| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Wie entferne ich Yontoo?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
24.04.2014, 20:24
| #1 |
| |  Wie entferne ich Yontoo? Guten Abend, ich habe gerade unter msconfig > Systemkonfiguration > Systemstart das Systemstartelement Yontoo Desktop entdeckt. Mein Pc ist auffällig langsam, daher habe ich da mal nachgeschaut. Ich bräuchte Hilfe zum richtigen entfernen dieses Schädlings? Soll ich als erstes Informationen zusammenstellen wie hier beschrieben? Edit: Das "hier" bezieht sich auf http://www.trojaner-board.de/69886-a...-beachten.html LG Geändert von iNERD (24.04.2014 um 20:25 Uhr) Grund: Link |
|
24.04.2014, 20:40
| #2 |
| /// the machine /// TB-Ausbilder    |  Wie entferne ich Yontoo? hi,
__________________genau 
__________________ |
|
24.04.2014, 21:50
| #3 |
| | Wie entferne ich Yontoo? defogger_disable.txt
__________________Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 22:10 on 24/04/2014 (beasy)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-04-2014
Ran by beasy (administrator) on ENTERBRAINMENT on 24-04-2014 22:11:35
Running from C:\Users\beasy\Desktop\yantoo entfernen
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe
(Wacom Technology, Corp.) C:\Windows\system32\Wacom_Tablet.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKBap64.exe
(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GdBgInx64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\LGDevAgt.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
() C:\Program Files (x86)\RocketDock\RocketDock.exe
(Wacom Technology, Corp.) C:\Windows\system32\WTablet\Wacom_TabletUser.exe
(Spotify Ltd) C:\Users\beasy\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE
(Wacom Technology, Corp.) C:\Windows\system32\Wacom_Tablet.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\Applets\LCDClock.exe
(Samsung Electronics.) C:\Program Files (x86)\Samsung SSD Magician\Samsung Magician.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\Applets\LCDCountdown.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\Applets\LCDPop3.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\Applets\LCDMedia.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\Applets\LCDRSS.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\WMPSideShowGadget.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
() C:\Program Files (x86)\Everything\Everything.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
(AVM Berlin) C:\Users\beasy\AppData\Local\Apps\2.0\N16QM8YT.CZ7\V6RBX4PA.DWQ\frit..tion_1acae14e4778b8d2_0002.0003_6dcb4a48ddb2ee39\fritzbox-usb-fernanschluss.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
() C:\Program Files (x86)\Adobe\Adobe InDesign CS6\Utilities\adb.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Launch LgDeviceAgent] => C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe [415816 2010-08-03] (Logitech Inc.)
HKLM\...\Run: [Launch LCDMon] => C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe [2412616 2010-08-03] (Logitech Inc.)
HKLM\...\Run: [Launch LGDCore] => C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe [4725320 2010-08-03] (Logitech Inc.)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2782096 2010-07-26] (CANON INC.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [444904 2012-09-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [JMB36X IDE Setup] => C:\Windows\RaidTool\xInsIDE.exe [43608 2010-09-07] ()
HKLM-x32\...\Run: [TaskTray] => [X]
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-12-11] (Intel Corporation)
HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1724728 2013-12-19] (G Data Software AG)
HKLM-x32\...\Run: [G Data ASM] => C:\Program Files (x86)\G Data\InternetSecurity\DelayLoader\AutorunDelayLoader.exe [431224 2013-12-19] (G Data Software AG)
HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1316248 2010-12-02] (CANON INC.)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2013-03-21] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1075296 2013-04-25] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [402432 2010-07-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe [44128 2013-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [642664 2013-05-08] (Adobe Systems Inc.)
HKLM-x32\...\Run: [hpqSRMon] => C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\program files (x86)\g data\internetsecurity\avkkid\avkcks.exe,C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\Run: [RocketDock] => C:\Program Files (x86)\RocketDock\RocketDock.exe [495616 2007-09-02] ()
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\Run: [Spotify Web Helper] => C:\Users\beasy\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171968 2014-04-04] (Spotify Ltd)
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\Run: [Yontoo Desktop] => "C:\Users\beasy\AppData\Roaming\Yontoo\YontooDesktop.exe"
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\Run: [Wunderlist] => "C:\Program Files (x86)\Wunderlist2\Wunderlist.exe" /silent
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\Run: [Steam] => J:\Program Files (x86)\Steam\Steam.exe [1826496 2014-04-22] (Valve Corporation)
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\Run: [OfficeSyncProcess] => C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [720064 2013-04-22] (Microsoft Corporation)
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x91000000
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\MountPoints2: I - I:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\MountPoints2: {2d4df0ad-9247-11e2-b850-002354f5ab13} - H:\autorun.exe .\index.html
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\MountPoints2: {877163de-cb78-11e3-9721-002354f5ab13} - L:\LaunchU3.exe -a
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\MountPoints2: {accac8b5-e001-11e2-adf5-002354f5ab13} - I:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\MountPoints2: {eb8b64cb-9f6e-11e2-be54-002354f5ab13} - I:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\MountPoints2: {efc92dbc-af22-11e2-bb24-002354f5ab13} - L:\HTC_Sync_Manager_PC.exe
Startup: C:\Users\beasy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
Startup: C:\Users\beasy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Magician.lnk
ShortcutTarget: Samsung Magician.lnk -> C:\Program Files (x86)\Samsung SSD Magician\Samsung Magician.exe (Samsung Electronics.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xE0993C365726CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.msn.com/spbasic.htm
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.msn.com/spbasic.htm
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,CustomizeSearch = hxxp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,SearchURL = hxxp://home.microsoft.com/access/autosearch.asp?p=%s
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
SearchScopes: HKLM-x32 - {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.searchmainia.info/?unqvl=15&l=1&q={searchTerms}
SearchScopes: HKCU - DefaultScope {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.searchmainia.info/?unqvl=15&l=1&q={searchTerms}
SearchScopes: HKCU - {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = hxxp://int.search-results.com/web?q={SEARCHTERMS}&o=15527&l=dis&prt=NIS&chn=retail&geo=DE&ver=18
SearchScopes: HKCU - {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.searchmainia.info/?unqvl=15&l=1&q={searchTerms}
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: QTTabBar AutoLoader - {d2bf470e-ed1c-487f-a777-2bd8835eb6ce} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Evernote extension - {92EF2EAD-A7CE-4424-B0DB-499CF856608E} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: QTTabBar AutoLoader - {d2bf470e-ed1c-487f-a777-2bd8835eb6ce} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - QTTabBar - {d2bf470e-ed1c-487f-a333-2bd8835eb6ce} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM - QTTab Standard Buttons - {d2bf470e-ed1c-487f-a666-2bd8835eb6ce} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - QTTabBar - {d2bf470e-ed1c-487f-a333-2bd8835eb6ce} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - QTTab Standard Buttons - {d2bf470e-ed1c-487f-a666-2bd8835eb6ce} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\beasy\AppData\Roaming\Mozilla\Firefox\Profiles\9d18f66r.default-1370685285713
FF SearchEngineOrder.user_pref("browser.search.order.1", "");: user_pref("browser.search.order.1", "");
FF SearchEngineOrder.user_pref("browser.search.order.1,S", "");: user_pref("browser.search.order.1,S", "");
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.16bars.de/
FF Keyword.URL: user_pref("keyword.URL", "");
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_182.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin: adobe.com/AdobeExManDetect - C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\Win64Plugin\npAdobeExManDetectX64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_182.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin-x32: adobe.com/AdobeExManDetect - C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\npAdobeExManDetectX86.dll (Adobe Systems)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101799.dll (Amazon.com, Inc.)
FF Plugin HKCU: pokki.com/PokkiDownloadHelper - C:\Users\beasy\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll (Pokki)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ProxTube - Unblock YouTube - C:\Users\beasy\AppData\Roaming\Mozilla\Firefox\Profiles\9d18f66r.default-1370685285713\Extensions\{2541D29A-DB9E-4c1e-949A-31EFB4AEF4E7} [2013-12-06]
FF Extension: Firebug - C:\Users\beasy\AppData\Roaming\Mozilla\Firefox\Profiles\9d18f66r.default-1370685285713\Extensions\firebug@software.joehewitt.com.xpi [2013-06-15]
FF Extension: WhatFontis.com right-click shortcut - C:\Users\beasy\AppData\Roaming\Mozilla\Firefox\Profiles\9d18f66r.default-1370685285713\Extensions\webmaster@WhatFONTis.com.xpi [2013-12-11]
FF Extension: Pinterest Pin Button - C:\Users\beasy\AppData\Roaming\Mozilla\Firefox\Profiles\9d18f66r.default-1370685285713\Extensions\{677a8f98-fd64-40b0-a883-b8c95d0cbf17}.xpi [2013-09-27]
FF Extension: Adblock Plus - C:\Users\beasy\AppData\Roaming\Mozilla\Firefox\Profiles\9d18f66r.default-1370685285713\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-06-08]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-03-24]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-03-24]
Chrome:
=======
CHR HomePage: hxxp://websearch.searchmainia.info/?unqvl=15
CHR RestoreOnStartup: "hxxp://websearch.searchmainia.info/?unqvl=15"
CHR Extension: (BrowSoe2asaaveey) - C:\Users\beasy\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkkghgaeeoggfndcpipgabacadfdhpfk [2013-04-08]
==================== Services (Whitelisted) =================
R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2244728 2014-02-12] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe [2723400 2014-03-25] (G Data Software AG)
R3 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [2992760 2014-01-30] (G Data Software AG)
R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700024 2014-02-03] (G Data Software AG)
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [5268336 2014-03-25] (INCA Internet Co., Ltd.)
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [166912 2012-10-08] ()
R2 PMBDeviceInfoProvider; C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [483864 2013-04-24] (Sony Corporation)
R2 TabletServiceWacom; C:\Windows\system32\Wacom_Tablet.exe [3647272 2009-03-27] (Wacom Technology, Corp.)
==================== Drivers (Whitelisted) ====================
S3 AKAI_ACV0_MIDI; C:\Windows\System32\drivers\akaiacv0m.sys [55104 2012-07-12] (Ploytec GmbH)
S3 AKAI_ACV0_USB; C:\Windows\System32\Drivers\akaiacv0u.sys [426816 2012-07-12] (Ploytec GmbH)
S3 AKAI_ACV0_WDM; C:\Windows\System32\drivers\akaiacv0a.sys [50496 2012-07-12] (Numark)
R3 avmaura; C:\Windows\System32\DRIVERS\avmaura.sys [116480 2013-08-21] (AVM Berlin)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-03-22] (DT Soft Ltd)
R3 FFUsbAudio; C:\Windows\System32\DRIVERS\ffusbaudio.sys [51200 2010-03-05] (Focusrite Audio Engineering Ltd.)
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [57344 2014-04-06] (G Data Software AG)
R3 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt64.sys [22016 2014-04-06] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [135168 2014-04-06] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [68608 2014-04-06] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64000 2014-04-06] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [107128 2013-09-23] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [65024 2014-04-06] (G Data Software AG)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28216 2012-12-11] (Intel Corporation)
R3 mc2avs; C:\Windows\System32\Drivers\mc2avs.sys [358520 2012-06-06] (Native Instruments GmbH)
R3 mc2usb_svc; C:\Windows\System32\Drivers\mc2usb.sys [81016 2012-06-06] (Native Instruments GmbH)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
R3 NIWinCDEmu; C:\Windows\System32\DRIVERS\NIWinCDEmu.sys [112408 2014-02-01] ()
R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [114568 2013-03-21] (Renesas Electronics Corporation)
R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [230280 2013-03-21] (Renesas Electronics Corporation)
S3 V0260VID; C:\Windows\System32\DRIVERS\V0260Vid.sys [189664 2007-07-18] (Creative Technology Ltd.)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-24 22:11 - 2014-04-24 22:11 - 00000000 ____D () C:\FRST
2014-04-24 22:07 - 2014-04-24 22:07 - 00000168 _____ () C:\Users\beasy\defogger_reenable
2014-04-24 22:06 - 2014-04-24 22:11 - 00000000 ____D () C:\Users\beasy\Desktop\yantoo entfernen
2014-04-24 21:12 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-04-24 21:11 - 2014-04-24 21:12 - 00000000 ____D () C:\AdwCleaner
2014-04-24 12:57 - 2014-04-24 13:01 - 00000000 ____D () C:\Users\beasy\Desktop\instagram
2014-04-23 08:49 - 2014-04-24 20:47 - 00000000 ____D () C:\Users\beasy\AppData\Local\Pokki
2014-04-23 08:49 - 2014-04-23 08:49 - 02756424 _____ (Pokki) C:\Users\beasy\Downloads\PokkiInstaller.exe
2014-04-21 14:58 - 2014-04-21 14:58 - 00000000 ____D () C:\ProgramData\McAfee
2014-04-19 12:54 - 2014-04-19 12:54 - 00000656 _____ () C:\Users\beasy\Desktop\Design.lnk
2014-04-19 12:07 - 2014-04-19 12:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Evernote
2014-04-10 09:00 - 2014-03-31 03:16 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-10 09:00 - 2014-03-31 03:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-10 09:00 - 2014-03-31 02:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-10 09:00 - 2014-03-31 01:57 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-10 09:00 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-10 09:00 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-10 09:00 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-10 09:00 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-10 09:00 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-10 09:00 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-10 09:00 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-10 09:00 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-10 09:00 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-10 09:00 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-10 09:00 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-10 09:00 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-10 09:00 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-10 09:00 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-10 09:00 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-10 09:00 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-10 09:00 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-08 19:28 - 2014-04-08 19:28 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-04-08 19:28 - 2014-04-08 19:28 - 00000000 ____D () C:\Users\beasy\AppData\Local\Skype
