 1.02.01 - Lenovo)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
MarketResearch (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30320 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30320 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 ENU (x32 Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 x64 ENU (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
Mozilla Thunderbird 24.2.0 (x86 de) (x32 Version: 24.2.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation)
PDF Architect (x32 Version: 1.1.83.9982 - pdfforge GmbH)
PDFCreator (x32 Version: 1.7.1 - pdfforge)
PHOTOfunSTUDIO 6.0 (x32 Version: 6.00.135 - Panasonic Corporation)
PokerStars (x32 Version: - PokerStars)
Power2Go (x32 Version: 5.6.0.7303 - CyberLink Corp.)
PS_AIO_07_B010_SW_Min (x32 Version: 140.0.224.000 - Hewlett-Packard) Hidden
QuickTime (x32 Version: 7.74.80.86 - Apple Inc.)
Ravensburger tiptoi (x32 Version: - )
Realtek USB 2.0 Reader Driver (x32 Version: 6.1.7600.10003 - Realtek Semiconductor Corp.)
Samsung Kies (x32 Version: 2.0.3.11082_152 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.0.3.11082_152 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (Version: 1.5.22.0 - SAMSUNG Electronics Co., Ltd.)
Scan (x32 Version: 140.0.80.000 - Hewlett-Packard) Hidden
Shop for HP Supplies (Version: 14.0 - HP)
Skype Click to Call (x32 Version: 5.10.9560 - Skype Technologies S.A.)
Skype™ 6.11 (x32 Version: 6.11.102 - Skype Technologies S.A.)
SmartWebPrinting (x32 Version: 140.0.186.000 - Hewlett-Packard) Hidden
Snap.Do (x32 Version: 11.9.1.13233 - ReSoft Ltd.) <==== ATTENTION
Snap.Do Engine (HKCU Version: 11.9.1.13233 - ReSoft Ltd.) <==== ATTENTION
SolutionCenter (x32 Version: 140.0.214.000 - Hewlett-Packard) Hidden
Sony Picture Utility (x32 Version: 2.0.01.13310 - Sony Corporation)
Sony USB Driver (x32 Version: 2.00 - Sony Corporation)
SopCast 3.5.0 (x32 Version: 3.5.0 - www.sopcast.com)
Spybot - Search & Destroy (x32 Version: 2.1.20 - Safer-Networking Ltd.)
SpywareBlaster 5.0 (x32 Version: 5.0.0 - BrightFort LLC)
Status (x32 Version: 140.0.256.000 - Hewlett-Packard) Hidden
Super LoiLoScope WebShortcut (x32 Version: 1.0.0 - LoiLo)
Synaptics Pointing Device Driver (Version: 15.3.0.0 - Synaptics Incorporated)
Toolbox (x32 Version: 140.0.428.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden
TuneUp Utilities Language Pack (de-DE) (x32 Version: 13.0.3020.2 - TuneUp Software) Hidden
Update for 2007 Microsoft Office System (KB967642) (x32 Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2850085) 32-Bit Edition (x32 Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (x32 Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (x32 Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32 Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (x32 Version: - Microsoft)
UserGuide (x32 Version: 1.0.0.6 - Lenovo)
Veetle TV (x32 Version: 0.9.18 - Veetle, Inc)
VideoPlayer v2.0.6 (x32 Version: v2.0.6 - TUGUU SL)
Visual C++ 9.0 ATL (x86) WinSXS MSM (x32 Version: 9.0 - Microsoft Corporation) Hidden
Visual Studio 2010 x64 Redistributables (Version: 13.0.0.1 - AVG Technologies)
Visual Studio 2012 x64 Redistributables (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (x32 Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.1.1 (x32 Version: 2.1.1 - VideoLAN)
WebReg (x32 Version: 140.0.212.017 - Hewlett-Packard) Hidden
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Mobile-Gerätecenter (Version: 6.1.6965.0 - Microsoft Corporation)
Windows-Treiberpaket - Lenovo (ACPIVPC) System (12/02/2010 6.1.0.1) (Version: 12/02/2010 6.1.0.1 - Lenovo)
WinSCP 5.1.7 (x32 Version: 5.1.7 - Martin Prikryl)
WISO Steuer-Sparbuch 2012 (x32 Version: 19.03.7334 - Buhl Data Service GmbH)
WISO Steuer-Sparbuch 2013 (x32 Version: 20.03.8202 - Buhl Data Service GmbH)
WISO Steuer-Sparbuch 2014 (x32 Version: 21.00.8480 - Buhl Data Service GmbH)
==================== Restore Points =========================
02-01-2014 18:36:49 Geplanter Prüfpunkt
09-01-2014 20:07:12 Geplanter Prüfpunkt
14-01-2014 22:02:34 S
16-01-2014 09:00:20 Windows Update
24-01-2014 13:17:03 Geplanter Prüfpunkt
30-01-2014 09:40:13 Windows Update
==================== Hosts content: ==========================
2009-07-14 03:34 - 2013-12-13 23:19 - 00450639 ____R C:\windows\system32\Drivers\etc\hosts
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123moviedownload.com
There are 1000 more lines.
==================== Scheduled Tasks (whitelisted) =============
Task: {009528ED-52F6-4790-BE00-DD91377DC08C} - \Feven 1.5-updater No Task File
Task: {1143F85F-2668-4661-AF29-0D93549313BE} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-05] (Adobe Systems Incorporated)
Task: {2CC84A62-0344-458F-8950-53F20E730C9B} - \SuperLyrics-16-codedownloader No Task File
Task: {388A26B0-DE88-4B5A-9A9D-299C60ECA502} - System32\Tasks\GlaryInitialize => C:\Program Files\Glary Utilities\initialize.exe [2012-04-06] (Glarysoft Ltd)
Task: {43E8C3C2-2F3A-4B84-960C-553C29B8F96D} - System32\Tasks\HDvid Codec V6.0-updater => C:\Program Files (x86)\HDvid Codec V6.0\HDvid Codec V6.0-updater.exe [2013-11-23] (installdaddy) <==== ATTENTION
Task: {68C369F7-8465-4C1C-B0CF-5A0A7F0060D0} - System32\Tasks\FreeHDSport TV V6.0-updater => C:\Program Files (x86)\FreeHDSport TV V6.0\FreeHDSport TV V6.0-updater.exe [2013-11-23] (installdaddy) <==== ATTENTION
Task: {6E3FDD5C-DD16-4349-998C-FAF36E2EFA06} - System32\Tasks\HDvid Codec V6.0-firefoxinstaller => C:\Program Files (x86)\HDvid Codec V6.0\HDvid Codec V6.0-firefoxinstaller.exe [2013-11-23] (installdaddy) <==== ATTENTION
Task: {6F496C51-7EF1-4F29-9509-990133411737} - \Feven 1.5-codedownloader No Task File
Task: {73428423-F5E0-4953-902F-7EE7365CEA34} - \SuperLyrics-16-enabler No Task File
Task: {88BF277C-AA67-4DAD-B443-3D1AC2E601A8} - \Feven 1.5-firefoxinstaller No Task File
Task: {8EF02868-4992-4137-96FD-6BF13F2904EF} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
Task: {96FFFD4B-71D0-4BAF-B35E-B69449810B8F} - System32\Tasks\FreeHDSport TV V6.0-firefoxinstaller => C:\Program Files (x86)\FreeHDSport TV V6.0\FreeHDSport TV V6.0-firefoxinstaller.exe [2013-11-23] (installdaddy) <==== ATTENTION
Task: {9775CB94-392C-4FAE-ABF6-433CEC6315F0} - System32\Tasks\HP-Online-Aktualisierungsprogramm => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [2011-10-28] (Hewlett-Packard)
Task: {981C9FF3-313A-429E-A182-735B7A9479AA} - \Feven 1.5-enabler No Task File
Task: {A0B9DF4B-F55D-4776-A7A6-B873F941C46A} - System32\Tasks\MirageAgent => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [2011-01-29] (CyberLink)
Task: {A2BF6A21-4B3E-412B-B2A3-71F8E08B8FF6} - \SuperLyrics-16-chromeinstaller No Task File
Task: {CED26936-BFEB-44A3-AC80-95C9A98D0280} - System32\Tasks\AdobeFlashPlayerUpdate => C:\windows\SysWOW64\FlashPlayerUpdateService.exe
Task: {D0A98551-1172-4750-A3A6-ACEAA583E48F} - \Feven 1.5-chromeinstaller No Task File
Task: {E55BDC1D-0C51-48B5-B861-0C51B3FC52FB} - \SuperLyrics-16-firefoxinstaller No Task File
Task: {EE60958A-C52D-475D-9D7D-07362871886B} - \Desk 365 RunAsStdUser No Task File
Task: {F0CC5669-0C1A-4B7D-ADB1-8C8EFE922656} - System32\Tasks\AdobeFlashPlayerUpdate 2 => C:\windows\SysWOW64\FlashPlayerUpdateService.exe
Task: {F8E0DF0B-91C0-4D98-8B62-ADBC2DA8497D} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-12-03] (Adobe Systems Incorporated)
Task: {FB21CEC8-5EEC-4780-96DC-099C84DF61FC} - \SuperLyrics-16-updater No Task File
Task: {FF8BBFD0-8D2A-4E8C-AE04-F5C75977CF2E} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\FreeHDSport TV V6.0-firefoxinstaller.job => C:\Program Files (x86)\FreeHDSport TV V6.0\FreeHDSport TV V6.0-firefoxinstaller.exe <==== ATTENTION
Task: C:\windows\Tasks\FreeHDSport TV V6.0-updater.job => C:\Program Files (x86)\FreeHDSport TV V6.0\FreeHDSport TV V6.0-updater.exe <==== ATTENTION
Task: C:\windows\Tasks\GlaryInitialize.job => C:\Program Files\Glary Utilities\initialize.exe
Task: C:\windows\Tasks\HDvid Codec V6.0-firefoxinstaller.job => C:\Program Files (x86)\HDvid Codec V6.0\HDvid Codec V6.0-firefoxinstaller.exe <==== ATTENTION
Task: C:\windows\Tasks\HDvid Codec V6.0-updater.job => C:\Program Files (x86)\HDvid Codec V6.0\HDvid Codec V6.0-updater.exe <==== ATTENTION
==================== Loaded Modules (whitelisted) =============
2008-12-20 04:20 - 2011-10-24 17:26 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\kbdhook.dll
2011-11-01 23:26 - 2011-11-01 23:26 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2011-11-01 23:26 - 2011-11-01 23:26 - 01242472 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-08-04 16:27 - 2013-05-16 09:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2013-08-04 16:27 - 2013-05-16 09:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2013-08-04 16:27 - 2013-05-16 09:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2013-08-04 16:27 - 2012-08-23 09:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2013-08-04 16:27 - 2012-04-03 16:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2013-12-05 21:24 - 2013-12-19 14:45 - 09618736 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wgui14.dll
