| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Im Internetbrowser öffnen sich immer wieder neue Seiten mit Werbung :(Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
13.05.2014, 19:25
| #1 |
| |  Im Internetbrowser öffnen sich immer wieder neue Seiten mit Werbung :( Hallo Zusammen, in letzter Zeit werde ich immer wieder mit Werbung "zugemüllt" wenn ich den Internetbrowser egal ob Firefox, Internetexplorer etc. öffne. Ich hab schon ein wenig gegoogelt und bin jetzt auf diese Seite gestoßen und mir wie in einem Tread beschrieben wurde, den "OTL" Scanner runtergeladen. Habe jetzt den Anweisungen befolgt und folgendes hat sich jetzt nach dem Scan geöffnet: Hab ich einen Virus? Ich hoffe ihr könnt mir weiter helfen.. Vielen Dank im Voraus  OTL logfile created on: 13.05.2014 19:39:29 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\TT Lammers\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.11.9600.17041) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,97 Gb Total Physical Memory | 1,75 Gb Available Physical Memory | 44,14% Memory free 7,93 Gb Paging File | 5,28 Gb Available in Paging File | 66,60% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 232,79 Gb Total Space | 149,68 Gb Free Space | 64,30% Space Free | Partition Type: NTFS Computer Name: TTLAMMERS-PC | User Name: TT Lammers | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\TT Lammers\Desktop\otl.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_206.exe (Adobe Systems, Inc.) PRC - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe (APN LLC.) PRC - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe (APN) PRC - C:\Program Files (x86)\Iminent\WinkHandler.exe () PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\PDF24\pdf24.exe (Geek Software GmbH) PRC - C:\ProgramData\WPM\wprotectmanager.exe (Cherished Technololgy LIMITED) PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - C:\Program Files (x86)\WinZipper\winzipersvc.exe (Taiwan Shui Mu Chih Ching Technology Limited.) PRC - C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe () PRC - C:\PROGRA~2\ICQ6TO~1\ICQSER~1.EXE () PRC - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.) PRC - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.) ========== Modules (No Company Name) ========== MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll () MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll () MOD - C:\Program Files (x86)\Iminent\WinkHandler.exe () MOD - C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe () ========== Services (SafeList) ========== SRV:64bit: - (IEEtwCollectorService) -- C:\Windows\SysNative\IEEtwCollector.exe (Microsoft Corporation) SRV:64bit: - (hpsrv) -- C:\Windows\SysNative\hpservice.exe (Hewlett-Packard Company) SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD) SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (APNMCP) -- C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe (APN LLC.) SRV - (WinkHandler) -- C:\Program Files (x86)\Iminent\WinkHandler.exe () SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) SRV - (Wpm) -- C:\ProgramData\WPM\wprotectmanager.exe (Cherished Technololgy LIMITED) SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (winzipersvc) -- C:\Program Files (x86)\WinZipper\winzipersvc.exe (Taiwan Shui Mu Chih Ching Technology Limited.) SRV - (Guard.Mail.ru) -- C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe () SRV - (ICQ Service) -- C:\PROGRA~2\ICQ6TO~1\ICQSER~1.EXE () SRV - (ACDaemon) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira Operations GmbH & Co. KG) DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG) DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG) DRV:64bit: - (usb_rndisx) -- C:\Windows\SysNative\drivers\usb8023x.sys (Microsoft Corporation) DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.) DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (hpdskflt) -- C:\Windows\SysNative\drivers\hpdskflt.sys (Hewlett-Packard Company) DRV:64bit: - (Accelerometer) -- C:\Windows\SysNative\drivers\Accelerometer.sys (Hewlett-Packard Company) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation) DRV:64bit: - (NETw5s64) -- C:\Windows\SysNative\drivers\NETw5s64.sys (Intel Corporation) DRV:64bit: - (ATSwpWDF) -- C:\Windows\SysNative\drivers\ATSwpWDF.sys (AuthenTec, Inc.) DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (WSDPrintDevice) -- C:\Windows\SysNative\drivers\WSDPrint.sys (Microsoft Corporation) DRV:64bit: - (WSDScan) -- C:\Windows\SysNative\drivers\WSDScan.sys (Microsoft Corporation) DRV:64bit: - (StillCam) -- C:\Windows\SysNative\drivers\serscan.sys (Microsoft