| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: DiegiCoooupon und UTAdRemovvAlApp - nicht löschbare Erweiterungen [Chrome]Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
18.03.2014, 01:09
| #1 |
| | ![DiegiCoooupon und UTAdRemovvAlApp - nicht löschbare Erweiterungen [Chrome] - Standard](images/icons/icon1.gif){kind=icon} DiegiCoooupon und UTAdRemovvAlApp - nicht löschbare Erweiterungen [Chrome] Hallo Leute! Ich bin bei der Suche nach meinem Problem auf eure Seite gestoßen. Hab mich hier mal umgesehen, aber konnte leider keine Lösung zu meinem Problem finden. Mein Problem ist folgendes: Habe ein paar nicht erwünschte Addons, welche mir unerwünschte Werbung einbleden. Ich hoffe, dass ist das einzige was sie machen. Naja auf jedenfall habe ich das gefühl, dass sie zusätzlich noch weiteren Spam-Müll auf meinem PC installiert haben. Habe den AdwCleaner rüber laufen lassen und alles löschen lassen, was er gefunden hat. Leider sind auch nach der Bereinigung die "Erweiterungen" noch in meinen Chrome-Einstellungen zu finden. Manuelle Deaktivierung und Löschung bringen auch nichts, da beim nächsten Start alles wieder wie vorher ist. Hier ist der Log des AdwCleaner: # AdwCleaner v3.022 - Bericht erstellt am 18/03/2014 um 00:10:45 # Aktualisiert 13/03/2014 von Xplode # Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits) # Benutzername : Marko - HORSTBANGBRO # Gestartet von : C:\Users\Marko\Downloads\adwcleaner.exe # Option : Suchen ***** [ Dienste ] ***** ***** [ Dateien / Ordner ] ***** Datei Gefunden : C:\Users\Marko\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_pflphaooapbgpeakohlggbpidpppgdff_0.localstorage Datei Gefunden : C:\Users\Marko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\net.lnk Datei Gefunden : C:\Users\Marko\AppData\Roaming\Mozilla\Firefox\Profiles\sqbxduqc.default-1369861845500\searchplugins\Mysearchdial.xml Ordner Gefunden : C:\Users\Marko\AppData\Roaming\Mozilla\Firefox\Profiles\sqbxduqc.default-1369861845500\Extensions\sal-8@cqg-v.co.uk Ordner Gefunden : C:\Users\Marko\AppData\Roaming\Mozilla\Firefox\Profiles\sqbxduqc.default-1369861845500\Extensions\sal-8@cqg-v.co.uk Ordner Gefunden : C:\Users\Marko\AppData\Roaming\Mozilla\Firefox\Profiles\sqbxduqc.default-1369861845500\Extensions\sal-8@cqg-v.co.uk Ordner Gefunden : C:\Users\Marko\AppData\Roaming\Mozilla\Firefox\Profiles\sqbxduqc.default-1369861845500\Extensions\sal-8@cqg-v.co.uk Ordner Gefunden : C:\Users\Marko\AppData\Roaming\Mozilla\Firefox\Profiles\sqbxduqc.default-1369861845500\Extensions\sal-8@cqg-v.co.uk Ordner Gefunden : C:\Users\Marko\AppData\Roaming\Mozilla\Firefox\Profiles\sqbxduqc.default-1369861845500\Extensions\staged Ordner Gefunden : C:\Users\Marko\AppData\Roaming\Mozilla\Firefox\Profiles\sqbxduqc.default-1369861845500\Extensions\staged Ordner Gefunden : C:\Users\Marko\AppData\Roaming\Mozilla\Firefox\Profiles\sqbxduqc.default-1369861845500\Extensions\staged Ordner Gefunden : C:\Users\Marko\AppData\Roaming\Mozilla\Firefox\Profiles\sqbxduqc.default-1369861845500\Extensions\staged Ordner Gefunden : C:\Users\Marko\AppData\Roaming\Mozilla\Firefox\Profiles\sqbxduqc.default-1369861845500\Extensions\staged Ordner Gefunden : C:\Users\Marko\AppData\Roaming\Mozilla\Firefox\Profiles\sqbxduqc.default-1369861845500\Extensions\xabaee@hsrv.co.uk Ordner Gefunden : C:\Users\Marko\AppData\Roaming\Mozilla\Firefox\Profiles\sqbxduqc.default-1369861845500\Extensions\xabaee@hsrv.co.uk Ordner Gefunden : C:\Users\Marko\AppData\Roaming\Mozilla\Firefox\Profiles\sqbxduqc.default-1369861845500\Extensions\xabaee@hsrv.co.uk Ordner Gefunden : C:\Users\Marko\AppData\Roaming\Mozilla\Firefox\Profiles\sqbxduqc.default-1369861845500\Extensions\xabaee@hsrv.co.uk