2013-12-05 21:24 - 2013-12-19 14:44 - 00035120 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\rsdcom48.dll
2013-12-05 21:24 - 2013-12-19 14:44 - 00309040 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\rscorewinapi48.dll
2013-12-05 21:24 - 2013-12-19 14:44 - 00321840 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\rsguiwinapi48.dll
2013-12-05 21:24 - 2013-12-19 14:45 - 03698992 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wcore14.dll
2013-12-05 21:24 - 2013-12-19 14:44 - 00136496 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\rsodbc48.dll
2013-12-05 21:24 - 2013-12-19 14:44 - 02573104 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wfvie14.dll
2013-12-05 21:24 - 2013-12-19 14:44 - 01886000 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wsteu14.dll
2013-12-05 21:24 - 2013-12-19 14:44 - 01905456 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wreli14.dll
2013-12-05 21:24 - 2013-12-19 14:44 - 04274992 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wauff14.dll
2013-12-05 21:24 - 2013-10-30 17:37 - 01043456 ____N () C:\Program Files (x86)\WISO\Steuersoftware 2014\clucene-core.dll
2013-12-05 21:24 - 2013-10-30 17:37 - 00094720 ____N () C:\Program Files (x86)\WISO\Steuersoftware 2014\clucene-shared.dll
2013-12-05 21:24 - 2013-10-30 17:37 - 00250368 ____N () C:\Program Files (x86)\WISO\Steuersoftware 2014\clucene-contribs-lib.dll
2013-12-05 21:24 - 2013-12-19 14:44 - 01468208 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wmain14.dll
2013-12-05 21:24 - 2013-12-19 14:45 - 05055792 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wbae114.dll
2013-12-05 21:24 - 2013-12-19 14:44 - 01678640 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wbae214.dll
2013-12-05 21:24 - 2013-12-19 14:44 - 01804080 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wbae314.dll
2013-12-05 21:24 - 2013-12-19 14:44 - 01626416 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wbae414.dll
2013-12-05 21:24 - 2013-12-19 14:44 - 01126704 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\whau114.dll
2013-12-05 21:24 - 2013-12-19 14:45 - 01313072 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\whau214.dll
2013-12-05 21:24 - 2013-12-19 14:44 - 01281840 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wwerb14.dll
2013-12-05 21:24 - 2013-12-19 14:45 - 07274288 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wkont14.dll
2013-12-05 21:24 - 2013-12-19 14:44 - 01274672 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wimp14.dll
2013-12-05 21:24 - 2013-12-19 14:44 - 01330480 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wfabu14.dll
2013-10-19 00:55 - 2013-10-19 00:55 - 25100288 _____ () C:\Users\Kruse\AppData\Roaming\Dropbox\bin\libcef.dll
2013-11-09 15:03 - 2013-11-09 15:03 - 00169472 _____ () C:\windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\7d7cb9572deb4b67694dfab4d6ad05af\IsdiInterop.ni.dll
2011-10-24 16:50 - 2011-02-18 09:16 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2013-12-22 13:27 - 2013-12-22 13:27 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-12-11 23:03 - 2013-12-11 23:03 - 03017840 _____ () C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll
2013-12-11 23:03 - 2013-12-11 23:03 - 00158832 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll
2013-12-11 23:03 - 2013-12-11 23:03 - 00023152 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll
2014-02-05 19:09 - 2014-02-05 19:09 - 16287624 _____ () C:\windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll
2013-08-01 15:01 - 2013-08-01 15:01 - 05208416 _____ () C:\Program Files (x86)\AVG\AVG2014\Tuneup\TuneUpCore.bpl
2013-08-20 21:48 - 2013-08-20 21:48 - 00075616 _____ () C:\Program Files (x86)\AVG\AVG2014\Tuneup\TuneUpAPI32.dll
2013-08-20 21:48 - 2013-08-20 21:48 - 00593760 _____ () C:\Program Files (x86)\AVG\AVG2014\Tuneup\RegistryCleaner.dll
2013-08-20 21:48 - 2013-08-20 21:48 - 00350048 _____ () C:\Program Files (x86)\AVG\AVG2014\Tuneup\GainDiskSpace.dll
2013-08-20 21:48 - 2013-08-20 21:48 - 00427360 _____ () C:\Program Files (x86)\AVG\AVG2014\Tuneup\DriveDefrag32.dll
2013-08-20 21:48 - 2013-08-20 21:48 - 00461664 _____ () C:\Program Files (x86)\AVG\AVG2014\Tuneup\ShortcutCleaner.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\Temp:373E1720
AlternateDataStreams: C:\ProgramData\Temp:5C321E34
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
Name: iSafeNetFilter
Description: iSafeNetFilter
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: iSafeNetFilter
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Event log errors: =========================
Application errors:
==================
Error: (02/03/2014 10:49:32 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
Error: (02/03/2014 10:49:32 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (02/03/2014 10:49:32 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (02/03/2014 09:59:31 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
Error: (02/03/2014 09:59:31 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (02/03/2014 09:59:31 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (02/03/2014 08:55:21 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
Error: (02/03/2014 08:55:21 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (02/03/2014 08:55:21 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (02/02/2014 10:55:27 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 26.0.0.5087, Zeitstempel: 0x52a0d273
Name des fehlerhaften Moduls: xul.dll, Version: 26.0.0.5087, Zeitstempel: 0x52a0d20a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0014e1a8
ID des fehlerhaften Prozesses: 0x100c
Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0
Pfad der fehlerhaften Anwendung: firefox.exe1
Pfad des fehlerhaften Moduls: firefox.exe2
Berichtskennung: firefox.exe3
System errors:
=============
Error: (02/05/2014 05:29:29 PM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0x80070422
Error: (02/05/2014 05:27:27 PM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0x80070422
Error: (02/05/2014 05:27:24 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuchanbieter-Host" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1058
Error: (02/05/2014 05:27:03 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
iSafeNetFilter
Error: (02/05/2014 05:26:31 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Bilderfassung (WIA)" ist vom Dienst "Shellhardwareerkennung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1058
Error: (02/05/2014 04:53:16 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst AVGIDSAgent konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.
Error: (02/05/2014 04:47:38 PM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0x80070422
Error: (02/05/2014 04:45:23 PM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0x80070422
Error: (02/05/2014 04:45:20 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuchanbieter-Host" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1058
Error: (02/05/2014 04:45:08 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
iSafeNetFilter
Microsoft Office Sessions:
=========================
CodeIntegrity Errors:
===================================
Date: 2013-04-02 21:06:21.040
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-04-02 21:06:20.975
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-04-02 21:06:18.906
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-04-02 21:06:18.834
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-04-02 21:06:16.745
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-04-02 21:06:16.665
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-04-02 21:06:14.575
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-04-02 21:06:14.528
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-04-02 21:06:12.375
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-04-02 21:06:12.328
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 79%
Total physical RAM: 4039.86 MB
Available physical RAM: 832.66 MB
Total Pagefile: 8077.9 MB
Available Pagefile: 4941.37 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:421.81 GB) (Free:263.17 GB) NTFS
Drive d: (LENOVO) (Fixed) (Total:29 GB) (Free:26.89 GB) NTFS
Drive f: (Dockyard) (CDROM) (Total:0.05 GB) (Free:0 GB) CDFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: E9797E6D)
Partition 1: (Active) - (Size=200 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=422 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=29 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=15 GB) - (Type=12)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-02-05 21:20:32
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 TOSHIBA_ rev.GJ20 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\Kruse\AppData\Local\Temp\ugloqpoc.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff80002fb3000 45 bytes [00, 00, 10, 02, 4D, 6D, 43, ...]