Corporation) DRV:64bit: - (TPM) -- C:\Windows\SysNative\drivers\tpm.sys (Microsoft Corporation) DRV:64bit: - (AgereSoftModem) -- C:\Windows\SysNative\drivers\agrsm64.sys (LSI Corp) DRV:64bit: - (netw5v64) -- C:\Windows\SysNative\drivers\netw5v64.sys (Intel Corporation) DRV:64bit: - (e1yexpress) -- C:\Windows\SysNative\drivers\e1y60x64.sys (Intel Corporation) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (HpqKbFiltr) -- C:\Windows\SysNative\drivers\HpqKbFiltr.sys (Hewlett-Packard Development Company, L.P.) DRV:64bit: - (HBtnKey) -- C:\Windows\SysNative\drivers\CPQBttn64.sys (Hewlett-Packard Development Company, L.P.) DRV:64bit: - (rismxdp) -- C:\Windows\SysNative\drivers\rixdpx64.sys (REDC) DRV:64bit: - (RICOH SmartCard Reader) -- C:\Windows\SysNative\drivers\rismcx64.sys (RICOH Company, Ltd.) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.awesomehp.com/?type=hp&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.awesomehp.com/web/?type=ds&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT&q={searchTerms} IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.awesomehp.com/web/?type=ds&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT&q={searchTerms} IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.awesomehp.com/?type=hp&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {33BB0A4E-99AF-4226-BDF6-49120163DE86} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE:64bit: - HKLM\..\SearchScopes\{460C3D19-B3D4-4964-A550-77D263B0CCCB}: "URL" = hxxp://www.awesomehp.com/web/?type=ds&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT&q={searchTerms} IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.awesomehp.com/?type=hp&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.awesomehp.com/web/?type=ds&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT&q={searchTerms} IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.awesomehp.com/web/?type=ds&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT&q={searchTerms} IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.awesomehp.com/?type=hp&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT IE - HKLM\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5} IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZDr--M9JXGUna1oWD0CV0Ozk-Rt4Oo0TEUiVWXd0ZSG5UP7CRZI870OiFjQw_sO7nty0GkxMhekZhTIFyg1S9VYwce7WannCp0b8ZzsPpYpN1KC4R0c18jdbnuAz43KsGIg2gz4qf8EHw,,&q={searchTerms} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-169882981-2974695269-2748925970-1001\SOFTWARE\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://www.claro-search.com/?affID=114506&tt=4812_5&babsrc=HP_clro&mntrId=7cbab5d900000000000000216a3bc6ad IE - HKU\S-1-5-21-169882981-2974695269-2748925970-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.awesomehp.com/?type=hp&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT IE - HKU\S-1-5-21-169882981-2974695269-2748925970-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZDr--M9JXGUna1oWD0CV0Ozk-Rt4Oo0TEUiVWXd0ZSG5UP7CRZI870OiFjQw_sO7nty0GkxMhekZhTIFyg1S9VYwce7WannCp0b8ZzsPpYpN1KC4R0c18jdbnuAz43KsGIg2gz4qf8EGA,,&q={searchTerms} IE - HKU\S-1-5-21-169882981-2974695269-2748925970-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZDr--M9JXGUna1oWD0CV0Ozk-Rt4Oo0TEUiVWXd0ZSG5UP7CRZI870OiFjQw_sO7nty0GkxMhekZhTIFyg1S9VYwce7WannCp0b8ZzsPpYpN1KC4R0c18jdbnuAz43KsGIg2gz4qf8EGA,,&q={searchTerms} IE - HKU\S-1-5-21-169882981-2974695269-2748925970-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZDr--M9JXGUna1oWD0CV0Ozk-Rt4Oo0TEUiVWXd0ZSG5UP7CRZI870OiFjQw_sO7nty0GkxMhekZhTE0LPl7nfnBSc0ax5uDcscDZ4nZ2-hTHC4FiHP0Ir17U635wZtwgHiz3MJxyBGSw,, IE - HKU\S-1-5-21-169882981-2974695269-2748925970-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\S-1-5-21-169882981-2974695269-2748925970-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKU\S-1-5-21-169882981-2974695269-2748925970-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = EA B4 E7 84 44 13 CD 01 [binary data] IE - HKU\S-1-5-21-169882981-2974695269-2748925970-1001\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZDr--M9JXGUna1oWD0CV0Ozk-Rt4Oo0TEUiVWXd0ZSG5UP7CRZI870OiFjQw_sO7nty0GkxMhekZhTIFyg1S9VYwce7WannCp0b8ZzsPpYpN1KC4R0c18jdbnuAz43KsGIg2gz4qf8EGA,,&q={searchTerms} IE - HKU\S-1-5-21-169882981-2974695269-2748925970-1001\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZDr--M9JXGUna1oWD0CV0Ozk-Rt4Oo0TEUiVWXd0ZSG5UP7CRZI870OiFjQw_sO7nty0GkxMhekZhTIFyg1S9VYwce7WannCp0b8ZzsPpYpN1KC4R0c18jdbnuAz43KsGIg2gz4qf8EGA,,&q={searchTerms} IE - HKU\S-1-5-21-169882981-2974695269-2748925970-1001\..