| |
| |||||||
Log-Analyse und Auswertung: Windows 8: Werbetafeln auf Webseiten und Umleitung auf WerbeseitenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte. |
 |
07.05.2014, 14:05
| #1 |
| |  Windows 8: Werbetafeln auf Webseiten und Umleitung auf Werbeseiten Hallo, mein Problem besteht schon längere Zeit und ich bin letzten Endes auf diese Seite gestoßen, um mir Hilfe zu holen. Ich vermute, dass mein Computer mit einem Virus infiziert wurde, nachdem ich mir Freeware von einer Webseite runtergeladen habe. Das zeigt sich durch unterstrichene Wörter auf allen Internetseiten, die zusätzlich mit einem grünem Kreis markiert sind. Sobald ich mit der Maus auf den Kreis gehe, erscheint die Information 'Click to continue > by Feven Pro 1.2'. Zusätzlich ist jede Seite bepackt mit kleinen Werbetafeln, die unter sich die Information 'Ads By OnlineBrowserAdvertising' und 'Ad Options' zeigen. Klicke ich auf diese Links, werde ich zu folgender Seite weitergeleitet: hxxp://rvzr-a.akamaihd.net/sd/apps/adinfo-1.0-p/index.html?bj1PbmxpbmVCcm93c2VyQWR2ZXJ0aXNpbmcmaD1ydnpyLWEuYWthbWFpaGQubmV0JmM9Z3JlZW4mbz13c2FyJmQ9JnQ9MTsyOzM7NDs1OzY7Nzs4Ozk7MTA7MTE7MTI7MTM7MTQmYT0 xNzAwJnM9MTAwOCZ3PXd3dy5zcGVrdHJ1bS5kZSZiPWJkMiZyZD0mcmk9 Außerdem werden immer wieder neue Fenster mit Werbung geöffnet. Was ich bisher getan habe: lange Zeit nichts. Auf Rat eines Freundes setzte ich allerdings meine Internetbrowser (Firefox und Internet Explorer) zurück und holte mir das Add on NoScript. Allerdings musste ich feststellen, dass wenn Seiten durch das Add on blockiert wurden, ich keinen Zugang zu passwortgeschützten Seiten habe mit der Folge, dass ich keine Skripte für die Uni downloaden kann. Also muss ich die Blockierung entfernen und schon erscheint überall wieder die Werbung, was den Computer enorm langsamer werden lässt. Falls es noch Hilfe für mein Problem gibt, wäre ich dankbar dafür. Beste Grüße  |
|
07.05.2014, 17:12
| #2 |
| /// the machine /// TB-Ausbilder    | Windows 8: Werbetafeln auf Webseiten und Umleitung auf Werbeseiten Hi,
__________________Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen. Ich kann auf Arbeit keine Anhänge öffnen, danke.  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
07.05.2014, 18:45
| #3 |
| | Windows 8: Werbetafeln auf Webseiten und Umleitung auf WerbeseitenCode:
ATTFilter GMER Logfile: FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-05-2014
Ran by ******** (administrator) on ANA on 07-05-2014 11:30:16
Running from C:\Users\********\Desktop
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Cherished Technololgy LIMITED) C:\ProgramData\WPM\wprotectmanager.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
() C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\AdminService.exe
(REINER SCT) C:\Windows\SysWOW64\cjpcsc.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Parallel Lines Development, LLC) C:\ProgramData\InternetUpdater\InternetUpdaterService.exe
(Acer Incorporate) C:\Program Files\Packard Bell\Packard Bell Launch Manager\LMSvc.exe
() C:\Program Files (x86)\NewPlayer\NewPlayerUpdaterService.exe
(Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesApp64.exe
(Atheros Communications) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe
() C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Pixart Imaging Inc) C:\Windows\System32\TiltWheelMouse.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Conduit) C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe
(Conduit) C:\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe
(Conduit) C:\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\ielowutil.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_206.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_206.exe
(Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2874256 2012-12-07] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13519432 2000-01-01] (Realtek Semiconductor)
HKLM\...\Run: [MouseDriver] => C:\Windows\system32\TiltWheelMouse.exe [241152 2013-04-09] (Pixart Imaging Inc)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-03-13] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-24] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Updater] => C:\ProgramData\Updater\Updater.exe [486264 2013-12-19] (Updater)
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe [132736 2013-04-15] ( (Atheros Communications))
HKU\S-1-5-21-529792085-2144148937-180937944-1001\...\Run: [Optimizer Pro] => C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe [134648 2013-10-28] ()
HKU\S-1-5-21-529792085-2144148937-180937944-1001\...\Run: [Amazon Cloud Player] => C:\Users\********\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3140608 2014-01-14] ()
HKU\S-1-5-21-529792085-2144148937-180937944-1001\...\Run: [IncrediMail] => C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [444840 2014-01-29] (IncrediMail, Ltd.)
HKU\S-1-5-21-529792085-2144148937-180937944-1001\...\Run: [Updater] => C:\ProgramData\Updater\updater.exe [486264 2013-12-19] (Updater)
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll [1355552 2014-04-08] (Conduit)
AppInit_DLLs: C:\PROGRA~2\OPTIMI~1\OPTPRO~2.DLL => C:\Program Files (x86)\Optimizer Pro\OptProCrash_x64.dll [4448072 2013-12-02] ()
AppInit_DLLs-x32: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll [1050912 2014-04-08] (Conduit)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com/?ctid=CT3314932&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP64625AB8-0A50-47DC-97B9-A8FAC97E22FB&SSPV=
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1386002337&from=tugs&uid=TOSHIBAXMQ01ABD050_53PFP88HTXX53PFP88HT&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1386002337&from=tugs&uid=TOSHIBAXMQ01ABD050_53PFP88HTXX53PFP88HT
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1386002337&from=tugs&uid=TOSHIBAXMQ01ABD050_53PFP88HTXX53PFP88HT
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1386002337&from=tugs&uid=TOSHIBAXMQ01ABD050_53PFP88HTXX53PFP88HT&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1386002337&from=tugs&uid=TOSHIBAXMQ01ABD050_53PFP88HTXX53PFP88HT&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1386002337&from=tugs&uid=TOSHIBAXMQ01ABD050_53PFP88HTXX53PFP88HT
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1386002337&from=tugs&uid=TOSHIBAXMQ01ABD050_53PFP88HTXX53PFP88HT
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1386002337&from=tugs&uid=TOSHIBAXMQ01ABD050_53PFP88HTXX53PFP88HT&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.nationzoom.com/?type=sc&ts=1386002337&from=tugs&uid=TOSHIBAXMQ01ABD050_53PFP88HTXX53PFP88HT
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1386002337&from=tugs&uid=TOSHIBAXMQ01ABD050_53PFP88HTXX53PFP88HT&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1386002337&from=tugs&uid=TOSHIBAXMQ01ABD050_53PFP88HTXX53PFP88HT&q={searchTerms}
SearchScopes: HKLM - {5A6CD5A0-E384-4C39-B2EA-2C4345E8590B} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAPBJS
SearchScopes: HKLM - {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1386002337&from=tugs&uid=TOSHIBAXMQ01ABD050_53PFP88HTXX53PFP88HT&q={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1386002337&from=tugs&uid=TOSHIBAXMQ01ABD050_53PFP88HTXX53PFP88HT&q={searchTerms}
SearchScopes: HKLM-x32 - {5A6CD5A0-E384-4C39-B2EA-2C4345E8590B} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAPBJS
SearchScopes: HKLM-x32 - {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3314932&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP64625AB8-0A50-47DC-97B9-A8FAC97E22FB&q={searchTerms}&SSPV=
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3314932&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP64625AB8-0A50-47DC-97B9-A8FAC97E22FB&q={searchTerms}&SSPV=
BHO: freeven - {11111111-1111-1111-1111-110511161182} - C:\Program Files (x86)\freeven\freeven-bho64.dll (freeven)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.141\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Speed Test Analysis - {310D38FE-EB4C-467C-8781-B7C2AEB7847D} - C:\Program Files (x86)\Speed Test Analysis\ScriptHost.dll (SpeedAnalysis.com)
BHO-x32: Websteroids - {44ed99e2-16a6-4b89-80d6-5b21cf42e78b} - C:\ProgramData\Websteroids\IE\common.dll (Creative Island Media, LLC)
BHO-x32: Re-markit - {7acc27ef-a170-48ba-823f-a8ad857c9fb7} - C:\Program Files (x86)\Re-markit\136.dll ()
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\8jtvym4t.default-1398775407563
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\nationzoom.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: MediaPlayerEnhance - C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\8jtvym4t.default-1398775407563\Extensions\0c822a17-a68f-4066-9257-d229458d21ca@9c178d17-dc61-4aaf-b2da-1425ac7300ac.com [2014-05-01]
FF Extension: freeven - C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\8jtvym4t.default-1398775407563\Extensions\e49d3f99-7c89-4eb4-99f3-ff903e2189b2@5288754a-7a48-41a0-a10f-e98c9ac12040.com [2014-04-29]
FF Extension: NoScript - C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\8jtvym4t.default-1398775407563\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-04-29]
FF HKCU\...\Firefox\Extensions: [{8e7d6746-77a0-402a-b4ab-a6f73a41db80}] - C:\Program Files (x86)\Re-markit\136.xpi
FF Extension: Re-markit - C:\Program Files (x86)\Re-markit\136.xpi [2013-12-02]
==================== Services (Whitelisted) =================
S2 70e6ca8c; C:\Program Files (x86)\Optimizer Pro\OptProCrashSvc.dll [191128 2013-12-02] ()
R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-24] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1017424 2014-02-24] (Avira Operations GmbH & Co. KG)
R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [228480 2013-04-15] (Qualcomm Atheros Commnucations)
S2 BackupStack; C:\Program Files (x86)\MyPC Backup\BackupStack.exe [38440 2013-09-20] ()
R2 cjpcsc; C:\Windows\SysWOW64\cjpcsc.exe [515632 2013-05-21] (REINER SCT)
R2 CltMngSvc; C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe [2470688 2014-04-08] (Conduit)
S3 DeviceFastLaneService; C:\Program Files\Packard Bell\Packard Bell Device Fast-lane\DeviceFastLaneSvc.exe [469648 2012-11-16] (Acer Incorporated)
S3 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [662088 2013-03-15] (Acer Incorporated)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [100752 2012-12-07] (ELAN Microelectronics Corp.)
R2 InternetUpdater; C:\ProgramData\InternetUpdater\InternetUpdaterService.exe [45568 2014-01-15] (Parallel Lines Development, LLC)
R2 LMSvc; C:\Program Files\Packard Bell\Packard Bell Launch Manager\LMSvc.exe [431656 2013-03-15] (Acer Incorporate)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe [289256 2014-01-16] (McAfee, Inc.)