INITKDBG C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575 fffff80002fb302f 16 bytes [00, 01, 00, 00, 00, 00, 00, ...]
.text C:\windows\System32\win32k.sys!W32pServiceTable fffff96000163e00 7 bytes [00, 96, F3, FF, 01, A1, F0]
.text C:\windows\System32\win32k.sys!W32pServiceTable + 8 fffff96000163e08 3 bytes [C0, 06, 02]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe[1756] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077361465 2 bytes [36, 77]
.text C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe[1756] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000773614bb 2 bytes [36, 77]
.text ... * 2
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[2928] C:\windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000077361465 2 bytes [36, 77]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[2928] C:\windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000773614bb 2 bytes [36, 77]
.text ... * 2
.text C:\Users\Kruse\AppData\Roaming\Dropbox\bin\Dropbox.exe[3344] C:\windows\syswow64\Psapi.dll!GetModuleInformation + 69 0000000077361465 2 bytes [36, 77]
.text C:\Users\Kruse\AppData\Roaming\Dropbox\bin\Dropbox.exe[3344] C:\windows\syswow64\Psapi.dll!GetModuleInformation + 155 00000000773614bb 2 bytes [36, 77]
.text ... * 2
---- Threads - GMER 2.1 ----
Thread C:\windows\system32\AUDIODG.EXE [1144:4272] 0000000067cb5658
Thread C:\windows\system32\AUDIODG.EXE [1144:4200] 0000000067ca2104
Thread C:\windows\System32\svchost.exe [1064:1188] 000007fefcfba808
---- Processes - GMER 2.1 ----
Process C:\Users\Kruse\AppData\LocalLow\AdobeAir\IE\AdobeAirUpdater.exe (*** suspicious ***) @ C:\Users\Kruse\AppData\LocalLow\AdobeAir\IE\AdobeAirUpdater.exe [1676](2011-11-03 14:24:56) 0000000000080000
Library C:\Users\Kruse\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll (*** suspicious ***) @ C:\Users\Kruse\AppData\Roaming\Dropbox\bin\Dropbox.exe [3344](2014-01-03 00:45:04) 0000000004020000
Library C:\Users\Kruse\AppData\Roaming\Dropbox\bin\libcef.dll (*** suspicious ***) @ C:\Users\Kruse\AppData\Roaming\Dropbox\bin\Dropbox.exe [3344](2013-10-18 23:55:02) 0000000069680000
Library C:\Users\Kruse\AppData\Roaming\Dropbox\bin\icudt.dll (*** suspicious ***) @ C:\Users\Kruse\AppData\Roaming\Dropbox\bin\Dropbox.exe [3344] (ICU Data DLL/The ICU Project)(2013-10-18 23:55:00) 0000000068360000
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0c6076fc1a13
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0c6076fc1a13 (not active ControlSet)
---- EOF - GMER 2.1 ----
Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.02.05.09 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16476 Kruse :: KRUSE-PC [Administrator] 05.02.2014 22:42:22 mbam-log-2014-02-05 (22-42-22).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 213498 Laufzeit: 5 Minute(n), 54 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 2 HKLM\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> Keine Aktion durchgeführt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HDvid Codec V6.0 (PUP.Optional.HDVidCodec.A) -> Keine Aktion durchgeführt. Infizierte Registrierungswerte: 1 HKLM\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Daten: 237459230643934076733244078123666006660 -> Keine Aktion durchgeführt. Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 1 C:\Program Files (x86)\HDvid Codec V6.0 (PUP.Optional.HDVidCodec.A) -> Keine Aktion durchgeführt. Infizierte Dateien: 16 C:\Users\Kruse\Downloads\codec_pack_ff(1).exe (PUP.Optional.OneClickDownloader.A) -> Keine Aktion durchgeführt. C:\Users\Kruse\Downloads\codec_pack_ff(2).exe (PUP.Optional.OneClickDownloader.A) -> Keine Aktion durchgeführt. C:\Users\Kruse\Downloads\codec_pack_ff(3).exe (PUP.Optional.OneClickDownloader.A) -> Keine Aktion durchgeführt. C:\Users\Kruse\Downloads\codec_pack_ff.exe (PUP.Optional.OneClickDownloader.A) -> Keine Aktion durchgeführt. C:\Users\Kruse\Downloads\Setup(1).exe (PUP.Optional.BundleInstaller.A) -> Keine Aktion durchgeführt. C:\Users\Kruse\Downloads\Setup(2).exe (PUP.Optional.BundleInstaller.A) -> Keine Aktion durchgeführt. C:\Users\Kruse\Downloads\Setup.exe (PUP.Optional.BundleInstaller.A) -> Keine Aktion durchgeführt. C:\Users\Kruse\Downloads\StreamhuntAppsSetup(18_3f)3_ff.exe (PUP.Optional.OneClickDownloader.A) -> Keine Aktion durchgeführt. C:\Windows\Installer\36a98.msi (PUP.Optional.SmartBar.A) -> Keine Aktion durchgeführt. C:\Windows\Tasks\HDvid Codec V6.0-firefoxinstaller.job (PUP.Optional.HDVidCodec.A) -> Keine Aktion durchgeführt. C:\Windows\Tasks\HDvid Codec V6.0-updater.job (PUP.Optional.HDVidCodec.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\HDvid Codec V6.0\45971.xpi (PUP.Optional.HDVidCodec.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\HDvid Codec V6.0\HDvid Codec V6.0-firefoxinstaller.exe (PUP.Optional.HDVidCodec.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\HDvid Codec V6.0\HDvid Codec V6.0-updater.exe (PUP.Optional.HDVidCodec.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\HDvid Codec V6.0\Uninstall.exe (PUP.Optional.HDVidCodec.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\HDvid Codec V6.0\utils.exe (PUP.Optional.HDVidCodec.A) -> Keine Aktion durchgeführt. (Ende) |
|
06.02.2014, 07:04
| #2 |
| /// the machine /// TB-Ausbilder    | Windows 7: Im Text sind wahllos Wörter grün unterstrichen, welche Werbelinks sind HI,
__________________Funde von MBAM löschen lassen. Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ |
|
06.02.2014, 16:16
| #3 |
| | Windows 7: Im Text sind wahllos Wörter grün unterstrichen, welche Werbelinks sind Vielen Dank, dass Ihr mir helft. Anbei die Logfiles.
__________________VG nhg600 Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.1 (02.04.2014:1)
OS: Windows 7 Home Premium x64
Ran by Kruse on 06.02.2014 at 15:58:49,39
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\DisplayName
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\URL
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-2467686847-4161017723-4110476100-1001\Software\sweetim
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\sweetim
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110411411162}
~~~ Files
Successfully deleted: [File] "C:\Users\Public\Desktop\iLivid Download Manager.lnk"
~~~ Folders
Successfully deleted: [Empty Folder] C:\Users\Kruse\appdata\local\{0107D1BC-7A1F-4CBE-B390-7BC11E49CFBB}
Successfully deleted: [Empty Folder] C:\Users\Kruse\appdata\local\{02C95D3D-F411-431C-819E-C2C1ECA0E323}
Successfully deleted: [Empty Folder] C:\Users\Kruse\appdata\local\{0865FEC2-0F76-4474-A1F8-FEDBDBC057C9}
Successfully deleted: [Empty Folder] C:\Users\Kruse\appdata\local\{1164DACA-FCEF-49AD-95BF-82D905C674C3}
Successfully deleted: [Empty Folder] C:\Users\Kruse\appdata\local\{18121C78-7515-4141-8769-332DD3FEB429}
Successfully deleted: [Empty Folder] C:\Users\Kruse\appdata\local\{194BC2ED-536A-409C-A6C7-D3750B94F57E}
Successfully deleted: [Empty Folder] C:\Users\Kruse\appdata\local\{2211DDC4-C125-416A-BC58-B88395A35B6B}
Successfully deleted: [Empty Folder] C:\Users\Kruse\appdata\local\{5AE97EE2-B581-4A3B-9250-21B3E1BAE15E}
Successfully deleted: [Empty Folder] C:\Users\Kruse\appdata\local\{5F3C018D-56CA-40A0-912F-9D5A6E9BC437}
Successfully deleted: [Empty Folder] C:\Users\Kruse\appdata\local\{62D546C8-718B-4490-A358-5F8DF4E7620D}
Successfully deleted: [Empty Folder] C:\Users\Kruse\appdata\local\{6648E387-09D7-41DB-8CC4-DC2D16622D8D}
Successfully deleted: [Empty Folder] C:\Users\Kruse\appdata\local\{754484AF-4223-463C-87F5-21FCCDE9BD27}
Successfully deleted: [Empty Folder] C:\Users\Kruse\appdata\local\{774B444A-5E86-48BA-9E6A-8AF1C461D89A}
Successfully deleted: [Empty Folder] C:\Users\Kruse\appdata\local\{85409137-20FB-496A-B81A-B97CE969FA06}
Successfully deleted: [Empty Folder] C:\Users\Kruse\appdata\local\{85D931A1-7501-470A-A195-1DB7585F61BC}
Successfully deleted: [Empty Folder] C:\Users\Kruse\appdata\local\{AB46EFAE-821D-4EA1-B17F-5DB402724375}
Successfully deleted: [Empty Folder] C:\Users\Kruse\appdata\local\{BD141013-DC2F-4EA4-A4BF-8F10C823D69B}
Successfully deleted: [Empty Folder] C:\Users\Kruse\appdata\local\{C9CC6093-B9E3-4A56-8C6D-054F0196D017}
Successfully deleted: [Empty Folder] C:\Users\Kruse\appdata\local\{C9E4C60A-4CD2-4583-A885-5916182C7876}
Successfully deleted: [Empty Folder] C:\Users\Kruse\appdata\local\{CC22C1C4-54F8-4BB7-88CE-917FE84A28B0}