\SearchScopes,bProtectorDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} IE - HKU\S-1-5-21-169882981-2974695269-2748925970-1001\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5} IE - HKU\S-1-5-21-169882981-2974695269-2748925970-1001\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZDr--M9JXGUna1oWD0CV0Ozk-Rt4Oo0TEUiVWXd0ZSG5UP7CRZI870OiFjQw_sO7nty0GkxMhekZhTIFyg1S9VYwce7WannCp0b8ZzsPpYpN1KC4R0c18jdbnuAz43KsGIg2gz4qf8EGA,,&q={searchTerms} IE - HKU\S-1-5-21-169882981-2974695269-2748925970-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Ask Web Search" FF - prefs.js..browser.search.selectedEngine: "Ask Web Search" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://home.tb.ask.com/index.jhtml?ptb=3647B52E-61F9-4842-811C-226D62F0ED52&n=780bd8c7&p2=^AYY^xdm070^YYA^de&si=flvrunner" FF - prefs.js..extensions.enabledAddons: ext%40MediaViewV1alpha5026.net:1.1 FF - prefs.js..extensions.enabledAddons: ext%40MediaWatchV1home30.net:1.1 FF - prefs.js..extensions.enabledAddons: ext%40MediaBuzzV1mode146.net:1.1 FF - prefs.js..extensions.enabledAddons: 8hffxtbr%40Allin1Convert_8h.com:6.33.3.46645 FF - prefs.js..extensions.enabledAddons: ext%40RichMediaViewV1release866.net:1.1 FF - prefs.js..extensions.enabledAddons: 0c822a17-a68f-4066-9257-d229458d21ca%409c178d17-dc61-4aaf-b2da-1425ac7300ac.com:0.94.93 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:29.0.1 FF - prefs.js..extensions.toolbar.mindspark._8hMembers_.browser.search.defaultenginename.prev: "StartWeb" FF - prefs.js..extensions.toolbar.mindspark._8hMembers_.browser.search.defaultenginename.savedPrev: "true" FF - prefs.js..extensions.toolbar.mindspark._8hMembers_.browser.search.defaultenginename.tb: "Ask Web Search" FF - prefs.js..extensions.toolbar.mindspark._8hMembers_.browser.search.selectedEngine.prev: "StartWeb" FF - prefs.js..extensions.toolbar.mindspark._8hMembers_.browser.search.selectedEngine.savedPrev: "true" FF - prefs.js..extensions.toolbar.mindspark._8hMembers_.browser.search.selectedEngine.tb: "Ask Web Search" FF - prefs.js..browser.startup.homepage: "hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZDr--M9JXGUna1oWD0CV0Ozk-Rt4Oo0TEUiVWXd0ZSG5UP7CRZI870OiFjQw_sO7nty0GkxMhekZhTE0LPl7nfnBSc0ax5uDcscDZ4nZ2-hTHC4FiHP0Ir17U635wZtwgHiz3MJxyBGSw,," FF - prefs.js..browser.startup.homepage: "true" FF - prefs.js..browser.startup.homepage: "hxxp://home.tb.ask.com/index.jhtml?ptb=3647B52E-61F9-4842-811C-226D62F0ED52&n=780bd8c7&p2=^AYY^xdm070^YYA^de&si=flvrunner" FF - prefs.js..keyword.URL: "hxxp://search.tb.ask.com/search/GGmain.jhtml?st=kwd&ptb=3647B52E-61F9-4842-811C-226D62F0ED52&n=780bd8c7&ind=2014042311&p2=^AYY^xdm070^YYA^de&si=flvrunner&searchfor=" FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.55.2: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.55.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@playstation.com/PsndlCheck,version=1.00: File not found FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.5: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@lightspark.github.com/Lightspark;version=1: C:\Program Files (x86)\Lightspark 0.5.3-git\nplightsparkplugin.dll File not found FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\xz123@ya456.com: C:\Program Files (x86)\BetterSurf\ff FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\12x3q4@3244516.com: C:\Program Files (x86)\Better-Surf\ff FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ext@bettersurfplus.com: C:\Program Files (x86)\BetterSurf\BetterSurfPlus\ff FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ext@WebexpEnhancedV1alpha483.net: C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha483\ff [2013.12.21 18:30:54 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ext@flashenhancer.com: C:\Program Files (x86)\AmiExt\flashEnhancer\ff [2014.01.24 23:06:27 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ext@MediaPlayerV1alpha62.net: C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha62\ff [2014.01.29 19:36:08 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ext@MediaViewerV1alpha1336.net: C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha1336\ff [2014.02.24 18:12:18 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ext@MediaViewV1alpha1029.net: C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha1029\ff [2014.03.01 21:35:50 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ext@MediaViewV1alpha5026.net: C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha5026\ff [2014.03.16 17:17:47 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ext@MediaWatchV1home30.net: C:\Program Files (x86)\MediaWatchV1\MediaWatchV1home30\ff [2014.03.23 14:36:05 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ext@MediaBuzzV1mode146.net: C:\Program Files (x86)\MediaBuzzV1\MediaBuzzV1mode146\ff [2014.04.27 11:43:19 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ext@RichMediaViewV1release866.net: C:\Program Files (x86)\RichMediaViewV1\RichMediaViewV1release866\ff [2014.05.13 19:22:43 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 29.