R2 NewPlayerUpdaterService; C:\Program Files (x86)\NewPlayer\NewPlayerUpdaterService.exe [11776 2014-02-25] ()
R2 StarMoney 9.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [663184 2014-01-27] (Star Finanz-Software Entwicklung und Vertriebs GmbH)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [2412344 2014-01-28] (TuneUp Software)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-10-25] (Microsoft Corporation)
R2 Wpm; C:\ProgramData\WPM\wprotectmanager.exe [499856 2013-12-02] (Cherished Technololgy LIMITED)
==================== Drivers (Whitelisted) ====================
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [94208 2013-02-14] (Advanced Micro Devices)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-22] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131576 2013-12-22] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [84720 2013-12-22] (Avira Operations GmbH & Co. KG)
S3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [5139968 2012-06-02] (Broadcom Corporation)
S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-04-15] (Qualcomm Atheros)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
S3 cjusb; C:\Windows\system32\DRIVERS\cjusb.sys [35192 2012-09-04] (REINER SCT)
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
R3 LMDriver; C:\Windows\System32\drivers\LMDriver.sys [21360 2013-01-10] (Acer Incorporated)
R3 RadioShim; C:\Windows\System32\drivers\RadioShim.sys [15704 2013-01-10] (Acer Incorporated)
S3 SWDUMon; C:\Windows\system32\DRIVERS\SWDUMon.sys [16152 2013-11-17] ()
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [11880 2012-07-19] (TuneUp Software)
R3 t_mouse.sys; C:\Windows\system32\DRIVERS\t_mouse.sys [6144 2013-04-09] ()
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-05-07 11:30 - 2014-05-07 11:30 - 00018223 _____ () C:\Users\********\Desktop\FRST.txt
2014-05-07 11:30 - 2014-05-07 11:30 - 00000000 ____D () C:\FRST
2014-05-07 11:29 - 2014-05-07 11:29 - 02063872 _____ (Farbar) C:\Users\********\Desktop\FRST64.exe
2014-05-07 11:25 - 2014-05-07 11:26 - 00000480 _____ () C:\Users\********\Desktop\defogger_disable.log
2014-05-07 11:23 - 2014-05-07 11:25 - 00000480 _____ () C:\Users\********\Downloads\defogger_disable.log
2014-05-07 11:23 - 2014-05-07 11:23 - 00000000 _____ () C:\Users\********\defogger_reenable
2014-05-07 11:21 - 2014-05-07 11:22 - 00050477 _____ () C:\Users\********\Desktop\Defogger.exe
2014-05-06 15:01 - 2014-04-19 11:39 - 00628024 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe
2014-05-06 15:01 - 2014-04-19 10:45 - 00693760 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-05-06 15:01 - 2014-04-19 10:45 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-05-06 15:01 - 2014-04-19 08:57 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-05-06 15:01 - 2014-04-19 08:57 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-05-05 06:59 - 2014-04-29 16:14 - 19275264 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-05 06:59 - 2014-04-29 14:47 - 14357504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-05 06:59 - 2014-04-29 14:36 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-05 06:59 - 2014-04-29 14:25 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-30 10:04 - 2014-04-30 10:04 - 251586632 _____ () C:\Users\********\Documents\regedit Sicherung.reg
2014-04-29 17:15 - 2014-04-29 17:15 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-04-12 20:30 - 2014-03-07 02:48 - 01766400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-12 20:30 - 2014-03-07 02:48 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-12 20:30 - 2014-03-07 02:47 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-12 20:30 - 2014-03-07 02:47 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-12 20:30 - 2014-03-07 02:47 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-12 20:30 - 2014-03-07 02:08 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-12 20:30 - 2014-03-07 02:08 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-12 20:30 - 2013-05-16 00:37 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2014-04-12 20:30 - 2013-05-16 00:35 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll
2014-04-12 20:30 - 2013-02-21 12:29 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-12 20:30 - 2013-02-21 12:29 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-12 20:30 - 2013-02-21 12:29 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-12 20:30 - 2013-02-19 11:53 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll
2014-04-12 20:30 - 2012-11-08 06:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-12 20:30 - 2012-07-26 05:06 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-12 20:29 - 2014-03-07 02:47 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-12 20:29 - 2014-03-07 02:47 - 02049536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-12 20:29 - 2014-03-07 02:47 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-04-12 20:29 - 2014-03-07 02:08 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-12 20:29 - 2014-03-07 02:08 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-12 20:29 - 2014-03-07 02:08 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-12 20:29 - 2014-03-07 02:08 - 02240000 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-12 20:29 - 2014-03-07 02:08 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2014-04-12 20:29 - 2014-03-07 02:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-04-12 20:29 - 2014-03-07 02:08 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-12 20:29 - 2013-02-21 12:29 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-04-12 20:29 - 2013-02-21 12:14 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-04-12 20:29 - 2013-02-21 12:14 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-12 20:29 - 2012-11-08 06:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-12 17:24 - 2014-02-04 01:56 - 00332632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-12 17:24 - 2014-02-04 01:56 - 00278872 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-12 17:24 - 2014-01-31 02:48 - 00485888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSDApi.dll
2014-04-12 17:24 - 2014-01-31 02:48 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.dll
2014-04-12 17:24 - 2014-01-31 02:06 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\WSDApi.dll
2014-04-12 17:24 - 2014-01-27 05:42 - 02232664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-04-12 17:24 - 2014-01-27 05:39 - 01939288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-12 17:24 - 2014-01-27 02:52 - 17561088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-04-12 17:24 - 2014-01-27 02:31 - 19752448 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-04-12 17:24 - 2014-01-27 01:17 - 00386722 _____ () C:\Windows\system32\ApnDatabase.xml
2014-04-12 17:24 - 2014-01-16 01:42 - 00118784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dfsc.sys
2014-04-12 17:24 - 2014-01-11 08:48 - 05979648 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-04-12 17:24 - 2014-01-11 07:06 - 05092352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-04-12 17:24 - 2014-01-03 01:35 - 00365568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2014-04-12 17:24 - 2014-01-03 01:32 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2014-04-09 12:22 - 2014-02-06 01:41 - 01257984 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 12:22 - 2014-02-06 01:41 - 00978432 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-04-09 12:22 - 2014-02-06 01:26 - 00666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-04-09 12:22 - 2014-02-06 01:19 - 00974848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
==================== One Month Modified Files and Folders =======
2014-05-07 11:30 - 2014-05-07 11:30 - 00018223 _____ () C:\Users\********\Desktop\FRST.txt
2014-05-07 11:30 - 2014-05-07 11:30 - 00000000 ____D () C:\FRST
2014-05-07 11:29 - 2014-05-07 11:29 - 02063872 _____ (Farbar) C:\Users\********\Desktop\FRST64.exe
2014-05-07 11:27 - 2013-10-07 14:55 - 00003926 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{1FE1C09B-6610-4F02-922D-F5789EB168C5}
2014-05-07 11:26 - 2014-05-07 11:25 - 00000480 _____ () C:\Users\********\Desktop\defogger_disable.log
2014-05-07 11:25 - 2014-05-07 11:23 - 00000480 _____ () C:\Users\********\Downloads\defogger_disable.log
2014-05-07 11:25 - 2013-12-18 19:15 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-07 11:23 - 2014-05-07 11:23 - 00000000 _____ () C:\Users\********\defogger_reenable
2014-05-07 11:23 - 2013-09-28 14:25 - 00000000 ____D () C:\Users\********
2014-05-07 11:22 - 2014-05-07 11:21 - 00050477 _____ () C:\Users\********\Desktop\Defogger.exe
2014-05-07 11:21 - 2013-06-26 18:33 - 01361842 _____ () C:\Windows\WindowsUpdate.log
2014-05-07 11:04 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\WinStore
2014-05-07 10:50 - 2013-11-11 14:08 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-07 10:25 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\AUInstallAgent
2014-05-07 10:23 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\sru
2014-05-06 23:05 - 2013-06-26 18:49 - 00065536 _____ () C:\Windows\system32\spu_storage.bin
2014-05-03 20:33 - 2014-03-10 15:28 - 00002250 _____ () C:\Windows\Tasks\freeven-firefoxinstaller.job
2014-05-03 20:30 - 2014-03-10 15:30 - 00001500 _____ () C:\Windows\Tasks\freeven-updater.job
2014-05-03 20:29 - 2014-03-10 15:29 - 00002374 _____ () C:\Windows\Tasks\media enhance-firefoxinstaller.job
2014-05-03 20:29 - 2014-03-10 15:29 - 00001454 _____ () C:\Windows\Tasks\freeven-codedownloader.job
2014-05-03 20:29 - 2014-03-10 15:28 - 00003116 _____ () C:\Windows\Tasks\media enhance-chromeinstaller.job
2014-05-03 20:28 - 2014-03-10 15:28 - 00003092 _____ () C:\Windows\Tasks\freeven-chromeinstaller.job
2014-04-30 18:25 - 2013-12-18 19:15 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-30 10:04 - 2014-04-30 10:04 - 251586632 _____ () C:\Users\********\Documents\regedit Sicherung.reg
2014-04-29 18:04 - 2014-02-08 12:47 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-04-29 17:15 - 2014-04-29 17:15 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-04-29 16:28 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\rescache
2014-04-29 16:14 - 2014-05-05 06:59 - 19275264 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-29 15:37 - 2013-09-28 14:34 - 00003596 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-529792085-2144148937-180937944-1001
2014-04-29 15:28 - 2014-03-10 15:28 - 00000000 ____D () C:\Program Files (x86)\freeven
2014-04-29 15:08 - 2013-06-27 04:13 - 00753134 _____ () C:\Windows\system32\perfh007.dat
2014-04-29 15:08 - 2013-06-27 04:13 - 00155826 _____ () C:\Windows\system32\perfc007.dat
2014-04-29 15:08 - 2012-07-26 09:28 - 01745416 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-29 15:02 - 2014-02-24 17:50 - 00003992 _____ () C:\Windows\PFRO.log
2014-04-29 15:02 - 2012-07-26 09:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-29 15:01 - 2012-07-26 07:26 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-04-29 14:47 - 2014-05-05 06:59 - 14357504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-29 14:43 - 2013-12-23 17:49 - 00000000 ____D () C:\Users\********\Desktop\Alte Firefox-Daten
2014-04-29 14:36 - 2014-05-05 06:59 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-29 14:25 - 2014-05-05 06:59 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-28 20:05 - 2013-11-11 14:08 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-28 19:04 - 2014-02-08 13:17 - 00000000 ____D () C:\Program Files (x86)\StarMoney 9.0
2014-04-23 01:47 - 2013-11-17 14:38 - 00694232 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-23 01:47 - 2013-11-17 14:38 - 00078296 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-19 11:39 - 2014-05-06 15:01 - 00628024 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe
2014-04-19 10:45 - 2014-05-06 15:01 - 00693760 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-04-19 10:45 - 2014-05-06 15:01 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-04-19 08:57 - 2014-05-06 15:01 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-04-19 08:57 - 2014-05-06 15:01 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-04-14 14:24 - 2012-07-26 10:12 - 00000000 ___RD () C:\Windows\ToastData
2014-04-14 07:28 - 2014-02-09 12:41 - 00000000 ____D () C:\Program Files (x86)\SearchProtect
2014-04-13 14:01 - 2014-03-21 15:11 - 00003180 _____ () C:\Windows\setupact.log
2014-04-09 12:53 - 2014-03-17 20:09 - 00000000 ____D () C:\ProgramData\TicTaCoUpon
2014-04-09 12:53 - 2014-02-20 21:58 - 00000000 ____D () C:\ProgramData\TAbleViiewer
2014-04-09 12:53 - 2014-02-20 20:58 - 00000000 ____D () C:\ProgramData\topdeAl
2014-04-09 12:53 - 2014-01-24 13:57 - 00000000 ____D () C:\ProgramData\webseaVer
2014-04-09 12:52 - 2014-01-24 13:57 - 00000000 ____D () C:\ProgramData\AAppptooU
2014-04-09 12:48 - 2013-09-30 13:33 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-09 12:44 - 2013-09-30 13:33 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
Some content of TEMP:
====================
C:\Users\********\AppData\Local\Temp\avgnt.exe
C:\Users\********\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-05-07 11:04
==================== End Of Log ============================
--- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- [/CODE] Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 06-05-2014
Ran by ******** at 2014-05-07 11:31:41
Running from C:\Users\********\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Out of date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Enabled - Out of date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.206 - Adobe Systems Incorporated)
Amazon Cloud Player (HKCU\...\Amazon Amazon Cloud Player) (Version: 2.3.0.422 - Amazon Services LLC)
AMD Accelerated Video Transcoding (Version: 12.10.100.30313 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.1016.4 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{A6A7A944-0186-29D4-8FF9-EDD008403E08}) (Version: 8.0.911.0 - Advanced Micro Devices, Inc.)
ccc-utility64 (Version: 2013.0313.13.41666 - Advanced Micro Devices, Inc.) Hidden
ETDWare PS/2-X64 11.6.17.002_WHQL (HKLM\...\Elantech) (Version: 11.6.17.002 - ELAN Microelectronic Corp.)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.141.11 - McAfee, Inc.)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 29.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 29.0 (x86 de)) (Version: 29.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
MyPC Backup (HKLM\...\MyPC Backup) (Version: - MyPC Backup) <==== ATTENTION
Packard Bell Device Fast-lane (HKLM\...\{3F62D2FD-13C1-49A2-8B5D-47623D9460D7}) (Version: 1.00.3011 - Packard Bell)
Packard Bell Launch Manager (HKLM\...\{C18D55BD-1EC6-466D-B763-8EEDDDA9100E}) (Version: 8.00.3003 - Packard Bell)
Packard Bell Power Management (HKLM\...\{91F52DE4-B789-42B0-9311-A349F10E5479}) (Version: 7.00.3013 - Packard Bell)
Packard Bell Recovery Management (HKLM\...\{07F2005A-8CAC-4A4B-83A2-DA98A722CA61}) (Version: 6.00.3016 - Packard Bell)
PhotoFiltre 7 (HKCU\...\PhotoFiltre 7) (Version: - )
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.0.224 - Qualcomm Atheros Communications)
==================== Restore Points =========================
14-04-2014 12:01:22 Windows Update
21-04-2014 13:20:48 Geplanter Prüfpunkt
28-04-2014 17:19:18 Geplanter Prüfpunkt
05-05-2014 05:04:40 Windows Update
==================== Hosts content: ==========================
2012-07-26 07:26 - 2012-07-26 07:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {0ABCE008-56C7-4F3D-BA52-72E89AD3CDBD} - System32\Tasks\freeven-firefoxinstaller => C:\Program Files (x86)\freeven\freeven-firefoxinstaller.exe [2014-03-10] (freeven) <==== ATTENTION
Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {271DF31D-81B3-426C-B2D3-3C45494B8995} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\TuneUp Utilities 2013\OneClick.exe [2014-01-28] (TuneUp Software)
Task: {34607784-C965-4EBA-AB9D-390FFF4A247B} - System32\Tasks\Launch Manager => C:\Program Files\Packard Bell\Packard Bell Launch Manager\LMLauncher.exe [2013-03-15] (Acer Incorporate)
Task: {34812BF7-3FCE-424C-81FF-D8612ACF8DA6} - System32\Tasks\freeven-codedownloader => C:\Program Files (x86)\freeven\freeven-codedownloader.exe <==== ATTENTION
Task: {366B262A-8FC0-4BAE-A468-382075F8BBDD} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21] (Adobe Systems Incorporated)
Task: {3F1F3807-E352-4ADB-BA35-7D9992FB530A} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-28] (Adobe Systems Incorporated)
Task: {53445D97-60F2-432C-A50F-304644BC6A61} - System32\Tasks\Microsoft\Windows\Setup\Pre-staged GDR Notification => C:\Windows\system32\NotificationUI.exe [2014-04-19] (Microsoft Corporation)
Task: {5F610F8C-BDEC-476B-9712-0926ACF6C38E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-18] (Google Inc.)