2014-04-08 19:28 - 2014-04-08 19:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-04-06 18:29 - 2014-04-06 18:29 - 00022016 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBFlt64.sys
2014-04-06 18:29 - 2014-04-06 18:29 - 00001981 _____ () C:\Users\Public\Desktop\G Data InternetSecurity.lnk
2014-04-06 18:29 - 2014-04-06 18:29 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_GDKBFlt64_01007.Wdf
2014-04-06 18:29 - 2014-04-06 18:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity
2014-04-04 22:20 - 2014-04-04 22:20 - 00001952 _____ () C:\Users\Public\Desktop\CDBurnerXP.lnk
2014-04-04 10:44 - 2014-04-06 16:28 - 00000000 ____D () C:\Users\beasy\AppData\Roaming\Spotify
2014-04-04 10:44 - 2014-04-06 10:14 - 00000000 ____D () C:\Users\beasy\AppData\Local\Spotify
2014-04-04 10:44 - 2014-04-04 10:44 - 00001770 _____ () C:\Users\beasy\Desktop\Spotify.lnk
2014-04-04 10:44 - 2014-04-04 10:44 - 00001756 _____ () C:\Users\beasy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2014-03-30 21:21 - 2014-03-31 08:54 - 00000000 ____D () C:\Users\beasy\Desktop\gfx load
2014-03-30 17:30 - 2014-03-30 17:50 - 00000031 _____ () C:\Users\beasy\Desktop\basilikum.txt
2014-03-30 12:55 - 2014-03-30 12:55 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-28 23:10 - 2014-03-28 23:10 - 00000000 ____D () C:\Program Files\Common Files\INCA Shared
2014-03-28 23:10 - 2014-03-25 09:31 - 05268336 _____ (INCA Internet Co., Ltd.) C:\Windows\SysWOW64\GameMon.des
2014-03-28 23:08 - 2014-03-28 23:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Flyff
==================== One Month Modified Files and Folders =======
2014-04-24 22:11 - 2014-04-24 22:11 - 00000000 ____D () C:\FRST
2014-04-24 22:11 - 2014-04-24 22:06 - 00000000 ____D () C:\Users\beasy\Desktop\yantoo entfernen
2014-04-24 22:11 - 2013-03-22 13:31 - 00000000 ____D () C:\Users\beasy\Documents\Outlook-Dateien
2014-04-24 22:10 - 2013-03-21 18:44 - 02047500 _____ () C:\Windows\WindowsUpdate.log
2014-04-24 22:09 - 2013-04-07 15:16 - 00000000 ____D () C:\Users\beasy\Desktop\musik
2014-04-24 22:07 - 2014-04-24 22:07 - 00000168 _____ () C:\Users\beasy\defogger_reenable
2014-04-24 22:07 - 2013-03-21 18:44 - 00000000 ____D () C:\Users\beasy
2014-04-24 22:04 - 2013-03-22 00:16 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-24 21:12 - 2014-04-24 21:11 - 00000000 ____D () C:\AdwCleaner
2014-04-24 21:07 - 2013-03-22 00:20 - 00000000 ____D () C:\Users\beasy\AppData\Roaming\vlc
2014-04-24 20:47 - 2014-04-23 08:49 - 00000000 ____D () C:\Users\beasy\AppData\Local\Pokki
2014-04-24 20:44 - 2009-07-14 06:45 - 00014624 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-24 20:44 - 2009-07-14 06:45 - 00014624 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-24 20:40 - 2013-08-30 10:07 - 00000000 ____D () C:\Program Files (x86)\Everything
2014-04-24 20:39 - 2014-02-17 22:20 - 00002170 _____ () C:\Users\Public\Desktop\HP Photosmart Essential 3.5.lnk
2014-04-24 20:39 - 2013-08-21 17:40 - 01538728 _____ () C:\Windows\avmacc.log
2014-04-24 20:39 - 2009-07-14 04:34 - 00000513 _____ () C:\Windows\win.ini
2014-04-24 20:37 - 2013-03-24 19:12 - 00000000 ____D () C:\Users\beasy\AppData\Roaming\WTablet
2014-04-24 20:37 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-24 20:37 - 2009-07-14 06:51 - 00106079 _____ () C:\Windows\setupact.log
2014-04-24 20:33 - 2013-03-21 19:23 - 00155646 _____ () C:\Windows\DPINST.LOG
2014-04-24 20:14 - 2013-06-04 20:31 - 00001456 _____ () C:\Users\beasy\AppData\Local\Adobe Für Web speichern 12.0 Prefs
2014-04-24 18:26 - 2009-07-14 19:58 - 00703980 _____ () C:\Windows\system32\perfh007.dat
2014-04-24 18:26 - 2009-07-14 19:58 - 00151118 _____ () C:\Windows\system32\perfc007.dat
2014-04-24 18:26 - 2009-07-14 07:13 - 01632706 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-24 14:04 - 2013-03-27 20:32 - 00000000 ____D () C:\Program Files (x86)\JDownloader
2014-04-24 13:01 - 2014-04-24 12:57 - 00000000 ____D () C:\Users\beasy\Desktop\instagram
2014-04-24 08:31 - 2013-03-22 12:27 - 00000000 ____D () C:\Users\beasy\AppData\Local\Adobe
2014-04-23 08:49 - 2014-04-23 08:49 - 02756424 _____ (Pokki) C:\Users\beasy\Downloads\PokkiInstaller.exe
2014-04-21 16:23 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-21 14:58 - 2014-04-21 14:58 - 00000000 ____D () C:\ProgramData\McAfee
2014-04-21 14:58 - 2013-03-22 00:16 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-21 14:58 - 2013-03-22 00:16 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-21 14:58 - 2013-03-22 00:16 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-19 12:54 - 2014-04-19 12:54 - 00000656 _____ () C:\Users\beasy\Desktop\Design.lnk
2014-04-19 12:07 - 2014-04-19 12:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Evernote
2014-04-16 20:47 - 2014-01-09 16:49 - 00000132 _____ () C:\Users\beasy\AppData\Roaming\Adobe BMP Format CS5 Prefs
2014-04-16 20:44 - 2013-03-21 19:19 - 00167320 _____ () C:\Users\beasy\AppData\Local\GDIPFONTCACHEV1.DAT
2014-04-16 20:44 - 2009-07-14 06:45 - 11710880 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-04-16 20:11 - 2013-04-04 23:36 - 00000000 ____D () C:\Windows\pss
2014-04-16 20:11 - 2013-03-21 18:44 - 00000000 ___RD () C:\Users\beasy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-13 13:38 - 2013-10-11 08:36 - 00000000 ____D () C:\WTablet
2014-04-12 12:13 - 2014-02-01 00:37 - 00014324 _____ () C:\Users\beasy\Maschine2.log
2014-04-12 12:12 - 2014-02-01 00:37 - 00000968 _____ () C:\Users\beasy\ScanApp.log
2014-04-11 17:05 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-10 13:46 - 2013-03-22 00:14 - 00000000 ____D () C:\Program Files (x86)\Heroes of Newerth
2014-04-10 10:05 - 2013-03-22 00:23 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-10 10:04 - 2013-08-14 22:46 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-10 10:03 - 2013-03-28 12:34 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-09 08:53 - 2014-02-01 12:15 - 00000000 ____D () C:\Users\beasy\AppData\Roaming\Audacity
2014-04-08 20:07 - 2013-03-23 18:56 - 00000000 ____D () C:\Users\beasy\AppData\Roaming\Skype
2014-04-08 19:28 - 2014-04-08 19:28 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-04-08 19:28 - 2014-04-08 19:28 - 00000000 ____D () C:\Users\beasy\AppData\Local\Skype
2014-04-08 19:28 - 2014-04-08 19:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-04-08 19:28 - 2013-03-23 18:56 - 00000000 ____D () C:\ProgramData\Skype
2014-04-08 18:08 - 2013-03-22 00:18 - 00000000 ____D () C:\Users\beasy\AppData\Roaming\Adobe
2014-04-06 22:01 - 2013-03-21 19:11 - 01106986 _____ () C:\Windows\PFRO.log
2014-04-06 18:29 - 2014-04-06 18:29 - 00022016 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBFlt64.sys
2014-04-06 18:29 - 2014-04-06 18:29 - 00001981 _____ () C:\Users\Public\Desktop\G Data InternetSecurity.lnk
2014-04-06 18:29 - 2014-04-06 18:29 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_GDKBFlt64_01007.Wdf
2014-04-06 18:29 - 2014-04-06 18:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity
2014-04-06 18:29 - 2013-09-23 14:05 - 00135168 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys
2014-04-06 18:29 - 2013-09-23 14:05 - 00068608 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys
2014-04-06 18:29 - 2013-09-23 14:05 - 00065024 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys
2014-04-06 18:29 - 2013-09-23 14:05 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd64.sys
2014-04-06 18:29 - 2013-09-23 14:05 - 00057344 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys
2014-04-06 18:29 - 2013-09-23 13:52 - 00000000 ____D () C:\ProgramData\G Data
2014-04-06 16:28 - 2014-04-04 10:44 - 00000000 ____D () C:\Users\beasy\AppData\Roaming\Spotify
2014-04-06 10:14 - 2014-04-04 10:44 - 00000000 ____D () C:\Users\beasy\AppData\Local\Spotify
2014-04-06 10:13 - 2013-05-21 15:29 - 00000000 ____D () C:\Program Files (x86)\CDBurnerXP
2014-04-04 22:20 - 2014-04-04 22:20 - 00001952 _____ () C:\Users\Public\Desktop\CDBurnerXP.lnk
2014-04-04 22:20 - 2013-05-21 15:29 - 00001902 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2014-04-04 10:44 - 2014-04-04 10:44 - 00001770 _____ () C:\Users\beasy\Desktop\Spotify.lnk
2014-04-04 10:44 - 2014-04-04 10:44 - 00001756 _____ () C:\Users\beasy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2014-04-04 09:38 - 2013-03-22 00:34 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-03-31 08:54 - 2014-03-30 21:21 - 00000000 ____D () C:\Users\beasy\Desktop\gfx load
2014-03-31 03:16 - 2014-04-10 09:00 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-31 03:13 - 2014-04-10 09:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-31 02:13 - 2014-04-10 09:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-31 01:57 - 2014-04-10 09:00 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-30 17:50 - 2014-03-30 17:30 - 00000031 _____ () C:\Users\beasy\Desktop\basilikum.txt
2014-03-30 17:07 - 2013-03-21 19:13 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-03-30 12:55 - 2014-03-30 12:55 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-28 23:10 - 2014-03-28 23:10 - 00000000 ____D () C:\Program Files\Common Files\INCA Shared
2014-03-28 23:08 - 2014-03-28 23:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Flyff
2014-03-28 21:26 - 2013-03-23 18:04 - 00111595 _____ () C:\Windows\DirectX.log
2014-03-28 21:13 - 2013-10-31 14:11 - 00000000 ____D () C:\Users\beasy\Desktop\Notizen
2014-03-28 20:49 - 2013-05-14 06:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2014-03-28 20:47 - 2014-01-24 16:17 - 00000000 ____D () C:\ProgramData\Package Cache
2014-03-28 20:33 - 2013-11-23 12:09 - 00000000 ____D () C:\Users\beasy\AppData\Local\Battle.net
2014-03-28 20:32 - 2013-04-28 12:44 - 00000000 ____D () C:\Windows\Minidump
2014-03-28 20:31 - 2013-03-21 18:39 - 00346661 ____N () C:\Windows\Minidump\032814-25053-01.dmp
2014-03-28 20:00 - 2014-03-03 09:40 - 00000000 ____D () C:\Users\beasy\Desktop\inspiration
2014-03-28 19:38 - 2013-04-19 02:07 - 00000000 ____D () C:\Users\beasy\AppData\Local\Deployment
2014-03-25 09:31 - 2014-03-28 23:10 - 05268336 _____ (INCA Internet Co., Ltd.) C:\Windows\SysWOW64\GameMon.des
Some content of TEMP:
====================
C:\Users\beasy\AppData\Local\Temp\bitool.dll
C:\Users\beasy\AppData\Local\Temp\CheckLang.dll
C:\Users\beasy\AppData\Local\Temp\drm_dyndata_7400006.dll
C:\Users\beasy\AppData\Local\Temp\dsp_ipp.dll
C:\Users\beasy\AppData\Local\Temp\FastDownload.exe
C:\Users\beasy\AppData\Local\Temp\HPInstaller.exe
C:\Users\beasy\AppData\Local\Temp\installapi.exe
C:\Users\beasy\AppData\Local\Temp\InstallAX.exe
C:\Users\beasy\AppData\Local\Temp\InstallPlugin.exe
C:\Users\beasy\AppData\Local\Temp\MSETUP4.EXE
C:\Users\beasy\AppData\Local\Temp\ose00000.exe
C:\Users\beasy\AppData\Local\Temp\PlaySound.dll
C:\Users\beasy\AppData\Local\Temp\RunApp.dll
C:\Users\beasy\AppData\Local\Temp\SkypeSetup.exe
C:\Users\beasy\AppData\Local\Temp\vlc-2.0.6-win32.exe
C:\Users\beasy\AppData\Local\Temp\vlc-2.0.7-win32.exe
C:\Users\beasy\AppData\Local\Temp\vlc-2.0.8-win32.exe
C:\Users\beasy\AppData\Local\Temp\vlc-2.1.1-win32.exe
C:\Users\beasy\AppData\Local\Temp\vlc-2.1.2-win32.exe
C:\Users\beasy\AppData\Local\Temp\vlc-2.1.3-win32.exe
C:\Users\beasy\AppData\Local\Temp\Wunderlist-Setup2.3.0.31.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-04-19 12:24
==================== End Of Log ============================
--- --- --- --- --- --- --- --- --- Additions.txt Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-04-2014
Ran by beasy at 2014-04-24 22:12:02
Running from C:\Users\beasy\Desktop\yantoo entfernen
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: G Data InternetSecurity (Enabled - Up to date) {545C8713-0744-B079-87F8-349A6D5C8CF0}
AS: G Data InternetSecurity (Enabled - Up to date) {EF3D66F7-217E-BFF7-BD48-0FE816DBC64D}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: G Data Personal Firewall (Enabled) {6C670636-4D2B-B121-ACA7-9DAF938FCB8B}
==================== Installed Programs ======================
64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
Adobe Acrobat 9 Pro - English, Français, Deutsch (HKLM-x32\...\{AC76BA86-1033-F400-7760-000000000004}{AC76BA86-1033-F400-7760-000000000004}) (Version: 9.5.5 - Adobe Systems)
Adobe Acrobat 9 Pro - English, Français, Deutsch (x32 Version: 9.5.5 - Adobe Systems) Hidden
Adobe Acrobat 9.5.5 - CPSID_83708 (HKLM-x32\...\{AC76BA86-1033-F400-7760-000000000004}_955) (Version: - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.3.0.3670 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.3.0.3670 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.182 - Adobe Systems Incorporated)
Adobe Help Manager (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 4.0.244 - Adobe Systems Incorporated)
Adobe Help Manager (x32 Version: 4.0.244 - Adobe Systems Incorporated) Hidden
Adobe Media Player (HKLM-x32\...\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.8 - Adobe Systems Incorporated)
Adobe Media Player (x32 Version: 1.8 - Adobe Systems Incorporated) Hidden
Adobe® Content Viewer (HKLM-x32\...\com.adobe.dmp.contentviewer) (Version: 3.0.0 - Adobe Systems Incorporated)
Adobe® Content Viewer (x32 Version: 3.0.0 - Adobe Systems Incorporated) Hidden
Advanced Archive Password Recovery (HKLM-x32\...\{01011662-76A8-41E8-B1A8-4F8821570AC5}) (Version: 4.54.48.1338 - Elcomsoft Co. Ltd.)
AIO_CDA_ProductContext (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden
AIO_CDA_Software (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden
AIO_Scan (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden
Akai THE 809 (HKLM-x32\...\Akai The809_is1) (Version: - )
Akai THE BANK (HKLM-x32\...\Akai TheBANK_is1) (Version: - )
Akai THE NOISE (HKLM-x32\...\Akai TheNoise_is1) (Version: - )
Akai THE WUB (HKLM-x32\...\Akai TheWub_is1) (Version: - )
Amazon MP3-Downloader 1.0.17 (HKLM-x32\...\Amazon MP3-Downloader) (Version: 1.0.17 - Amazon Services LLC)
AMD Accelerated Video Transcoding (Version: 12.5.100.21219 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.1084.4 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{1701BD02-09B9-B25B-8290-C7D6A33C5A75}) (Version: 8.0.903.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Media Foundation Decoders (Version: 1.0.71219.1540 - Advanced Micro Devices, Inc.) Hidden
Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ASIO4ALL (HKLM-x32\...\ASIO4ALL) (Version: 2.10 - Michael Tippach)
Audacity 2.0.5 (HKLM-x32\...\Audacity_is1) (Version: 2.0.5 - Audacity Team)
AudibleManager (HKLM-x32\...\AudibleManager) (Version: 1999977726.48.56.37426554 - Audible, Inc.)