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 29.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2014.03.15 18:42:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TT Lammers\AppData\Roaming\mozilla\Extensions [2014.05.13 19:38:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TT Lammers\AppData\Roaming\mozilla\Firefox\Profiles\5c32r3dn.default\extensions [2014.05.02 18:29:51 | 000,000,000 | ---D | M] ("MediaPlayerEnhance") -- C:\Users\TT Lammers\AppData\Roaming\mozilla\Firefox\Profiles\5c32r3dn.default\extensions\0c822a17-a68f-4066-9257-d229458d21ca@9c178d17-dc61-4aaf-b2da-1425ac7300ac.com [2014.05.08 21:37:31 | 000,000,000 | ---D | M] (Allin1Convert) -- C:\Users\TT Lammers\AppData\Roaming\mozilla\Firefox\Profiles\5c32r3dn.default\extensions\8hffxtbr@Allin1Convert_8h.com [2014.05.11 18:25:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TT Lammers\AppData\Roaming\mozilla\Firefox\Profiles\5c32r3dn.default\extensions\0c822a17-a68f-4066-9257-d229458d21ca@9c178d17-dc61-4aaf-b2da-1425ac7300ac.com\extensionData [2014.05.02 18:29:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TT Lammers\AppData\Roaming\mozilla\Firefox\Profiles\5c32r3dn.default\extensions\0c822a17-a68f-4066-9257-d229458d21ca@9c178d17-dc61-4aaf-b2da-1425ac7300ac.com\extensionData\plugins [2014.05.11 18:25:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TT Lammers\AppData\Roaming\mozilla\Firefox\Profiles\5c32r3dn.default\extensions\0c822a17-a68f-4066-9257-d229458d21ca@9c178d17-dc61-4aaf-b2da-1425ac7300ac.com\extensionData\userCode [2014.03.26 23:09:42 | 000,555,989 | ---- | M] () (No name found) -- C:\Users\TT Lammers\AppData\Roaming\mozilla\firefox\profiles\5c32r3dn.default\extensions\toolbar_ORJ-V7C@apn.ask.com.xpi [2014.05.02 13:43:47 | 000,957,880 | ---- | M] () (No name found) -- C:\Users\TT Lammers\AppData\Roaming\mozilla\firefox\profiles\5c32r3dn.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014.03.22 14:34:02 | 000,001,003 | ---- | M] () -- C:\Users\TT Lammers\AppData\Roaming\mozilla\firefox\profiles\5c32r3dn.default\searchplugins\11-suche.xml [2014.04.23 11:08:38 | 000,009,608 | ---- | M] () -- C:\Users\TT Lammers\AppData\Roaming\mozilla\firefox\profiles\5c32r3dn.default\searchplugins\ask-web-search.xml [2014.03.22 14:34:02 | 000,002,353 | ---- | M] () -- C:\Users\TT Lammers\AppData\Roaming\mozilla\firefox\profiles\5c32r3dn.default\searchplugins\englische-ergebnisse.xml [2014.03.22 14:34:02 | 000,002,822 | ---- | M] () -- C:\Users\TT Lammers\AppData\Roaming\mozilla\firefox\profiles\5c32r3dn.default\searchplugins\gmx-suche.xml [2014.03.22 14:34:02 | 000,002,432 | ---- | M] () -- C:\Users\TT Lammers\AppData\Roaming\mozilla\firefox\profiles\5c32r3dn.default\searchplugins\lastminute.xml [2014.03.22 14:34:02 | 000,005,637 | ---- | M] () -- C:\Users\TT Lammers\AppData\Roaming\mozilla\firefox\profiles\5c32r3dn.default\searchplugins\webde-suche.xml [2014.03.29 23:49:27 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions [2014.05.10 18:35:30 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2014.04.27 11:43:19 | 000,000,000 | ---D | M] (Media Buzz) -- C:\PROGRAM FILES (X86)\MEDIABUZZV1\MEDIABUZZV1MODE146\FF [2014.03.16 17:17:47 | 000,000,000 | ---D | M] (Media View) -- C:\PROGRAM FILES (X86)\MEDIAVIEWV1\MEDIAVIEWV1ALPHA5026\FF [2014.03.23 14:36:05 | 000,000,000 | ---D | M] (Media Watch) -- C:\PROGRAM FILES (X86)\MEDIAWATCHV1\MEDIAWATCHV1HOME30\FF [2014.05.13 19:22:43 | 000,000,000 | ---D | M] (Rich Media View) -- C:\PROGRAM FILES (X86)\RICHMEDIAVIEWV1\RICHMEDIAVIEWV1RELEASE866\FF ========== Chrome ========== CHR - default_search_provider: () CHR - default_search_provider: search_url = CHR - default_search_provider: suggest_url = CHR - homepage: hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZDr--M9JXGUna1oWD0CV0Ozk-Rt4Oo0TEUiVWXd0ZSG5UP7CRZI870OiFjQw_sO7nty0GkxMhekZhTE0LPl7nfnBSc0ax5uDcscDZ4nZ2-hTHC4FiHP0Ir17U635wZtwgHiz3MJxyBGTA,, CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\bopakagnckmlgajfccecajhnimjiiedh\3.8.141.12_0\ CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml\1.4_0\ CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\cgbealecnakbhfoeeipcnoboempfkbjd\2.1_0\ CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\eagngmbbjpiegdiojneaoolbllnappjo\1.1_0\ CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe\1.2.1_0\ CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgabhipcejejjmhhchfonmamedcbeod\8.3_0\ CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\hggpkhijoeadmdfmlbdepfbngmhaldci\4.2.6.9_0\ CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnghlghflihkfiopikcjmaiajgbieegb\1.1_0\ CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp\1.34_0\ CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lamhhbmgfmocmpeljkaablpohealeplo\1.1_0\ CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.7.0.2_0\ CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\crossrider CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\ CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\mglkejdgkcfeeecbbancdeeidmfpjkco\1.1_0\ CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\nchpfiddbhbdnagofhkjlaiaejmkdcla\2.0_0\ CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\nkmdmgjelehbgmopdfpjadcnihhpneop\1.1_0\ CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\ CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\obohmgehnpafmnikhnbehbefaheahaho\1.1_0\ CHR - Extension: No name found = C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkndmigholgfjlniaohblojbhgjbkakn\1.2.0_0\ O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (media enhance) - {11111111-1111-1111-1111-110411411150} - C:\Program Files (x86)\media enhance\media enhance-bho64.dll (freeven) O2:64bit: - BHO: (ValueApps) - {93DBF2BB-A2B3-4683-A92E-57E60751F346} - C:\Programme\Conduit\ValueApps\IE\ValueAppsLoader.dll (Conduit Ltd.) O2:64bit: - BHO: (IMinent WebBooster (BHO)) - {A09AB6EB-31B5-454C-97EC-9B294D92EE2A} - C:\Program Files (x86)\Iminent\Minibar.InternetExplorer.BHOx64.dll File not found O2 - BHO: (no name) - {112BA211-334C-4A90-90EC-2AD1CDAB287C} - No CLSID value found. O2 - BHO: (flash-Enhancer) - {5A60B6BB-FA81-4EFA-AB9C-A820E2143736} - C:\Program Files (x86)\AmiExt\flashEnhancer\ie\flashEnhancer.dll () O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (no name) - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - No CLSID value found. O2 - BHO: (ValueApps) - {93DBF2BB-A2B3-4683-A92E-57E60751F346} - C:\Program Files (x86)\Conduit\ValueApps\IE\ValueAppsLoader.dll File not found O2 - BHO: (no name) - {A09AB6EB-31B5-454C-97EC-9B294D92EE2A} - No CLSID value found. O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3:64bit: - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - {1FAFD711-ABF9-4F6A-8130-5166C7371427} - No CLSID value found. O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ) O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found. O3 - HKU\S-1-5-21-169882981-2974695269-2748925970-1001\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O4 - HKLM..\Run: [ApnTBMon] C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe (APN) O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [Guard.Mail.ru.gui] C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe () O4 - HKLM..\Run: [Iminent] C:\Program Files (x86)\Iminent\Iminent.exe /warmup "F77F87E5-A6BD-4922-A530-EDF63D7E9F8C" File not found O4 - HKLM..\Run: [IminentMessenger] C:\Program Files (x86)\Iminent\Iminent.Messengers.exe File not found O4 - HKLM..\Run: [mobilegeni daemon] C:\Program Files (x86)\Mobogenie\DaemonProcess.exe File not found O4 - HKLM..\Run: [PDFPrint] C:\Program Files (x86)\PDF24\pdf24.exe (Geek Software GmbH) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-169882981-2974695269-2748925970-1001..\Run: [EA Core] "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent File not found O4 - HKU\S-1-5-21-169882981-2974695269-2748925970-1001..\Run: [HP Photosmart 5520 series (NET)] C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe (Hewlett-Packard Co.) O4 - HKU\S-1-5-21-169882981-2974695269-2748925970-1001..\Run: [lollipop_10271122] lollipop_10271122 File not found O4 - HKU\S-1-5-21-169882981-2974695269-2748925970-1001..\Run: [NextLive] C:\Users\TT Lammers\AppData\Roaming\newnext.me\nengine.dll (NewNextDotMe) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKU\S-1-5-21-169882981-2974695269-2748925970-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0 O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O9 - Extra Button: HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files (x86)\Hewlett-Packard\Smart Print 2.0\smartprintsetup.exe (Hewlett-Packard) O9 - Extra 'Tools' menuitem : HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files (x86)\Hewlett-Packard\Smart Print 2.0\smartprintsetup.exe (Hewlett-Packard) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0511CC15-6296-4FDF-A167-F94D1E800332}: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20:64bit: - Winlogon\Notify\ScCertProp: DllName - (wlnotify.dll) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{26969bd7-5590-11e2-86ff-00247e5b77a2}\Shell - "" = AutoRun O33 - MountPoints2\{26969bd7-5590-11e2-86ff-00247e5b77a2}\Shell\AutoRun\command - "" = E:\Startme.exe O33 - MountPoints2\{430916fa-809c-11e1-8051-00247e5b77a2}\Shell - "" = AutoRun O33 - MountPoints2\{430916fa-809c-11e1-8051-00247e5b77a2}\Shell\AutoRun\command - "" = E:\Startme.exe O33 - MountPoints2\{4e7c47c4-f87d-11e2-9b2f-00247e5b77a2}\Shell - "" = AutoRun O33 - MountPoints2\{4e7c47c4-f87d-11e2-9b2f-00247e5b77a2}\Shell\AutoRun\command - "" = E:\iLinker.exe O33 - MountPoints2\{90792bbe-5d80-11e2-8a77-00247e5b77a2}\Shell - "" = AutoRun O33 - MountPoints2\{90792bbe-5d80-11e2-8a77-00247e5b77a2}\Shell\AutoRun\command - "" = E:\Startme.exe O33 - MountPoints2\{90792bcd-5d80-11e2-8a77-00247e5b77a2}\Shell - "" = AutoRun O33 - MountPoints2\{90792bcd-5d80-11e2-8a77-00247e5b77a2}\Shell\AutoRun\command - "" = E:\Startme.exe O33 - MountPoints2\F\Shell - "" = AutoRun O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\Startme.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2014.05.13 19:38:16 | 000,000,000 | ---D | C] -- C:\ProgramData\AskPartnerNetwork [2014.05.13 19:38:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AskPartnerNetwork [2014.05.13 19:36:58 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\TT Lammers\Desktop\otl.exe [2014.05.13 19:36:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Oracle [2014.05.13 19:36:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java [2014.05.13 19:35:41 | 000,264,616 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe [2014.05.13 19:35:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java [2014.05.13 19:35:16 | 000,175,528 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe [2014.05.13 19:35:16 | 000,175,016 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe [2014.05.13 19:35:16 | 000,096,168 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll [2014.05.13 19:35:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java [2014.05.13 19:22:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\RichMediaViewV1 [2014.05.11 18:28:24 | 000,000,000 | ---D | C] -- C:\Users\xxxx\Desktop\2014-05-11 - Info [2014.05.10 20:38:58 | 000,000,000 | --SD | C] -- C:\Users\xxxx\Documents\Eigene Datenquellen [2014.05.10 20:18:28 | 000,000,000 | ---D | C] -- C:\Users\xxxx\Desktop\2014-05-10 - Info2 [2014.05.10 20:18:28 | 000,000,000 | ---D | C] -- C:\Users\xxxx\Desktop\2014-05-10 - Info1 [2014.05.06 21:10:28 | 000,000,000 | --SD | C] -- C:\Windows\SysNative\CompatTel [2014.05.06 17:58:54 | 000,465,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aepdu.dll [2014.05.06 17:58:54 | 000,424,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aeinv.dll [2014.05.04 14:01:31 | 000,000,000 | -HSD | C] -- C:\Users\xxxx\AppData\Local\EmieUserList [2014.05.04 14:01:31 | 000,000,000 | -HSD | C] -- C:\Users\xxxx\AppData\Local\EmieSiteList [2014.05.03 18:57:55 | 000,000,000 | ---D | C] -- C:\Users\xxxx\Desktop\EDV [2014.05.03 12:02:52 | 000,574,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2014.05.03 12:02:52 | 000,440,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2014.05.03 12:02:47 | 000,548,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll [2014.05.03 12:02:41 | 000,586,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe [2014.05.03 12:02:40 | 000,038,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\JavaScriptCollectionAgent.dll [2014.05.03 12:02:40 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll [2014.05.03 12:02:40 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollectorres.dll [2014.05.03 12:02:37 | 000,752,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9diag.dll [2014.05.03 12:02:37 | 000,453,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll [2014.05.03 12:02:37 | 000,296,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll [2014.05.03 12:02:36 | 000,195,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll [2014.05.03 12:02:36 | 000,164,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll [2014.05.03 12:02:35 | 000,628,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2014.05.03 12:02:30 | 000,139,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe [2014.05.03 12:02:30 | 000,112,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2014.05.03 12:02:30 | 000,066,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll [2014.05.03 12:02:30 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll [2014.05.03 