Ordner Gefunden : C:\Users\Marko\AppData\Roaming\Mozilla\Firefox\Profiles\sqbxduqc.default-1369861845500\Extensions\xabaee@hsrv.co.uk Ordner Gefunden C:\Program Files (x86)\DDIgiCouuponu Ordner Gefunden C:\Program Files (x86)\DDIgiCouuponu Ordner Gefunden C:\Program Files (x86)\DiegiCoooupon Ordner Gefunden C:\Program Files (x86)\DiegiCoooupon Ordner Gefunden C:\Program Files (x86)\Mysearchdial Ordner Gefunden C:\ProgramData\boost_interprocess Ordner Gefunden C:\ProgramData\DDIgiCouuponu Ordner Gefunden C:\ProgramData\DDIgiCouuponu Ordner Gefunden C:\ProgramData\DiegiCoooupon Ordner Gefunden C:\ProgramData\DiegiCoooupon Ordner Gefunden C:\ProgramData\savenSHaRe i Ordner Gefunden C:\ProgramData\StarApp Ordner Gefunden C:\Users\Marko\AppData\LocalLow\Mysearchdial Ordner Gefunden C:\Users\Marko\AppData\Roaming\Mysearchdial Ordner Gefunden C:\Users\Marko\AppData\Roaming\Windows Net Data ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** Schlüssel Gefunden : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B} Schlüssel Gefunden : HKCU\Software\AppDataLow\SProtector Schlüssel Gefunden : HKCU\Software\InstallCore Schlüssel Gefunden : HKCU\Software\mysearchdial Schlüssel Gefunden : HKCU\Software\mysearchdial.com Schlüssel Gefunden : [x64] HKCU\Software\InstallCore Schlüssel Gefunden : [x64] HKCU\Software\mysearchdial Schlüssel Gefunden : [x64] HKCU\Software\mysearchdial.com Schlüssel Gefunden : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0} Schlüssel Gefunden : HKLM\Software\{5F189DF5-2D05-472B-9091-84D9848AE48B} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{C292AD0A-C11F-479B-B8DB-743E72D283B0} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{CA5CAA63-B27C-4963-9BEC-CB16A36D56F8} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\esrv.EXE Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\esrv.mysearchdialesrvc Schlüssel Gefunden : HKLM\SOFTWARE\Classes\esrv.mysearchdialesrvc.1 Schlüssel Gefunden : HKLM\Software\InstallCore Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{219046AE-358F-4CF1-B1FD-2B4DE83642A8} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\BundleSweetIMSetup_RASAPI32 Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\BundleSweetIMSetup_RASMANCS Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\sweetim_rasapi32 Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\sweetim_rasmancs Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\sweetpacksupdatemanager_rasapi32 Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SweetPacksUpdateManager_RASMANCS Schlüssel Gefunden : HKLM\Software\mysearchdial Schlüssel Gefunden : HKLM\Software\SP Global Schlüssel Gefunden : HKLM\Software\SProtector Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847} ***** [ Browser ] ***** -\\ Internet Explorer v11.0.9600.16428 Einstellung Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls [Tabs] - hxxp://start.mysearchdial.com/?f=2&a=irmsd62&cd=2XzuyEtN2Y1L1QzuzytD0EyC0B0A0DzytBtD0CyC0A0AtByBtN0D0Tzu0SyDtAtCtN1L2XzutBtFtBtFyEtFyBtAtCtN1L1Czu1L1C1H1B1QyCtB&cr=375338644&ir= -\\ Mozilla Firefox v26.0 (de) [ Datei : C:\Users\Marko\AppData\Roaming\Mozilla\Firefox\Profiles\sqbxduqc.default-1369861845500\prefs.js ] Zeile gefunden : user_pref("aol_toolbar.default.homepage.check", false); Zeile gefunden : user_pref("aol_toolbar.default.search.check", false); Zeile gefunden : user_pref("browser.search.order.1", "Mysearchdial"); Zeile gefunden : user_pref("extensions.8EZM4d0Z.scode", "new function(){var a=this;a.domain_storage=\"hxxp://xls.searchfun.in\";a.prefix=\"if72ru4ruh7fewui\";a.conf={\"1\":{\"0\":1,\"1\":21600,\"2\":0,\"3\":0,\"4\":0,[...] Zeile gefunden : user_pref("extensions.BabylonToolbar.prtkDS", 0); Zeile gefunden : user_pref("extensions.BabylonToolbar.prtkHmpg", 0); Zeile gefunden : user_pref("extensions.GJcpKnJg.scode", "(function(){if(window.self.location.hostname.indexOf(\"acebook.co\")>-1){return};var _wlst={lsKey:\"ssjsmn2ja8ddw2a\",get:function(b,a){if(3<b)return a(!1);var [...] Zeile gefunden : user_pref("extensions.mysearchdial.aflt", "irmsd62"); Zeile gefunden : user_pref("extensions.mysearchdial.appId", "{CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}"); Zeile gefunden : user_pref("extensions.mysearchdial.cd", "2XzuyEtN2Y1L1QzuzytD0EyC0B0A0DzytBtD0CyC0A0AtByBtN0D0Tzu0SyDtAtCtN1L2XzutBtFtBtFyEtFyBtAtCtN1L1Czu1L1C1H1B1QyCtB"); Zeile gefunden : user_pref("extensions.mysearchdial.cr", "375338644"); Zeile gefunden : user_pref("extensions.mysearchdial.dfltLng", ""); Zeile gefunden : user_pref("extensions.mysearchdial.dfltSrch", true); Zeile gefunden : user_pref("extensions.mysearchdial.dnsErr", true); Zeile gefunden : user_pref("extensions.mysearchdial.excTlbr", false); Zeile gefunden : user_pref("extensions.mysearchdial.hmpg", true); Zeile gefunden : user_pref("extensions.mysearchdial.hmpgUrl", "hxxp://start.mysearchdial.com/?f=1&a=irmsd62&cd=2XzuyEtN2Y1L1QzuzytD0EyC0B0A0DzytBtD0CyC0A0AtByBtN0D0Tzu0SyDtAtCtN1L2XzutBtFtBtFyEtFyBtAtCtN1L1Czu1L1C1H1B[...] Zeile gefunden : user_pref("extensions.mysearchdial.id", "90E6BAD920C6AA27"); Zeile gefunden : user_pref("extensions.mysearchdial.instlDay", "15871"); Zeile gefunden : user_pref("extensions.mysearchdial.instlRef", ""); Zeile gefunden : user_pref("extensions.mysearchdial.newTabUrl", "hxxp://start.mysearchdial.com/?f=2&a=irmsd62&cd=2XzuyEtN2Y1L1QzuzytD0EyC0B0A0DzytBtD0CyC0A0AtByBtN0D0Tzu0SyDtAtCtN1L2XzutBtFtBtFyEtFyBtAtCtN1L1Czu1L1C1H[...] Zeile gefunden : user_pref("extensions.mysearchdial.prdct", "mysearchdial"); Zeile gefunden : user_pref("extensions.mysearchdial.prtnrId", "mysearchdial"); Zeile gefunden : user_pref("extensions.mysearchdial.srchPrvdr", "Mysearchdial"); Zeile gefunden : user_pref("extensions.mysearchdial.tlbrId", "base"); Zeile gefunden : user_pref("extensions.mysearchdial.tlbrSrchUrl", "hxxp://start.mysearchdial.com/?f=3&a=irmsd62&cd=2XzuyEtN2Y1L1QzuzytD0EyC0B0A0DzytBtD0CyC0A0AtByBtN0D0Tzu0SyDtAtCtN1L2XzutBtFtBtFyEtFyBtAtCtN1L1Czu1L1C[...] Zeile gefunden : user_pref("extensions.mysearchdial.vrsn", ""); Zeile gefunden : user_pref("extensions.mysearchdial.vrsni", ""); Zeile gefunden : user_pref("extensions.mysearchdial_i.hmpg", true); Zeile gefunden : user_pref("extensions.mysearchdial_i.newTab", false); Zeile gefunden : user_pref("extensions.mysearchdial_i.smplGrp", "none"); Zeile gefunden : user_pref("extensions.mysearchdial_i.vrsnTs", "9:38:52"); Zeile gefunden : user_pref("extensions.v4VzM3TbosQf.scode", "(function(){if(window.self.location.hostname.indexOf(\"acebook.co\")>-1){return};var _wlst={lsKey:\"ssjsmn2ja8ddw2a\",get:function(b,a){if(3<b)return a(!1);[...] Zeile gefunden : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", ""); Zeile gefunden : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", ""); Zeile gefunden : user_pref("sweetim.toolbar.previous.browser.startup.homepage", ""); Zeile gefunden : user_pref("sweetim.toolbar.previous.keyword.URL", ""); Zeile gefunden : user_pref("sweetim.toolbar.scripts.1.domain-blacklist", ""); Zeile gefunden : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_DS", ""); Zeile gefunden : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_HP", ""); Zeile gefunden : user_pref("sweetim.toolbar.searchguard.enable", ""); -\\ Google Chrome v31.0.1650.63 [ Datei : C:\Users\Marko\AppData\Local\Google\Chrome\User Data\Default\preferences ] ************************* AdwCleaner[R0].txt - [10451 octets] - [18/03/2014 00:10:45] ########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [10512 octets] ########## Und hier habe ich jetzt nach der Bereinigung nochmal FRST drüber laufen lassen und das ist der aktuelle Log: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014 Ran by Marko (administrator) on HORSTBANGBRO on 18-03-2014 00:57:07 Running from C:\Users\Marko\Downloads Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (Bitdefender) C:\Program Files\Bitdefender\Bitdefender\vsserv.exe (AMD) C:\Windows\system32\atiesrxx.exe (Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe (AMD) C:\Windows\system32\atieclxx.exe (Symantec) D:\Programme\Nortin AntiBot\agent\Bin\NABAgent.exe (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Malwarebytes Corporation) D:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) D:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Symantec) D:\Programme\Nortin AntiBot\agent\Bin\NABWatcher.exe (Bitdefender) C:\Program Files\Bitdefender\Bitdefender\updatesrv.exe (Bitdefender) C:\Program Files\Bitdefender\Bitdefender SafeBox\safeboxservice.exe (Malwarebytes Corporation) D:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Bitdefender) C:\Program Files\Bitdefender\Bitdefender\bdagent.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Bitdefender) C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe (Bitdefender) C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe () C:\Users\Marko\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe (Logitech, Inc.) D:\Programme\Logitech Touch Mouse Server\iTouch-Server-Win.exe (Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe (Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Symantec) D:\Programme\Nortin AntiBot\agent\Bin\NortonAntiBot.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Symantec) D:\Programme\Nortin AntiBot\agent\Bin\NABMonitor.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Bitdefender) C:\Program Files\Bitdefender\Bitdefender\seccenter.exe (Malwarebytes Corporation) D:\Programme\Malwarebytes' Anti-Malware\mbam.exe (Mozilla Corporation) D:\Programme\Mozilla Thunderbird\thunderbird.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe () C:\Program Files\Bitdefender\Bitdefender\Antispam32\pmbxcrnmh.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [Bdagent] - C:\Program Files\Bitdefender\Bitdefender\bdagent.exe [1739480 2014-03-17] (Bitdefender) HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM-x32\...\Run: [iTunesHelper] - D:\Programme\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.) HKLM-x32\...\Run: [NortonAntiBot] - D:\Programme\Nortin AntiBot\agent\bin\NortonAntiBot.exe [1378840 2007-11-12] (Symantec) HKU\.DEFAULT\...\Run: [Bitdefender-Geldbörse-Agent] - C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe [567888 2014-03-17] (Bitdefender) HKU\.DEFAULT\...\Run: [Bitdefender-Geldbörse] - C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe [1001536 2014-03-17] (Bitdefender) HKU\.DEFAULT\...\Run: [Bitdefender-Geldbörse-Anwendungs-Agent] - C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe [614232 2014-03-17] (Bitdefender) HKU\S-1-5-21-4056887023-3191848789-1834893943-1000\...\Run: [Bitdefender-Geldbörse-Agent] - C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe [567888 2014-03-17] (Bitdefender) HKU\S-1-5-21-4056887023-3191848789-1834893943-1000\...\Run: [Bitdefender-Geldbörse] - C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe [1001536 2014-03-17] (Bitdefender) HKU\S-1-5-21-4056887023-3191848789-1834893943-1000\...