Task: {60AD0A16-FFCD-481A-A1E8-89109E6BBE3C} - System32\Tasks\media enhance-chromeinstaller => C:\Program Files (x86)\media enhance\media enhance-chromeinstaller.exe [2014-03-10] (freeven) <==== ATTENTION
Task: {60CFA1BE-BF5C-4488-ABBF-779F1BF98079} - System32\Tasks\media enhance-codedownloader => C:\Program Files (x86)\media enhance\media enhance-codedownloader.exe [2014-03-10] (freeven) <==== ATTENTION
Task: {85FCD08C-9440-406A-A13B-DC373AC38A33} - System32\Tasks\freeven-chromeinstaller => C:\Program Files (x86)\freeven\freeven-chromeinstaller.exe [2014-03-10] (freeven) <==== ATTENTION
Task: {9CEBF02B-7198-4F2B-AF15-A0DDFE6FA02B} - System32\Tasks\Power Management => C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe [2013-03-15] (Acer Incorporated)
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {AE8FE2B0-1DCF-4BC9-96B4-927976405E42} - System32\Tasks\ALUAgent => C:\Program Files (x86)\Packard Bell\Live Updater\liveupdater_agent.exe [2013-01-22] ()
Task: {AED5D449-7B9C-4107-8E18-B673402AEEB7} - System32\Tasks\freeven-updater => C:\Program Files (x86)\freeven\freeven-updater.exe <==== ATTENTION
Task: {B012414F-0AE0-4FAD-B298-D95BAE8372DE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-18] (Google Inc.)
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {D3FBA45B-6D83-4D8E-ACA5-C7B7E7664129} - System32\Tasks\media enhance-firefoxinstaller => C:\Program Files (x86)\media enhance\media enhance-firefoxinstaller.exe [2014-03-10] (freeven) <==== ATTENTION
Task: {E9407CE0-6659-4908-B420-D13AED3FD91C} - System32\Tasks\SlimDrivers Startup => C:\Program Files (x86)\SlimDrivers\SlimDrivers.exe [2013-09-24] (SlimWare Utilities, Inc.)
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {EDEB5EC1-A6FA-4B60-B957-75C7CD5D6BD0} - System32\Tasks\ALU => C:\Program Files (x86)\Packard Bell\Live Updater\updater.exe [2013-02-22] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\freeven-chromeinstaller.job => C:\Program Files (x86)\freeven\freeven-chromeinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\freeven-codedownloader.job => C:\Program Files (x86)\freeven\freeven-codedownloader.exe <==== ATTENTION
Task: C:\Windows\Tasks\freeven-firefoxinstaller.job => C:\Program Files (x86)\freeven\freeven-firefoxinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\freeven-updater.job => C:\Program Files (x86)\freeven\freeven-updater.exe <==== ATTENTION
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\media enhance-chromeinstaller.job => C:\Program Files (x86)\media enhance\media enhance-chromeinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\media enhance-codedownloader.job => C:\Program Files (x86)\media enhance\media enhance-codedownloader.exe <==== ATTENTION
Task: C:\Windows\Tasks\media enhance-firefoxinstaller.job => C:\Program Files (x86)\media enhance\media enhance-firefoxinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\SlimDrivers Startup.job => C:\Program Files (x86)\SlimDrivers\SlimDrivers.exe
==================== Loaded Modules (whitelisted) =============
2013-11-06 10:25 - 2012-09-18 16:27 - 00192512 _____ () C:\Windows\System32\zlhp1020.dll
2013-11-06 10:25 - 2012-09-18 16:27 - 00065024 _____ () C:\Windows\system32\spool\PRTPROCS\x64\pphp1020.dll
2013-11-06 10:25 - 2012-09-18 16:27 - 03162624 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\suhp1020.dll
2013-11-06 10:25 - 2012-09-18 16:27 - 01236992 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\gchp1020.dll
2008-10-24 16:35 - 2008-10-24 16:35 - 00128296 _____ () C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
2014-02-25 17:00 - 2014-02-25 17:00 - 00011776 _____ () C:\Program Files (x86)\NewPlayer\NewPlayerUpdaterService.exe
2014-01-28 13:34 - 2014-01-28 13:34 - 00741176 _____ () C:\Program Files (x86)\TuneUp Utilities 2013\avgrepliba.dll
2013-04-15 11:23 - 2013-04-15 11:23 - 00011264 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll
2013-04-15 11:20 - 2013-04-15 11:20 - 00086016 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\Map\MAP.dll
2013-04-15 11:25 - 2013-04-15 11:25 - 00012928 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
2013-04-09 06:46 - 2013-01-02 08:55 - 00175008 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\ModernShared\ErrorReporting\ErrorReporting.dll
2013-11-17 22:11 - 2013-10-31 20:25 - 00394808 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2014-02-08 13:20 - 2011-01-13 11:44 - 00232800 _____ () C:\Program Files (x86)\StarMoney 9.0\ouservice\PATCHW32.dll
2014-04-29 17:15 - 2014-04-29 17:15 - 03845232 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== EXE Association (whitelisted) =============
==================== Disabled items from MSCONFIG ==============
==================== Faulty Device Manager Devices =============
Name: Bluetooth USB Adapter
Description: Bluetooth USB Adapter
Class Guid: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974}
Manufacturer: Qualcomm Atheros Communications
Service: BTHUSB
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (04/29/2014 03:10:20 PM) (Source: MsiInstaller) (User: NT-AUTORITÄT) (EventID: 11921)
Description: Product: Nero Update -- Error 1921.Service Nero Update (NAUpdate) could not be stopped. Verify that you have sufficient privileges to stop system services.
Error: (04/24/2014 05:09:32 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2147023174. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (04/15/2014 10:02:58 AM) (Source: Application Hang) (User: ) (EventID: 1002)
Description: Programm Explorer.EXE, Version 6.2.9200.16628 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: e34
Startzeit: 01cf57dcf4c8e982
Endzeit: 0
Anwendungspfad: C:\Windows\Explorer.EXE
Berichts-ID: 56da3ebe-c474-11e3-be9a-54bef7315bfa
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Error: (04/08/2014 09:10:59 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2147023174. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (04/07/2014 11:24:09 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2147023174. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (03/12/2014 03:13:25 PM) (Source: SideBySide) (User: ) (EventID: 78)
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.
Error: (03/12/2014 00:38:34 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2147023174. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (03/09/2014 10:50:04 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2147023174. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (03/07/2014 11:47:42 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2147023174. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (03/06/2014 11:13:43 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 10.0.9200.16798, Zeitstempel: 0x52ec7da1
Name des fehlerhaften Moduls: SPVC32.dll, Version: 2.11.11.7, Zeitstempel: 0x53148395
Ausnahmecode: 0xc0000005
Fehleroffset: 0x004f3eda
ID des fehlerhaften Prozesses: 0x1eb4
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3
Vollständiger Name des fehlerhaften Pakets: IEXPLORE.EXE4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: IEXPLORE.EXE5
System errors:
=============
Error: (04/29/2014 03:04:05 PM) (Source: DCOM) (User: Ana) (EventID: 10016)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}Ana********S-1-5-21-529792085-2144148937-180937944-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (04/29/2014 03:04:05 PM) (Source: DCOM) (User: Ana) (EventID: 10016)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}Ana********S-1-5-21-529792085-2144148937-180937944-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (04/29/2014 03:04:05 PM) (Source: DCOM) (User: Ana) (EventID: 10016)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}Ana********S-1-5-21-529792085-2144148937-180937944-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (04/29/2014 03:04:05 PM) (Source: DCOM) (User: Ana) (EventID: 10016)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}Ana********S-1-5-21-529792085-2144148937-180937944-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (04/29/2014 03:04:05 PM) (Source: DCOM) (User: Ana) (EventID: 10016)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}Ana********S-1-5-21-529792085-2144148937-180937944-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (04/29/2014 03:02:42 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)
Description: Der Dienst "Computer Backup (MyPC Backup)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1392
Error: (04/14/2014 02:26:15 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)
Description: Der Dienst "Computer Backup (MyPC Backup)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1392
Error: (04/12/2014 05:13:13 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)
Description: Der Dienst "Computer Backup (MyPC Backup)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1392
Error: (04/12/2014 05:09:36 PM) (Source: Service Control Manager) (User: ) (EventID: 7043)
Description: Der Dienst Windows Update konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.
Error: (04/06/2014 09:33:48 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)
Description: Der Dienst "Computer Backup (MyPC Backup)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1392
Microsoft Office Sessions:
=========================
Error: (04/29/2014 03:10:20 PM) (Source: MsiInstaller) (User: NT-AUTORITÄT) (EventID: 11921)
Description: Product: Nero Update -- Error 1921.Service Nero Update (NAUpdate) could not be stopped. Verify that you have sufficient privileges to stop system services.(NULL)(NULL)(NULL)(NULL)(NULL)
Error: (04/24/2014 05:09:32 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2147023174
Error: (04/15/2014 10:02:58 AM) (Source: Application Hang) (User: ) (EventID: 1002)
Description: Explorer.EXE6.2.9200.16628e3401cf57dcf4c8e9820C:\Windows\Explorer.EXE56da3ebe-c474-11e3-be9a-54bef7315bfa
Error: (04/08/2014 09:10:59 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2147023174
Error: (04/07/2014 11:24:09 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2147023174
Error: (03/12/2014 03:13:25 PM) (Source: SideBySide) (User: ) (EventID: 78)
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Users\********\Downloads\SoftonicDownloader_fuer_apache-openoffice.exe
Error: (03/12/2014 00:38:34 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2147023174
Error: (03/09/2014 10:50:04 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2147023174
Error: (03/07/2014 11:47:42 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2147023174
Error: (03/06/2014 11:13:43 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: IEXPLORE.EXE10.0.9200.1679852ec7da1SPVC32.dll2.11.11.753148395c0000005004f3eda1eb401cf32deb4f6ec5bC:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32.dll9c830a10-a50f-11e3-be95-54bef7315bfa
==================== Memory info ===========================
Percentage of memory in use: 65%
Total physical RAM: 3529.25 MB
Available physical RAM: 1225.68 MB
Total Pagefile: 9929.25 MB
Available Pagefile: 6430.46 MB
Total Virtual: 8192 MB
Available Virtual: 8191.78 MB
==================== Drives ================================
Drive c: (Packard Bell) (Fixed) (Total:447.95 GB) (Free:375.42 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 466 GB) (Disk ID: AC49E186)
Partition: GPT Partition Type.