12:02:30 | 000,032,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll [2014.05.03 12:02:29 | 000,032,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll [2014.05.03 12:02:23 | 000,940,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe [2014.05.03 12:02:23 | 000,846,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll [2014.05.03 12:02:23 | 000,704,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll [2014.05.03 12:02:23 | 000,592,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9diag.dll [2014.05.03 12:02:23 | 000,111,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollector.exe [2014.05.03 12:02:23 | 000,051,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieetwproxystub.dll [2014.05.03 12:02:23 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwproxystub.dll [2014.05.03 12:02:18 | 002,043,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2014.05.03 12:02:18 | 001,967,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2014.05.03 12:02:09 | 005,784,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2014.04.27 11:43:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MediaBuzzV1 [2014.04.19 12:25:34 | 000,000,000 | ---D | C] -- C:\Users\xxxx\Desktop\Prüfungen [2014.04.15 19:55:41 | 000,000,000 | ---D | C] -- C:\Users\xxxx\Documents\BewerbungsMaster [2014.04.15 19:55:41 | 000,000,000 | ---D | C] -- C:\Users\xxxx\AppData\Local\BewerbungsMaster [2014.04.15 19:55:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BewerbungsMaster [2014.04.15 19:54:58 | 000,000,000 | ---D | C] -- C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BewerbungsMaster [2014.04.15 19:54:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\BEWERBUNGSMASTER [2014.04.15 19:54:49 | 000,335,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\Setup1.exe [2014.04.15 19:54:46 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\ST6UNST.EXE [2014.04.15 19:17:30 | 000,692,400 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2014.04.15 19:17:30 | 000,070,832 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [1 C:\Users\xxxx\Desktop\*.tmp files -> C:\Users\xxxx\Desktop\*.tmp -> ] [1 C:\Users\xxxx\AppData\Local\*.tmp files -> C:\Users\xxxx\AppData\Local\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2014.05.13 19:37:15 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\xxxx\Desktop\otl.exe [2014.05.13 19:35:08 | 000,264,616 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe [2014.05.13 19:35:08 | 000,175,528 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe [2014.05.13 19:35:08 | 000,096,168 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll [2014.05.13 19:35:06 | 000,175,016 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe [2014.05.13 19:33:50 | 000,021,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2014.05.13 19:33:49 | 000,021,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2014.05.13 19:32:43 | 001,620,684 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2014.05.13 19:32:43 | 000,699,682 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2014.05.13 19:32:43 | 000,654,480 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2014.05.13 19:32:43 | 000,149,790 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2014.05.13 19:32:43 | 000,122,352 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2014.05.13 19:25:54 | 000,000,376 | ---- | M] () -- C:\Windows\tasks\AmiUpdXp.job [2014.05.13 19:25:42 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2014.05.13 19:25:37 | 3193,122,816 | -HS- | M] () -- C:\hiberfil.sys [2014.05.13 19:25:01 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2014.05.13 19:22:48 | 000,000,306 | RHS- | M] () -- C:\ProgramData\ntuser.pol [2014.05.05 17:20:39 | 005,710,941 | ---- | M] () -- C:\Users\xxxx\Desktop\Sara Bareilles - Brave.mp3 [2014.05.03 15:32:27 | 004,369,702 | ---- | M] () -- C:\Users\xxxx\Desktop\Alle Farben - She Moves (Far Away) feat. Graham Candy (Street Video).mp3 [2014.04.29 14:24:11 | 000,742,872 | ---- | M] () -- C:\Users\xxxx\Documents\Scan0002.jpg [2014.04.28 22:16:48 | 000,692,400 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2014.04.28 22:16:48 | 000,070,832 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2014.04.24 22:32:25 | 000,000,583 | ---- | M] () -- C:\Users\xxxx\Desktop\Buchungsuebersicht.lnk [2014.04.22 19:11:07 | 400,341,788 | ---- | M] () -- C:\Windows\MEMORY.DMP [2014.04.15 19:54:49 | 000,335,872 | ---- | M] (Microsoft Corporation) -- C:\Windows\Setup1.exe [2014.04.15 19:54:47 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\ST6UNST.EXE [2014.04.14 04:24:46 | 