\Run: [Bitdefender-Geldbörse-Anwendungs-Agent] - C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe [614232 2014-03-17] (Bitdefender) HKU\S-1-5-21-4056887023-3191848789-1834893943-1000\...\Run: [Amazon Cloud Player] - C:\Users\Marko\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3140608 2014-01-14] () HKU\S-1-5-21-4056887023-3191848789-1834893943-1000\...\MountPoints2: {5de60358-541b-11e3-a18e-90e6bad920c6} - F:\HTC_Sync_Manager_PC.exe HKU\S-1-5-21-4056887023-3191848789-1834893943-1000\...\MountPoints2: {792dbd03-1a26-11e2-8d94-806e6f6e6963} - E:\Setup.exe Startup: C:\Users\Marko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech Touch Mouse Server.lnk ShortcutTarget: Logitech Touch Mouse Server.lnk -> D:\Programme\Logitech Touch Mouse Server\iTouch-Server-Win.exe (Logitech, Inc.) Startup: C:\Users\Marko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\thunderbird - Verknüpfung.lnk ShortcutTarget: thunderbird - Verknüpfung.lnk -> D:\Programme\Mozilla Thunderbird\thunderbird.exe (Mozilla Corporation) GroupPolicy: Group Policy on Chrome detected <======= ATTENTION ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x3932A8CD0B27CE01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.giga.de/software/ HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd62&cd=2XzuyEtN2Y1L1QzuzytD0EyC0B0A0DzytBtD0CyC0A0AtByBtN0D0Tzu0SyDtAtCtN1L2XzutBtFtBtFyEtFyBtAtCtN1L1Czu1L1C1H1 B1QyCtB&cr=375338644&ir= SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd62&cd=2XzuyEtN2Y1L1QzuzytD0EyC0B0A0DzytBtD0CyC0A0AtByBtN0D0Tzu0SyDtAtCtN1L2XzutBtFtBtFyEtFyBtAtCtN1L1Czu1L1C1H1 B1QyCtB&cr=375338644&ir= SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=horus BHO: Bitdefender-Geldbörse - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender\pmbxie.dll (Bitdefender) BHO-x32: Bitdefender-Geldbörse - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender\Antispam32\pmbxie.dll (Bitdefender) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 213.209.104.220 213.209.104.250 FireFox: ======== FF ProfilePath: C:\Users\Marko\AppData\Roaming\Mozilla\Firefox\Profiles\sqbxduqc.default-1369861845500 FF SearchEngineOrder.user_pref("browser.search.order.1,S", "");: user_pref("browser.search.order.1,S", ""); FF SelectedSearchEngine: Google FF Homepage: google.de|hxxp://www.giga.de/software/ FF Keyword.URL: user_pref("keyword.URL", ""); FF NetworkProxy: "type", 4 FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.) FF Plugin-x32: @Apple.com/iTunes,version=1.0 - D:\Programme\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @cambridgesoft.com/Chem3D,version=11.0 - D:\Programme\Chem3D\npChem3DPlugin.dll (CambridgeSoft Corp.) FF Plugin-x32: @cambridgesoft.com/ChemDraw,version=11.0 - D:\Programme\ChemDraw\npcdp32.dll (CambridgeSoft Corp.) FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - D:\Programme\Picasa\Picasa3\npPicasa3.dll (Google, Inc.) FF Plugin-x32: @idsoftware.com/QuakeLive - C:\ProgramData\id Software\QuakeLive\npquakezero.dll (id Software Inc.) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - D:\PROGRA~1\Office\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - D:\PROGRA~1\Office\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @nullsoft.com/winampDetector;version=1 - D:\Programme\Winamp Detect\npwachk.dll (Nullsoft, Inc.) FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF HKLM\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender\bdtbext FF Extension: bdToolbar - C:\Program Files\Bitdefender\Bitdefender\bdtbext [2014-01-10] FF HKLM-x32\...