==================== End Of Log ============================
Code:
ATTFilter
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 11:26 on 07/05/2014 (Ana Sydow)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 06-05-2014
Ran by ******** at 2014-05-07 11:31:41
Running from C:\Users\********\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Out of date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Enabled - Out of date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.206 - Adobe Systems Incorporated)
Amazon Cloud Player (HKCU\...\Amazon Amazon Cloud Player) (Version: 2.3.0.422 - Amazon Services LLC)
AMD Accelerated Video Transcoding (Version: 12.10.100.30313 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.1016.4 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{A6A7A944-0186-29D4-8FF9-EDD008403E08}) (Version: 8.0.911.0 - Advanced Micro Devices, Inc.)
ccc-utility64 (Version: 2013.0313.13.41666 - Advanced Micro Devices, Inc.) Hidden
ETDWare PS/2-X64 11.6.17.002_WHQL (HKLM\...\Elantech) (Version: 11.6.17.002 - ELAN Microelectronic Corp.)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.141.11 - McAfee, Inc.)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 29.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 29.0 (x86 de)) (Version: 29.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
MyPC Backup (HKLM\...\MyPC Backup) (Version: - MyPC Backup) <==== ATTENTION
Packard Bell Device Fast-lane (HKLM\...\{3F62D2FD-13C1-49A2-8B5D-47623D9460D7}) (Version: 1.00.3011 - Packard Bell)
Packard Bell Launch Manager (HKLM\...\{C18D55BD-1EC6-466D-B763-8EEDDDA9100E}) (Version: 8.00.3003 - Packard Bell)
Packard Bell Power Management (HKLM\...\{91F52DE4-B789-42B0-9311-A349F10E5479}) (Version: 7.00.3013 - Packard Bell)
Packard Bell Recovery Management (HKLM\...\{07F2005A-8CAC-4A4B-83A2-DA98A722CA61}) (Version: 6.00.3016 - Packard Bell)
PhotoFiltre 7 (HKCU\...\PhotoFiltre 7) (Version: - )
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.0.224 - Qualcomm Atheros Communications)
==================== Restore Points =========================
14-04-2014 12:01:22 Windows Update
21-04-2014 13:20:48 Geplanter Prüfpunkt
28-04-2014 17:19:18 Geplanter Prüfpunkt
05-05-2014 05:04:40 Windows Update
==================== Hosts content: ==========================
2012-07-26 07:26 - 2012-07-26 07:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {0ABCE008-56C7-4F3D-BA52-72E89AD3CDBD} - System32\Tasks\freeven-firefoxinstaller => C:\Program Files (x86)\freeven\freeven-firefoxinstaller.exe [2014-03-10] (freeven) <==== ATTENTION
Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {271DF31D-81B3-426C-B2D3-3C45494B8995} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\TuneUp Utilities 2013\OneClick.exe [2014-01-28] (TuneUp Software)
Task: {34607784-C965-4EBA-AB9D-390FFF4A247B} - System32\Tasks\Launch Manager => C:\Program Files\Packard Bell\Packard Bell Launch Manager\LMLauncher.exe [2013-03-15] (Acer Incorporate)
Task: {34812BF7-3FCE-424C-81FF-D8612ACF8DA6} - System32\Tasks\freeven-codedownloader => C:\Program Files (x86)\freeven\freeven-codedownloader.exe <==== ATTENTION
Task: {366B262A-8FC0-4BAE-A468-382075F8BBDD} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21] (Adobe Systems Incorporated)
Task: {3F1F3807-E352-4ADB-BA35-7D9992FB530A} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-28] (Adobe Systems Incorporated)
Task: {53445D97-60F2-432C-A50F-304644BC6A61} - System32\Tasks\Microsoft\Windows\Setup\Pre-staged GDR Notification => C:\Windows\system32\NotificationUI.exe [2014-04-19] (Microsoft Corporation)
Task: {5F610F8C-BDEC-476B-9712-0926ACF6C38E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-18] (Google Inc.)
Task: {60AD0A16-FFCD-481A-A1E8-89109E6BBE3C} - System32\Tasks\media enhance-chromeinstaller => C:\Program Files (x86)\media enhance\media enhance-chromeinstaller.exe [2014-03-10] (freeven) <==== ATTENTION
Task: {60CFA1BE-BF5C-4488-ABBF-779F1BF98079} - System32\Tasks\media enhance-codedownloader => C:\Program Files (x86)\media enhance\media enhance-codedownloader.exe [2014-03-10] (freeven) <==== ATTENTION
Task: {85FCD08C-9440-406A-A13B-DC373AC38A33} - System32\Tasks\freeven-chromeinstaller => C:\Program Files (x86)\freeven\freeven-chromeinstaller.exe [2014-03-10] (freeven) <==== ATTENTION
Task: {9CEBF02B-7198-4F2B-AF15-A0DDFE6FA02B} - System32\Tasks\Power Management => C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe [2013-03-15] (Acer Incorporated)
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {AE8FE2B0-1DCF-4BC9-96B4-927976405E42} - System32\Tasks\ALUAgent => C:\Program Files (x86)\Packard Bell\Live Updater\liveupdater_agent.exe [2013-01-22] ()
Task: {AED5D449-7B9C-4107-8E18-B673402AEEB7} - System32\Tasks\freeven-updater => C:\Program Files (x86)\freeven\freeven-updater.exe <==== ATTENTION
Task: {B012414F-0AE0-4FAD-B298-D95BAE8372DE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-18] (Google Inc.)
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {D3FBA45B-6D83-4D8E-ACA5-C7B7E7664129} - System32\Tasks\media enhance-firefoxinstaller => C:\Program Files (x86)\media enhance\media enhance-firefoxinstaller.exe [2014-03-10] (freeven) <==== ATTENTION
Task: {E9407CE0-6659-4908-B420-D13AED3FD91C} - System32\Tasks\SlimDrivers Startup => C:\Program Files (x86)\SlimDrivers\SlimDrivers.exe [2013-09-24] (SlimWare Utilities, Inc.)
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {EDEB5EC1-A6FA-4B60-B957-75C7CD5D6BD0} - System32\Tasks\ALU => C:\Program Files (x86)\Packard Bell\Live Updater\updater.exe [2013-02-22] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\freeven-chromeinstaller.job => C:\Program Files (x86)\freeven\freeven-chromeinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\freeven-codedownloader.job => C:\Program Files (x86)\freeven\freeven-codedownloader.exe <==== ATTENTION
Task: C:\Windows\Tasks\freeven-firefoxinstaller.job => C:\Program Files (x86)\freeven\freeven-firefoxinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\freeven-updater.job => C:\Program Files (x86)\freeven\freeven-updater.exe <==== ATTENTION
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\media enhance-chromeinstaller.job => C:\Program Files (x86)\media enhance\media enhance-chromeinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\media enhance-codedownloader.job => C:\Program Files (x86)\media enhance\media enhance-codedownloader.exe <==== ATTENTION
Task: C:\Windows\Tasks\media enhance-firefoxinstaller.job => C:\Program Files (x86)\media enhance\media enhance-firefoxinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\SlimDrivers Startup.job => C:\Program Files (x86)\SlimDrivers\SlimDrivers.exe
==================== Loaded Modules (whitelisted) =============
2013-11-06 10:25 - 2012-09-18 16:27 - 00192512 _____ () C:\Windows\System32\zlhp1020.dll
2013-11-06 10:25 - 2012-09-18 16:27 - 00065024 _____ () C:\Windows\system32\spool\PRTPROCS\x64\pphp1020.dll
2013-11-06 10:25 - 2012-09-18 16:27 - 03162624 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\suhp1020.dll
2013-11-06 10:25 - 2012-09-18 16:27 - 01236992 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\gchp1020.dll
2008-10-24 16:35 - 2008-10-24 16:35 - 00128296 _____ () C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
2014-02-25 17:00 - 2014-02-25 17:00 - 00011776 _____ () C:\Program Files (x86)\NewPlayer\NewPlayerUpdaterService.exe
2014-01-28 13:34 - 2014-01-28 13:34 - 00741176 _____ () C:\Program Files (x86)\TuneUp Utilities 2013\avgrepliba.dll
2013-04-15 11:23 - 2013-04-15 11:23 - 00011264 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll
2013-04-15 11:20 - 2013-04-15 11:20 - 00086016 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\Map\MAP.dll
2013-04-15 11:25 - 2013-04-15 11:25 - 00012928 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
2013-04-09 06:46 - 2013-01-02 08:55 - 00175008 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\ModernShared\ErrorReporting\ErrorReporting.dll
2013-11-17 22:11 - 2013-10-31 20:25 - 00394808 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2014-02-08 13:20 - 2011-01-13 11:44 - 00232800 _____ () C:\Program Files (x86)\StarMoney 9.0\ouservice\PATCHW32.dll
2014-04-29 17:15 - 2014-04-29 17:15 - 03845232 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== EXE Association (whitelisted) =============
==================== Disabled items from MSCONFIG ==============
==================== Faulty Device Manager Devices =============
Name: Bluetooth USB Adapter
Description: Bluetooth USB Adapter
Class Guid: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974}
Manufacturer: Qualcomm Atheros Communications
Service: BTHUSB
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (04/29/2014 03:10:20 PM) (Source: MsiInstaller) (User: NT-AUTORITÄT) (EventID: 11921)
Description: Product: Nero Update -- Error 1921.Service Nero Update (NAUpdate) could not be stopped. Verify that you have sufficient privileges to stop system services.
Error: (04/24/2014 05:09:32 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2147023174. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (04/15/2014 10:02:58 AM) (Source: Application Hang) (User: ) (EventID: 1002)
Description: Programm Explorer.EXE, Version 6.2.9200.16628 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: e34
Startzeit: 01cf57dcf4c8e982
Endzeit: 0
Anwendungspfad: C:\Windows\Explorer.EXE
Berichts-ID: 56da3ebe-c474-11e3-be9a-54bef7315bfa
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Error: (04/08/2014 09:10:59 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2147023174. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (04/07/2014 11:24:09 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2147023174. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (03/12/2014 03:13:25 PM) (Source: SideBySide) (User: ) (EventID: 78)
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.
Error: (03/12/2014 00:38:34 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2147023174. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (03/09/2014 10:50:04 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2147023174. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (03/07/2014 11:47:42 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2147023174. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (03/06/2014 11:13:43 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 10.0.9200.16798, Zeitstempel: 0x52ec7da1
Name des fehlerhaften Moduls: SPVC32.dll, Version: 2.11.11.7, Zeitstempel: 0x53148395
Ausnahmecode: 0xc0000005
Fehleroffset: 0x004f3eda
ID des fehlerhaften Prozesses: 0x1eb4
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3
Vollständiger Name des fehlerhaften Pakets: IEXPLORE.EXE4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: IEXPLORE.EXE5
System errors:
=============
Error: (04/29/2014 03:04:05 PM) (Source: DCOM) (User: Ana) (EventID: 10016)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}Ana********S-1-5-21-529792085-2144148937-180937944-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (04/29/2014 03:04:05 PM) (Source: DCOM) (User: Ana) (EventID: 10016)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}Ana********S-1-5-21-529792085-2144148937-180937944-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (04/29/2014 03:04:05 PM) (Source: DCOM) (User: Ana) (EventID: 10016)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}Ana********S-1-5-21-529792085-2144148937-180937944-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (04/29/2014 03:04:05 PM) (Source: DCOM) (User: Ana) (EventID: 10016)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}Ana********S-1-5-21-529792085-2144148937-180937944-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (04/29/2014 03:04:05 PM) (Source: DCOM) (User: Ana) (EventID: 10016)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}Ana********S-1-5-21-529792085-2144148937-180937944-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (04/29/2014 03:02:42 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)
Description: Der Dienst "Computer Backup (MyPC Backup)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1392
Error: (04/14/2014 02:26:15 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)
Description: Der Dienst "Computer Backup (MyPC Backup)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1392
Error: (04/12/2014 05:13:13 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)
Description: Der Dienst "Computer Backup (MyPC Backup)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1392
Error: (04/12/2014 05:09:36 PM) (Source: Service Control Manager) (User: ) (EventID: 7043)
Description: Der Dienst Windows Update konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.
Error: (04/06/2014 09:33:48 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)
Description: Der Dienst "Computer Backup (MyPC Backup)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1392
Microsoft Office Sessions:
=========================
Error: (04/29/2014 03:10:20 PM) (Source: MsiInstaller) (User: NT-AUTORITÄT) (EventID: 11921)
Description: Product: Nero Update -- Error 1921.Service Nero Update (NAUpdate) could not be stopped. Verify that you have sufficient privileges to stop system services.(NULL)(NULL)(NULL)(NULL)(NULL)
Error: (04/24/2014 05:09:32 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2147023174
Error: (04/15/2014 10:02:58 AM) (Source: Application Hang) (User: ) (EventID: 1002)
Description: Explorer.EXE6.2.9200.16628e3401cf57dcf4c8e9820C:\Windows\Explorer.EXE56da3ebe-c474-11e3-be9a-54bef7315bfa
Error: (04/08/2014 09:10:59 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2147023174
Error: (04/07/2014 11:24:09 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2147023174
Error: (03/12/2014 03:13:25 PM) (Source: SideBySide) (User: ) (EventID: 78)
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Users\********\Downloads\SoftonicDownloader_fuer_apache-openoffice.exe
Error: (03/12/2014 00:38:34 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2147023174
Error: (03/09/2014 10:50:04 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2147023174
Error: (03/07/2014 11:47:42 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: Ana) (EventID: 5973)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2147023174
Error: (03/06/2014 11:13:43 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: IEXPLORE.EXE10.0.9200.1679852ec7da1SPVC32.dll2.11.11.753148395c0000005004f3eda1eb401cf32deb4f6ec5bC:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32.dll9c830a10-a50f-11e3-be95-54bef7315bfa
==================== Memory info ===========================
Percentage of memory in use: 65%
Total physical RAM: 3529.25 MB
Available physical RAM: 1225.68 MB
Total Pagefile: 9929.25 MB
Available Pagefile: 6430.46 MB
Total Virtual: 8192 MB
Available Virtual: 8191.78 MB
==================== Drives ================================
Drive c: (Packard Bell) (Fixed) (Total:447.95 GB) (Free:375.42 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 466 GB) (Disk ID: AC49E186)
Partition: GPT Partition Type.