Successfully deleted: [Empty Folder] C:\Users\Kruse\appdata\local\{E162CC03-3BF8-45C0-AD7D-0087DA35DBF4}
Successfully deleted: [Empty Folder] C:\Users\Kruse\appdata\local\{EAA2181D-8147-4C43-A25F-1BBE4712DC48}
Successfully deleted: [Empty Folder] C:\Users\Kruse\appdata\local\{F8F410D3-7C00-4A46-A5AC-9D358B2B46D3}
~~~ FireFox
Emptied folder: C:\Users\Kruse\AppData\Roaming\mozilla\firefox\profiles\w06s99lu.default\minidumps [175 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 06.02.2014 at 16:07:09,05
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
ATTFilter # AdwCleaner v3.018 - Bericht erstellt am 06/02/2014 um 15:40:09
# Updated 28/01/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Kruse - KRUSE-PC
# Gestartet von : C:\Users\Kruse\Downloads\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Users\Kruse\AppData\Local\Temp\Smartbar
Datei Gelöscht : C:\Users\Kruse\AppData\Roaming\Mozilla\Firefox\Profiles\w06s99lu.default\foxydeal.sqlite
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKCU\Software\FoxyDeal
Schlüssel Gelöscht : HKCU\Software\smartbar
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16428
-\\ Mozilla Firefox v26.0 (de)
[ Datei : C:\Users\Kruse\AppData\Roaming\Mozilla\Firefox\Profiles\w06s99lu.default\prefs.js ]
-\\ Google Chrome v
[ Datei : C:\Users\Kruse\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [56462 octets] - [22/01/2014 16:16:34]
AdwCleaner[R1].txt - [1402 octets] - [24/01/2014 22:01:21]
AdwCleaner[R2].txt - [1719 octets] - [06/02/2014 15:38:53]
AdwCleaner[S0].txt - [49961 octets] - [22/01/2014 16:19:53]
AdwCleaner[S1].txt - [1419 octets] - [24/01/2014 22:05:25]
AdwCleaner[S2].txt - [1540 octets] - [06/02/2014 15:40:09]
########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1600 octets] ##########
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-02-2014
Ran by Kruse (administrator) on KRUSE-PC on 06-02-2014 16:13:36
Running from C:\Users\Kruse\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
() C:\Users\Kruse\AppData\LocalLow\AdobeAir\IE\AdobeAirUpdater.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
(Vimicro) C:\Program Files (x86)\USB Camera2\VM332_STI.EXE
(CyberLink) C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
() C:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe
(Dropbox, Inc.) C:\Users\Kruse\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2741544 2011-04-08] (Synaptics Incorporated)
HKLM\...\Run: [Lenovo EE Boot Optimizer] - C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe [114688 2011-10-24] (Lenovo)
HKLM\...\Run: [EnergyUtility] - C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [5908928 2011-10-24] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [332BigDog] - C:\Program Files (x86)\USB Camera2\VM332_STI.EXE [536576 2010-01-19] (Vimicro)
HKLM-x32\...\Run: [YouCam Mirage] - C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [136488 2011-01-29] (CyberLink)
HKLM-x32\...\Run: [YouCam Tray] - C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe [228448 2011-01-29] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdatePRCShortCut] - C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe [222504 2009-05-13] (CyberLink Corp.)
HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [310640 2013-03-28] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [AVG_UI] - C:\Program Files (x86)\AVG\AVG2014\avgui.exe [4956176 2013-11-07] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [3830224 2013-05-16] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2467686847-4161017723-4110476100-1001\...\Run: [KiesPDLR] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [1106288 2013-03-28] (Samsung)
HKU\S-1-5-21-2467686847-4161017723-4110476100-1001\...\Run: [KiesPreload] - C:\Program Files (x86)\Samsung\Kies\Kies.exe [1511792 2013-03-28] (Samsung)
HKU\S-1-5-21-2467686847-4161017723-4110476100-1001\...\Run: [KiesAirMessage] - C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe [578560 2013-03-20] (Samsung Electronics)
HKU\S-1-5-21-2467686847-4161017723-4110476100-1001\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [1106288 2013-03-28] (Samsung)
HKU\S-1-5-21-2467686847-4161017723-4110476100-1001\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20587168 2013-11-18] (Skype Technologies S.A.)
HKU\S-1-5-21-2467686847-4161017723-4110476100-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
Startup: C:\Users\Kruse\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Kruse\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=LENN&bmod=LENN
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.welt.de/
HKLM\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: AdobeAir - {DCA971EE-CB86-4592-AE52-A45B2E257A12} - C:\Users\Kruse\AppData\LocalLow\AdobeAir\IE\AdobeAir.dll (Adobe Systems Inc.)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {F92A9FE4-2850-4198-B9D5-279880E49B16} - No File
DPF: HKLM {8FEFF364-6A5F-4966-A917-A3AC28411659} hxxp://download.sopcast.com/download/SOPCORE.CAB
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Kruse\AppData\Roaming\Mozilla\Firefox\Profiles\w06s99lu.default
FF Homepage: hxxp://www.bild.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @veetle.com/veetleCorePlugin,version=0.9.18 - C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF Plugin-x32: @veetle.com/veetlePlayerPlugin,version=0.9.18 - C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: FreeHDSport TV V6.0 - C:\Users\Kruse\AppData\Roaming\Mozilla\Firefox\Profiles\w06s99lu.default\Extensions\01e89cb1-f65e-4d01-9a8c-16784b40f1e3@2579a6e9-6ce6-413f-94ce-37240c823447.com [2014-01-28]
FF Extension: HDvid Codec V6.0 - C:\Users\Kruse\AppData\Roaming\Mozilla\Firefox\Profiles\w06s99lu.default\Extensions\34f57b0c-8cdb-4914-818c-928df47c6c4f@3a243122-a6fc-40c9-a1e6-ba11e930da09.com [2014-01-28]
FF Extension: HTTPS-Everywhere - C:\Users\Kruse\AppData\Roaming\Mozilla\Firefox\Profiles\w06s99lu.default\Extensions\https-everywhere@eff.org [2014-01-05]
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Kruse\AppData\Roaming\Mozilla\Firefox\Profiles\w06s99lu.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2012-11-20]
FF Extension: Adblock Plus - C:\Users\Kruse\AppData\Roaming\Mozilla\Firefox\Profiles\w06s99lu.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-12-01]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2013-12-22]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011-12-25]
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013-08-24]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011-12-25]
Chrome:
=======
CHR HomePage:
CHR Extension: (No Name) - C:\Users\Kruse\AppData\Local\Google\Chrome\User Data\Default\Extensions\baodmgdpdoelldjmkhknbolcldnfjegg [2013-11-07]
CHR Extension: (No Name) - C:\Users\Kruse\AppData\Local\Google\Chrome\User Data\Default\Extensions\incpbbmbclbkhjphicahojidkcabaajc [2013-11-04]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Users\Kruse\AppData\Roaming\DVDVideoSoft\DVDVideoSoftBrowserExtension.crx [2012-11-16]
CHR HKLM-x32\...\Chrome\Extension: [gdalfokaihlahnhdieedhgfekidifmfa] - C:\Users\Kruse\AppData\LocalLow\AdobeAir\CHROME\AdobeAir.crx [2011-11-03]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2012-03-02]
==================== Services (Whitelisted) =================
R2 AdobeAirUpdater; C:\Users\Kruse\AppData\LocalLow\AdobeAir\IE\AdobeAirUpdater.exe [18432 2011-11-03] ()
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3478544 2013-11-11] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [348008 2013-09-24] (AVG Technologies CZ, s.r.o.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
==================== Drivers (Whitelisted) ====================
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [150808 2013-11-05] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [240920 2013-11-04] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [194872 2013-10-24] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [212280 2013-10-31] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [294712 2013-10-31] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123704 2013-10-01] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31544 2013-09-10] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [251192 2013-08-01] (AVG Technologies CZ, s.r.o.)