AudioShell 1.3.5 (HKLM-x32\...\AudioShell_is1) (Version: 1.3.5 - Softpointer Inc)
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
BitNami WordPress-Modul (HKLM-x32\...\BitNami WordPress-Modul 3.8-0) (Version: 3.8-0 - BitNami)
bl (x32 Version: 1.0.0 - Your Company Name) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
BufferChm (x32 Version: 130.0.331.000 - Hewlett-Packard) Hidden
Canon Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version: - )
Canon iX6500 series Benutzerregistrierung (HKLM-x32\...\Canon iX6500 series Benutzerregistrierung) (Version: - )
Canon iX6500 series Printer Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iX6500_series) (Version: - Canon Inc.)
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: - )
Canon Solution Menu EX (HKLM-x32\...\CanonSolutionMenuEX) (Version: - )
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center (x32 Version: 2012.1219.1521.27485 - Ihr Firmenname) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.3.4643 - CDBurnerXP)
CDex - Open Source Digital Audio CD Extractor (HKLM-x32\...\CDex) (Version: 1.70.4.2009 - Georgy Berdyshev)
Copy (x32 Version: 130.0.428.000 - Hewlett-Packard) Hidden
Counter-Strike (HKLM-x32\...\Steam App 10) (Version: - Valve)
Creative Live! Cam Vista IM Driver (1.11.02.00) (HKLM\...\Creative VF0260) (Version: - )
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.47.1.0333 - Disc Soft Ltd)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{5971CA1F-6BDE-498F-952C-9F2BF94070A4}) (Version: - Microsoft)
Destinations (x32 Version: 130.0.0.0 - Hewlett-Packard) Hidden
DeviceDiscovery (x32 Version: 130.0.465.000 - Hewlett-Packard) Hidden
Diablo III (HKLM-x32\...\Diablo III) (Version: - Blizzard Entertainment)
discoDSP Discovery Pro (HKLM-x32\...\DDDP_is1) (Version: 3 - discoDSP)
DocProc (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
Dota 2 (HKLM-x32\...\Steam App 570) (Version: - Valve )
Driver Genius Professional Edition (HKLM-x32\...\Driver Genius Professional Edition_is1) (Version: 10.0 - Driver-Soft Inc.)
eLicenser Control (HKLM-x32\...\eLicenser Control) (Version: - Steinberg Media Technologies GmbH)
Evernote v. 5.3.1 (HKLM-x32\...\{28AAF752-C41B-11E3-8CB0-00163E98E7D6}) (Version: 5.3.1.3363 - Evernote Corp.)
Everything 1.2.1.371 (HKLM-x32\...\Everything) (Version: - )
Exact Audio Copy 1.0beta3 (HKLM-x32\...\Exact Audio Copy) (Version: 1.0beta3 - Andre Wiethoff)
FabFilter Pro-C VST RTAS v1.1.2 (HKLM-x32\...\FabFilter Pro-C VST RTAS_is1) (Version: - )
FabFilter Volcano VST RTAS v2.03 (HKLM-x32\...\FabFilter Volcano VST RTAS_is1) (Version: - TEAM AiR)
Fax (x32 Version: 130.0.418.000 - Hewlett-Packard) Hidden
FileZilla Client 3.7.4.1 (HKLM-x32\...\FileZilla Client) (Version: 3.7.4.1 - Tim Kosse)
FlowStone FL 3.0 (HKLM-x32\...\FlowStone) (Version: - )
Flyff (HKLM-x32\...\{7E210E1C-52A1-40E3-817B-D504E9F64DFA}_is1) (Version: Flyff - Gala Networks Europe Limited)
Focusrite USB 2.0 Audio Driver 2.2 (HKLM\...\Focusrite USB 2.0 Audio Driver_is1) (Version: 2.2 - Focusrite Audio Engineering Limited.)
Focusrite USB Audio Driver 1.8 (HKLM\...\Focusrite USB Audio Driver_is1) (Version: 1.8 - Focusrite Audio Engineering Ltd.)
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
FRITZ!Box USB-Fernanschluss (HKCU\...\2db37667170956ee) (Version: 2.3.2.0 - AVM Berlin)
G Data InternetSecurity (HKLM-x32\...\{85203592-3610-4FB9-AA11-15B2255B5A12}) (Version: 25.0.1.2 - G Data Software AG)
GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment)
Heroes of Newerth (HKLM-x32\...\hon) (Version: 2.3.0 - S2 Games)
HP Customer Participation Program 13.0 (HKLM\...\HPExtendedCapabilities) (Version: 13.0 - HP)
HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)
HP Photosmart All-In-One Driver Software 13.0 Rel. A (HKLM\...\{17016DA1-F040-4032-BD36-34DD317BC9D5}) (Version: 13.0 - HP)
HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP)
HP Smart Web Printing 4.51 (HKLM\...\HP Smart Web Printing) (Version: 4.51 - HP)
HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HP Update (HKLM-x32\...\{97486FBE-A3FC-4783-8D55-EA37E9D171CC}) (Version: 5.005.000.001 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0000 - Microsoft) Hidden
HPPhotoGadget (x32 Version: 130.0.282.000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabelContent1 (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotosmartEssential (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
HPSSupply (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
IcoFX 1.6.4 (HKLM-x32\...\IcoFX_is1) (Version: - )
IL Download Manager (HKLM-x32\...\IL Download Manager) (Version: - Image-Line)
IL Shared Libraries (HKLM-x32\...\IL Shared Libraries) (Version: - Image-Line)
Image Data Converter (HKLM-x32\...\{87998E4E-6D9C-411B-AAE9-B8523FFE357D}) (Version: 4.2.02.10112 - Sony Corporation)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1010 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.7.1.1001 - Intel Corporation)
IPTInstaller (HKLM-x32\...\{6965F2F4-1CD2-4F42-A8EF-9EF433F9AA72}) (Version: 4.0.4 - HTC)
iTunes (HKLM\...\{B8BA155B-1E75-405F-9CB4-8A99615D09DC}) (Version: 11.1.5.5 - Apple Inc.)
iZotope Trash (HKLM-x32\...\iZotope Trash_is1) (Version: 1.05 - iZotope, Inc.)
JDownloader 0.9 (HKLM-x32\...\5513-1208-7298-9440) (Version: 0.9 - AppWork GmbH)
JMicron JMB36X Driver (HKLM-x32\...\{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}) (Version: 1.17.65.11 - JMicron Technology Corp.)
K-Lite Mega Codec Pack 10.0.5 (HKLM-x32\...\KLiteCodecPack_is1) (Version: 10.0.5 - )
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version: - )
Logitech GamePanel Software 3.06.109 (HKLM\...\{A1E85B9A-AFAD-4D38-AF01-6B020DD5213A}) (Version: 3.06.109 - Logitech Inc.)
MarketResearch (x32 Version: 130.0.374.000 - Hewlett-Packard) Hidden
Marvel Heroes (HKLM-x32\...\Steam App 226320) (Version: - )
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Games for Windows - LIVE (HKLM-x32\...\{4D243BA7-9AC4-46D1-90E5-EEB88974F501}) (Version: 2.0.687.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{05B49229-22A2-4F88-842A-BBC2EBE1CCF6}) (Version: 2.0.687.0 - Microsoft Corporation)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-0081-0407-0000-0000000FF1CE}) (Version: 14.0.6123.5001 - Microsoft Corporation)
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit (HKLM-x32\...\{95140000-007D-0409-0000-0000000FF1CE}) (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft_VC80_ATL_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_ATL_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_CRT_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFC_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFCLOC_x86_x64 (Version: 80.50727.4053 - Adobe) Hidden
Microsoft_VC90_ATL_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_ATL_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_CRT_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFC_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFC_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
MixMeister BPM Analyzer 1.0 (HKLM-x32\...\MixMeister BPM Analyzer_is1) (Version: - MixMeister Technology LLC)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 28.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
MPC 1.0.0 (HKLM-x32\...\MPC_is1) (Version: 1.0.0 - Akai Professional)
MPC 1.6.0 (HKLM\...\com.akaipro.mpc.standard_is1) (Version: 1.6.0 - Akai Professional)
MPC Factory Content 1.0.0 (HKLM-x32\...\MPC Factory Content_is1) (Version: 1.0.0 - Akai Professional)
MPC Renaissance driver (HKLM\...\USB_AUDIO_DEusb-audio.deAkaiACV0) (Version: - )
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Native Instruments Absynth v3.0 (HKLM-x32\...\Native Instruments Absynth v3.0) (Version: - )
Native Instruments B4 Tone Wheels Bundle v1.11 (HKLM-x32\...\Native Instruments B4 Tone Wheels Bundle v1.11) (Version: - )
Native Instruments Controller Editor (Version: 1.6.2.1863 - Native Instruments) Hidden
Native Instruments FM7 (HKLM-x32\...\Native Instruments FM7) (Version: - )
Native Instruments FM7 Presets Addon 1 (HKLM-x32\...\Native Instruments FM7 Presets Addon 1) (Version: - )
Native Instruments Komplete Selection (Version: 1.0.4.1 - Native Instruments) Hidden
Native Instruments Kontakt 5 (Version: 5.3.0.6464 - Native Instruments) Hidden
Native Instruments Kontakt Factory Selection (Version: 1.2.0.004 - Native Instruments) Hidden
Native Instruments Maschine 2 (Version: 2.0.6.1083 - Native Instruments) Hidden
Native Instruments Maschine 2 Factory Library (Version: 1.1.0.7 - Native Instruments) Hidden
Native Instruments Maschine Controller Driver (Version: 3.0.1.648 - Native Instruments) Hidden
Native Instruments Maschine Controller MK2 Driver (Version: 3.0.4.719 - Native Instruments) Hidden
Native Instruments Maschine Mikro Driver (Version: 3.0.2.664 - Native Instruments) Hidden
Native Instruments Maschine Mikro MK2 Driver (Version: 3.0.4.719 - Native Instruments) Hidden
Native Instruments Maschine Studio Driver (Version: 3.1.2.796 - Native Instruments) Hidden
Native Instruments Massive (Version: 1.4.0.292 - Native Instruments) Hidden
Native Instruments Reaktor 5 (Version: 5.9.0.725 - Native Instruments) Hidden
Native Instruments Service Center (Version: 2.5.2.1549 - Native Instruments) Hidden
Native Instruments Solid Bus Comp FX (Version: 1.1.1.427 - Native Instruments) Hidden
Network64 (Version: 130.0.572.000 - Hewlett-Packard) Hidden
Network64 (Version: 140.0.221.000 - Hewlett-Packard) Hidden
Nur Entfernen der CopyTrans Suite möglich (HKCU\...\CopyTrans Suite) (Version: 2.37 - WindSolutions)
OCR Software by I.R.I.S. 13.0 (HKLM\...\HPOCR) (Version: 13.0 - HP)
Opera 12.16 (HKLM-x32\...\Opera 12.16.1860) (Version: 12.16.1860 - Opera Software ASA)
Opera Stable 20.0.1387.91 (HKLM-x32\...\Opera 20.0.1387.91) (Version: 20.0.1387.91 - Opera Software ASA)
PageExpress A3 USB 2400 Pro V1.0 (HKLM-x32\...\InstallShield_{FF484104-ECC5-499C-9B12-D0F8178A16A5}) (Version: 1.2 - Ihr Firmenname)
PageExpress A3 USB 2400 Pro V1.0 (x32 Version: 1.2 - Ihr Firmenname) Hidden
PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
PDF Settings CS6 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
ph (x32 Version: 1.0.0 - Your Company Name) Hidden
Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
PlayMemories Home (HKLM-x32\...\{0657DE52-8F5C-4073-B70C-ED4F3F7FA076}) (Version: 7.0.03.04240 - Sony Corporation)
Pokki Download Helper (HKCU\...\PokkiDownloadHelper) (Version: 1.3.1.282 - Pokki)
QTTabBar 1.5.0.0 Beta 2 (HKLM-x32\...\{7EDF4F60-E41A-4D55-8400-A633443C0065}) (Version: 1.5.260 - Quizo and Paul Accisano)
reFX Vanguard VSTi RTAS v1.8.0 (HKLM-x32\...\reFX Vanguard_is1) (Version: - )
Rename-It! (HKLM-x32\...\Rename-It!) (Version: 3.32 - Beroux)
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{17528CE4-C333-48FB-A9E4-D841E795CDCE}) (Version: 3.0.23.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.1.39.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.39.0 - Renesas Electronics Corporation) Hidden
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 3.0.23.0 - Renesas Electronics Corporation) Hidden
RESIDENT EVIL 5 (HKLM-x32\...\{AC08BBA0-96B9-431A-A7D0-D8598E493775}) (Version: 1.0.0.129 - CAPCOM CO., LTD.)
RocketDock 1.3.5 (HKLM-x32\...\RocketDock_is1) (Version: - Punk Software)
Samsung Magician (HKLM-x32\...\{29AE3F9F-7158-4ca7-B1ED-28A73ECDB215}_is1) (Version: 4.3.0 - Samsung Electronics)
Scan (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) Hidden
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 13.0 - HP)
Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
SmartWebPrinting (x32 Version: 130.0.457.000 - Hewlett-Packard) Hidden
SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
SolveigMM AVI Trimmer (HKLM-x32\...\SolveigMM AVI Trimmer 2.1.1307.29) (Version: 2.1.1307.29 - Solveig Multimedia)
Sony RAW Driver (HKLM-x32\...\{166FCF01-AC98-4288-A01C-90BEB808C059}) (Version: 2.0.00.08130 - Sony Corporation)
Spotify (HKCU\...\Spotify) (Version: 0.9.7.16.g4b197456 - Spotify AB)
Status (x32 Version: 130.0.469.000 - Hewlett-Packard) Hidden
Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation)
TeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.17396 - TeamViewer)
Toolbox (x32 Version: 130.0.648.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 130.0.422.000 - Hewlett-Packard) Hidden
Trilogy (HKLM-x32\...\Trilogy_is1) (Version: - Spectrasonics, Inc.)
UnloadSupport (x32 Version: 11.0.0 - Hewlett-Packard) Hidden
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2837594) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{D3C85176-ACCC-4AF0-817D-1BC803303B74}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2837594) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{D3C85176-ACCC-4AF0-817D-1BC803303B74}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817396) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{39767ECA-1731-45DB-AB5B-6BF40E151D66}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{BA610006-2C39-4419-9834-CF61AB24810A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUS_{C70D2038-A2C4-4A99-87DE-5272BB44F0CE}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUS_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2863818) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUS_{83B1B530-7D9E-4C6A-907F-E979CEE9C295}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2878225) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{EFF5EBA3-40AD-4859-85E7-3C1CF4F297EB}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUS_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{2BA40F82-F3A4-441C-BF1A-ED4C42FF4872}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUS_{40EC8FB1-5202-469D-9232-C28FB1C6FC64}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft)
Update for Microsoft Visio 2010 (KB2553444) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{799005D3-9B70-4219-AFE0-BC479614CC4D}) (Version: - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{8C55AA83-54C2-4236-A622-78440A411DC5}) (Version: - Microsoft)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
Wacom Tablett (HKLM-x32\...\Wacom Tablet Driver) (Version: - Wacom Technology Corp.)