==================== End Of Log ============================
|
|
08.05.2014, 10:53
| #4 |
| /// the machine /// TB-Ausbilder | Windows 8: Werbetafeln auf Webseiten und Umleitung auf Werbeseiten Revo Uninstaller - Download - Filepony Damit alles deinstallieren was Du in der Additional.txt findest mit dem Zusatz <== ATTENTION Mit Revo auch Moderat die Reste entfernen lassen. Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
08.05.2014, 18:46
| #5 |
| | Windows 8: Werbetafeln auf Webseiten und Umleitung auf Werbeseiten Ich konnte in dem Revo Uninstaller nicht die entsprechenden Programme, die mit einem Attention vermerkt waren, finden. Es werden lediglich 6 installierte Programme angezeigt und erweiterte Einstellung waren nicht zu finden, unter denen die anderen Programme hätten aufgelistet sein können. Ich habe dann über die Suchfunktion des Explorers im Laufwerk C nach ihnen gesucht und gefunden, konnte sie aber nicht mit dem Jagdmodus des Revo Uninstaller deinstallieren. Alle weiteren Schritte, wie dem Download der Anti- Malware und dem Adw- Cleaner, habe ich dann lieber noch nicht abgearbeitet. |
|
09.05.2014, 15:57
| #6 |
| /// the machine /// TB-Ausbilder | Windows 8: Werbetafeln auf Webseiten und Umleitung auf Werbeseiten Mach einfach die 3 Tools
__________________ --> Windows 8: Werbetafeln auf Webseiten und Umleitung auf Werbeseiten |
|
11.05.2014, 11:36
| #7 |
| | Windows 8: Werbetafeln auf Webseiten und Umleitung auf Werbeseiten Wie in der Anleitung beschrieben, wollte ich die mbam.txt- Datei erstellen, es wurde allerdings darauf hingewiesen, dass die Malwarebytes Anti- Malware nicht mehr funktioniert und das Programm aufgrund eines Problems nicht ausgeführt wird. Kann das in Zusammenhang mit den uninstallierten Dateien aus dem Revo Uninstaller stehen? |
|
12.05.2014, 11:03
| #8 |
| /// the machine /// TB-Ausbilder | Windows 8: Werbetafeln auf Webseiten und Umleitung auf Werbeseiten Nein, MBAm hat ab und an Probleme in der neuen Version. Alles von MBAm deinstallieren, dann MBAM neu installieren.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
14.05.2014, 21:20
| #9 |
| | Windows 8: Werbetafeln auf Webseiten und Umleitung auf Werbeseiten So, nachdem ich erfolglos versuchte nach der Deinstallation restliche Dateien des Anti- Malware- Programmes zu entfernen, installierte ich es erneut und exportierte erst die mbam.txt- Datei und verschob anschließend die gefundenen Dateien. Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 14.05.2014 Suchlauf-Zeit: 21:32:07 Logdatei: mbam.txt Administrator: Ja Version: 2.00.1.1004 Malware Datenbank: v2014.05.14.08 Rootkit Datenbank: v2014.03.27.01 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Chameleon: Deaktiviert Betriebssystem: Windows 8 CPU: x64 Dateisystem: NTFS Benutzer: ******** Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 257753 Verstrichene Zeit: 29 Min, 2 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Shuriken: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 1 PUP.Optional.Conduit.A, HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-3\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://search.conduit.com/?ctid=CT3314932&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP64625AB8-0A50-47DC-97B9-A8FAC97E22FB&SSPV=, Gut: (hxxp://www.google.com), Schlecht: (hxxp://search.conduit.com/?ctid=CT3314932&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP64625AB8-0A50-47DC-97B9-A8FAC97E22FB&SSPV=),,[fa5675dc2e4d6cca1b7ff549bc4813ed] Ordner: 18 PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\bin, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\rep, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\rep, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\bin, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\bubble, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\rep, , [4a065af767149e98ced4c2f7ca393fc1], Dateien: 79 PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\EULA.txt, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\bin\SPTool.dll, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\bin\uninstall.exe, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\rep\SystemRepository.dat, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe_1399914313710, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPTool64.exe, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32.dll, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll_1399914313804, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64.dll, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings.html, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\style.css, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\bubble\bubble.css, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\bubble\bubble.html, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\bubble\bubble.js, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\bubble\defaults.js, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\hez-selected.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Apply-default.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Apply-onclick.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Apply-Rollover.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bg-uninstall.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bg-with-logo.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bg.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgNotif.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgSettings.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgSettingsDS.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgUninstall.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\btnBlue.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\btnClose.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\btnSilver.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\button-bg.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\checkbox.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\checkbox_checked.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\checkbox_def.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\close-win-def.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\close-win-over-click.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\gray-bg.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\hez-def.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\hez.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\icon-win.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\info-icon.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\menu-rollover.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\menu-selected.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button-def.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button-selected.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button2.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Settings-icon.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\text-field.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\v.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\x.png, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\defaults.js, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\dialogUtils.js, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\jquery.1.7.1.min.js, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\json2.min.js, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\main.js, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\SPDialogAPI.js, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\defaults.js, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\protection.css, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\protection.html, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\protection.js, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\defaults.js, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.css, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.html, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.js, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\defaults.js, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\settings.css, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\settings.html, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\settings.js, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\defaults.js, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.css, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.html, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.js, , [4a065af767149e98ced4c2f7ca393fc1], PUP.Optional.CrossRider.A, C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\8jtvym4t.default-1398775407563\prefs.js, Gut: (), Schlecht: (user_pref("extensions.crossrider.bic", "145ad963b78b806a111fb38810b2f070");), ,[c7894a079edd9e982a332f4563a19070] PUP.Optional.Conduit.A, C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\8jtvym4t.default-1398775407563\prefs.js, Gut: (), Schlecht: (user_pref("browser.startup.homepage", "hxxp://search.conduit.com/?ctid=CT3314932&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP64625AB8-0A50-47DC-97B9-A8FAC97E22FB&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&ISID=");), ,[d27e450ca3d8cc6a354d7301996b4db3] PUP.Optional.Conduit.A, C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\8jtvym4t.default-1398775407563\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "hxxp://search.conduit.com/?ctid=CT3314932&octid=EB_ORIGINAL_CTID&SearchSource=69&CUI=&SSPV=&Lay=1&UM=4&UP=SP64625AB8-0A50-47DC-97B9-A8FAC97E22FB&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&SSPV=&ISID=");), ,[1e32ed6494e785b166560f6560a4ea16] Physische Sektoren: 0 (No malicious items detected) (end) AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.208 - Bericht erstellt am 14/05/2014 um 21:44:09
# Aktualisiert 11/05/2014 von Xplode
# Betriebssystem : Windows 8 (64 bits)
# Benutzername : ******** - ANA
# Gestartet von : C:\Users\********\Downloads\adwcleaner_3.208.exe
# Option : Löschen
***** [ Dienste ] *****
[#] Dienst Gelöscht : 70e6ca8c
[#] Dienst Gelöscht : BackupStack
Dienst Gelöscht : NewPlayerUpdaterService
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\InternetUpdater
Ordner Gelöscht : C:\ProgramData\topdeal
Ordner Gelöscht : C:\ProgramData\WPM
Ordner Gelöscht : C:\ProgramData\TicTaCoUpon
Ordner Gelöscht : C:\ProgramData\webseaVer
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\optimizer pro v3.2
Ordner Gelöscht : C:\Program Files (x86)\MyPC Backup
Ordner Gelöscht : C:\Program Files (x86)\NewPlayer
Ordner Gelöscht : C:\Program Files (x86)\Optimizer Pro
Ordner Gelöscht : C:\Windows\SysWOW64\SearchProtect
Ordner Gelöscht : C:\Users\********\AppData\Local\SearchProtect
Ordner Gelöscht : C:\Users\********\AppData\LocalLow\StumbleUpon
Ordner Gelöscht : C:\Users\********\AppData\Roaming\Activeris
Datei Gelöscht : C:\END
Datei Gelöscht : C:\Users\********\AppData\Roaming\aps.scan.quick.results
Datei Gelöscht : C:\Users\********\Desktop\MyPC Backup.lnk
***** [ Verknüpfungen ] *****
Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\Users\********\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
***** [ Registrierungsdatenbank ] *****
Wert Gelöscht : HKCU\Software\Mozilla\Firefox\Extensions [{8e7d6746-77a0-402a-b4ab-a6f73a41db80}]
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\bopakagnckmlgajfccecajhnimjiiedh
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Optimizer Pro]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\AddonsFramework.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ButtonSite.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ScriptHost.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\mypc backup
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{18B9B16E-716F-43DF-A6AD-512C7D2EB983}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{19975B78-1907-4DD6-A437-4C48120F46A4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{562B9316-C08A-444A-9482-62080DD851AE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{562B9317-C08A-444A-9482-62080DD851AE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AA9A4890-4262-4441-8977-E2FFCBFB706C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AA9A4890-4262-4441-8977-E2FFCBFB706C}
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\IM
Schlüssel Gelöscht : HKCU\Software\ImInstaller
Schlüssel Gelöscht : HKCU\Software\Optimizer Pro
Schlüssel Gelöscht : HKCU\Software\pc speed maximizer
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\DynConIE
Schlüssel Gelöscht : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gelöscht : HKLM\Software\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Schlüssel Gelöscht : HKLM\Software\ImInstaller
Schlüssel Gelöscht : HKLM\Software\installedbrowserextensions
Schlüssel Gelöscht : HKLM\Software\SearchProtect
Schlüssel Gelöscht : HKLM\Software\supWPM
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\installedbrowserextensions
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup
Daten Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\OPTIMI~1\OPTPRO~2.DLL
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.16537
-\\ Mozilla Firefox v29.0.1 (de)
[ Datei : C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\8jtvym4t.default-1398775407563\prefs.js ]
Zeile gelöscht : user_pref("browser.newtab.url", "hxxp://search.conduit.com/?ctid=CT3314932&octid=EB_ORIGINAL_CTID&SearchSource=69&CUI=&SSPV=&Lay=1&UM=4&UP=SP64625AB8-0A50-47DC-97B9-A8FAC97E22FB&SSPV=&SSPV=&SSPV=&SSPV[...]
Zeile gelöscht : user_pref("browser.search.defaultenginename", "Conduit Search");
Zeile gelöscht : user_pref("browser.search.selectedEngine", "Conduit Search");
Zeile gelöscht : user_pref("browser.startup.homepage", "hxxp://search.conduit.com/?ctid=CT3314932&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP64625AB8-0A50-47DC-97B9-A8FAC97E22FB&SSPV=&SSPV=&SSPV=&SSPV=&SSPV[...]