S3 FsUsbExDisk; C:\windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-03-20] ()
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
U3 BcmSqlStartupSvc;
U2 CLKMSVC10_3A60B698;
U2 CLKMSVC10_C3B3B687;
U2 DriverService;
U2 iATAgentService;
U2 idealife Update Service;
U3 IGRS;
S1 iSafeNetFilter; \??\C:\Program Files (x86)\iSafe\iSafeNetFilter.sys [X]
U2 IviRegMgr;
U2 nvUpdatusService;
U2 Oasis2Service;
U2 PCCarerService;
U2 ReadyComm.DirectRouter;
U2 RichVideo;
U2 RtLedService;
U2 SoftwareService;
U3 SQLWriter;
U2 Stereo Service;
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-02-06 16:07 - 2014-02-06 16:07 - 00004018 _____ () C:\Users\Kruse\Desktop\JRT.txt
2014-02-06 15:58 - 2014-02-06 15:58 - 00000000 ____D () C:\windows\ERUNT
2014-02-06 15:50 - 2014-02-06 15:50 - 01037530 _____ (Thisisu) C:\Users\Kruse\Downloads\JRT.exe
2014-02-06 15:36 - 2014-02-06 15:37 - 01166132 _____ () C:\Users\Kruse\Downloads\adwcleaner.exe
2014-02-05 21:23 - 2014-02-05 21:23 - 00005491 _____ () C:\Users\Kruse\Desktop\GMER.log
2014-02-05 21:21 - 2014-02-05 21:21 - 00027235 _____ () C:\Users\Kruse\Desktop\FRST.txt
2014-02-05 21:20 - 2014-02-05 21:20 - 00039790 _____ () C:\Users\Kruse\Desktop\Addition.txt
2014-02-05 21:20 - 2014-02-05 21:20 - 00005491 _____ () C:\Users\Kruse\Desktop\defogger_disable.log
2014-02-05 20:57 - 2014-02-05 20:57 - 00380416 _____ () C:\Users\Kruse\Downloads\Gmer-19357.exe
2014-02-05 20:42 - 2014-02-05 20:42 - 00039790 _____ () C:\Users\Kruse\Downloads\Addition.txt
2014-02-05 20:41 - 2014-02-06 16:13 - 00019119 _____ () C:\Users\Kruse\Downloads\FRST.txt
2014-02-05 20:41 - 2014-02-06 16:13 - 00000000 ____D () C:\FRST
2014-02-05 20:39 - 2014-02-05 20:39 - 02082304 _____ (Farbar) C:\Users\Kruse\Downloads\FRST64.exe
2014-02-05 20:38 - 2014-02-05 20:39 - 01139200 _____ (Farbar) C:\Users\Kruse\Downloads\FRST.exe
2014-02-05 20:37 - 2014-02-05 20:37 - 00000472 _____ () C:\Users\Kruse\Downloads\defogger_disable.log
2014-02-05 20:37 - 2014-02-05 20:37 - 00000000 _____ () C:\Users\Kruse\defogger_reenable
2014-02-05 20:35 - 2014-02-05 20:35 - 00050477 _____ () C:\Users\Kruse\Downloads\Defogger.exe
2014-02-05 18:58 - 2014-02-06 15:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-02-03 08:25 - 2014-02-03 08:25 - 00000000 __SHD () C:\found.000
2014-01-23 08:40 - 2014-01-23 08:40 - 00921000 _____ (Oracle Corporation) C:\Users\Kruse\Downloads\jxpiinstall(1).exe
2014-01-22 16:16 - 2014-02-06 15:40 - 00000000 ____D () C:\AdwCleaner
2014-01-22 16:14 - 2014-01-22 16:14 - 00614784 _____ (Chip Digital GmbH) C:\Users\Kruse\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-01-15 10:01 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbhub.sys
2014-01-15 10:01 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbport.sys
2014-01-15 10:01 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbccgp.sys
2014-01-15 10:01 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbehci.sys
2014-01-15 10:01 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbuhci.sys
2014-01-15 10:01 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbohci.sys
2014-01-15 10:01 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbd.sys
2014-01-15 10:01 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\windows\system32\Drivers\netio.sys
2014-01-15 10:01 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
==================== One Month Modified Files and Folders =======
2014-02-06 16:13 - 2014-02-05 20:41 - 00019119 _____ () C:\Users\Kruse\Downloads\FRST.txt
2014-02-06 16:13 - 2014-02-05 20:41 - 00000000 ____D () C:\FRST
2014-02-06 16:09 - 2013-09-29 17:52 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-02-06 16:07 - 2014-02-06 16:07 - 00004018 _____ () C:\Users\Kruse\Desktop\JRT.txt
2014-02-06 16:02 - 2013-11-23 19:05 - 00000000 ____D () C:\Program Files (x86)\FreeHDSport TV V6.0
2014-02-06 16:02 - 2013-11-23 18:36 - 00000000 ____D () C:\Program Files (x86)\HDvid Codec V6.0
2014-02-06 15:58 - 2014-02-06 15:58 - 00000000 ____D () C:\windows\ERUNT
2014-02-06 15:50 - 2014-02-06 15:50 - 01037530 _____ (Thisisu) C:\Users\Kruse\Downloads\JRT.exe
2014-02-06 15:50 - 2009-07-14 05:45 - 00021280 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-06 15:50 - 2009-07-14 05:45 - 00021280 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-06 15:46 - 2013-11-14 19:44 - 01407178 _____ () C:\windows\WindowsUpdate.log
2014-02-06 15:44 - 2012-12-01 18:15 - 00000000 ___RD () C:\Users\Kruse\Dropbox
2014-02-06 15:44 - 2012-12-01 18:11 - 00000000 ____D () C:\Users\Kruse\AppData\Roaming\Dropbox
2014-02-06 15:44 - 2011-11-04 23:01 - 00000000 ____D () C:\Users\Kruse\AppData\Roaming\Skype
2014-02-06 15:43 - 2011-10-24 17:23 - 00121867 _____ () C:\windows\system32\fastboot.set
2014-02-06 15:42 - 2013-11-23 19:05 - 00002248 _____ () C:\windows\Tasks\FreeHDSport TV V6.0-firefoxinstaller.job
2014-02-06 15:42 - 2013-11-23 19:05 - 00001344 _____ () C:\windows\Tasks\FreeHDSport TV V6.0-updater.job
2014-02-06 15:42 - 2013-11-23 18:36 - 00002172 _____ () C:\windows\Tasks\HDvid Codec V6.0-firefoxinstaller.job
2014-02-06 15:42 - 2013-11-23 18:36 - 00001326 _____ () C:\windows\Tasks\HDvid Codec V6.0-updater.job
2014-02-06 15:42 - 2013-11-14 20:58 - 00014504 _____ () C:\windows\setupact.log
2014-02-06 15:42 - 2012-05-11 19:00 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-02-06 15:42 - 2012-04-15 10:04 - 00000314 _____ () C:\windows\Tasks\GlaryInitialize.job
2014-02-06 15:42 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-02-06 15:40 - 2014-01-22 16:16 - 00000000 ____D () C:\AdwCleaner
2014-02-06 15:37 - 2014-02-06 15:36 - 01166132 _____ () C:\Users\Kruse\Downloads\adwcleaner.exe
2014-02-06 15:37 - 2013-02-12 21:47 - 00000000 ____D () C:\ProgramData\MFAData
2014-02-06 15:33 - 2014-02-05 18:58 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-02-06 15:31 - 2013-12-09 07:08 - 00166266 _____ () C:\windows\PFRO.log
2014-02-05 21:23 - 2014-02-05 21:23 - 00005491 _____ () C:\Users\Kruse\Desktop\GMER.log
2014-02-05 21:21 - 2014-02-05 21:21 - 00027235 _____ () C:\Users\Kruse\Desktop\FRST.txt
2014-02-05 21:20 - 2014-02-05 21:20 - 00039790 _____ () C:\Users\Kruse\Desktop\Addition.txt
2014-02-05 21:20 - 2014-02-05 21:20 - 00005491 _____ () C:\Users\Kruse\Desktop\defogger_disable.log
2014-02-05 20:57 - 2014-02-05 20:57 - 00380416 _____ () C:\Users\Kruse\Downloads\Gmer-19357.exe
2014-02-05 20:57 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\system32\NDF
2014-02-05 20:42 - 2014-02-05 20:42 - 00039790 _____ () C:\Users\Kruse\Downloads\Addition.txt
2014-02-05 20:39 - 2014-02-05 20:39 - 02082304 _____ (Farbar) C:\Users\Kruse\Downloads\FRST64.exe
2014-02-05 20:39 - 2014-02-05 20:38 - 01139200 _____ (Farbar) C:\Users\Kruse\Downloads\FRST.exe
2014-02-05 20:37 - 2014-02-05 20:37 - 00000472 _____ () C:\Users\Kruse\Downloads\defogger_disable.log
2014-02-05 20:37 - 2014-02-05 20:37 - 00000000 _____ () C:\Users\Kruse\defogger_reenable
2014-02-05 20:37 - 2011-11-04 20:31 - 00000000 ____D () C:\Users\Kruse
2014-02-05 20:35 - 2014-02-05 20:35 - 00050477 _____ () C:\Users\Kruse\Downloads\Defogger.exe
2014-02-05 19:09 - 2013-09-29 17:52 - 00003822 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2014-02-05 19:09 - 2013-03-23 16:07 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-02-05 19:09 - 2011-11-05 23:21 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-03 22:49 - 2011-10-24 08:25 - 17305588 _____ () C:\windows\system32\perfh007.dat
2014-02-03 22:49 - 2011-10-24 08:25 - 05542960 _____ () C:\windows\system32\perfc007.dat
2014-02-03 22:49 - 2009-07-14 06:13 - 00006292 _____ () C:\windows\system32\PerfStringBackup.INI
2014-02-03 08:25 - 2014-02-03 08:25 - 00000000 __SHD () C:\found.000
2014-01-29 09:29 - 2012-04-30 10:11 - 00000000 ____D () C:\Users\Kruse\Documents\Mein Steuer-Sparbuch Heute
2014-01-27 23:12 - 2011-12-25 13:52 - 00000000 ____D () C:\Users\Kruse\AppData\Roaming\HpUpdate
2014-01-26 13:40 - 2011-12-07 12:34 - 00000000 ____D () C:\Users\Kruse\Documents\Beruf
2014-01-23 08:40 - 2014-01-23 08:40 - 00921000 _____ (Oracle Corporation) C:\Users\Kruse\Downloads\jxpiinstall(1).exe
2014-01-22 21:34 - 2013-12-06 20:35 - 00000000 ____D () C:\Users\Kruse\AppData\Roaming\vlc