WaveLab LE 7 (HKLM-x32\...\WaveLabLE7) (Version: 7.0.1.506 - Steinberg)
WebReg (x32 Version: 130.0.132.017 - Hewlett-Packard) Hidden
Windows Live Communications Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows-Treiberpaket - Focusrite USB 2.0 Audio Driver (09/22/2011 2.2.0.0) (HKLM\...\54CB6483AA6621FEF67643C55EC698A0CF71605E) (Version: 09/22/2011 2.2.0.0 - Focusrite)
WinRAR 4.20 (64-bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
Wunderlist (HKCU\...\f4d33ae8dc11fa61) (Version: 2.0.6.13 - 6 Wunderkinder GmbH)
XAMPP (HKLM-x32\...\xampp) (Version: 1.8.2-3 - BitNami)
YTD Video Downloader 4.6 (HKLM-x32\...\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}) (Version: 4.6 - GreenTree Applications SRL)
==================== Restore Points =========================
28-03-2014 18:47:29 Wunderlist
28-03-2014 19:26:06 DirectX wurde installiert
08-04-2014 07:47:11 Installed Evernote v. 5.3
10-04-2014 08:02:57 Windows Update
19-04-2014 09:28:08 Installed Evernote v. 5.3.1
==================== Hosts content: ==========================
2009-07-14 04:34 - 2013-04-26 13:29 - 00000924 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 activate.adobe.com
127.0.0.1 lmlicenses.wip4.adobe.com
127.0.0.1 lm.licenses.adobe.com
==================== Scheduled Tasks (whitelisted) =============
Task: {1A4F88CA-10F8-4376-95B1-B6C160D5B297} - System32\Tasks\AdobeAAMUpdater-1.0-Enterbrainment-beasy => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-09-20] (Adobe Systems Incorporated)
Task: {20605257-9E2A-47F2-BDD4-1B0C6E2BEE49} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {DC6CDEDC-5114-4049-B72C-F6B115DBCBA0} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-21] (Adobe Systems Incorporated)
Task: {F25238D2-8078-496C-9534-B0BBBCF1E8C4} - System32\Tasks\Microsoft\Windows\TabletPC\InputPersonalization => C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe [2009-07-14] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2012-10-08 17:04 - 2012-10-08 17:04 - 00166912 _____ () C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
2013-12-19 04:42 - 2013-12-19 04:42 - 00350840 ____N () C:\Program Files (x86)\Common Files\G Data\AVKProxy\PktIcpt2x64.dll
2013-09-05 01:17 - 2013-09-05 01:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2010-01-02 16:42 - 2010-01-02 16:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2011-04-23 01:54 - 2011-04-23 01:54 - 00083968 _____ () C:\Program Files (x86)\QTTabBar\QTHookLib64.dll
2013-03-22 00:16 - 2007-09-02 14:58 - 00495616 _____ () C:\Program Files (x86)\RocketDock\RocketDock.exe
2009-03-13 03:18 - 2009-03-13 03:18 - 00602624 _____ () C:\Program Files (x86)\Everything\Everything.exe
2013-01-29 17:11 - 2013-01-29 17:11 - 00410942 _____ () C:\Program Files (x86)\Adobe\Adobe InDesign CS6\Utilities\adb.exe
2014-01-20 14:17 - 2014-01-20 14:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-01-20 14:16 - 2014-01-20 14:16 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2013-03-22 00:16 - 2007-09-02 14:57 - 00069632 _____ () C:\Program Files (x86)\RocketDock\RocketDock.dll
2014-04-14 14:17 - 2014-04-14 14:17 - 00433664 _____ () C:\Program Files (x86)\Evernote\Evernote\libxml2.dll
2014-04-14 14:17 - 2014-04-14 14:17 - 00315392 _____ () C:\Program Files (x86)\Evernote\Evernote\libtidy.dll
2013-12-09 17:18 - 2013-11-28 13:14 - 00013824 _____ () C:\Program Files (x86)\Samsung SSD Magician\SAMSUNG_SSD.dll
2013-12-09 17:18 - 2013-11-28 19:59 - 00098816 _____ () C:\Program Files (x86)\Samsung SSD Magician\PAL.dll
2013-12-09 17:18 - 2013-11-28 19:59 - 00034304 _____ () C:\Program Files (x86)\Samsung SSD Magician\SATA.dll
2013-12-09 17:18 - 2013-11-28 19:59 - 00032768 _____ () C:\Program Files (x86)\Samsung SSD Magician\SAT.dll
2013-12-09 17:18 - 2013-11-28 20:00 - 00031232 _____ () C:\Program Files (x86)\Samsung SSD Magician\SMINI.dll
2013-12-09 17:18 - 2013-11-28 19:59 - 00029696 _____ () C:\Program Files (x86)\Samsung SSD Magician\SAS.dll
2013-05-21 15:10 - 2009-02-27 17:39 - 00019968 _____ () C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.deu
2013-05-21 15:10 - 2009-02-27 17:32 - 00020480 _____ () C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\AcroTray.FRA
2014-02-27 14:24 - 2014-02-27 14:24 - 00017920 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\PSIClient\0818bbec4f228582cd475b2eded32a93\PSIClient.ni.dll
2014-03-30 12:55 - 2014-03-30 12:55 - 03642480 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\office14\Cultures\office.odf
2013-02-14 16:46 - 2013-02-14 16:46 - 01044048 _____ () C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== Disabled items from MSCONFIG ==============
==================== Faulty Device Manager Devices =============
Name: Unknown Device
Description: Unknown Device
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: (Standard-USB-Hostcontroller)
Service:
Problem: : Windows has stopped this device because it has reported problems. (Code 43)
Resolution: One of the drivers controlling the device notified the operating system that the device failed in some manner. For more information about how to diagnose the problem, see the hardware documentation.
==================== Event log errors: =========================
Application errors:
==================
Error: (04/24/2014 09:09:24 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (04/24/2014 09:09:24 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (04/24/2014 08:46:40 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (04/24/2014 08:46:40 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (04/24/2014 07:47:09 PM) (Source: Application Hang) (User: )
Description: Programm explorer.exe, Version 6.1.7601.17567 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1750
Startzeit: 01cf5fdbb9a6e454
Endzeit: 13290
Anwendungspfad: C:\Windows\explorer.exe
Berichts-ID: 56971c11-cbd8-11e3-9721-002354f5ab13
Error: (04/24/2014 06:49:13 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (04/24/2014 06:49:13 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (04/24/2014 06:39:13 PM) (Source: Application Hang) (User: )
Description: Programm explorer.exe, Version 6.1.7601.17567 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 3520
Startzeit: 01cf5faba185263c
Endzeit: 9255
Anwendungspfad: C:\Windows\explorer.exe
Berichts-ID: ebac6260-cbce-11e3-9721-002354f5ab13
Error: (04/24/2014 00:54:57 PM) (Source: Application Hang) (User: )
Description: Programm Explorer.EXE, Version 6.1.7601.17567 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 934
Startzeit: 01cf5f859e945a42
Endzeit: 39
Anwendungspfad: C:\Windows\Explorer.EXE
Berichts-ID: db0b3907-cb9e-11e3-9721-002354f5ab13
Error: (04/23/2014 09:28:07 AM) (Source: Application Hang) (User: )
Description: Programm firefox.exe, Version 28.0.0.5186 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 2148
Startzeit: 01cf5ec536ac7e81
Endzeit: 31
Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Berichts-ID: ceedfc36-cab8-11e3-8820-002354f5ab13
System errors:
=============
Error: (04/24/2014 07:47:03 PM) (Source: Disk) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk5\DR7.
Error: (04/24/2014 07:46:43 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk5\DR7 gefunden.
Error: (04/24/2014 07:46:41 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk5\DR7 gefunden.
Error: (04/24/2014 07:46:21 PM) (Source: Disk) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk5\DR7.
Error: (04/24/2014 06:44:19 PM) (Source: Disk) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk5\DR7.
Error: (04/24/2014 06:43:58 PM) (Source: Disk) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk5\DR7.
Error: (04/24/2014 06:43:44 PM) (Source: Disk) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk5\DR7.
Error: (04/24/2014 06:43:23 PM) (Source: Disk) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk5\DR7.
Error: (04/24/2014 06:40:44 PM) (Source: Disk) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk5\DR7.
Error: (04/24/2014 06:40:02 PM) (Source: Disk) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk5\DR7.
Microsoft Office Sessions:
=========================
Error: (04/24/2014 09:09:24 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files (x86)\Adobe\Acrobat 9.0\Designer 8.2\FormDesigner.exe
Error: (04/24/2014 09:09:24 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files (x86)\Adobe\Acrobat 9.0\Designer 8.2\FormDesigner.exe
Error: (04/24/2014 08:46:40 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files (x86)\Adobe\Acrobat 9.0\Designer 8.2\FormDesigner.exe
Error: (04/24/2014 08:46:40 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files (x86)\Adobe\Acrobat 9.0\Designer 8.2\FormDesigner.exe
Error: (04/24/2014 07:47:09 PM) (Source: Application Hang)(User: )
Description: explorer.exe6.1.7601.17567175001cf5fdbb9a6e45413290C:\Windows\explorer.exe56971c11-cbd8-11e3-9721-002354f5ab13
Error: (04/24/2014 06:49:13 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files (x86)\Adobe\Acrobat 9.0\Designer 8.2\FormDesigner.exe
Error: (04/24/2014 06:49:13 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files (x86)\Adobe\Acrobat 9.0\Designer 8.2\FormDesigner.exe
Error: (04/24/2014 06:39:13 PM) (Source: Application Hang)(User: )
Description: explorer.exe6.1.7601.17567352001cf5faba185263c9255C:\Windows\explorer.exeebac6260-cbce-11e3-9721-002354f5ab13
Error: (04/24/2014 00:54:57 PM) (Source: Application Hang)(User: )
Description: Explorer.EXE6.1.7601.1756793401cf5f859e945a4239C:\Windows\Explorer.EXEdb0b3907-cb9e-11e3-9721-002354f5ab13
Error: (04/23/2014 09:28:07 AM) (Source: Application Hang)(User: )
Description: firefox.exe28.0.0.5186214801cf5ec536ac7e8131C:\Program Files (x86)\Mozilla Firefox\firefox.execeedfc36-cab8-11e3-8820-002354f5ab13
==================== Memory info ===========================
Percentage of memory in use: 25%
Total physical RAM: 12278.11 MB
Available physical RAM: 9117.38 MB
Total Pagefile: 12476.29 MB
Available Pagefile: 9042.68 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: (Win) (Fixed) (Total:238.37 GB) (Free:135.16 GB) NTFS
Drive d: (Biggi) (Fixed) (Total:931.51 GB) (Free:9.66 GB) NTFS
Drive f: (150) (Fixed) (Total:146.48 GB) (Free:76.16 GB) NTFS
Drive g: (Brainment) (Fixed) (Total:319.18 GB) (Free:5.82 GB) NTFS
Drive h: (AW_2781) (CDROM) (Total:0.01 GB) (Free:0 GB) CDFS
Drive j: (Samsung 160GB) (Fixed) (Total:149.04 GB) (Free:80.19 GB) NTFS
Drive k: (foto & video) (Fixed) (Total:931.51 GB) (Free:778.82 GB) NTFS
Drive p: (IPWN) (Removable) (Total:148.79 GB) (Free:19.61 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149 GB) (Disk ID: E353C3E5)
Partition 1: (Not Active) - (Size=149 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 0F9F0F9F)
Partition 1: (Not Active) - (Size=146 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=319 GB) - (Type=07 NTFS)
========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 210D709E)
Partition 1: (Not Active) - (Size=932 GB) - (Type=07 NTFS)
========================================================
Disk: 3 (MBR Code: Windows 7 or 8) (Size: 238 GB) (Disk ID: A14AE4AE)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=238 GB) - (Type=07 NTFS)
========================================================
Disk: 4 (MBR Code: Windows XP) (Size: 932 GB) (Disk ID: 0002846E)
Partition 1: (Not Active) - (Size=932 GB) - (Type=07 NTFS)
Attempted reading MBR returned 0 bytes.
Could not read MBR for disk 5.
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-04-24 23:07:40
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk3\DR3 -> \Device\00000074 ATA_____ rev.6B0Q 238,47GB
Running: Gmer-19357.exe; Driver: C:\Users\beasy\AppData\Local\Temp\kwtyapog.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe[2036] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000755e1465 2 bytes [5E, 75]
.text C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe[2036] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000755e14bb 2 bytes [5E, 75]
.text ... * 2
.text C:\Windows\Explorer.EXE[4356] C:\Windows\system32\SHELL32.dll!SHLoadInProc + 944 000007fefe397fd0 5 bytes JMP 000007feffb600f0
.text C:\Windows\Explorer.EXE[4356] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feff647490 5 bytes JMP 000007feffb60018
.text C:\Windows\Explorer.EXE[4356] C:\Windows\system32\ole32.dll!RegisterDragDrop 000007feff780d10 5 bytes JMP 000007feffb60030
.text C:\Program Files (x86)\RocketDock\RocketDock.exe[4744] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000755e1465 2 bytes [5E, 75]
.text C:\Program Files (x86)\RocketDock\RocketDock.exe[4744] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000755e14bb 2 bytes [5E, 75]
.text ... * 2
.text C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4724] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000755e1465 2 bytes [5E, 75]
.text C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4724] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000755e14bb 2 bytes [5E, 75]
.text ... * 2
.text C:\Program Files (x86)\Samsung SSD Magician\Samsung Magician.exe[5152] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000755e1465 2 bytes [5E, 75]
.text C:\Program Files (x86)\Samsung SSD Magician\Samsung Magician.exe[5152] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000755e14bb 2 bytes [5E, 75]
.text ... * 2
.text C:\Program Files\Logitech\GamePanel Software\Applets\LCDMedia.exe[5356] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000755e1465 2 bytes [5E, 75]
.text C:\Program Files\Logitech\GamePanel Software\Applets\LCDMedia.exe[5356] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000755e14bb 2 bytes [5E, 75]
.text ... * 2
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[5832] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000755e1465 2 bytes [5E, 75]
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[5832] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000755e14bb 2 bytes [5E, 75]
.text ... * 2
.text C:\Program Files (x86)\Windows Media Player\wmplayer.exe[7976] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000755e1465 2 bytes [5E, 75]
.text C:\Program Files (x86)\Windows Media Player\wmplayer.exe[7976] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000755e14bb 2 bytes [5E, 75]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4084] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000755e1465 2 bytes [5E, 75]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4084] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000755e14bb 2 bytes [5E, 75]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5724] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000755e1465 2 bytes [5E, 75]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5724] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000755e14bb 2 bytes [5E, 75]
.text ... * 2
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[1812] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000755e1465 2 bytes [5E, 75]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[1812] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000755e14bb 2 bytes [5E, 75]
.text ... * 2
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[8572] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000755e1465 2 bytes [5E, 75]
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[8572] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000755e14bb 2 bytes [5E, 75]
.text ... * 2
.text C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe[8588] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000755e1465 2 bytes [5E, 75]
.text C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe[8588] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000755e14bb 2 bytes [5E, 75]
.text ... * 2
.text C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe[7800] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000755e1465 2 bytes [5E, 75]
.text C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe[7800] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000755e14bb 2 bytes [5E, 75]
.text ... * 2
.text C:\Users\beasy\Desktop\yantoo entfernen\Gmer-19357.exe[6272] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000755e1465 2 bytes [5E, 75]
.text C:\Users\beasy\Desktop\yantoo entfernen\Gmer-19357.exe[6272] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000755e14bb 2 bytes [5E, 75]
.text ... * 2
---- EOF - GMER 2.1 ----
Code:
ATTFilter *** Prozess ***
Prozess: 4732
Dateiname: erunt.exe
Pfad: c:\windows\erunt.exe
Herausgeber: Unbekannter Herausgeber
Erstelldatum: 02/22/13 15:05:21
Änderungsdatum: 02/22/13 02:04:50
Gestartet von: cmd.exe
Herausgeber: Microsoft Windows
*** Aktionen ***
Ein Packer wurde auf die Programmdatei angewandt. Möglicherweise um schädliche Inhalte zu verbergen.