Zeile gelöscht : user_pref("extensions.crossrider.bic", "145ad963b78b806a111fb38810b2f070");
*************************
AdwCleaner[R0].txt - [6516 octets] - [14/05/2014 21:43:13]
AdwCleaner[S0].txt - [5749 octets] - [14/05/2014 21:44:09]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5809 octets] ##########
[/CODE] Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 8 x64
Ran by ******** on 14.05.2014 at 21:51:17,91
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\im
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\boost_interprocess"
Successfully deleted: [Folder] "\software"
~~~ FireFox
Emptied folder: C:\Users\********\AppData\Roaming\mozilla\firefox\profiles\8jtvym4t.default-1398775407563\minidumps [2 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 14.05.2014 at 22:04:18,39
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-05-2014 Ran by Ana Sydow (administrator) on ANA on 14-05-2014 22:08:44 Running from C:\Users\Ana Sydow\Desktop Platform: Windows 8 (X64) OS Language: German Standard Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe () C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Qualcomm Atheros Commnucations) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\AdminService.exe (REINER SCT) C:\Windows\SysWOW64\cjpcsc.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe (Acer Incorporate) C:\Program Files\Packard Bell\Packard Bell Launch Manager\LMSvc.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe (TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesApp64.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe (Atheros Communications) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Pixart Imaging Inc) C:\Windows\System32\TiltWheelMouse.exe (IncrediMail, Ltd.) C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (IncrediMail, Ltd.) C:\Program Files (x86)\IncrediMail\Bin\ImApp.exe (Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2874256 2012-12-07] (ELAN Microelectronics Corp.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13519432 2000-01-01] (Realtek Semiconductor) HKLM\...\Run: [MouseDriver] => C:\Windows\system32\TiltWheelMouse.exe [241152 2013-04-09] (Pixart Imaging Inc) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-03-13] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-24] (Avira Operations GmbH & Co. KG) HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe [132736 2013-04-15] ( (Atheros Communications)) HKU\S-1-5-21-529792085-2144148937-180937944-1001\...\Run: [Amazon Cloud Player] => C:\Users\Ana Sydow\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3140608 2014-01-14] () HKU\S-1-5-21-529792085-2144148937-180937944-1001\...\Run: [IncrediMail] => C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [444840 2014-01-29] (IncrediMail, Ltd.) GroupPolicy: Group Policy on Chrome detected <======= ATTENTION ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com StartMenuInternet: IEXPLORE.EXE - iexplore.exe SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM - {5A6CD5A0-E384-4C39-B2EA-2C4345E8590B} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAPBJS SearchScopes: HKLM-x32 - {5A6CD5A0-E384-4C39-B2EA-2C4345E8590B} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAPBJS BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.141\McAfeeMSS_IE.dll (McAfee, Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 FireFox: ======== FF ProfilePath: C:\Users\Ana Sydow\AppData\Roaming\Mozilla\Firefox\Profiles\8jtvym4t.default-1398775407563 FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll () FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll () FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll (McAfee, Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll () FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll () FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: NoScript - C:\Users\Ana Sydow\AppData\Roaming\Mozilla\Firefox\Profiles\8jtvym4t.default-1398775407563\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-04-29] ==================== Services (Whitelisted) ================= R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] () R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-24] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-24] (Avira Operations GmbH & Co. KG) S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1017424 2014-02-24] (Avira Operations GmbH & Co. KG) R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [228480 2013-04-15] (Qualcomm Atheros Commnucations) R2 cjpcsc; C:\Windows\SysWOW64\cjpcsc.exe [515632 2013-05-21] (REINER SCT) S3 DeviceFastLaneService; C:\Program Files\Packard Bell\Packard Bell Device Fast-lane\DeviceFastLaneSvc.exe [469648 2012-11-16] (Acer Incorporated) S3 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [662088 2013-03-15] (Acer Incorporated) R2 ETDService; C:\Program Files\Elantech\ETDService.exe [100752 2012-12-07] (ELAN Microelectronics Corp.) R2 LMSvc; C:\Program Files\Packard Bell\Packard Bell Launch Manager\LMSvc.exe [431656 2013-03-15] (Acer Incorporate) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation) S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe [289256 2014-01-16] (McAfee, Inc.) R2 StarMoney 9.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [663184 2014-01-27] (Star Finanz-Software Entwicklung und Vertriebs GmbH) R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [2412344 2014-01-28] (TuneUp Software) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-10-25] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [94208 2013-02-14] (Advanced Micro Devices) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-22] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131576 2013-12-22] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-10-31] (Avira Operations GmbH & Co. KG) R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [84720 2013-12-22] (Avira Operations GmbH & Co. KG) S3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [5139968 2012-06-02] (Broadcom Corporation) S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-04-15] (Qualcomm Atheros) S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation) S3 cjusb; C:\Windows\system32\DRIVERS\cjusb.sys [35192 2012-09-04] (REINER SCT) S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider) S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider) R3 LMDriver; C:\Windows\System32\drivers\LMDriver.sys [21360 2013-01-10] (Acer Incorporated) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-05-14] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation) R3 RadioShim; C:\Windows\System32\drivers\RadioShim.sys [15704 2013-01-10] (Acer Incorporated) S3 SWDUMon; C:\Windows\system32\DRIVERS\SWDUMon.sys [16152 2013-11-17] () R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [11880 2012-07-19] (TuneUp Software) S3 t_mouse.sys; C:\Windows\system32\DRIVERS\t_mouse.sys [6144 2013-04-09] () ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-05-14 22:08 - 2014-05-14 22:08 - 00011474 _____ () C:\Users\Ana Sydow\Desktop\FRST.txt 2014-05-14 22:08 - 2014-05-14 22:08 - 00000000 ____D () C:\Users\Ana Sydow\Desktop\FRST-OlderVersion 2014-05-14 22:04 - 2014-05-14 22:04 - 00000949 _____ () C:\Users\Ana Sydow\Desktop\JRT.txt 2014-05-14 21:51 - 2014-05-14 21:51 - 00000000 ____D () C:\Windows\ERUNT 2014-05-14 21:50 - 2014-05-14 21:50 - 01016261 _____ (Thisisu) C:\Users\Ana Sydow\Downloads\JRT.exe 2014-05-14 21:34 - 2014-05-14 21:44 - 00000000 ____D () C:\AdwCleaner 2014-05-14 21:34 - 2014-05-14 21:34 - 01325827 _____ () C:\Users\Ana Sydow\Downloads\adwcleaner_3.208.exe 2014-05-14 21:32 - 2014-05-14 21:33 - 00015602 _____ () C:\Users\Ana Sydow\Desktop\mbam.txt 2014-05-14 21:01 - 2014-05-14 21:01 - 00001114 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-05-14 21:01 - 2014-05-14 21:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-05-14 21:01 - 2014-05-14 21:01 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-05-14 21:01 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-05-14 21:01 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-05-14 21:01 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-05-14 21:00 - 2014-05-14 21:00 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Ana Sydow\Downloads\mbam-setup-2.0.1.1004(2).exe 2014-05-12 21:14 - 2014-05-12 21:14 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Ana Sydow\Downloads\mbam-setup-2.0.1.1004(1).exe 2014-05-10 20:01 - 2014-05-10 20:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-05-10 19:58 - 2014-05-14 21:48 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-05-10 19:57 - 2014-05-10 19:57 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-05-10 19:55 - 2014-05-10 19:56 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Ana Sydow\Downloads\mbam-setup-2.0.1.1004.exe 2014-05-08 18:49 - 2014-05-08 21:30 - 00001276 _____ () C:\Users\Ana Sydow\Desktop\Revo Uninstaller.lnk 2014-05-08 18:49 - 2014-05-08 21:30 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-05-08 18:48 - 2014-05-08 18:48 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Ana Sydow\Desktop\revosetup95.exe 2014-05-07 11:35 - 2014-05-07 11:35 - 00380416 _____ () C:\Users\Ana Sydow\Desktop\Gmer-19357.exe 2014-05-07 11:30 - 2014-05-14 22:08 - 00000000 ____D () C:\FRST 2014-05-07 11:29 - 2014-05-14 22:08 - 02066944 _____ (Farbar) C:\Users\Ana Sydow\Desktop\FRST64.exe 2014-05-07 11:23 - 2014-05-07 11:25 - 00000480 _____ () C:\Users\Ana Sydow\Downloads\defogger_disable.log 2014-05-07 11:23 - 2014-05-07 11:23 - 00000000 _____ () C:\Users\Ana Sydow\defogger_reenable 2014-05-07 11:21 - 2014-05-07 11:22 - 00050477 _____ () C:\Users\Ana Sydow\Desktop\Defogger.exe 2014-05-06 15:01 - 2014-04-19 11:39 - 00628024 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe 2014-05-06 15:01 - 2014-04-19 10:45 - 00693760 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll 2014-05-06 15:01 - 2014-04-19 10:45 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll 2014-05-06 15:01 - 2014-04-19 08:57 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll 2014-05-06 15:01 - 2014-04-19 08:57 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll 2014-05-05 06:59 - 2014-04-29 16:14 - 19275264 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-05-05 06:59 - 2014-04-29 14:47 - 14357504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-05-05 06:59 - 2014-04-29 14:36 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-05-05 06:59 - 2014-04-29 14:25 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-04-30 10:04 - 2014-04-30 10:04 - 251586632 _____ () C:\Users\Ana Sydow\Documents\regedit Sicherung.reg ==================== One Month Modified Files and Folders ======= 2014-05-14 22:09 - 2014-05-14 22:08 - 00011474 _____ () C:\Users\Ana Sydow\Desktop\FRST.txt 2014-05-14 22:08 - 2014-05-14 22:08 - 00000000 ____D () C:\Users\Ana Sydow\Desktop\FRST-OlderVersion 2014-05-14 22:08 - 2014-05-07 11:30 - 00000000 ____D () C:\FRST 2014-05-14 22:08 - 2014-05-07 11:29 - 02066944 _____ (Farbar) C:\Users\Ana Sydow\Desktop\FRST64.exe 2014-05-14 22:04 - 2014-05-14 22:04 - 00000949 _____ () C:\Users\Ana Sydow\Desktop\JRT.txt 2014-05-14 22:01 - 2013-09-28 14:34 - 00003594 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-529792085-2144148937-180937944-1001 2014-05-14 22:00 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\sru 2014-05-14 21:51 - 2014-05-14 21:51 - 00000000 ____D () C:\Windows\ERUNT 2014-05-14 21:50 - 2014-05-14 21:50 - 01016261 _____ (Thisisu) C:\Users\Ana Sydow\Downloads\JRT.exe 2014-05-14 21:50 - 2013-11-11 14:08 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-05-14 21:48 - 2014-05-10 19:58 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-05-14 21:46 - 2013-12-18 19:15 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-05-14 21:46 - 2012-07-26 09:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-05-14 21:45 - 2014-02-24 17:50 - 00029612 _____ () C:\Windows\PFRO.log 2014-05-14 21:44 - 2014-05-14 21:34 - 00000000 ____D () C:\AdwCleaner 2014-05-14 21:44 - 2014-02-08 12:47 - 00001073 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2014-05-14 21:42 - 2013-10-07 14:55 - 00003926 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{1FE1C09B-6610-4F02-922D-F5789EB168C5} 2014-05-14 21:36 - 2014-02-08 12:47 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-05-14 21:36 - 2012-07-26 07:26 - 00262144 ___SH () C:\Windows\system32\config\BBI 2014-05-14 21:34 - 2014-05-14 21:34 - 01325827 _____ () C:\Users\Ana Sydow\Downloads\adwcleaner_3.208.exe 2014-05-14 21:33 - 2014-05-14 21:32 - 00015602 _____ () C:\Users\Ana Sydow\Desktop\mbam.txt 2014-05-14 21:25 - 2013-12-18 19:15 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-05-14 21:01 - 2014-05-14 21:01 - 00001114 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-05-14 21:01 - 2014-05-14 21:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-05-14 21:01 - 2014-05-14 21:01 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-05-14 21:00 - 2014-05-14 21:00 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Ana Sydow\Downloads\mbam-setup-2.0.1.1004(2).exe 2014-05-14 20:59 - 2013-06-26 18:33 - 01968808 _____ () C:\Windows\WindowsUpdate.log 2014-05-14 16:28 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\AUInstallAgent 2014-05-14 07:33 - 2013-06-26 18:49 - 00065536 _____ () C:\Windows\system32\spu_storage.bin 2014-05-13 19:55 - 2013-11-11 14:08 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-05-12 21:16 - 2013-11-06 19:52 - 00000000 ____D () C:\Users\Ana Sydow\AppData\Local\CrashDumps 2014-05-12 21:14 - 2014-05-12 21:14 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Ana Sydow\Downloads\mbam-setup-2.0.1.1004(1).exe 2014-05-11 21:59 - 2014-01-13 20:00 - 00012504 _____ () C:\Users\Ana Sydow\Documents\Stundenzettel INP.odt 2014-05-10 21:01 - 2014-02-09 12:40 - 00000000 ____D () C:\ProgramData\Updater 2014-05-10 21:01 - 2014-01-24 13:57 - 00000000 ____D () C:\ProgramData\AAppptooU 2014-05-10 20:02 - 2014-05-10 20:01 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-05-10 19:57 - 2014-05-10 19:57 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-05-10 19:56 - 2014-05-10 19:55 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Ana Sydow\Downloads\mbam-setup-2.0.1.1004.exe 2014-05-09 13:54 - 2014-02-08 13:17 - 00000000 ____D () C:\Program Files (x86)\StarMoney 9.0 2014-05-08 21:30 - 2014-05-08 18:49 - 00001276 _____ () C:\Users\Ana Sydow\Desktop\Revo Uninstaller.lnk 2014-05-08 21:30 - 2014-05-08 18:49 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-05-08 18:48 - 2014-05-08 18:48 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Ana