\Firefox\Extensions: [ffpwdman@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender\Antispam32\ffpwdman\ FF Extension: Bitdefender Wallet - C:\Program Files\Bitdefender\Bitdefender\Antispam32\ffpwdman\ [] FF HKLM-x32\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender\bdtbext FF Extension: bdToolbar - C:\Program Files\Bitdefender\Bitdefender\bdtbext [2014-01-10] Chrome: ======= CHR HomePage: chrome://newtab CHR RestoreOnStartup: "" CHR Extension: (Bitdefender Wallet) - C:\Users\Marko\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccahoghmggldkcdjiebjkidpfongdfbl [2014-01-11] CHR Extension: (ProxMate - Proxy on steroids!) - C:\Users\Marko\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifalmiidchkjjmkkbkoaibpmoeichmki [2014-03-18] CHR Extension: (Google Wallet) - C:\Users\Marko\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-27] CHR Extension: (UTAdRemovvAlApp) - C:\Users\Marko\AppData\Local\Google\Chrome\User Data\Default\Extensions\oljglngckgpciheaojbgflchkkonfnca [2014-01-30] CHR Extension: (DiegiCoooupon) - C:\ProgramData\noaichmhhoofokjondakcdllhbbaeelh [2013-12-31] CHR HKLM-x32\...\Chrome\Extension: [ccahoghmggldkcdjiebjkidpfongdfbl] - C:\Program Files\Bitdefender\Bitdefender\Antispam32\pmbxcr.crx [2014-01-10] CHR HKLM-x32\...\Chrome\Extension: [mkcedibhemacmilmkpndpkoidlnmgngg] - C:\Users\Marko\ChromeExtensions\mkcedibhemacmilmkpndpkoidlnmgngg\amazon.crx [2013-11-22] CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Services (Whitelisted) ================= R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-12-19] (Advanced Micro Devices, Inc.) S4 BdDesktopParental; C:\Program Files\Bitdefender\Bitdefender\bdparentalservice.exe [77632 2013-11-21] (Bitdefender) S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [49152 2014-01-08] () R2 MBAMScheduler; D:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; D:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 SafeBox; C:\Program Files\Bitdefender\Bitdefender SafeBox\safeboxservice.exe [94624 2013-07-08] (Bitdefender) R2 SymantecAntiBotAgent; D:\Programme\Nortin AntiBot\agent\Bin\NABAgent.exe [4909592 2007-11-12] (Symantec) R2 SymantecAntiBotWatcher; D:\Programme\Nortin AntiBot\agent\Bin\NABWatcher.exe [539160 2007-11-12] (Symantec) R2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender\updatesrv.exe [67320 2013-10-07] (Bitdefender) R2 VSSERV; C:\Program Files\Bitdefender\Bitdefender\vsserv.exe [1507248 2014-03-17] (Bitdefender) ==================== Drivers (Whitelisted) ==================== R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2012-12-28] () R0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [893440 2014-03-17] (BitDefender) R3 avchv; C:\Windows\System32\DRIVERS\avchv.sys [261056 2012-11-02] (BitDefender) R3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [635392 2014-03-17] (BitDefender) R1 BdfNdisf; c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [93600 2013-02-22] (BitDefender LLC) R1 bdfwfpf; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [103504 2011-11-14] (BitDefender LLC) S3 bdfwfpf_pc; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf_pc.sys [121928 2013-07-02] (Bitdefender SRL) S3 BDSandBox; C:\Windows\system32\drivers\bdsandbox.sys [82824 2013-11-04] (BitDefender SRL) R1 BDVEDISK; C:\Windows\System32\DRIVERS\bdvedisk.sys [76944 2012-04-17] (BitDefender) R0 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [150256 2013-08-23] (BitDefender LLC) R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2012-12-28] () R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] () R3 SymantecAntiBotDriver; D:\Programme\Nortin AntiBot\agent\driver\platform_VISTA\AntiBotDriver.sys [204824 2007-11-12] (Symantec Corporation. ) R3 SymantecAntiBotFilter; D:\Programme\Nortin AntiBot\agent\driver\platform_VISTA\AntiBotFilter.sys [35352 2007-11-12] (Symantec Corporation. ) R0 trufos; C:\Windows\System32\DRIVERS\trufos.sys [389240 2013-08-07] (BitDefender S.R.L.) S3 cpuz135; \??