Das Programm hat in Dateien oder Ordnern geschrieben die genutzt werden können um das System zu gefährden.
Das Programm hat Werte in der System-Registrierung verändert die genutzt werden können um das System zu gefährden.
YGLRtuLAcnJycmJi0HJycnJiYuBycignh2JicCp0ckInJyYGt3JycnJiYnAsJycnJyYGaHJycnJiYoArJycnJyYGmXJykCsWbSsJyXJycKdycnB4cnJycmJicJlycnJyYmJwunKxXmO2cnKxXmO2cmJicI5ycgAA
Version der Regeln: 4.4.10
OS: Windows 6.1 Service Pack 1.0 Build: 7601 - Workstation 64bit OS
Version der dll: 40166
ERUNT.exe C:\FRST\HIVES silent sysreg curuser /noconfirmdelete /noprogresswindow
MD5: 2E0323A94915FAAB10A25F3BABF82584
C:\Windows\system32\cmd.exe /c ERUNT.exe C:\FRST\HIVES silent sysreg curuser /noconfirmdelete /noprogresswindow
MD5:
Geändert von iNERD (24.04.2014 um 22:22 Uhr) Grund: Ergänzung |
|
25.04.2014, 18:59
| #4 | |
| /// the machine /// TB-Ausbilder | Wie entferne ich Yontoo?Zitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
26.04.2014, 14:01
| #5 |
| |  Wie entferne ich Yontoo? Moin, das scheinen wohl alte, überflüssige Host Einträge zu sein von denen ich nichts wusste. Hab Sie entfernt. Die Lizenzen der legal erworbenen Adobe Produkte bewahre ich in der Schublade auf... Nächstes mal kannste ja vielleicht vorher nachfragen oder drauf aufmerksam machen bevor du so eine Beschuldigung veröffentlichst. Wirkt dann auf jedenfall professioneller. Wie gehts weiter? |
|
26.04.2014, 18:41
| #6 |
| /// the machine /// TB-Ausbilder | Wie entferne ich Yontoo? Hast ungefähr ne Ahnung wie oft am Tag ich genau diesen Satz posten muss? Und wieviel schwachsinnige Aureden ich mir anhören muss? Alles nur weil jeder meint, seine Bilder wären so geil, die kann man nur mit Photoshop machen, die 2000 Tacken für das Programm kann man ja sparen. Und wenn ich sowas ignoriere mach ich mich mit strafbar, ganz einfach. Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ --> Wie entferne ich Yontoo? |
|
26.04.2014, 22:56
| #7 |
| | Wie entferne ich Yontoo? Hallo, vielen Dank für deine Antwort. In meinem Fall musste ich für Adobe keine 2000 takken ausgeben da ich zu der Zeit Schüler war und es noch diese tollen 80% Rabatt gab.. Ich kann dein Misstrauen verstehen aber es ist, finde ich, auch wichtig deine "Vorurteile" nicht zu verallgemeinern. Danke aber für deine Hilfe! Ich poste morgen die neuen logs. |
|
27.04.2014, 15:57
| #8 |
| | Wie entferne ich Yontoo? die neuen logs: mbam.txt Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 27.04.2014 Suchlauf-Zeit: 16:17:59 Logdatei: mbam.txt Administrator: Ja Version: 2.00.1.1004 Malware Datenbank: v2014.04.27.03 Rootkit Datenbank: v2014.03.27.01 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Chameleon: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: beasy Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 291016 Verstrichene Zeit: 19 Min, 36 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Shuriken: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 4 PUP.Optional.SProtector.A, HKU\S-1-5-21-2748726515-3267308534-365629110-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SProtector, In Quarantäne, [dc24e51b2ad6bf41745709958a7942be], PUP.Optional.InstallCore.A, HKU\S-1-5-21-2748726515-3267308534-365629110-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, In Quarantäne, [d42cda26ad53976982991472f50d5aa6], PUP.Optional.InstallCore.A, HKU\S-1-5-21-2748726515-3267308534-365629110-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, In Quarantäne, [41bfb14fea163ac632139a029b685ca4], PUP.Optional.WebSearchInfo, HKU\S-1-5-21-2748726515-3267308534-365629110-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}, In Quarantäne, [ba46b050c9373ac63f64e1c948bb48b8], Registrierungswerte: 2 PUP.Optional.InstallCore.A, HKU\S-1-5-21-2748726515-3267308534-365629110-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 0G2Y1R2X0G1M2S1M0G1S1H, In Quarantäne, [41bfb14fea163ac632139a029b685ca4] PUP.Optional.WebSearchInfo, HKU\S-1-5-21-2748726515-3267308534-365629110-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {BB74DE59-BC4C-4172-9AC4-73315F71CFFE}, In Quarantäne, [758bdc2457a94bb5554f03a729daa35d] Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 3 PUP.Optional.Delta.A, C:\Users\beasy\AppData\Local\Temp\is1070216317\DeltaTB.exe, In Quarantäne, [d42c19e75aa6a45c09678b786e936e92], PUP.Optional.Babylon.A, C:\Users\beasy\AppData\Roaming\Mozilla\Firefox\Profiles\9d18f66r.default-1370685285713\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.prtkDS", 0);), Ersetzt,[a45c6898b14f827e5a9fe27a689c1ce4] PUP.Optional.Babylon.A, C:\Users\beasy\AppData\Roaming\Mozilla\Firefox\Profiles\9d18f66r.default-1370685285713\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.prtkHmpg", 0);), Ersetzt,[f7098f71d52b35cb5f9a104c4eb69868] Physische Sektoren: 0 (No malicious items detected) (end) Code:
ATTFilter # AdwCleaner v3.204 - Bericht erstellt am 27/04/2014 um 16:29:45
# Aktualisiert 26/04/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : beasy - ENTERBRAINMENT
# Gestartet von : C:\Users\beasy\Desktop\yantoo entfernen\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Program Files (x86)\BrowseToSave
Ordner Gelöscht : C:\Program Files (x86)\driver-soft
Ordner Gelöscht : C:\Program Files (x86)\GreenTree Applications
Ordner Gelöscht : C:\Windows\SysWOW64\AI_RecycleBin
Ordner Gelöscht : C:\Users\beasy\AppData\Local\Pokki
Ordner Gelöscht : C:\Users\beasy\AppData\Roaming\SendSpace
Ordner Gelöscht : C:\Users\beasy\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkkghgaeeoggfndcpipgabacadfdhpfk
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKCU\Software\Classes\pokki
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Yontoo Desktop]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{059EACC2-1ABE-49E8-928D-DC8BD355B7A9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}
Schlüssel Gelöscht : HKLM\Software\Driver-Soft
Schlüssel Gelöscht : HKLM\Software\SP Global
Schlüssel Gelöscht : HKLM\Software\SProtector
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Tarma Installer
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16521
-\\ Mozilla Firefox v28.0 (de)
[ Datei : C:\Users\beasy\AppData\Roaming\Mozilla\Firefox\Profiles\9d18f66r.default-1370685285713\prefs.js ]
Zeile gelöscht : user_pref("aol_toolbar.default.homepage.check", false);
Zeile gelöscht : user_pref("aol_toolbar.default.search.check", false);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.prtkDS", 0);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.prtkHmpg", 0);
Zeile gelöscht : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
Zeile gelöscht : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");
Zeile gelöscht : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "");
Zeile gelöscht : user_pref("sweetim.toolbar.previous.keyword.URL", "");
Zeile gelöscht : user_pref("sweetim.toolbar.scripts.1.domain-blacklist", "");
Zeile gelöscht : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_DS", "");
Zeile gelöscht : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_HP", "");
Zeile gelöscht : user_pref("sweetim.toolbar.searchguard.enable", "");
-\\ Google Chrome v
[ Datei : C:\Users\beasy\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Gelöscht [Homepage] : hxxp://websearch.searchmainia.info/?unqvl=15
Gelöscht [Extension] : fkkghgaeeoggfndcpipgabacadfdhpfk
*************************
AdwCleaner[R0].txt - [4480 octets] - [24/04/2014 21:11:30]
AdwCleaner[R1].txt - [3987 octets] - [27/04/2014 16:28:40]
AdwCleaner[S0].txt - [3774 octets] - [27/04/2014 16:29:45]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3834 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Professional x64
Ran by beasy on 27.04.2014 at 16:37:31,56
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\softsafe"
Successfully deleted: [Folder] "C:\ProgramData\starapp"
Successfully deleted: [Folder] "C:\ProgramData\tarma installer"
Successfully deleted: [Folder] "C:\ProgramData\ytd video downloader"
Successfully deleted: [Folder] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ytd video downloader"
~~~ FireFox
Emptied folder: C:\Users\beasy\AppData\Roaming\mozilla\firefox\profiles\9d18f66r.default-1370685285713\minidumps [5 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 27.04.2014 at 16:42:26,59
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-04-2014
Ran by beasy (administrator) on ENTERBRAINMENT on 27-04-2014 16:44:19
Running from C:\Users\beasy\Desktop\yantoo entfernen
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe
(Wacom Technology, Corp.) C:\Windows\system32\Wacom_Tablet.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GdBgInx64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\LGDevAgt.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
() C:\Program Files (x86)\RocketDock\RocketDock.exe
(Spotify Ltd) C:\Users\beasy\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
(Samsung Electronics.) C:\Program Files (x86)\Samsung SSD Magician\Samsung Magician.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\Applets\LCDClock.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\Applets\LCDCountdown.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\Applets\LCDPop3.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\Applets\LCDMedia.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\Applets\LCDRSS.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Wacom Technology, Corp.) C:\Windows\system32\WTablet\Wacom_TabletUser.exe
(Wacom Technology, Corp.) C:\Windows\system32\Wacom_Tablet.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\WMPSideShowGadget.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
() C:\Program Files (x86)\Everything\Everything.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe
(AVM Berlin) C:\Users\beasy\AppData\Local\Apps\2.0\N16QM8YT.CZ7\V6RBX4PA.DWQ\frit..tion_1acae14e4778b8d2_0002.0003_6dcb4a48ddb2ee39\fritzbox-usb-fernanschluss.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Launch LgDeviceAgent] => C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe [415816 2010-08-03] (Logitech Inc.)
HKLM\...\Run: [Launch LCDMon] => C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe [2412616 2010-08-03] (Logitech Inc.)
HKLM\...\Run: [Launch LGDCore] => C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe [4725320 2010-08-03] (Logitech Inc.)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2782096 2010-07-26] (CANON INC.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [444904 2012-09-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [JMB36X IDE Setup] => C:\Windows\RaidTool\xInsIDE.exe [43608 2010-09-07] ()
HKLM-x32\...\Run: [TaskTray] => [X]
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-12-11] (Intel Corporation)
HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1724728 2013-12-19] (G Data Software AG)
HKLM-x32\...\Run: [G Data ASM] => C:\Program Files (x86)\G Data\InternetSecurity\DelayLoader\AutorunDelayLoader.exe [431224 2013-12-19] (G Data Software AG)
HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1316248 2010-12-02] (CANON INC.)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2013-03-21] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1075296 2013-04-25] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [402432 2010-07-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe [44128 2013-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [642664 2013-05-08] (Adobe Systems Inc.)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\program files (x86)\g data\internetsecurity\avkkid\avkcks.exe,C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe,
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\Run: [RocketDock] => C:\Program Files (x86)\RocketDock\RocketDock.exe [495616 2007-09-02] ()
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\Run: [Wunderlist] => "C:\Program Files (x86)\Wunderlist2\Wunderlist.exe" /silent
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x91000000
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\MountPoints2: I - I:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\MountPoints2: {2d4df0ad-9247-11e2-b850-002354f5ab13} - H:\autorun.exe .\index.html
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\MountPoints2: {877163de-cb78-11e3-9721-002354f5ab13} - L:\LaunchU3.exe -a
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\MountPoints2: {accac8b5-e001-11e2-adf5-002354f5ab13} - I:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\MountPoints2: {eb8b64cb-9f6e-11e2-be54-002354f5ab13} - I:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\MountPoints2: {efc92dbc-af22-11e2-bb24-002354f5ab13} - L:\HTC_Sync_Manager_PC.exe
Startup: C:\Users\beasy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Magician.lnk
ShortcutTarget: Samsung Magician.lnk -> C:\Program Files (x86)\Samsung SSD Magician\Samsung Magician.exe (Samsung Electronics.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xE0993C365726CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.msn.com/spbasic.htm
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.msn.com/spbasic.htm
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,CustomizeSearch = hxxp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,SearchURL = hxxp://home.microsoft.com/access/autosearch.asp?p=%s
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: QTTabBar AutoLoader - {d2bf470e-ed1c-487f-a777-2bd8835eb6ce} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Evernote extension - {92EF2EAD-A7CE-4424-B0DB-499CF856608E} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: QTTabBar AutoLoader - {d2bf470e-ed1c-487f-a777-2bd8835eb6ce} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - QTTabBar - {d2bf470e-ed1c-487f-a333-2bd8835eb6ce} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM - QTTab Standard Buttons - {d2bf470e-ed1c-487f-a666-2bd8835eb6ce} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - QTTabBar - {d2bf470e-ed1c-487f-a333-2bd8835eb6ce} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - QTTab Standard Buttons - {d2bf470e-ed1c-487f-a666-2bd8835eb6ce} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\beasy\AppData\Roaming\Mozilla\Firefox\Profiles\9d18f66r.default-1370685285713
FF SearchEngineOrder.user_pref("browser.search.order.1", "");: user_pref("browser.search.order.1", "");
FF SearchEngineOrder.user_pref("browser.search.order.1,S", "");: user_pref("browser.search.order.1,S", "");
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.16bars.de/
FF Keyword.URL: user_pref("keyword.URL", "");
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_182.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin: adobe.com/AdobeExManDetect - C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\Win64Plugin\npAdobeExManDetectX64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_182.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin-x32: adobe.com/AdobeExManDetect - C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\npAdobeExManDetectX86.dll (Adobe Systems)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101799.dll (Amazon.com, Inc.)
FF Plugin HKCU: pokki.com/PokkiDownloadHelper - C:\Users\beasy\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll No File
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ProxTube - Unblock YouTube - C:\Users\beasy\AppData\Roaming\Mozilla\Firefox\Profiles\9d18f66r.default-1370685285713\Extensions\{2541D29A-DB9E-4c1e-949A-31EFB4AEF4E7} [2013-12-06]
FF Extension: Firebug - C:\Users\beasy\AppData\Roaming\Mozilla\Firefox\Profiles\9d18f66r.default-1370685285713\Extensions\firebug@software.joehewitt.com.xpi [2013-06-15]
FF Extension: WhatFontis.com right-click shortcut - C:\Users\beasy\AppData\Roaming\Mozilla\Firefox\Profiles\9d18f66r.default-1370685285713\Extensions\webmaster@WhatFONTis.com.xpi [2013-12-11]
FF Extension: Pinterest Pin Button - C:\Users\beasy\AppData\Roaming\Mozilla\Firefox\Profiles\9d18f66r.default-1370685285713\Extensions\{677a8f98-fd64-40b0-a883-b8c95d0cbf17}.xpi [2013-09-27]
FF Extension: Adblock Plus - C:\Users\beasy\AppData\Roaming\Mozilla\Firefox\Profiles\9d18f66r.default-1370685285713\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-06-08]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-03-24]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-03-24]
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://websearch.searchmainia.info/?unqvl=15"
CHR Extension: (No Name) - C:\Users\beasy\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkkghgaeeoggfndcpipgabacadfdhpfk [2013-04-08]
==================== Services (Whitelisted) =================
R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2244728 2014-02-12] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe [2723400 2014-03-25] (G Data Software AG)
R3 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [2992760 2014-01-30] (G Data Software AG)
R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700024 2014-02-03] (G Data Software AG)
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [5268336 2014-03-25] (INCA Internet Co., Ltd.)