Sydow\Desktop\revosetup95.exe 2014-05-08 13:06 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\rescache 2014-05-07 11:35 - 2014-05-07 11:35 - 00380416 _____ () C:\Users\Ana Sydow\Desktop\Gmer-19357.exe 2014-05-07 11:25 - 2014-05-07 11:23 - 00000480 _____ () C:\Users\Ana Sydow\Downloads\defogger_disable.log 2014-05-07 11:23 - 2014-05-07 11:23 - 00000000 _____ () C:\Users\Ana Sydow\defogger_reenable 2014-05-07 11:23 - 2013-09-28 14:25 - 00000000 ____D () C:\Users\Ana Sydow 2014-05-07 11:22 - 2014-05-07 11:21 - 00050477 _____ () C:\Users\Ana Sydow\Desktop\Defogger.exe 2014-05-07 11:04 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\WinStore 2014-04-30 10:04 - 2014-04-30 10:04 - 251586632 _____ () C:\Users\Ana Sydow\Documents\regedit Sicherung.reg 2014-04-29 16:14 - 2014-05-05 06:59 - 19275264 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-04-29 15:08 - 2013-06-27 04:13 - 00753134 _____ () C:\Windows\system32\perfh007.dat 2014-04-29 15:08 - 2013-06-27 04:13 - 00155826 _____ () C:\Windows\system32\perfc007.dat 2014-04-29 15:08 - 2012-07-26 09:28 - 01745416 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-04-29 14:47 - 2014-05-05 06:59 - 14357504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-04-29 14:43 - 2013-12-23 17:49 - 00000000 ____D () C:\Users\Ana Sydow\Desktop\Alte Firefox-Daten 2014-04-29 14:36 - 2014-05-05 06:59 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-04-29 14:25 - 2014-05-05 06:59 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-04-23 01:47 - 2013-11-17 14:38 - 00694232 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-04-23 01:47 - 2013-11-17 14:38 - 00078296 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-04-19 11:39 - 2014-05-06 15:01 - 00628024 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe 2014-04-19 10:45 - 2014-05-06 15:01 - 00693760 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll 2014-04-19 10:45 - 2014-05-06 15:01 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll 2014-04-19 08:57 - 2014-05-06 15:01 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll 2014-04-19 08:57 - 2014-05-06 15:01 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll 2014-04-14 14:24 - 2012-07-26 10:12 - 00000000 ___RD () C:\Windows\ToastData Some content of TEMP: ==================== C:\Users\Ana Sydow\AppData\Local\Temp\avgnt.exe C:\Users\Ana Sydow\AppData\Local\Temp\Quarantine.exe C:\Users\Ana Sydow\AppData\Local\Temp\SPSetup.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-05-07 11:04 ==================== End Of Log ============================ --- --- --- [/CODE] |
|
15.05.2014, 19:42
| #10 |
| /// the machine /// TB-Ausbilder | Windows 8: Werbetafeln auf Webseiten und Umleitung auf WerbeseitenESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
19.05.2014, 20:58
| #11 |
| | Windows 8: Werbetafeln auf Webseiten und Umleitung auf Werbeseiten Hier nun ohne weitere Probleme die log- Dateien Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=4a12c35af7c29344ab5bff24dd2ad853
# engine=18324
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-05-19 07:49:13
# local_time=2014-05-19 09:49:13 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode=5893 16776574 100 94 5533361 18823013 0 0
# scanned=199301
# found=9
# cleaned=0
# scan_time=6791
sh=19030FA4598FC2FEC25ED5E8E53DE570588B4639 ft=1 fh=2b1981409da2edb8 vn="Variante von MSIL/AdvancedSystemProtector.A evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-529792085-2144148937-180937944-1001\$RMSW91V\ActiverisAntiMalware.exe"
sh=4F430B9EDF5BE2B89663F2F2EF5F29833D3C01BC ft=1 fh=88c475c00e368826 vn="Variante von Win64/SProtector.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Optimizer Pro\OptProCrash_x64.dll.vir"
sh=C5828B700B9EF61FA1534D5D18482BF12F591CBF ft=1 fh=0404da55e35b3671 vn="Variante von Win32/AdWare.SpeedingUpMyPC.D Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Optimizer Pro\OptProLauncher.exe.vir"
sh=DDD2974F59F7DBB2C99557C05FB33787C7B27748 ft=1 fh=b62022df389e395a vn="Variante von Win32/Adware.SpeedingUpMyPC.C Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Optimizer Pro\OptProSmartScan.exe.vir"
sh=1AB5FE7F5654ECBB42397AE222C0B8159081D6C6 ft=1 fh=2b551abc4ed949a7 vn="Mehrere Bedrohungen" ac=I fn="C:\ProgramData\Updater\Uninstall.exe"
sh=1AB5FE7F5654ECBB42397AE222C0B8159081D6C6 ft=1 fh=2b551abc4ed949a7 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\All Users\Updater\Uninstall.exe"
sh=08ADA5974AE4CDE0E1A2610F48486C71833811B7 ft=1 fh=39a4b8e5163e42ce vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\Users\********\AppData\Local\Temp\SPSetup.exe"
sh=76A9E0236CD2449CBD111EAB8A91BA94DF48B277 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\********\Desktop\Alte Firefox-Daten\o1phnnn7.default-1387814044019\extensions\0c822a17-a68f-4066-9257-d229458d21ca@9c178d17-dc61-4aaf-b2da-1425ac7300ac.com\extensionData\plugins\91.js"
sh=76A9E0236CD2449CBD111EAB8A91BA94DF48B277 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\********\Desktop\Alte Firefox-Daten\o1phnnn7.default-1387814044019\extensions\e49d3f99-7c89-4eb4-99f3-ff903e2189b2@5288754a-7a48-41a0-a10f-e98c9ac12040.com\extensionData\plugins\91_monetizationLoader.js.js"
Code:
ATTFilter
UNSUPPORTED OPERATING SYSTEM! ABORTED!
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-05-2014 Ran by ******** (administrator) on ANA on 19-05-2014 21:52:11 Running from C:\Users\********\Desktop Platform: Windows 8 (X64) OS Language: German Standard Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe () C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Qualcomm Atheros Commnucations) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\AdminService.exe (REINER SCT) C:\Windows\SysWOW64\cjpcsc.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe (Acer Incorporate) C:\Program Files\Packard Bell\Packard Bell Launch Manager\LMSvc.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe (TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesApp64.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Atheros Communications) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Pixart Imaging Inc) C:\Windows\System32\TiltWheelMouse.exe () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\ipmgui.exe (Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2874256 2012-12-07] (ELAN Microelectronics Corp.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13519432 2000-01-01] (Realtek Semiconductor) HKLM\...\Run: [MouseDriver] => C:\Windows\system32\TiltWheelMouse.exe [241152 2013-04-09] (Pixart Imaging Inc) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-03-13] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-24] (Avira Operations GmbH & Co. KG) HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe [132736 2013-04-15] ( (Atheros Communications)) HKU\S-1-5-21-529792085-2144148937-180937944-1001\...\Run: [Amazon Cloud Player] => C:\Users\********\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3140608 2014-01-14] () HKU\S-1-5-21-529792085-2144148937-180937944-1001\...\Run: [IncrediMail] => C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [444840 2014-01-29] (IncrediMail, Ltd.) HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Amazon Cloud Player] => C:\Users\********\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3140608 2014-01-14] () HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [IncrediMail] => C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [444840 2014-01-29] (IncrediMail, Ltd.) HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [Amazon Cloud Player] => C:\Users\********\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3140608 2014-01-14] () HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [IncrediMail] => C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [444840 2014-01-29] (IncrediMail, Ltd.) HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Run: [Amazon Cloud Player] => C:\Users\********\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3140608 2014-01-14] () HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Run: [IncrediMail] => C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [444840 2014-01-29] (IncrediMail, Ltd.) GroupPolicy: Group Policy on Chrome detected <======= ATTENTION ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com StartMenuInternet: IEXPLORE.EXE - iexplore.exe SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM - {5A6CD5A0-E384-4C39-B2EA-2C4345E8590B} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAPBJS SearchScopes: HKLM-x32 - {5A6CD5A0-E384-4C39-B2EA-2C4345E8590B} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAPBJS BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.141\McAfeeMSS_IE.dll (McAfee, Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 FireFox: ======== FF ProfilePath: C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\8jtvym4t.default-1398775407563 FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll () FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll () FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll (McAfee, Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll () FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll () FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: NoScript - C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\8jtvym4t.default-1398775407563\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-04-29] ==================== Services (Whitelisted) ================= R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] () R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-24] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-24] (Avira Operations GmbH & Co. KG) S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1017424 2014-02-24] (Avira Operations GmbH & Co. KG) R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [228480 2013-04-15] (Qualcomm Atheros Commnucations) R2 cjpcsc; C:\Windows\SysWOW64\cjpcsc.exe [515632 2013-05-21] (REINER SCT) S3 DeviceFastLaneService; C:\Program Files\Packard Bell\Packard Bell Device Fast-lane\DeviceFastLaneSvc.exe [469648 2012-11-16] (Acer Incorporated) S3 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [662088 2013-03-15] (Acer Incorporated) R2 ETDService; C:\Program Files\Elantech\ETDService.exe [100752 2012-12-07] (ELAN Microelectronics Corp.) R2 LMSvc; C:\Program Files\Packard Bell\Packard Bell Launch Manager\LMSvc.exe [431656 2013-03-15] (Acer Incorporate) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation) S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe [289256 2014-01-16] (McAfee, Inc.) R2 StarMoney 9.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [663184 2014-01-27] (Star Finanz-Software Entwicklung und Vertriebs GmbH) R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [2412344 2014-01-28] (TuneUp Software) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-10-25] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [94208 2013-02-14] (Advanced Micro Devices) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-22] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131576 2013-12-22] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-10-31] (Avira Operations GmbH & Co. KG) R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [84720 2013-12-22] (Avira Operations GmbH & Co. KG) S3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [5139968 2012-06-02] (Broadcom Corporation) S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-04-15] (Qualcomm Atheros) S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation) S3 cjusb; C:\Windows\system32\DRIVERS\cjusb.sys [35192 2012-09-04] (REINER SCT) S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider) S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider) R3 LMDriver; C:\Windows\System32\drivers\LMDriver.sys [21360 2013-01-10] (Acer Incorporated) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-05-19] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation) R3 RadioShim; C:\Windows\System32\drivers\RadioShim.sys [15704 2013-01-10] (Acer Incorporated) S3 SWDUMon; C:\Windows\system32\DRIVERS\SWDUMon.sys [16152 2013-11-17] () R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [11880 2012-07-19] (TuneUp Software) S3 t_mouse.sys; C:\Windows\system32\DRIVERS\t_mouse.sys [6144 2013-04-09] () ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-05-19 19:52 - 2014-05-19 19:52 - 02347384 _____ (ESET) C:\Users\********\Downloads\esetsmartinstaller_deu(1).exe 2014-05-19 19:51 - 2014-05-19 19:51 - 00000000 ____D () C:\MFT 27992 2014-05-19 19:38 - 2014-05-19 19:38 - 00855379 _____ () C:\Users\********\Desktop\SecurityCheck.exe 2014-05-18 13:15 - 2014-05-18 13:15 - 00000000 ____D () C:\Program Files (x86)\ESET 2014-05-18 13:14 - 2014-05-18 13:14 - 02347384 _____ (ESET) C:\Users\********\Downloads\esetsmartinstaller_deu.exe 2014-05-14 22:10 - 2014-05-14 22:11 - 00023604 _____ () C:\Users\********\Desktop\FRST2.txt 2014-05-14 22:08 - 2014-05-19 21:52 - 00012587 _____ () C:\Users\********\Desktop\FRST.txt 2014-05-14 22:08 - 2014-05-19 21:52 - 00000000 ____D () C:\Users\********\Desktop\FRST-OlderVersion 2014-05-14 22:04 - 2014-05-14 22:04 - 00000949 _____ () C:\Users\********\Desktop\JRT.txt 2014-05-14 21:51 - 2014-05-14 21:51 - 00000000 ____D () C:\Windows\ERUNT 2014-05-14 21:50 - 2014-05-14 21:50 - 01016261 _____ (Thisisu) C:\Users\********\Downloads\JRT.exe 2014-05-14 21:34 - 2014-05-14 21:44 - 00000000 ____D () C:\AdwCleaner 2014-05-14 21:34 - 2014-05-14 21:34 - 01325827 _____ () C:\Users\********\Downloads\adwcleaner_3.208.exe 2014-05-14 21:32 - 2014-05-14 21:33 - 00015602 _____ () C:\Users\********\Desktop\mbam.txt 2014-05-14 21:01 - 2014-05-14 21:01 - 00001114 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-05-14 21:01 - 2014-05-14 21:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-05-14 21:01 - 2014-05-14 21:01 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-05-14 21:01 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-05-14 21:01 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-05-14 21:01 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-05-14 21:00 - 2014-05-14 21:00 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\********\Downloads\mbam-setup-2.0.1.1004(2).exe 2014-05-12 21:14 - 2014-05-12 21:14 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\********\Downloads\mbam-setup-2.0.1.1004(1).exe 2014-05-10 20:01 - 2014-05-10 20:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-05-10 19:58 - 2014-05-19 21:38 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-05-10 19:57 - 2014-05-10 19:57 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-05-10 