\C:\Users\Marko\AppData\Local\Temp\cpuz135\cpuz135_x64.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-03-18 00:35 - 2014-03-18 00:57 - 00016946 _____ () C:\Users\Marko\Downloads\FRST.txt 2014-03-18 00:35 - 2014-03-18 00:57 - 00000000 ____D () C:\FRST 2014-03-18 00:35 - 2014-03-18 00:36 - 00034127 _____ () C:\Users\Marko\Downloads\Addition.txt 2014-03-18 00:34 - 2014-03-18 00:35 - 02157056 _____ (Farbar) C:\Users\Marko\Downloads\FRST64.exe 2014-03-18 00:08 - 2014-03-18 00:08 - 00000000 ____D () C:\Windows\ERUNT 2014-03-18 00:07 - 2014-03-18 00:07 - 01037734 _____ (Thisisu) C:\Users\Marko\Downloads\JRT.exe 2014-03-18 00:05 - 2014-03-18 00:18 - 00000000 ____D () C:\AdwCleaner 2014-03-18 00:05 - 2014-03-18 00:05 - 01950720 _____ () C:\Users\Marko\Downloads\adwcleaner.exe 2014-03-18 00:04 - 2014-03-18 00:04 - 01950720 _____ () C:\Users\Marko\Downloads\adwcleaner_3.022.exe 2014-03-17 23:56 - 2014-03-17 23:56 - 00000000 ____D () C:\Users\Marko\AppData\Roaming\Symantec 2014-03-17 23:54 - 2014-03-17 23:54 - 00003162 _____ () C:\Windows\System32\Tasks\{C517FD8D-57C5-426A-9A52-F51498614E7F} 2014-03-17 23:53 - 2014-03-17 23:53 - 00000000 ____D () C:\ProgramData\Downloaded Installations 2014-03-17 23:52 - 2014-03-17 23:52 - 13725464 _____ () C:\Users\Marko\Downloads\Norton_AntiBot_setup_de.exe 2014-03-17 23:39 - 2014-03-17 23:39 - 00000000 ____D () C:\Users\Marko\AppData\Roaming\Malwarebytes 2014-03-17 23:38 - 2014-03-17 23:38 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Marko\Downloads\mbam-setup-1.75.0.1300.exe 2014-03-17 23:38 - 2014-03-17 23:38 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Marko\Downloads\mbam-setup-1.75.0.1300 (1).exe 2014-03-17 23:38 - 2014-03-17 23:38 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-03-17 23:38 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-03-17 23:10 - 2014-03-17 23:10 - 00000000 ____D () C:\Program Files (x86)\UTAdRemovvAlApp 2014-03-17 22:48 - 2014-03-18 00:51 - 00000445 _____ () C:\Windows\system32\checkdnsid.xml ==================== One Month Modified Files and Folders ======= 2014-03-18 00:57 - 2014-03-18 00:35 - 00016946 _____ () C:\Users\Marko\Downloads\FRST.txt 2014-03-18 00:57 - 2014-03-18 00:35 - 00000000 ____D () C:\FRST 2014-03-18 00:51 - 2014-03-17 22:48 - 00000445 _____ () C:\Windows\system32\checkdnsid.xml 2014-03-18 00:50 - 2012-10-19 21:21 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-03-18 00:49 - 2012-10-19 21:21 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-03-18 00:49 - 2012-10-19 21:21 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-03-18 00:49 - 2012-10-19 21:21 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-03-18 00:36 - 2014-03-18 00:35 - 00034127 _____ () C:\Users\Marko\Downloads\Addition.txt 2014-03-18 00:35 - 2014-03-18 00:34 - 02157056 _____ (Farbar) C:\Users\Marko\Downloads\FRST64.exe 2014-03-18 00:28 - 2012-10-19 20:54 - 01152645 _____ () C:\Windows\WindowsUpdate.log 2014-03-18 00:28 - 2009-07-14 05:45 - 00020624 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-03-18 00:28 - 2009-07-14 05:45 - 00020624 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-03-18 00:25 - 2013-10-27 15:14 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-03-18 00:21 - 2013-10-27 15:14 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-03-18 00:20 - 2012-10-19 21:08 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-03-18 00:20 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-03-18 00:20 - 2009-07-14 05:51 - 00132683 _____ () C:\Windows\setupact.log 2014-03-18 00:18 - 2014-03-18 00:05 - 00000000 ____D () C:\AdwCleaner 