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [166912 2012-10-08] ()
R2 PMBDeviceInfoProvider; C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [483864 2013-04-24] (Sony Corporation)
R2 TabletServiceWacom; C:\Windows\system32\Wacom_Tablet.exe [3647272 2009-03-27] (Wacom Technology, Corp.)
==================== Drivers (Whitelisted) ====================
S3 AKAI_ACV0_MIDI; C:\Windows\System32\drivers\akaiacv0m.sys [55104 2012-07-12] (Ploytec GmbH)
S3 AKAI_ACV0_USB; C:\Windows\System32\Drivers\akaiacv0u.sys [426816 2012-07-12] (Ploytec GmbH)
S3 AKAI_ACV0_WDM; C:\Windows\System32\drivers\akaiacv0a.sys [50496 2012-07-12] (Numark)
R3 avmaura; C:\Windows\System32\DRIVERS\avmaura.sys [116480 2013-08-21] (AVM Berlin)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-03-22] (DT Soft Ltd)
R3 FFUsbAudio; C:\Windows\System32\DRIVERS\ffusbaudio.sys [51200 2010-03-05] (Focusrite Audio Engineering Ltd.)
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [57344 2014-04-06] (G Data Software AG)
R3 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt64.sys [22016 2014-04-06] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [135168 2014-04-06] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [68608 2014-04-06] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64000 2014-04-06] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [106272 2014-04-24] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [65024 2014-04-06] (G Data Software AG)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28216 2012-12-11] (Intel Corporation)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation)
R3 mc2avs; C:\Windows\System32\Drivers\mc2avs.sys [358520 2012-06-06] (Native Instruments GmbH)
R3 mc2usb_svc; C:\Windows\System32\Drivers\mc2usb.sys [81016 2012-06-06] (Native Instruments GmbH)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
R3 NIWinCDEmu; C:\Windows\System32\DRIVERS\NIWinCDEmu.sys [112408 2014-02-01] ()
R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [114568 2013-03-21] (Renesas Electronics Corporation)
R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [230280 2013-03-21] (Renesas Electronics Corporation)
S3 V0260VID; C:\Windows\System32\DRIVERS\V0260Vid.sys [189664 2007-07-18] (Creative Technology Ltd.)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-27 16:35 - 2014-04-27 16:35 - 00000000 ____D () C:\Windows\ERUNT
2014-04-27 15:57 - 2014-04-27 16:31 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-27 15:56 - 2014-04-27 15:56 - 00001105 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-27 15:56 - 2014-04-27 15:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-04-27 15:56 - 2014-04-27 15:56 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-27 15:56 - 2014-04-27 15:56 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-27 15:56 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-27 15:56 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-27 15:56 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-26 14:55 - 2014-04-26 15:01 - 00000959 _____ () C:\Users\beasy\Desktop\text.txt
2014-04-24 22:11 - 2014-04-27 16:44 - 00000000 ____D () C:\FRST
2014-04-24 22:07 - 2014-04-24 22:07 - 00000168 _____ () C:\Users\beasy\defogger_reenable
2014-04-24 22:06 - 2014-04-27 16:44 - 00000000 ____D () C:\Users\beasy\Desktop\yantoo entfernen
2014-04-24 21:12 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-04-24 21:11 - 2014-04-27 16:29 - 00000000 ____D () C:\AdwCleaner
2014-04-24 12:57 - 2014-04-27 16:07 - 00000000 ____D () C:\Users\beasy\Desktop\instagram
2014-04-23 08:49 - 2014-04-23 08:49 - 02756424 _____ (Pokki) C:\Users\beasy\Downloads\PokkiInstaller.exe
2014-04-21 14:58 - 2014-04-21 14:58 - 00000000 ____D () C:\ProgramData\McAfee
2014-04-19 12:54 - 2014-04-19 12:54 - 00000656 _____ () C:\Users\beasy\Desktop\Design.lnk
2014-04-19 12:07 - 2014-04-19 12:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Evernote
2014-04-10 09:00 - 2014-03-31 03:16 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-10 09:00 - 2014-03-31 03:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-10 09:00 - 2014-03-31 02:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-10 09:00 - 2014-03-31 01:57 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-10 09:00 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-10 09:00 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-10 09:00 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-10 09:00 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-10 09:00 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-10 09:00 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-10 09:00 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-10 09:00 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-10 09:00 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-10 09:00 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-10 09:00 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-10 09:00 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-10 09:00 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-10 09:00 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-10 09:00 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-10 09:00 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-10 09:00 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-08 19:28 - 2014-04-08 19:28 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-04-08 19:28 - 2014-04-08 19:28 - 00000000 ____D () C:\Users\beasy\AppData\Local\Skype
2014-04-08 19:28 - 2014-04-08 19:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-04-06 18:29 - 2014-04-06 18:29 - 00022016 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBFlt64.sys
2014-04-06 18:29 - 2014-04-06 18:29 - 00001981 _____ () C:\Users\Public\Desktop\G Data InternetSecurity.lnk
2014-04-06 18:29 - 2014-04-06 18:29 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_GDKBFlt64_01007.Wdf
2014-04-06 18:29 - 2014-04-06 18:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity
2014-04-04 22:20 - 2014-04-04 22:20 - 00001952 _____ () C:\Users\Public\Desktop\CDBurnerXP.lnk
2014-04-04 10:44 - 2014-04-06 16:28 - 00000000 ____D () C:\Users\beasy\AppData\Roaming\Spotify
2014-04-04 10:44 - 2014-04-06 10:14 - 00000000 ____D () C:\Users\beasy\AppData\Local\Spotify
2014-04-04 10:44 - 2014-04-04 10:44 - 00001770 _____ () C:\Users\beasy\Desktop\Spotify.lnk
2014-04-04 10:44 - 2014-04-04 10:44 - 00001756 _____ () C:\Users\beasy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2014-03-30 21:21 - 2014-03-31 08:54 - 00000000 ____D () C:\Users\beasy\Desktop\gfx load
2014-03-30 17:30 - 2014-03-30 17:50 - 00000031 _____ () C:\Users\beasy\Desktop\basilikum.txt
2014-03-30 12:55 - 2014-03-30 12:55 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-28 23:10 - 2014-03-28 23:10 - 00000000 ____D () C:\Program Files\Common Files\INCA Shared
2014-03-28 23:10 - 2014-03-25 09:31 - 05268336 _____ (INCA Internet Co., Ltd.) C:\Windows\SysWOW64\GameMon.des
2014-03-28 23:08 - 2014-03-28 23:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Flyff
==================== One Month Modified Files and Folders =======
2014-04-27 16:44 - 2014-04-24 22:11 - 00000000 ____D () C:\FRST
2014-04-27 16:44 - 2014-04-24 22:06 - 00000000 ____D () C:\Users\beasy\Desktop\yantoo entfernen
2014-04-27 16:38 - 2009-07-14 06:45 - 00014624 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-27 16:38 - 2009-07-14 06:45 - 00014624 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-27 16:35 - 2014-04-27 16:35 - 00000000 ____D () C:\Windows\ERUNT
2014-04-27 16:34 - 2013-03-21 18:44 - 00000000 ___RD () C:\Users\beasy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-27 16:33 - 2014-02-17 22:20 - 00002170 _____ () C:\Users\Public\Desktop\HP Photosmart Essential 3.5.lnk
2014-04-27 16:33 - 2013-08-21 17:40 - 01550329 _____ () C:\Windows\avmacc.log
2014-04-27 16:33 - 2009-07-14 04:34 - 00000513 _____ () C:\Windows\win.ini
2014-04-27 16:31 - 2014-04-27 15:57 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-27 16:31 - 2013-03-24 19:12 - 00000000 ____D () C:\Users\beasy\AppData\Roaming\WTablet
2014-04-27 16:31 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-27 16:31 - 2009-07-14 06:51 - 00106415 _____ () C:\Windows\setupact.log
2014-04-27 16:30 - 2013-03-21 19:11 - 01107664 _____ () C:\Windows\PFRO.log
2014-04-27 16:30 - 2013-03-21 18:44 - 01151457 _____ () C:\Windows\WindowsUpdate.log
2014-04-27 16:29 - 2014-04-24 21:11 - 00000000 ____D () C:\AdwCleaner
2014-04-27 16:14 - 2009-07-14 19:58 - 00703980 _____ () C:\Windows\system32\perfh007.dat
2014-04-27 16:14 - 2009-07-14 19:58 - 00151118 _____ () C:\Windows\system32\perfc007.dat
2014-04-27 16:14 - 2009-07-14 07:13 - 01632706 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-27 16:12 - 2013-03-22 00:20 - 00000000 ____D () C:\Users\beasy\AppData\Roaming\vlc
2014-04-27 16:07 - 2014-04-24 12:57 - 00000000 ____D () C:\Users\beasy\Desktop\instagram
2014-04-27 16:04 - 2013-03-22 00:16 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-27 16:01 - 2013-03-22 12:27 - 00000000 ____D () C:\Users\beasy\AppData\Local\Adobe
2014-04-27 15:56 - 2014-04-27 15:56 - 00001105 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-27 15:56 - 2014-04-27 15:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-04-27 15:56 - 2014-04-27 15:56 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-27 15:56 - 2014-04-27 15:56 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-27 15:56 - 2013-04-07 15:16 - 00000000 ____D () C:\Users\beasy\Desktop\musik
2014-04-26 15:02 - 2013-03-22 13:31 - 00000000 ____D () C:\Users\beasy\Documents\Outlook-Dateien
2014-04-26 15:01 - 2014-04-26 14:55 - 00000959 _____ () C:\Users\beasy\Desktop\text.txt
2014-04-26 14:39 - 2013-08-30 10:07 - 00000000 ____D () C:\Program Files (x86)\Everything
2014-04-26 14:38 - 2013-04-19 02:07 - 00000000 ____D () C:\Users\beasy\AppData\Local\Deployment
2014-04-25 11:30 - 2013-04-28 12:44 - 00000000 ____D () C:\Windows\Minidump
2014-04-25 11:30 - 2013-03-21 18:39 - 00293093 ____N () C:\Windows\Minidump\042514-11278-01.dmp
2014-04-24 23:23 - 2013-09-23 14:12 - 00106272 _____ (G Data Software) C:\Windows\system32\Drivers\GRD.sys
2014-04-24 23:23 - 2013-09-23 14:12 - 00018160 _____ (G Data Software) C:\Windows\system32\Drivers\GdPhyMem.sys
2014-04-24 22:58 - 2013-04-01 21:23 - 00000000 ____D () C:\Users\beasy\AppData\Local\CrashDumps
2014-04-24 22:07 - 2014-04-24 22:07 - 00000168 _____ () C:\Users\beasy\defogger_reenable
2014-04-24 22:07 - 2013-03-21 18:44 - 00000000 ____D () C:\Users\beasy
2014-04-24 20:33 - 2013-03-21 19:23 - 00155646 _____ () C:\Windows\DPINST.LOG
2014-04-24 20:14 - 2013-06-04 20:31 - 00001456 _____ () C:\Users\beasy\AppData\Local\Adobe Für Web speichern 12.0 Prefs
2014-04-24 14:04 - 2013-03-27 20:32 - 00000000 ____D () C:\Program Files (x86)\JDownloader
2014-04-23 08:49 - 2014-04-23 08:49 - 02756424 _____ (Pokki) C:\Users\beasy\Downloads\PokkiInstaller.exe
2014-04-21 16:23 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-21 14:58 - 2014-04-21 14:58 - 00000000 ____D () C:\ProgramData\McAfee
2014-04-21 14:58 - 2013-03-22 00:16 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-21 14:58 - 2013-03-22 00:16 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-21 14:58 - 2013-03-22 00:16 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-19 12:54 - 2014-04-19 12:54 - 00000656 _____ () C:\Users\beasy\Desktop\Design.lnk
2014-04-19 12:07 - 2014-04-19 12:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Evernote
2014-04-16 20:47 - 2014-01-09 16:49 - 00000132 _____ () C:\Users\beasy\AppData\Roaming\Adobe BMP Format CS5 Prefs
2014-04-16 20:44 - 2013-03-21 19:19 - 00167320 _____ () C:\Users\beasy\AppData\Local\GDIPFONTCACHEV1.DAT
2014-04-16 20:44 - 2009-07-14 06:45 - 11710880 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-04-16 20:11 - 2013-04-04 23:36 - 00000000 ____D () C:\Windows\pss
2014-04-13 13:38 - 2013-10-11 08:36 - 00000000 ____D () C:\WTablet
2014-04-12 12:13 - 2014-02-01 00:37 - 00014324 _____ () C:\Users\beasy\Maschine2.log
2014-04-12 12:12 - 2014-02-01 00:37 - 00000968 _____ () C:\Users\beasy\ScanApp.log
2014-04-11 17:05 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-10 13:46 - 2013-03-22 00:14 - 00000000 ____D () C:\Program Files (x86)\Heroes of Newerth
2014-04-10 10:05 - 2013-03-22 00:23 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-10 10:04 - 2013-08-14 22:46 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-10 10:03 - 2013-03-28 12:34 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-09 08:53 - 2014-02-01 12:15 - 00000000 ____D () C:\Users\beasy\AppData\Roaming\Audacity
2014-04-08 20:07 - 2013-03-23 18:56 - 00000000 ____D () C:\Users\beasy\AppData\Roaming\Skype
2014-04-08 19:28 - 2014-04-08 19:28 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-04-08 19:28 - 2014-04-08 19:28 - 00000000 ____D () C:\Users\beasy\AppData\Local\Skype
2014-04-08 19:28 - 2014-04-08 19:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-04-08 19:28 - 2013-03-23 18:56 - 00000000 ____D () C:\ProgramData\Skype
2014-04-08 18:08 - 2013-03-22 00:18 - 00000000 ____D () C:\Users\beasy\AppData\Roaming\Adobe
2014-04-06 18:29 - 2014-04-06 18:29 - 00022016 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBFlt64.sys
2014-04-06 18:29 - 2014-04-06 18:29 - 00001981 _____ () C:\Users\Public\Desktop\G Data InternetSecurity.lnk
2014-04-06 18:29 - 2014-04-06 18:29 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_GDKBFlt64_01007.Wdf
2014-04-06 18:29 - 2014-04-06 18:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity
2014-04-06 18:29 - 2013-09-23 14:05 - 00135168 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys
2014-04-06 18:29 - 2013-09-23 14:05 - 00068608 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys
2014-04-06 18:29 - 2013-09-23 14:05 - 00065024 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys
2014-04-06 18:29 - 2013-09-23 14:05 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd64.sys
2014-04-06 18:29 - 2013-09-23 14:05 - 00057344 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys
2014-04-06 18:29 - 2013-09-23 13:52 - 00000000 ____D () C:\ProgramData\G Data
2014-04-06 16:28 - 2014-04-04 10:44 - 00000000 ____D () C:\Users\beasy\AppData\Roaming\Spotify
2014-04-06 10:14 - 2014-04-04 10:44 - 00000000 ____D () C:\Users\beasy\AppData\Local\Spotify
2014-04-06 10:13 - 2013-05-21 15:29 - 00000000 ____D () C:\Program Files (x86)\CDBurnerXP
2014-04-04 22:20 - 2014-04-04 22:20 - 00001952 _____ () C:\Users\Public\Desktop\CDBurnerXP.lnk