19:55 - 2014-05-10 19:56 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\********\Downloads\mbam-setup-2.0.1.1004.exe 2014-05-08 18:49 - 2014-05-08 21:30 - 00001276 _____ () C:\Users\********\Desktop\Revo Uninstaller.lnk 2014-05-08 18:49 - 2014-05-08 21:30 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-05-08 18:48 - 2014-05-08 18:48 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\********\Desktop\revosetup95.exe 2014-05-07 11:35 - 2014-05-07 11:35 - 00380416 _____ () C:\Users\********\Desktop\Gmer-19357.exe 2014-05-07 11:30 - 2014-05-19 21:52 - 00000000 ____D () C:\FRST 2014-05-07 11:29 - 2014-05-19 21:52 - 02067456 _____ (Farbar) C:\Users\********\Desktop\FRST64.exe 2014-05-07 11:23 - 2014-05-07 11:25 - 00000480 _____ () C:\Users\********\Downloads\defogger_disable.log 2014-05-07 11:23 - 2014-05-07 11:23 - 00000000 _____ () C:\Users\********\defogger_reenable 2014-05-07 11:21 - 2014-05-07 11:22 - 00050477 _____ () C:\Users\********\Desktop\Defogger.exe 2014-05-06 15:01 - 2014-04-19 11:39 - 00628024 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe 2014-05-06 15:01 - 2014-04-19 10:45 - 00693760 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll 2014-05-06 15:01 - 2014-04-19 10:45 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll 2014-05-06 15:01 - 2014-04-19 08:57 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll 2014-05-06 15:01 - 2014-04-19 08:57 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll 2014-05-05 06:59 - 2014-04-29 16:14 - 19275264 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-05-05 06:59 - 2014-04-29 14:47 - 14357504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-05-05 06:59 - 2014-04-29 14:36 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-05-05 06:59 - 2014-04-29 14:25 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-04-30 10:04 - 2014-04-30 10:04 - 251586632 _____ () C:\Users\********\Documents\regedit Sicherung.reg ==================== One Month Modified Files and Folders ======= 2014-05-19 21:52 - 2014-05-14 22:08 - 00012587 _____ () C:\Users\********\Desktop\FRST.txt 2014-05-19 21:52 - 2014-05-14 22:08 - 00000000 ____D () C:\Users\********\Desktop\FRST-OlderVersion 2014-05-19 21:52 - 2014-05-07 11:30 - 00000000 ____D () C:\FRST 2014-05-19 21:52 - 2014-05-07 11:29 - 02067456 _____ (Farbar) C:\Users\********\Desktop\FRST64.exe 2014-05-19 21:50 - 2013-11-11 14:08 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-05-19 21:42 - 2013-10-07 14:55 - 00003926 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{1FE1C09B-6610-4F02-922D-F5789EB168C5} 2014-05-19 21:39 - 2013-06-26 18:33 - 01305111 _____ () C:\Windows\WindowsUpdate.log 2014-05-19 21:38 - 2014-05-10 19:58 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-05-19 21:25 - 2013-12-18 19:15 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-05-19 20:00 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\sru 2014-05-19 19:52 - 2014-05-19 19:52 - 02347384 _____ (ESET) C:\Users\********\Downloads\esetsmartinstaller_deu(1).exe 2014-05-19 19:51 - 2014-05-19 19:51 - 00000000 ____D () C:\MFT 27992 2014-05-19 19:38 - 2014-05-19 19:38 - 00855379 _____ () C:\Users\********\Desktop\SecurityCheck.exe 2014-05-19 19:33 - 2014-02-08 13:17 - 00000000 ____D () C:\Program Files (x86)\StarMoney 9.0 2014-05-19 12:31 - 2013-06-26 18:49 - 00065536 _____ () C:\Windows\system32\spu_storage.bin 2014-05-18 13:15 - 2014-05-18 13:15 - 00000000 ____D () C:\Program Files (x86)\ESET 2014-05-18 13:14 - 2014-05-18 13:14 - 02347384 _____ (ESET) C:\Users\********\Downloads\esetsmartinstaller_deu.exe 2014-05-18 10:55 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\AUInstallAgent 2014-05-15 20:10 - 2013-06-27 04:13 - 00753134 _____ () C:\Windows\system32\perfh007.dat 2014-05-15 20:10 - 2013-06-27 04:13 - 00155826 _____ () C:\Windows\system32\perfc007.dat 2014-05-15 20:10 - 2012-07-26 09:28 - 01745416 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-05-15 18:25 - 2013-12-18 19:15 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-05-15 17:50 - 2013-09-30 13:33 - 00000000 ____D () C:\Windows\system32\MRT 2014-05-15 17:48 - 2013-09-30 13:33 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-05-15 17:48 - 2012-07-26 07:26 - 00262144 ___SH () C:\Windows\system32\config\ELAM 2014-05-15 14:45 - 2013-11-06 17:21 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2014-05-14 22:35 - 2013-09-28 14:34 - 00003596 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-529792085-2144148937-180937944-1001 2014-05-14 22:11 - 2014-05-14 22:10 - 00023604 _____ () C:\Users\********\Desktop\FRST2.txt 2014-05-14 22:04 - 2014-05-14 22:04 - 00000949 _____ () C:\Users\********\Desktop\JRT.txt 2014-05-14 21:51 - 2014-05-14 21:51 - 00000000 ____D () C:\Windows\ERUNT 2014-05-14 21:50 - 2014-05-14 21:50 - 01016261 _____ (Thisisu) C:\Users\********\Downloads\JRT.exe 2014-05-14 21:46 - 2012-07-26 09:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-05-14 21:45 - 2014-02-24 17:50 - 00029612 _____ () C:\Windows\PFRO.log 2014-05-14 21:44 - 2014-05-14 21:34 - 00000000 ____D () C:\AdwCleaner 2014-05-14 21:44 - 2014-02-08 12:47 - 00001073 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2014-05-14 21:36 - 2014-02-08 12:47 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-05-14 21:36 - 2012-07-26 07:26 - 00262144 ___SH () C:\Windows\system32\config\BBI 2014-05-14 21:34 - 2014-05-14 21:34 - 01325827 _____ () C:\Users\********\Downloads\adwcleaner_3.208.exe 2014-05-14 21:33 - 2014-05-14 21:32 - 00015602 _____ () C:\Users\********\Desktop\mbam.txt 2014-05-14 21:01 - 2014-05-14 21:01 - 00001114 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-05-14 21:01 - 2014-05-14 21:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-05-14 21:01 - 2014-05-14 21:01 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-05-14 21:00 - 2014-05-14 21:00 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\********\Downloads\mbam-setup-2.0.1.1004(2).exe 2014-05-13 19:55 - 2013-11-11 14:08 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-05-12 21:16 - 2013-11-06 19:52 - 00000000 ____D () C:\Users\********\AppData\Local\CrashDumps 2014-05-12 21:14 - 2014-05-12 21:14 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\********\Downloads\mbam-setup-2.0.1.1004(1).exe 2014-05-11 21:59 - 2014-01-13 20:00 - 00012504 _____ () C:\Users\********\Documents\Stundenzettel INP.odt 2014-05-10 21:01 - 2014-02-09 12:40 - 00000000 ____D () C:\ProgramData\Updater 2014-05-10 21:01 - 2014-01-24 13:57 - 00000000 ____D () C:\ProgramData\AAppptooU 2014-05-10 20:02 - 2014-05-10 20:01 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-05-10 19:57 - 2014-05-10 19:57 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-05-10 19:56 - 2014-05-10 19:55 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\********\Downloads\mbam-setup-2.0.1.1004.exe 2014-05-08 21:30 - 2014-05-08 18:49 - 00001276 _____ () C:\Users\********\Desktop\Revo Uninstaller.lnk 2014-05-08 21:30 - 2014-05-08 18:49 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-05-08 18:48 - 2014-05-08 18:48 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\********\Desktop\revosetup95.exe 2014-05-08 13:06 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\rescache 2014-05-07 11:35 - 2014-05-07 11:35 - 00380416 _____ () C:\Users\********\Desktop\Gmer-19357.exe 2014-05-07 11:25 - 2014-05-07 11:23 - 00000480 _____ () C:\Users\********\Downloads\defogger_disable.log 2014-05-07 11:23 - 2014-05-07 11:23 - 00000000 _____ () C:\Users\********\defogger_reenable 2014-05-07 11:23 - 2013-09-28 14:25 - 00000000 ____D () C:\Users\******** 2014-05-07 11:22 - 2014-05-07 11:21 - 00050477 _____ () C:\Users\********\Desktop\Defogger.exe 2014-05-07 11:04 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\WinStore 2014-04-30 10:04 - 2014-04-30 10:04 - 251586632 _____ () C:\Users\********\Documents\regedit Sicherung.reg 2014-04-29 16:14 - 2014-05-05 06:59 - 19275264 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-04-29 14:47 - 2014-05-05 06:59 - 14357504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-04-29 14:43 - 2013-12-23 17:49 - 00000000 ____D () C:\Users\********\Desktop\Alte Firefox-Daten 2014-04-29 14:36 - 2014-05-05 06:59 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-04-29 14:25 - 2014-05-05 06:59 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-04-23 01:47 - 2013-11-17 14:38 - 00694232 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-04-23 01:47 - 2013-11-17 14:38 - 00078296 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-04-19 11:39 - 2014-05-06 15:01 - 00628024 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe 2014-04-19 10:45 - 2014-05-06 15:01 - 00693760 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll 2014-04-19 10:45 - 2014-05-06 15:01 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll 2014-04-19 08:57 - 2014-05-06 15:01 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll 2014-04-19 08:57 - 2014-05-06 15:01 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll Some content of TEMP: ==================== C:\Users\********\AppData\Local\Temp\avgnt.exe C:\Users\********\AppData\Local\Temp\Quarantine.exe C:\Users\********\AppData\Local\Temp\SPSetup.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-05-18 13:03 ==================== End Of Log ============================ --- --- --- [/CODE] |
|
20.05.2014, 12:35
| #12 |
| /// the machine /// TB-Ausbilder | Windows 8: Werbetafeln auf Webseiten und Umleitung auf Werbeseiten Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\$Recycle.Bin
C:\ProgramData\Updater
HKU\S-1-5-21-529792085-2144148937-180937944-1001\...\Run: [IncrediMail] => C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [444840 2014-01-29] (IncrediMail, Ltd.)
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Amazon Cloud Player] => C:\Users\********\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3140608 2014-01-14] ()
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [IncrediMail] => C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [444840 2014-01-29] (IncrediMail, Ltd.)
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [Amazon Cloud Player] => C:\Users\********\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3140608 2014-01-14] ()
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [IncrediMail] => C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [444840 2014-01-29] (IncrediMail, Ltd.)
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Run: [Amazon Cloud Player] => C:\Users\********\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3140608 2014-01-14] ()
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Run: [IncrediMail] => C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [444840 2014-01-29] (IncrediMail, Ltd.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
20.05.2014, 14:02
| #13 |
| | Windows 8: Werbetafeln auf Webseiten und Umleitung auf Werbeseiten Die letzte Datei, wie gewünscht Und hier bringe ich auch mein Dankeschön für die schnelle und kompetente Hilfe an. Und ebenfalls vielen Dank für die weiteren Tipps Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 17-05-2014
Ran by ******* at 2014-05-20 13:42:47 Run:1
Running from C:\Users\*******\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
C:\$Recycle.Bin
C:\ProgramData\Updater
HKU\S-1-5-21-529792085-2144148937-180937944-1001\...\Run: [IncrediMail] => C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [444840 2014-01-29] (IncrediMail, Ltd.)
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Amazon Cloud Player] => C:\Users\********\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3140608 2014-01-14] ()
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [IncrediMail] => C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [444840 2014-01-29] (IncrediMail, Ltd.)
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [Amazon Cloud Player] => C:\Users\********\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3140608 2014-01-14] ()
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [IncrediMail] => C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [444840 2014-01-29] (IncrediMail, Ltd.)
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Run: [Amazon Cloud Player] => C:\Users\********\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3140608 2014-01-14] ()
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Run: [IncrediMail] => C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [444840 2014-01-29] (IncrediMail, Ltd.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
*****************
C:\$Recycle.Bin => Moved successfully.
C:\ProgramData\Updater => Moved successfully.
HKU\S-1-5-21-529792085-2144148937-180937944-1001\Software\Microsoft\Windows\CurrentVersion\Run\\IncrediMail => Value deleted successfully.
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Run\\Amazon Cloud Player => Value deleted successfully.
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Run\\IncrediMail => Value deleted successfully.
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\Software\Microsoft\Windows\CurrentVersion\Run\\Amazon Cloud Player => Value deleted successfully.
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\Software\Microsoft\Windows\CurrentVersion\Run\\IncrediMail => Value deleted successfully.
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\Software\Microsoft\Windows\CurrentVersion\Run\\Amazon Cloud Player => Value deleted successfully.
HKU\S-1-5-21-529792085-2144148937-180937944-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\Software\Microsoft\Windows\CurrentVersion\Run\\IncrediMail => Value deleted successfully.
C:\Windows\system32\GroupPolicy\Machine => Moved successfully.
C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully.
The system needed a reboot.
==== End of Fixlog ====
 |
|
21.05.2014, 07:54
| #14 |
| /// the machine /// TB-Ausbilder | Windows 8: Werbetafeln auf Webseiten und Umleitung auf Werbeseiten Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Windows 8: Werbetafeln auf Webseiten und Umleitung auf Werbeseiten |
| ads by onlinebrowseradvertising, computer, conduit search, conduit search entfernen, conduit.search, conduit.search entfernen, continue, entfernen, explorer, infiziert, internet explorer, internetseite, js/toolbar.crossrider.b, msil/advancedsystemprotector.a, nationzoom, nationzoom entfernen, problem, pup.optional.conduit.a, pup.optional.crossrider.a, pup.optional.searchprotect.a, webseiten, win32/adware.speedingupmypc.c, win32/adware.speedingupmypc.d, win32/conduit.searchprotect.h, win64/sprotector.b |