2014-03-18 00:13 - 2012-10-21 12:58 - 00243230 _____ () C:\Windows\PFRO.log 2014-03-18 00:12 - 2012-10-19 20:58 - 00000000 ___RD () C:\Users\Marko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-03-18 00:10 - 2013-12-31 04:17 - 00000000 ____D () C:\ProgramData\76875dc3edccf86 2014-03-18 00:08 - 2014-03-18 00:08 - 00000000 ____D () C:\Windows\ERUNT 2014-03-18 00:07 - 2014-03-18 00:07 - 01037734 _____ (Thisisu) C:\Users\Marko\Downloads\JRT.exe 2014-03-18 00:05 - 2014-03-18 00:05 - 01950720 _____ () C:\Users\Marko\Downloads\adwcleaner.exe 2014-03-18 00:04 - 2014-03-18 00:04 - 01950720 _____ () C:\Users\Marko\Downloads\adwcleaner_3.022.exe 2014-03-17 23:56 - 2014-03-17 23:56 - 00000000 ____D () C:\Users\Marko\AppData\Roaming\Symantec 2014-03-17 23:54 - 2014-03-17 23:54 - 00003162 _____ () C:\Windows\System32\Tasks\{C517FD8D-57C5-426A-9A52-F51498614E7F} 2014-03-17 23:53 - 2014-03-17 23:53 - 00000000 ____D () C:\ProgramData\Downloaded Installations 2014-03-17 23:52 - 2014-03-17 23:52 - 13725464 _____ () C:\Users\Marko\Downloads\Norton_AntiBot_setup_de.exe 2014-03-17 23:39 - 2014-03-17 23:39 - 00000000 ____D () C:\Users\Marko\AppData\Roaming\Malwarebytes 2014-03-17 23:38 - 2014-03-17 23:38 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Marko\Downloads\mbam-setup-1.75.0.1300.exe 2014-03-17 23:38 - 2014-03-17 23:38 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Marko\Downloads\mbam-setup-1.75.0.1300 (1).exe 2014-03-17 23:38 - 2014-03-17 23:38 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-03-17 23:32 - 2013-09-17 18:04 - 00000000 ____D () C:\Users\Marko\AppData\Roaming\DVDVideoSoft 2014-03-17 23:18 - 2014-01-30 23:16 - 00000000 ____D () C:\ProgramData\UTAdRemovvAlApp 2014-03-17 23:10 - 2014-03-17 23:10 - 00000000 ____D () C:\Program Files (x86)\UTAdRemovvAlApp 2014-03-17 23:04 - 2014-01-10 23:06 - 00893440 _____ (BitDefender) C:\Windows\system32\Drivers\avc3.sys 2014-03-17 23:03 - 2014-01-10 23:06 - 00635392 _____ (BitDefender) C:\Windows\system32\Drivers\avckf.sys 2014-03-17 22:55 - 2013-10-29 20:29 - 00000000 ____D () C:\Users\Marko\AppData\Local\Battle.net 2014-03-17 22:38 - 2013-09-13 10:39 - 00000163 _____ () C:\Users\Marko\AppData\Roaming\WB.CFG Some content of TEMP: ==================== C:\Users\Marko\AppData\Local\Temp\69774uninstall.exe C:\Users\Marko\AppData\Local\Temp\install_flash_player.exe C:\Users\Marko\AppData\Local\Temp\install_flash_player_ax.exe C:\Users\Marko\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe C:\Users\Marko\AppData\Local\Temp\ose00000.exe C:\Users\Marko\AppData\Local\Temp\ose00001.exe C:\Users\Marko\AppData\Local\Temp\Sqlite3.dll ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-01-31 07:37 ==================== End Of Log ============================ Wäre schön wenn mir irgendwer helfen könnte. einen schönen Abend noch lG Marko Achja und eine der Erweiterungen lässt sich nichteinmal deaktiviere, dahinter steht: "Durch Unternehmensrichtlinie installiert" |
| Themen zu DiegiCoooupon und UTAdRemovvAlApp - nicht löschbare Erweiterungen [Chrome] |
| administrator, adobe, appdatalow, bonjour, browser, chrome, defender, diegicoooupon, erweiterungen, explorer, firefox, firewall, flash player, google, internet, internet explorer, mozilla, preferences, problem, registrierungsdatenbank, registry, server, services.exe, software, svchost.exe, symantec, temp, unerwünschte werbung, unternehmensrichtlinie, utadremovvalapp, vista, werbung, windows, winlogon.exe |
![DiegiCoooupon und UTAdRemovvAlApp - nicht löschbare Erweiterungen [Chrome]](iconimages/plagegeister-aller-art-deren-bekaempfung/diegicoooupon-utadremovvalapp-loeschbare-erweiterungen-chrome_ltr.gif)
Baum-Darstellung