2014-01-22 16:14 - 2014-01-22 16:14 - 00614784 _____ (Chip Digital GmbH) C:\Users\Kruse\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-01-19 18:56 - 2012-04-15 10:04 - 00001040 _____ () C:\Users\Kruse\Desktop\Glary Utilities.lnk
2014-01-19 18:56 - 2011-11-04 20:31 - 00002255 _____ () C:\Users\Kruse\Desktop\OneKey Recovery.lnk
2014-01-16 17:03 - 2013-08-02 22:21 - 00437320 _____ () C:\windows\system32\FNTCACHE.DAT
2014-01-16 10:07 - 2011-11-08 22:22 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-01-16 10:06 - 2013-08-03 02:05 - 00000000 ____D () C:\windows\system32\MRT
2014-01-16 10:01 - 2011-11-05 21:11 - 86054176 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-01-12 13:30 - 2012-04-30 10:08 - 00000846 _____ () C:\windows\wiso.ini
2014-01-09 10:16 - 2012-12-01 18:15 - 00001017 _____ () C:\Users\Kruse\Desktop\Dropbox.lnk
2014-01-09 10:16 - 2012-12-01 18:12 - 00000000 ____D () C:\Users\Kruse\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-01-09 10:16 - 2011-11-04 20:31 - 00000000 ___RD () C:\Users\Kruse\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Some content of TEMP:
====================
C:\Users\Kruse\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-01-29 16:01
==================== End Of Log ============================
--- --- --- |
|
07.02.2014, 09:54
| #4 |
| /// the machine /// TB-Ausbilder | Windows 7: Im Text sind wahllos Wörter grün unterstrichen, welche Werbelinks sindESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
07.02.2014, 19:47
| #5 |
| | Windows 7: Im Text sind wahllos Wörter grün unterstrichen, welche Werbelinks sind Hallo Schrauber, Euer Wissen ist für mich als Laien ziemlich imponierend. Vielen Dank für die Hilfe! Hoffentlich klappt alles. VG nhg600 FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-02-2014
Ran by Kruse (administrator) on KRUSE-PC on 07-02-2014 15:30:41
Running from C:\Users\Kruse\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
() C:\Users\Kruse\AppData\LocalLow\AdobeAir\IE\AdobeAirUpdater.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
() C:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe
(Dropbox, Inc.) C:\Users\Kruse\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Vimicro) C:\Program Files (x86)\USB Camera2\VM332_STI.EXE
(CyberLink) C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcfgex.exe
() C:\Users\Kruse\Downloads\SecurityCheck.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2741544 2011-04-08] (Synaptics Incorporated)
HKLM\...\Run: [Lenovo EE Boot Optimizer] - C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe [114688 2011-10-24] (Lenovo)
HKLM\...\Run: [EnergyUtility] - C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [5908928 2011-10-24] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [332BigDog] - C:\Program Files (x86)\USB Camera2\VM332_STI.EXE [536576 2010-01-19] (Vimicro)
HKLM-x32\...\Run: [YouCam Mirage] - C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [136488 2011-01-29] (CyberLink)
HKLM-x32\...\Run: [YouCam Tray] - C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe [228448 2011-01-29] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdatePRCShortCut] - C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe [222504 2009-05-13] (CyberLink Corp.)
HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [310640 2013-03-28] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [AVG_UI] - C:\Program Files (x86)\AVG\AVG2014\avgui.exe [4956176 2013-11-07] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [3830224 2013-05-16] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2467686847-4161017723-4110476100-1001\...\Run: [KiesPDLR] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [1106288 2013-03-28] (Samsung)
HKU\S-1-5-21-2467686847-4161017723-4110476100-1001\...\Run: [KiesPreload] - C:\Program Files (x86)\Samsung\Kies\Kies.exe [1511792 2013-03-28] (Samsung)
HKU\S-1-5-21-2467686847-4161017723-4110476100-1001\...\Run: [KiesAirMessage] - C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe [578560 2013-03-20] (Samsung Electronics)
HKU\S-1-5-21-2467686847-4161017723-4110476100-1001\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [1106288 2013-03-28] (Samsung)
HKU\S-1-5-21-2467686847-4161017723-4110476100-1001\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20587168 2013-11-18] (Skype Technologies S.A.)
HKU\S-1-5-21-2467686847-4161017723-4110476100-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
Startup: C:\Users\Kruse\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Kruse\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=LENN&bmod=LENN
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.welt.de/
HKLM\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: AdobeAir - {DCA971EE-CB86-4592-AE52-A45B2E257A12} - C:\Users\Kruse\AppData\LocalLow\AdobeAir\IE\AdobeAir.dll (Adobe Systems Inc.)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {F92A9FE4-2850-4198-B9D5-279880E49B16} - No File
DPF: HKLM {8FEFF364-6A5F-4966-A917-A3AC28411659} hxxp://download.sopcast.com/download/SOPCORE.CAB
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Kruse\AppData\Roaming\Mozilla\Firefox\Profiles\w06s99lu.default
FF Homepage: hxxp://www.bild.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @veetle.com/veetleCorePlugin,version=0.9.18 - C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF Plugin-x32: @veetle.com/veetlePlayerPlugin,version=0.9.18 - C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: FreeHDSport TV V6.0 - C:\Users\Kruse\AppData\Roaming\Mozilla\Firefox\Profiles\w06s99lu.default\Extensions\01e89cb1-f65e-4d01-9a8c-16784b40f1e3@2579a6e9-6ce6-413f-94ce-37240c823447.com [2014-01-28]
FF Extension: HDvid Codec V6.0 - C:\Users\Kruse\AppData\Roaming\Mozilla\Firefox\Profiles\w06s99lu.default\Extensions\34f57b0c-8cdb-4914-818c-928df47c6c4f@3a243122-a6fc-40c9-a1e6-ba11e930da09.com [2014-01-28]
FF Extension: HTTPS-Everywhere - C:\Users\Kruse\AppData\Roaming\Mozilla\Firefox\Profiles\w06s99lu.default\Extensions\https-everywhere@eff.org [2014-01-05]
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Kruse\AppData\Roaming\Mozilla\Firefox\Profiles\w06s99lu.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2012-11-20]
FF Extension: Adblock Plus - C:\Users\Kruse\AppData\Roaming\Mozilla\Firefox\Profiles\w06s99lu.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-12-01]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-02-06]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011-12-25]
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013-08-24]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011-12-25]
Chrome:
=======
CHR HomePage:
CHR Extension: (No Name) - C:\Users\Kruse\AppData\Local\Google\Chrome\User Data\Default\Extensions\baodmgdpdoelldjmkhknbolcldnfjegg [2013-11-07]
CHR Extension: (No Name) - C:\Users\Kruse\AppData\Local\Google\Chrome\User Data\Default\Extensions\incpbbmbclbkhjphicahojidkcabaajc [2013-11-04]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Users\Kruse\AppData\Roaming\DVDVideoSoft\DVDVideoSoftBrowserExtension.crx [2012-11-16]
CHR HKLM-x32\...\Chrome\Extension: [gdalfokaihlahnhdieedhgfekidifmfa] - C:\Users\Kruse\AppData\LocalLow\AdobeAir\CHROME\AdobeAir.crx [2011-11-03]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2012-03-02]
==================== Services (Whitelisted) =================
R2 AdobeAirUpdater; C:\Users\Kruse\AppData\LocalLow\AdobeAir\IE\AdobeAirUpdater.exe [18432 2011-11-03] ()
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3478544 2013-11-11] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [348008 2013-09-24] (AVG Technologies CZ, s.r.o.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
==================== Drivers (Whitelisted) ====================
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [150808 2013-11-05] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [240920 2013-11-04] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [194872 2013-10-24] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [212280 2013-10-31] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [294712 2013-10-31] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123704 2013-10-01] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31544 2013-09-10] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [251192 2013-08-01] (AVG Technologies CZ, s.r.o.)