2014-04-04 22:20 - 2013-05-21 15:29 - 00001902 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2014-04-04 10:44 - 2014-04-04 10:44 - 00001770 _____ () C:\Users\beasy\Desktop\Spotify.lnk
2014-04-04 10:44 - 2014-04-04 10:44 - 00001756 _____ () C:\Users\beasy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2014-04-04 09:38 - 2013-03-22 00:34 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-04-03 09:51 - 2014-04-27 15:56 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-04-27 15:56 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-04-27 15:56 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-03-31 08:54 - 2014-03-30 21:21 - 00000000 ____D () C:\Users\beasy\Desktop\gfx load
2014-03-31 03:16 - 2014-04-10 09:00 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-31 03:13 - 2014-04-10 09:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-31 02:13 - 2014-04-10 09:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-31 01:57 - 2014-04-10 09:00 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-30 17:50 - 2014-03-30 17:30 - 00000031 _____ () C:\Users\beasy\Desktop\basilikum.txt
2014-03-30 17:07 - 2013-03-21 19:13 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-03-30 12:55 - 2014-03-30 12:55 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-28 23:10 - 2014-03-28 23:10 - 00000000 ____D () C:\Program Files\Common Files\INCA Shared
2014-03-28 23:08 - 2014-03-28 23:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Flyff
2014-03-28 21:26 - 2013-03-23 18:04 - 00111595 _____ () C:\Windows\DirectX.log
2014-03-28 21:13 - 2013-10-31 14:11 - 00000000 ____D () C:\Users\beasy\Desktop\Notizen
2014-03-28 20:49 - 2013-05-14 06:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2014-03-28 20:47 - 2014-01-24 16:17 - 00000000 ____D () C:\ProgramData\Package Cache
2014-03-28 20:33 - 2013-11-23 12:09 - 00000000 ____D () C:\Users\beasy\AppData\Local\Battle.net
2014-03-28 20:31 - 2013-03-21 18:39 - 00346661 ____N () C:\Windows\Minidump\032814-25053-01.dmp
2014-03-28 20:00 - 2014-03-03 09:40 - 00000000 ____D () C:\Users\beasy\Desktop\inspiration
Some content of TEMP:
====================
C:\Users\beasy\AppData\Local\Temp\bitool.dll
C:\Users\beasy\AppData\Local\Temp\CheckLang.dll
C:\Users\beasy\AppData\Local\Temp\drm_dyndata_7400006.dll
C:\Users\beasy\AppData\Local\Temp\dsp_ipp.dll
C:\Users\beasy\AppData\Local\Temp\FastDownload.exe
C:\Users\beasy\AppData\Local\Temp\HPInstaller.exe
C:\Users\beasy\AppData\Local\Temp\installapi.exe
C:\Users\beasy\AppData\Local\Temp\InstallAX.exe
C:\Users\beasy\AppData\Local\Temp\InstallPlugin.exe
C:\Users\beasy\AppData\Local\Temp\MSETUP4.EXE
C:\Users\beasy\AppData\Local\Temp\ose00000.exe
C:\Users\beasy\AppData\Local\Temp\PlaySound.dll
C:\Users\beasy\AppData\Local\Temp\Quarantine.exe
C:\Users\beasy\AppData\Local\Temp\RunApp.dll
C:\Users\beasy\AppData\Local\Temp\SkypeSetup.exe
C:\Users\beasy\AppData\Local\Temp\vlc-2.0.6-win32.exe
C:\Users\beasy\AppData\Local\Temp\vlc-2.0.7-win32.exe
C:\Users\beasy\AppData\Local\Temp\vlc-2.0.8-win32.exe
C:\Users\beasy\AppData\Local\Temp\vlc-2.1.1-win32.exe
C:\Users\beasy\AppData\Local\Temp\vlc-2.1.2-win32.exe
C:\Users\beasy\AppData\Local\Temp\vlc-2.1.3-win32.exe
C:\Users\beasy\AppData\Local\Temp\Wunderlist-Setup2.3.0.31.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-04-19 12:24
==================== End Of Log ============================
...soweit alles da. Host ist auch bereinigt. LG |
|
28.04.2014, 08:43
| #9 |
| /// the machine /// TB-Ausbilder | Wie entferne ich Yontoo?ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
28.04.2014, 21:17
| #10 |
| | Wie entferne ich Yontoo? die neuen logs: log.txt: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=09359e4f9d785247ad4c5cd9ee070419
# engine=18060
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-04-28 06:21:29
# local_time=2014-04-28 08:21:29 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 66 85 25008607 150339139 0 0
# scanned=702077
# found=1
# cleaned=0
# scan_time=10465
sh=B3ECCE192A78D8F268196420C3BAF5D1FDA6AF23 ft=0 fh=0000000000000000 vn="Win32/Adware.MultiPlug.H Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\beasy\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkkghgaeeoggfndcpipgabacadfdhpfk\1\5161ef05a622c5.53749762.js.vir"
Code:
ATTFilter Results of screen317's Security Check version 0.99.82
Windows 7 Service Pack 1 x64 (UAC is disabled!)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
G Data InternetSecurity
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Adobe Flash Player 13.0.0.182
Mozilla Firefox (28.0)
````````Process Check: objlist.exe by Laurent````````
G Data InternetSecurity Firewall GDFwSvcx64.exe
G Data InternetSecurity Firewall GDFirewallTray.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-04-2014
Ran by beasy (administrator) on ENTERBRAINMENT on 28-04-2014 21:59:33
Running from C:\Users\beasy\Desktop\yantoo entfernen
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
(AMD) C:\Windows\system32\atieclxx.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe
(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe
(Wacom Technology, Corp.) C:\Windows\system32\Wacom_Tablet.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GdBgInx64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\LGDevAgt.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
() C:\Program Files (x86)\RocketDock\RocketDock.exe
(Samsung Electronics.) C:\Program Files (x86)\Samsung SSD Magician\Samsung Magician.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\Applets\LCDClock.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\Applets\LCDCountdown.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\Applets\LCDPop3.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\Applets\LCDMedia.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\Applets\LCDRSS.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Wacom Technology, Corp.) C:\Windows\system32\WTablet\Wacom_TabletUser.exe
(Wacom Technology, Corp.) C:\Windows\system32\Wacom_Tablet.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\WMPSideShowGadget.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE
(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe
(AVM Berlin) C:\Users\beasy\AppData\Local\Apps\2.0\N16QM8YT.CZ7\V6RBX4PA.DWQ\frit..tion_1acae14e4778b8d2_0002.0003_6dcb4a48ddb2ee39\fritzbox-usb-fernanschluss.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Launch LgDeviceAgent] => C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe [415816 2010-08-03] (Logitech Inc.)
HKLM\...\Run: [Launch LCDMon] => C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe [2412616 2010-08-03] (Logitech Inc.)
HKLM\...\Run: [Launch LGDCore] => C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe [4725320 2010-08-03] (Logitech Inc.)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2782096 2010-07-26] (CANON INC.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [444904 2012-09-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [JMB36X IDE Setup] => C:\Windows\RaidTool\xInsIDE.exe [43608 2010-09-07] ()
HKLM-x32\...\Run: [TaskTray] => [X]
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-12-11] (Intel Corporation)
HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1724728 2013-12-19] (G Data Software AG)
HKLM-x32\...\Run: [G Data ASM] => C:\Program Files (x86)\G Data\InternetSecurity\DelayLoader\AutorunDelayLoader.exe [431224 2013-12-19] (G Data Software AG)
HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1316248 2010-12-02] (CANON INC.)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2013-03-21] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1075296 2013-04-25] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [402432 2010-07-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe [44128 2013-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [642664 2013-05-08] (Adobe Systems Inc.)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\program files (x86)\g data\internetsecurity\avkkid\avkcks.exe,C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe,
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\Run: [RocketDock] => C:\Program Files (x86)\RocketDock\RocketDock.exe [495616 2007-09-02] ()
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\Run: [Wunderlist] => "C:\Program Files (x86)\Wunderlist2\Wunderlist.exe" /silent
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\Run: [AVMUSBFernanschluss] => C:\Users\beasy\AppData\Local\Apps\2.0\N16QM8YT.CZ7\V6RBX4PA.DWQ\frit..tion_1acae14e4778b8d2_0002.0003_6dcb4a48ddb2ee39\AVMAutoStart.exe [139264 2014-01-02] (AVM Berlin)
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x91000000
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\MountPoints2: I - I:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\MountPoints2: {2d4df0ad-9247-11e2-b850-002354f5ab13} - H:\autorun.exe .\index.html
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\MountPoints2: {877163de-cb78-11e3-9721-002354f5ab13} - L:\LaunchU3.exe -a
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\MountPoints2: {accac8b5-e001-11e2-adf5-002354f5ab13} - I:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\MountPoints2: {eb8b64cb-9f6e-11e2-be54-002354f5ab13} - I:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-2748726515-3267308534-365629110-1000\...\MountPoints2: {efc92dbc-af22-11e2-bb24-002354f5ab13} - L:\HTC_Sync_Manager_PC.exe
Startup: C:\Users\beasy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Magician.lnk
ShortcutTarget: Samsung Magician.lnk -> C:\Program Files (x86)\Samsung SSD Magician\Samsung Magician.exe (Samsung Electronics.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xE0993C365726CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.msn.com/spbasic.htm
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.msn.com/spbasic.htm
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,CustomizeSearch = hxxp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,SearchURL = hxxp://home.microsoft.com/access/autosearch.asp?p=%s
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: QTTabBar AutoLoader - {d2bf470e-ed1c-487f-a777-2bd8835eb6ce} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Evernote extension - {92EF2EAD-A7CE-4424-B0DB-499CF856608E} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: QTTabBar AutoLoader - {d2bf470e-ed1c-487f-a777-2bd8835eb6ce} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - QTTabBar - {d2bf470e-ed1c-487f-a333-2bd8835eb6ce} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM - QTTab Standard Buttons - {d2bf470e-ed1c-487f-a666-2bd8835eb6ce} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - QTTabBar - {d2bf470e-ed1c-487f-a333-2bd8835eb6ce} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - QTTab Standard Buttons - {d2bf470e-ed1c-487f-a666-2bd8835eb6ce} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\beasy\AppData\Roaming\Mozilla\Firefox\Profiles\9d18f66r.default-1370685285713
FF SearchEngineOrder.user_pref("browser.search.order.1", "");: user_pref("browser.search.order.1", "");
FF SearchEngineOrder.user_pref("browser.search.order.1,S", "");: user_pref("browser.search.order.1,S", "");
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.16bars.de/
FF Keyword.URL: user_pref("keyword.URL", "");
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_182.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin: adobe.com/AdobeExManDetect - C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\Win64Plugin\npAdobeExManDetectX64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_182.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin-x32: adobe.com/AdobeExManDetect - C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\npAdobeExManDetectX86.dll (Adobe Systems)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101799.dll (Amazon.com, Inc.)
FF Plugin HKCU: pokki.com/PokkiDownloadHelper - C:\Users\beasy\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll No File
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ProxTube - Unblock YouTube - C:\Users\beasy\AppData\Roaming\Mozilla\Firefox\Profiles\9d18f66r.default-1370685285713\Extensions\{2541D29A-DB9E-4c1e-949A-31EFB4AEF4E7} [2013-12-06]
FF Extension: Firebug - C:\Users\beasy\AppData\Roaming\Mozilla\Firefox\Profiles\9d18f66r.default-1370685285713\Extensions\firebug@software.joehewitt.com.xpi [2013-06-15]
FF Extension: WhatFontis.com right-click shortcut - C:\Users\beasy\AppData\Roaming\Mozilla\Firefox\Profiles\9d18f66r.default-1370685285713\Extensions\webmaster@WhatFONTis.com.xpi [2013-12-11]
FF Extension: Pinterest Pin Button - C:\Users\beasy\AppData\Roaming\Mozilla\Firefox\Profiles\9d18f66r.default-1370685285713\Extensions\{677a8f98-fd64-40b0-a883-b8c95d0cbf17}.xpi [2013-09-27]
FF Extension: Adblock Plus - C:\Users\beasy\AppData\Roaming\Mozilla\Firefox\Profiles\9d18f66r.default-1370685285713\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-06-08]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-03-24]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-03-24]
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://websearch.searchmainia.info/?unqvl=15"
CHR Extension: (No Name) - C:\Users\beasy\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkkghgaeeoggfndcpipgabacadfdhpfk [2013-04-08]
==================== Services (Whitelisted) =================
R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2244728 2014-02-12] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe [2723400 2014-03-25] (G Data Software AG)
R3 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [2992760 2014-01-30] (G Data Software AG)
R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700024 2014-02-03] (G Data Software AG)
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [5268336 2014-03-25] (INCA Internet Co., Ltd.)
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [166912 2012-10-08] ()
R2 PMBDeviceInfoProvider; C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [483864 2013-04-24] (Sony Corporation)
R2 TabletServiceWacom; C:\Windows\system32\Wacom_Tablet.exe [3647272 2009-03-27] (Wacom Technology, Corp.)
==================== Drivers (Whitelisted) ====================
S3 AKAI_ACV0_MIDI; C:\Windows\System32\drivers\akaiacv0m.sys [55104 2012-07-12] (Ploytec GmbH)
S3 AKAI_ACV0_USB; C:\Windows\System32\Drivers\akaiacv0u.sys [426816 2012-07-12] (Ploytec GmbH)
S3 AKAI_ACV0_WDM; C:\Windows\System32\drivers\akaiacv0a.sys [50496 2012-07-12] (Numark)
R3 avmaura; C:\Windows\System32\DRIVERS\avmaura.sys [116480 2013-08-21] (AVM Berlin)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-03-22] (DT Soft Ltd)
R3 FFUsbAudio; C:\Windows\System32\DRIVERS\ffusbaudio.sys [51200 2010-03-05] (Focusrite Audio Engineering Ltd.)