S3 FsUsbExDisk; C:\windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-03-20] ()
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
U3 BcmSqlStartupSvc;
U2 CLKMSVC10_3A60B698;
U2 CLKMSVC10_C3B3B687;
U2 DriverService;
U2 iATAgentService;
U2 idealife Update Service;
U3 IGRS;
S1 iSafeNetFilter; \??\C:\Program Files (x86)\iSafe\iSafeNetFilter.sys [X]
U2 IviRegMgr;
U2 nvUpdatusService;
U2 Oasis2Service;
U2 PCCarerService;
U2 ReadyComm.DirectRouter;
U2 RichVideo;
U2 RtLedService;
U2 SoftwareService;
U3 SQLWriter;
U2 Stereo Service;
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-02-07 15:30 - 2014-02-07 15:30 - 00000000 ____D () C:\Users\Kruse\Downloads\FRST-OlderVersion
2014-02-07 15:20 - 2014-02-07 15:20 - 00987425 _____ () C:\Users\Kruse\Downloads\SecurityCheck.exe
2014-02-07 11:33 - 2014-02-07 11:33 - 02347384 _____ (ESET) C:\Users\Kruse\Downloads\esetsmartinstaller_enu.exe
2014-02-06 16:55 - 2014-02-06 16:55 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-06 16:07 - 2014-02-06 16:07 - 00004018 _____ () C:\Users\Kruse\Desktop\JRT.txt
2014-02-06 15:58 - 2014-02-06 15:58 - 00000000 ____D () C:\windows\ERUNT
2014-02-06 15:50 - 2014-02-06 15:50 - 01037530 _____ (Thisisu) C:\Users\Kruse\Downloads\JRT.exe
2014-02-06 15:36 - 2014-02-06 15:37 - 01166132 _____ () C:\Users\Kruse\Downloads\adwcleaner.exe
2014-02-05 21:23 - 2014-02-05 21:23 - 00005491 _____ () C:\Users\Kruse\Desktop\GMER.log
2014-02-05 21:21 - 2014-02-05 21:21 - 00027235 _____ () C:\Users\Kruse\Desktop\FRST.txt
2014-02-05 21:20 - 2014-02-05 21:20 - 00039790 _____ () C:\Users\Kruse\Desktop\Addition.txt
2014-02-05 21:20 - 2014-02-05 21:20 - 00005491 _____ () C:\Users\Kruse\Desktop\defogger_disable.log
2014-02-05 20:57 - 2014-02-05 20:57 - 00380416 _____ () C:\Users\Kruse\Downloads\Gmer-19357.exe
2014-02-05 20:42 - 2014-02-05 20:42 - 00039790 _____ () C:\Users\Kruse\Downloads\Addition.txt
2014-02-05 20:41 - 2014-02-07 15:30 - 00019332 _____ () C:\Users\Kruse\Downloads\FRST.txt
2014-02-05 20:41 - 2014-02-07 15:30 - 00000000 ____D () C:\FRST
2014-02-05 20:39 - 2014-02-07 15:30 - 02079744 _____ (Farbar) C:\Users\Kruse\Downloads\FRST64.exe
2014-02-05 20:37 - 2014-02-05 20:37 - 00000472 _____ () C:\Users\Kruse\Downloads\defogger_disable.log
2014-02-05 20:37 - 2014-02-05 20:37 - 00000000 _____ () C:\Users\Kruse\defogger_reenable
2014-02-05 20:35 - 2014-02-05 20:35 - 00050477 _____ () C:\Users\Kruse\Downloads\Defogger.exe
2014-02-05 18:58 - 2014-02-06 15:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-02-03 08:25 - 2014-02-03 08:25 - 00000000 __SHD () C:\found.000
2014-01-23 08:40 - 2014-01-23 08:40 - 00921000 _____ (Oracle Corporation) C:\Users\Kruse\Downloads\jxpiinstall(1).exe
2014-01-22 16:16 - 2014-02-06 15:40 - 00000000 ____D () C:\AdwCleaner
2014-01-22 16:14 - 2014-01-22 16:14 - 00614784 _____ (Chip Digital GmbH) C:\Users\Kruse\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-01-15 10:01 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbhub.sys
2014-01-15 10:01 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbport.sys
2014-01-15 10:01 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbccgp.sys
2014-01-15 10:01 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbehci.sys
2014-01-15 10:01 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbuhci.sys
2014-01-15 10:01 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbohci.sys
2014-01-15 10:01 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbd.sys
2014-01-15 10:01 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\windows\system32\Drivers\netio.sys
2014-01-15 10:01 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
==================== One Month Modified Files and Folders =======
2014-02-07 15:30 - 2014-02-07 15:30 - 00000000 ____D () C:\Users\Kruse\Downloads\FRST-OlderVersion
2014-02-07 15:30 - 2014-02-05 20:41 - 00019332 _____ () C:\Users\Kruse\Downloads\FRST.txt
2014-02-07 15:30 - 2014-02-05 20:41 - 00000000 ____D () C:\FRST
2014-02-07 15:30 - 2014-02-05 20:39 - 02079744 _____ (Farbar) C:\Users\Kruse\Downloads\FRST64.exe
2014-02-07 15:22 - 2011-11-04 23:01 - 00000000 ____D () C:\Users\Kruse\AppData\Roaming\Skype
2014-02-07 15:20 - 2014-02-07 15:20 - 00987425 _____ () C:\Users\Kruse\Downloads\SecurityCheck.exe
2014-02-07 15:09 - 2013-09-29 17:52 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-02-07 14:02 - 2011-10-24 08:25 - 17335532 _____ () C:\windows\system32\perfh007.dat
2014-02-07 14:02 - 2011-10-24 08:25 - 05552792 _____ () C:\windows\system32\perfc007.dat
2014-02-07 14:02 - 2009-07-14 06:13 - 00006292 _____ () C:\windows\system32\PerfStringBackup.INI
2014-02-07 13:59 - 2013-11-14 20:58 - 00014616 _____ () C:\windows\setupact.log
2014-02-07 13:59 - 2013-11-14 19:44 - 01433655 _____ () C:\windows\WindowsUpdate.log
2014-02-07 13:10 - 2013-11-23 19:05 - 00002248 _____ () C:\windows\Tasks\FreeHDSport TV V6.0-firefoxinstaller.job
2014-02-07 13:05 - 2013-11-23 19:05 - 00001344 _____ () C:\windows\Tasks\FreeHDSport TV V6.0-updater.job
2014-02-07 12:41 - 2013-11-23 18:36 - 00002172 _____ () C:\windows\Tasks\HDvid Codec V6.0-firefoxinstaller.job
2014-02-07 12:36 - 2013-11-23 18:36 - 00001326 _____ () C:\windows\Tasks\HDvid Codec V6.0-updater.job
2014-02-07 11:33 - 2014-02-07 11:33 - 02347384 _____ (ESET) C:\Users\Kruse\Downloads\esetsmartinstaller_enu.exe
2014-02-07 11:29 - 2009-07-14 05:45 - 00021280 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-07 11:29 - 2009-07-14 05:45 - 00021280 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-07 11:27 - 2013-02-12 21:47 - 00000000 ____D () C:\ProgramData\MFAData
2014-02-07 11:24 - 2012-05-11 19:00 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-02-07 11:23 - 2012-12-01 18:15 - 00000000 ___RD () C:\Users\Kruse\Dropbox
2014-02-07 11:23 - 2012-12-01 18:11 - 00000000 ____D () C:\Users\Kruse\AppData\Roaming\Dropbox
2014-02-07 11:22 - 2012-04-15 10:04 - 00000314 _____ () C:\windows\Tasks\GlaryInitialize.job
2014-02-07 11:22 - 2011-10-24 17:23 - 00473189 _____ () C:\windows\system32\fastboot.set
2014-02-07 11:21 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-02-06 16:55 - 2014-02-06 16:55 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-06 16:07 - 2014-02-06 16:07 - 00004018 _____ () C:\Users\Kruse\Desktop\JRT.txt
2014-02-06 16:02 - 2013-11-23 19:05 - 00000000 ____D () C:\Program Files (x86)\FreeHDSport TV V6.0
2014-02-06 16:02 - 2013-11-23 18:36 - 00000000 ____D () C:\Program Files (x86)\HDvid Codec V6.0
2014-02-06 15:58 - 2014-02-06 15:58 - 00000000 ____D () C:\windows\ERUNT
2014-02-06 15:50 - 2014-02-06 15:50 - 01037530 _____ (Thisisu) C:\Users\Kruse\Downloads\JRT.exe
2014-02-06 15:40 - 2014-01-22 16:16 - 00000000 ____D () C:\AdwCleaner
2014-02-06 15:37 - 2014-02-06 15:36 - 01166132 _____ () C:\Users\Kruse\Downloads\adwcleaner.exe
2014-02-06 15:33 - 2014-02-05 18:58 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-02-06 15:31 - 2013-12-09 07:08 - 00166266 _____ () C:\windows\PFRO.log
2014-02-05 21:23 - 2014-02-05 21:23 - 00005491 _____ () C:\Users\Kruse\Desktop\GMER.log
2014-02-05 21:21 - 2014-02-05 21:21 - 00027235 _____ () C:\Users\Kruse\Desktop\FRST.txt
2014-02-05 21:20 - 2014-02-05 21:20 - 00039790 _____ () C:\Users\Kruse\Desktop\Addition.txt
2014-02-05 21:20 - 2014-02-05 21:20 - 00005491 _____ () C:\Users\Kruse\Desktop\defogger_disable.log
2014-02-05 20:57 - 2014-02-05 20:57 - 00380416 _____ () C:\Users\Kruse\Downloads\Gmer-19357.exe
2014-02-05 20:57 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\system32\NDF
2014-02-05 20:42 - 2014-02-05 20:42 - 00039790 _____ () C:\Users\Kruse\Downloads\Addition.txt
2014-02-05 20:37 - 2014-02-05 20:37 - 00000472 _____ () C:\Users\Kruse\Downloads\defogger_disable.log
2014-02-05 20:37 - 2014-02-05 20:37 - 00000000 _____ () C:\Users\Kruse\defogger_reenable
2014-02-05 20:37 - 2011-11-04 20:31 - 00000000 ____D () C:\Users\Kruse
2014-02-05 20:35 - 2014-02-05 20:35 - 00050477 _____ () C:\Users\Kruse\Downloads\Defogger.exe
2014-02-05 19:09 - 2013-09-29 17:52 - 00003822 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2014-02-05 19:09 - 2013-03-23 16:07 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-02-05 19:09 - 2011-11-05 23:21 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-03 08:25 - 2014-02-03 08:25 - 00000000 __SHD () C:\found.000
2014-01-29 09:29 - 2012-04-30 10:11 - 00000000 ____D () C:\Users\Kruse\Documents\Mein Steuer-Sparbuch Heute
2014-01-27 23:12 - 2011-12-25 13:52 - 00000000 ____D () C:\Users\Kruse\AppData\Roaming\HpUpdate
2014-01-26 13:40 - 2011-12-07 12:34 - 00000000 ____D () C:\Users\Kruse\Documents\Beruf
2014-01-23 08:40 - 2014-01-23 08:40 - 00921000 _____ (Oracle Corporation) C:\Users\Kruse\Downloads\jxpiinstall(1).exe
2014-01-22 21:34 - 2013-12-06 20:35 - 00000000 ____D () C:\Users\Kruse\AppData\Roaming\vlc
2014-01-22 16:14 - 2014-01-22 16:14 - 00614784 _____ (Chip Digital GmbH) C:\Users\Kruse\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-01-19 18:56 - 2012-04-15 10:04 - 00001040 _____ () C:\Users\Kruse\Desktop\Glary Utilities.lnk
2014-01-19 18:56 - 2011-11-04 20:31 - 00002255 _____ () C:\Users\Kruse\Desktop\OneKey Recovery.lnk
2014-01-16 17:03 - 2013-08-02 22:21 - 00437320 _____ () C:\windows\system32\FNTCACHE.DAT
2014-01-16 10:07 - 2011-11-08 22:22 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-01-16 10:06 - 2013-08-03 02:05 - 00000000 ____D () C:\windows\system32\MRT
2014-01-16 10:01 - 2011-11-05 21:11 - 86054176 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-01-12 13:30 - 2012-04-30 10:08 - 00000846 _____ () C:\windows\wiso.ini
2014-01-09 10:16 - 2012-12-01 18:15 - 00001017 _____ () C:\Users\Kruse\Desktop\Dropbox.lnk
2014-01-09 10:16 - 2012-12-01 18:12 - 00000000 ____D () C:\Users\Kruse\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-01-09 10:16 - 2011-11-04 20:31 - 00000000 ___RD () C:\Users\Kruse\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Some content of TEMP:
====================
C:\Users\Kruse\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-01-29 16:01
==================== End Of Log ============================
--- --- --- --- --- --- Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=717b7f6b504fc2479c7e81ec75c1fe81
# engine=16979
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-02-07 02:13:31
# local_time=2014-02-07 03:13:31 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 18159648 143412261 0 0
# scanned=241790
# found=7
# cleaned=0
# scan_time=12898
sh=F2D1C9BBCC933C9983E1DDF5E0979AEC276283C0 ft=1 fh=cac3b338f63d7a2b vn="Win32/AdWare.1ClickDownload.AQ application" ac=I fn="C:\Users\Kruse\Downloads\codec_pack_ff(1).exe"
sh=9D38E38F67A44CA456A3726205C55A2304C71C32 ft=1 fh=aad0afed668a504c vn="Win32/AdWare.1ClickDownload.AQ application" ac=I fn="C:\Users\Kruse\Downloads\codec_pack_ff(2).exe"
sh=72E7A567C262C83F683F6F8AD5D0FFF574D34A0D ft=1 fh=4bcc85ed2821364e vn="Win32/AdWare.1ClickDownload.AQ application" ac=I fn="C:\Users\Kruse\Downloads\codec_pack_ff(3).exe"
sh=B5799F33BE5EF214EA26BC46548F44031AA017D7 ft=1 fh=aa0de8e4880a0be3 vn="Win32/AdWare.1ClickDownload.AQ application" ac=I fn="C:\Users\Kruse\Downloads\codec_pack_ff.exe"
sh=B53FD602A470359366EC66734F8348CAF53E73B6 ft=1 fh=6bedf6e1e0c0fa81 vn="a variant of Win32/SpeedingUpMyPC.F application" ac=I fn="C:\Users\Kruse\Downloads\PCSpeedMaximizer.exe"
sh=10723FC5FFF54E0C354CFEE0831EB8A34B2490C6 ft=1 fh=1f199d448dffcb2f vn="Win32/AdWare.1ClickDownload.AQ application" ac=I fn="C:\Users\Kruse\Downloads\StreamhuntAppsSetup(18_3f)3_ff.exe"
sh=E9762A0C48EB9BBEBD4EF8E6D85481552E9BD2F5 ft=0 fh=0000000000000000 vn="Win32/Adware.ToolPlugin application" ac=I fn="I:\KRUSE-PC\Backup Set 2012-08-20 113900\Backup Files 2012-08-20 113900\Backup files 4.zip"
Code:
ATTFilter Results of screen317's Security Check version 0.99.79 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` AVG AntiVirus Free Edition 2014 Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` MVPS Hosts File SpywareBlaster 5.0 Spybot - Search & Destroy Malwarebytes Anti-Malware Version 1.75.0.1300 TuneUp Utilities Language Pack (de-DE) Java 7 Update 45 Java version out of Date! Adobe Flash Player 11.9.900.170 Adobe Reader 9 Adobe Reader out of Date! Mozilla Firefox (27.0) Mozilla Thunderbird (24.3.0) ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Spybot Teatimer.exe is disabled! AVG avgwdsvc.exe Malwarebytes' Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` Du fragst mich danach, ob ich das Problem noch immer habe. Jepp, es ist noch da. Allerdings deutlich weniger. Ich surfte ein wenig und war regelrecht auf der Suche nach diesen grün unterstrichenen Wörtern. Es gibt sie, doch in geringerer Anzahl. Auf der Suche fand ich aber etwas, das mir schon länger nicht mehr auffiel und von dem ich dachte, ich wäre das Problem los. Es sind schwarz unterstrichene Wörter, die den Verweis auf "Click to continue > by FreeHDSport TV V6.V" haben. Noch vor Wochen extrem häufig vertreten, wurden sie weniger. Außerdem wurde ich stutzig, dass ich auf meiner Suche feststellte, dass es Seiten gibt, die vollkommen unvollständig angezeigt werden. Es fehlen komplette Bilder zu Texten, manche Links werden auf diesem Weg gar nicht angezeigt. Auf Kicker.de und Bild.de z.B. gibt es Seiten, die deshalb vollkommen unbrauchbar sind. Oh man, was habe ich nur falsch gemacht... Ich hoffe auf weitere Hilfe, Schrauber. Dank Dir vorab!! VG nhg600 |
|
08.02.2014, 14:11
| #6 |
| /// the machine /// TB-Ausbilder | Windows 7: Im Text sind wahllos Wörter grün unterstrichen, welche Werbelinks sind Java und Adobe updaten. die Downloads und das Backup (im ESET Log) bitte löschen. In welchem Browser?
__________________ --> Windows 7: Im Text sind wahllos Wörter grün unterstrichen, welche Werbelinks sind |
|
08.02.2014, 19:50
| #7 |
| | Windows 7: Im Text sind wahllos Wörter grün unterstrichen, welche Werbelinks sind ESET ist vollkommen gelöscht. Zumindest wüßte ich nicht wo es noch ein Backup geben könnte. Beim Update von Java gab es folgenden Fehlerhinweis: Fehlerhinweis Java-Installationsprogramm: C:\Users\Kruse\Appdata\LocalLow\Sun\Java\jre1.7.0_51\jre1031.Mst is corrupted Flash Player ist aktuellste Version. Übrigens sind die gefühlt weniger auftretenden grün unterstrichenden Wörter wieder in großer Anzahl vorhanden... Und nun? Ideen? Danke und Gruß, nhg600 ...sorry, habe den Browser vergessen: Firefox! Geändert von nhg600 (08.02.2014 um 17:04 Uhr) |
|
09.02.2014, 16:38
| #8 |
| /// the machine /// TB-Ausbilder | Windows 7: Im Text sind wahllos Wörter grün unterstrichen, welche Werbelinks sind Revo Uninstaller - Download - Filepony damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren. Dann: https://support.mozilla.org/de/kb/fi...einfach-loesen Java deinstallieren, dann neu installieren. Im Log von ESET wird ein Backup von Dir als infiziert angemeckert, das sollst du löschen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Windows 7: Im Text sind wahllos Wörter grün unterstrichen, welche Werbelinks sind |
| antivirus, avg antivirus, browser, chromium, converter, device driver, dvdvideosoft ltd., email, error, fehler, firefox, flash player, hdvid codec v6.0, home, homepage, install.exe, mp3, problem, prozess, pup.optional.bundleinstaller.a, pup.optional.hdvidcodec.a, pup.optional.smartbar.a, pup.optional.sweetim.a, registry, security, svchost.exe, warum, win32/adware.1clickdownload.aq, win32/adware.toolplugin, win32/speedingupmypc.f, win32k.sys, windows, wiso |