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [57344 2014-04-06] (G Data Software AG)
R3 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt64.sys [22016 2014-04-06] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [135168 2014-04-06] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [68608 2014-04-06] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64000 2014-04-06] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [106272 2014-04-24] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [65024 2014-04-06] (G Data Software AG)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28216 2012-12-11] (Intel Corporation)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation)
R3 mc2avs; C:\Windows\System32\Drivers\mc2avs.sys [358520 2012-06-06] (Native Instruments GmbH)
R3 mc2usb_svc; C:\Windows\System32\Drivers\mc2usb.sys [81016 2012-06-06] (Native Instruments GmbH)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
R3 NIWinCDEmu; C:\Windows\System32\DRIVERS\NIWinCDEmu.sys [112408 2014-02-01] ()
R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [114568 2013-03-21] (Renesas Electronics Corporation)
R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [230280 2013-03-21] (Renesas Electronics Corporation)
S3 V0260VID; C:\Windows\System32\DRIVERS\V0260Vid.sys [189664 2007-07-18] (Creative Technology Ltd.)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-28 17:26 - 2014-04-28 17:26 - 00855379 _____ () C:\Users\beasy\Desktop\SecurityCheck.exe
2014-04-27 16:58 - 2014-04-27 16:58 - 00000033 _____ () C:\Users\beasy\Desktop\temp pfad.txt
2014-04-27 16:35 - 2014-04-27 16:35 - 00000000 ____D () C:\Windows\ERUNT
2014-04-27 15:57 - 2014-04-28 17:19 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-27 15:56 - 2014-04-27 15:56 - 00001105 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-27 15:56 - 2014-04-27 15:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-04-27 15:56 - 2014-04-27 15:56 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-27 15:56 - 2014-04-27 15:56 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-27 15:56 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-27 15:56 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-27 15:56 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-26 14:55 - 2014-04-26 15:01 - 00000959 _____ () C:\Users\beasy\Desktop\text.txt
2014-04-24 22:11 - 2014-04-28 21:59 - 00000000 ____D () C:\FRST
2014-04-24 22:07 - 2014-04-24 22:07 - 00000168 _____ () C:\Users\beasy\defogger_reenable
2014-04-24 22:06 - 2014-04-28 21:59 - 00000000 ____D () C:\Users\beasy\Desktop\yantoo entfernen
2014-04-24 21:12 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-04-24 21:11 - 2014-04-27 16:29 - 00000000 ____D () C:\AdwCleaner
2014-04-24 12:57 - 2014-04-28 18:58 - 00000000 ____D () C:\Users\beasy\Desktop\instagram
2014-04-21 14:58 - 2014-04-21 14:58 - 00000000 ____D () C:\ProgramData\McAfee
2014-04-19 12:54 - 2014-04-19 12:54 - 00000656 _____ () C:\Users\beasy\Desktop\Design.lnk
2014-04-19 12:07 - 2014-04-19 12:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Evernote
2014-04-10 09:00 - 2014-03-31 03:16 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-10 09:00 - 2014-03-31 03:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-10 09:00 - 2014-03-31 02:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-10 09:00 - 2014-03-31 01:57 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-10 09:00 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-10 09:00 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-10 09:00 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-10 09:00 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-10 09:00 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-10 09:00 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-10 09:00 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-10 09:00 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-10 09:00 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-10 09:00 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-10 09:00 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-10 09:00 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-10 09:00 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-10 09:00 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-10 09:00 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-10 09:00 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-10 09:00 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-08 19:28 - 2014-04-08 19:28 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-04-08 19:28 - 2014-04-08 19:28 - 00000000 ____D () C:\Users\beasy\AppData\Local\Skype
2014-04-08 19:28 - 2014-04-08 19:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-04-06 18:29 - 2014-04-06 18:29 - 00022016 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBFlt64.sys
2014-04-06 18:29 - 2014-04-06 18:29 - 00001981 _____ () C:\Users\Public\Desktop\G Data InternetSecurity.lnk
2014-04-06 18:29 - 2014-04-06 18:29 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_GDKBFlt64_01007.Wdf
2014-04-06 18:29 - 2014-04-06 18:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity
2014-04-04 22:20 - 2014-04-04 22:20 - 00001952 _____ () C:\Users\Public\Desktop\CDBurnerXP.lnk
2014-04-04 10:44 - 2014-04-06 16:28 - 00000000 ____D () C:\Users\beasy\AppData\Roaming\Spotify
2014-04-04 10:44 - 2014-04-06 10:14 - 00000000 ____D () C:\Users\beasy\AppData\Local\Spotify
2014-04-04 10:44 - 2014-04-04 10:44 - 00001770 _____ () C:\Users\beasy\Desktop\Spotify.lnk
2014-04-04 10:44 - 2014-04-04 10:44 - 00001756 _____ () C:\Users\beasy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2014-03-30 21:21 - 2014-03-31 08:54 - 00000000 ____D () C:\Users\beasy\Desktop\gfx load
2014-03-30 17:30 - 2014-03-30 17:50 - 00000031 _____ () C:\Users\beasy\Desktop\basilikum.txt
2014-03-30 12:55 - 2014-03-30 12:55 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
==================== One Month Modified Files and Folders =======
2014-04-28 21:59 - 2014-04-24 22:11 - 00000000 ____D () C:\FRST
2014-04-28 21:59 - 2014-04-24 22:06 - 00000000 ____D () C:\Users\beasy\Desktop\yantoo entfernen
2014-04-28 21:58 - 2013-04-07 15:16 - 00000000 ____D () C:\Users\beasy\Desktop\musik
2014-04-28 21:04 - 2013-03-22 00:16 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-28 18:58 - 2014-04-24 12:57 - 00000000 ____D () C:\Users\beasy\Desktop\instagram
2014-04-28 18:57 - 2013-11-15 13:10 - 00000000 ____D () C:\Users\beasy\Desktop\Fotografie
2014-04-28 17:26 - 2014-04-28 17:26 - 00855379 _____ () C:\Users\beasy\Desktop\SecurityCheck.exe
2014-04-28 17:25 - 2009-07-14 06:45 - 00014624 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-28 17:25 - 2009-07-14 06:45 - 00014624 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-28 17:22 - 2013-03-22 13:31 - 00000000 ____D () C:\Users\beasy\Documents\Outlook-Dateien
2014-04-28 17:22 - 2013-03-21 18:44 - 01192594 _____ () C:\Windows\WindowsUpdate.log
2014-04-28 17:21 - 2013-08-21 17:40 - 01559887 _____ () C:\Windows\avmacc.log
2014-04-28 17:20 - 2009-07-14 04:34 - 00000513 _____ () C:\Windows\win.ini
2014-04-28 17:19 - 2014-04-27 15:57 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-28 17:19 - 2013-03-24 19:12 - 00000000 ____D () C:\Users\beasy\AppData\Roaming\WTablet
2014-04-28 17:18 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-28 17:18 - 2009-07-14 06:51 - 00106583 _____ () C:\Windows\setupact.log
2014-04-28 08:36 - 2013-03-22 12:27 - 00000000 ____D () C:\Users\beasy\AppData\Local\Adobe
2014-04-27 22:14 - 2009-07-14 19:58 - 00703980 _____ () C:\Windows\system32\perfh007.dat
2014-04-27 22:14 - 2009-07-14 19:58 - 00151118 _____ () C:\Windows\system32\perfc007.dat
2014-04-27 22:14 - 2009-07-14 07:13 - 01632706 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-27 21:51 - 2013-03-27 20:32 - 00000000 ____D () C:\Program Files (x86)\JDownloader
2014-04-27 21:05 - 2013-03-22 00:20 - 00000000 ____D () C:\Users\beasy\AppData\Roaming\vlc
2014-04-27 16:58 - 2014-04-27 16:58 - 00000033 _____ () C:\Users\beasy\Desktop\temp pfad.txt
2014-04-27 16:35 - 2014-04-27 16:35 - 00000000 ____D () C:\Windows\ERUNT
2014-04-27 16:34 - 2013-03-21 18:44 - 00000000 ___RD () C:\Users\beasy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-27 16:33 - 2014-02-17 22:20 - 00002170 _____ () C:\Users\Public\Desktop\HP Photosmart Essential 3.5.lnk
2014-04-27 16:30 - 2013-03-21 19:11 - 01107664 _____ () C:\Windows\PFRO.log
2014-04-27 16:29 - 2014-04-24 21:11 - 00000000 ____D () C:\AdwCleaner
2014-04-27 15:56 - 2014-04-27 15:56 - 00001105 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-27 15:56 - 2014-04-27 15:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-04-27 15:56 - 2014-04-27 15:56 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-27 15:56 - 2014-04-27 15:56 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-26 15:01 - 2014-04-26 14:55 - 00000959 _____ () C:\Users\beasy\Desktop\text.txt
2014-04-26 14:39 - 2013-08-30 10:07 - 00000000 ____D () C:\Program Files (x86)\Everything
2014-04-26 14:38 - 2013-04-19 02:07 - 00000000 ____D () C:\Users\beasy\AppData\Local\Deployment
2014-04-25 11:30 - 2013-04-28 12:44 - 00000000 ____D () C:\Windows\Minidump
2014-04-25 11:30 - 2013-03-21 18:39 - 00293093 ____N () C:\Windows\Minidump\042514-11278-01.dmp
2014-04-24 23:23 - 2013-09-23 14:12 - 00106272 _____ (G Data Software) C:\Windows\system32\Drivers\GRD.sys
2014-04-24 23:23 - 2013-09-23 14:12 - 00018160 _____ (G Data Software) C:\Windows\system32\Drivers\GdPhyMem.sys
2014-04-24 22:58 - 2013-04-01 21:23 - 00000000 ____D () C:\Users\beasy\AppData\Local\CrashDumps
2014-04-24 22:07 - 2014-04-24 22:07 - 00000168 _____ () C:\Users\beasy\defogger_reenable
2014-04-24 22:07 - 2013-03-21 18:44 - 00000000 ____D () C:\Users\beasy
2014-04-24 20:33 - 2013-03-21 19:23 - 00155646 _____ () C:\Windows\DPINST.LOG
2014-04-24 20:14 - 2013-06-04 20:31 - 00001456 _____ () C:\Users\beasy\AppData\Local\Adobe Für Web speichern 12.0 Prefs
2014-04-21 16:23 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-21 14:58 - 2014-04-21 14:58 - 00000000 ____D () C:\ProgramData\McAfee
2014-04-21 14:58 - 2013-03-22 00:16 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-21 14:58 - 2013-03-22 00:16 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-21 14:58 - 2013-03-22 00:16 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-19 12:54 - 2014-04-19 12:54 - 00000656 _____ () C:\Users\beasy\Desktop\Design.lnk
2014-04-19 12:07 - 2014-04-19 12:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Evernote
2014-04-16 20:47 - 2014-01-09 16:49 - 00000132 _____ () C:\Users\beasy\AppData\Roaming\Adobe BMP Format CS5 Prefs
2014-04-16 20:44 - 2013-03-21 19:19 - 00167320 _____ () C:\Users\beasy\AppData\Local\GDIPFONTCACHEV1.DAT
2014-04-16 20:44 - 2009-07-14 06:45 - 11710880 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-04-16 20:11 - 2013-04-04 23:36 - 00000000 ____D () C:\Windows\pss
2014-04-13 13:38 - 2013-10-11 08:36 - 00000000 ____D () C:\WTablet
2014-04-12 12:13 - 2014-02-01 00:37 - 00014324 _____ () C:\Users\beasy\Maschine2.log
2014-04-12 12:12 - 2014-02-01 00:37 - 00000968 _____ () C:\Users\beasy\ScanApp.log
2014-04-11 17:05 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-10 13:46 - 2013-03-22 00:14 - 00000000 ____D () C:\Program Files (x86)\Heroes of Newerth
2014-04-10 10:05 - 2013-03-22 00:23 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-10 10:04 - 2013-08-14 22:46 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-10 10:03 - 2013-03-28 12:34 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-09 08:53 - 2014-02-01 12:15 - 00000000 ____D () C:\Users\beasy\AppData\Roaming\Audacity
2014-04-08 20:07 - 2013-03-23 18:56 - 00000000 ____D () C:\Users\beasy\AppData\Roaming\Skype
2014-04-08 19:28 - 2014-04-08 19:28 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-04-08 19:28 - 2014-04-08 19:28 - 00000000 ____D () C:\Users\beasy\AppData\Local\Skype
2014-04-08 19:28 - 2014-04-08 19:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-04-08 19:28 - 2013-03-23 18:56 - 00000000 ____D () C:\ProgramData\Skype
2014-04-08 18:08 - 2013-03-22 00:18 - 00000000 ____D () C:\Users\beasy\AppData\Roaming\Adobe
2014-04-06 18:29 - 2014-04-06 18:29 - 00022016 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBFlt64.sys
2014-04-06 18:29 - 2014-04-06 18:29 - 00001981 _____ () C:\Users\Public\Desktop\G Data InternetSecurity.lnk
2014-04-06 18:29 - 2014-04-06 18:29 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_GDKBFlt64_01007.Wdf
2014-04-06 18:29 - 2014-04-06 18:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity
2014-04-06 18:29 - 2013-09-23 14:05 - 00135168 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys
2014-04-06 18:29 - 2013-09-23 14:05 - 00068608 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys
2014-04-06 18:29 - 2013-09-23 14:05 - 00065024 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys
2014-04-06 18:29 - 2013-09-23 14:05 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd64.sys
2014-04-06 18:29 - 2013-09-23 14:05 - 00057344 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys
2014-04-06 18:29 - 2013-09-23 13:52 - 00000000 ____D () C:\ProgramData\G Data
2014-04-06 16:28 - 2014-04-04 10:44 - 00000000 ____D () C:\Users\beasy\AppData\Roaming\Spotify
2014-04-06 10:14 - 2014-04-04 10:44 - 00000000 ____D () C:\Users\beasy\AppData\Local\Spotify
2014-04-06 10:13 - 2013-05-21 15:29 - 00000000 ____D () C:\Program Files (x86)\CDBurnerXP
2014-04-04 22:20 - 2014-04-04 22:20 - 00001952 _____ () C:\Users\Public\Desktop\CDBurnerXP.lnk
2014-04-04 22:20 - 2013-05-21 15:29 - 00001902 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2014-04-04 10:44 - 2014-04-04 10:44 - 00001770 _____ () C:\Users\beasy\Desktop\Spotify.lnk
2014-04-04 10:44 - 2014-04-04 10:44 - 00001756 _____ () C:\Users\beasy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2014-04-04 09:38 - 2013-03-22 00:34 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-04-03 09:51 - 2014-04-27 15:56 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-04-27 15:56 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-04-27 15:56 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-03-31 08:54 - 2014-03-30 21:21 - 00000000 ____D () C:\Users\beasy\Desktop\gfx load
2014-03-31 03:16 - 2014-04-10 09:00 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-31 03:13 - 2014-04-10 09:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-31 02:13 - 2014-04-10 09:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-31 01:57 - 2014-04-10 09:00 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-30 17:50 - 2014-03-30 17:30 - 00000031 _____ () C:\Users\beasy\Desktop\basilikum.txt
2014-03-30 17:07 - 2013-03-21 19:13 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-03-30 12:55 - 2014-03-30 12:55 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-04-19 12:24
==================== End Of Log ============================
--- --- --- "CHR RestoreOnStartup: "hxxp://websearch.searchmainia.info/?unqvl=15"" gehört da doch sicher nicht hin oder? Geändert von iNERD (28.04.2014 um 21:18 Uhr) Grund: FRST ergänzt |
|
29.04.2014, 19:33
| #11 |
| /// the machine /// TB-Ausbilder | Wie entferne ich Yontoo? Genau Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter CHR RestoreOnStartup: "hxxp://websearch.searchmainia.info/?unqvl=15"
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Wie entferne ich Yontoo? |
| abend, auffällig, bräuchte, desktop, entdeck, entferne, entfernen, guten, hilfe, informationen, langsam, msconfig, pup.optional.babylon.a, pup.optional.delta.a, pup.optional.installcore.a, pup.optional.sprotector.a, pup.optional.websearchinfo, stelle, systemkonfiguration, systems, systemstart, win32/adware.multiplug.h, yontoo |
Linear-Darstellung