000,465,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\aepdu.dll [2014.04.14 04:19:37 | 000,424,448 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\aeinv.dll [1 C:\Users\xxxx\Desktop\*.tmp files -> C:\Users\xxxx\Desktop\*.tmp -> ] [1 C:\Users\xxxx AppData\Local\*.tmp files -> C:\Users\xxxx\AppData\Local\*.tmp -> ] ========== Files Created - No Company Name ========== [2014.05.05 17:20:35 | 005,710,941 | ---- | C] () -- C:\Users\xxxx\Desktop\Sara Bareilles - Brave.mp3 [2014.05.03 15:32:27 | 004,369,702 | ---- | C] () -- C:\Users\xxxx\Desktop\Alle Farben - She Moves (Far Away) feat. Graham Candy (Street Video).mp3 [2014.04.29 14:23:53 | 000,742,872 | ---- | C] () -- C:\Users\xxxx\Documents\Scan0002.jpg [2014.04.15 19:17:31 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2014.03.16 21:56:19 | 000,000,160 | ---- | C] () -- C:\Users\xxxx\AppData\Roaming\aps.uninstall.scan.results [2014.03.03 12:36:30 | 001,594,964 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2014.02.23 15:31:22 | 000,002,108 | ---- | C] () -- C:\Users\xxxx\AppData\Local\recently-used.xbel [2014.01.29 19:36:10 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol [2013.12.18 21:32:53 | 000,000,041 | ---- | C] () -- C:\Users\xxxx\AppData\Roaming\WB.CFG [2013.06.17 19:16:57 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini [2013.05.06 20:19:50 | 001,917,400 | ---- | C] () -- C:\Users\xxxx\DSC_0374.jpg [2013.04.22 19:33:39 | 000,586,713 | ---- | C] () -- C:\Users\xxxx\DSCF1662.jpg [2013.04.22 19:33:37 | 000,085,248 | ---- | C] () -- C:\Users\xxxx Lammers\554181_430948913619731_1182929366_n.jpg [2013.04.22 19:33:18 | 001,480,278 | ---- | C] () -- C:\Users\xxxx\DSC_0041.jpg [2013.04.22 19:33:06 | 000,985,147 | ---- | C] () -- C:\Users\xxxx\DSC_0046.jpg [2013.04.22 19:33:03 | 000,190,871 | ---- | C] () -- C:\Users\xxxxs\DSC_0064.jpg [2013.04.22 19:32:53 | 000,792,607 | ---- | C] () -- C:\Users\xxxx\DSCF1488.jpg [2013.04.22 19:32:44 | 000,700,924 | ---- | C] () -- C:\Users\xxxx\DSCF1358.jpg [2013.04.22 19:32:27 | 001,380,193 | ---- | C] () -- C:\Users\xxxx\IMG_0723.jpg [2013.04.22 19:32:15 | 000,923,506 | ---- | C] () -- C:\Users\xxxx\IMG_3529.jpg [2013.04.22 19:32:03 | 000,901,347 | ---- | C] () -- C:\Users\xxxx\DSC_0070.jpg [2013.04.22 19:31:51 | 000,951,420 | ---- | C] () -- C:\Users\xxxx\DSC00190.jpg [2013.04.22 19:31:47 | 000,189,649 | ---- | C] () -- C:\Users\xxxx\IMG_0682.jpg [2013.04.22 19:31:34 | 000,817,616 | ---- | C] () -- C:\Users\xxxx\IMG_6395.jpg [2013.04.22 19:31:33 | 000,050,312 | ---- | C] () -- C:\Users\xxxxs\Bild254.jpg [2013.04.22 19:31:32 | 000,021,587 | ---- | C] () -- C:\Users\TT xxxx\DSC_0215_20130406195310175-1.jpg [2013.04.22 19:31:29 | 000,165,176 | ---- | C] () -- C:\Users\TT xxxx\DSC_0215_20130406195310175.jpg [2013.04.22 19:31:26 | 000,253,405 | ---- | C] () -- C:\Users\TT xxxx\DSC01645_20130410210245927.jpg [2013.0422 19:31:20 | 000,392,629 | ---- | C] () -- C:\Users\TT xxxx\IMG_1187_20130410210735964.jpg [2013.04.22 19:31:07 | 001,028,722 | ---- | C] () -- C:\Users\TT xxxx\IMG_0612_20130410211153208.jpg [2013.04.22 19:31:04 | 000,163,035 | ---- | C] () -- C:\Users\TT xxxx\DSC_0262_20130417202117709.jpg [2013.04.22 19:31:02 | 000,178,987 | ---- | C] () -- C:\Users\TT xxxx\DSC_0265_20130417202143729.jpg [2013.04.22 19:30:59 | 000,160,705 | ---- | C] () -- C:\Users\TT xxxx\DSC_0261_20130417202229975.jpg [2013.04.22 19:30:57 | 000,056,887 | ---- | C] () -- C:\Users\TT xxxx\DSC_0262_20130417202117709_20130417202421992.jpg [2013.04.22 19:30:55 | 000,189,098 | ---- | C] () -- C:\Users\TT xxxx\DSC_0290_20130418195748969.jpg [2013.04.22 19:30:53 | 000,051,167 | ---- | C] () -- C:\Users\TT xxxx\248496_191171744264117_5348576_n_20130418202401632.jpg [2013.04.22 19:30:51 | 000,151,695 | ---- | C] () -- C:\Users\TT xxxx\DSC01652_20130418213654875.jpg [2013.04.22 19:30:48 | 000,117,433 | ---- | C] () -- C:\Users\xx xxxx\IMG-20130421-WA0067_20130421230557220.jpg [2013.04.22 19:30:46 | 000,145,093 | ---- | C] () -- C:\Users\xx xxxx\IMG-20130421-WA0035_20130421230856459.jpg [2013.04.22 19:30:38 | 000,556,094 | ---- | C] () -- C:\Users\TT Lammers\IMG-20130421-WA0029_20130421231015747.jpg [2013.04.22 19:30:37 | 000,109,465 | ---- | C] () -- C:\Users\TT Lammers\IMG-20130421-WA0019_20130421231618558.jpg [2013.04.22 19:30:35 | 000,110,253 | ---- | C] () -- C:\Users\TT Lammers\IMG-20130421-WA0018_20130421231705949.jpg [2013.01.19 19:12:41 | 000,797,539 | ---- | C] () -- C:\Users\TT Lammers\DSC_0095.jpg [2013.01.19 19:12:29 | 000,703,556 | ---- | C] () -- C:\Users\TT Lammers\DSC_0096.jpg [2013.01.19 19:12:18 | 000,803,703 | ---- | C] () -- C:\Users\TT Lammers\DSC_0097.jpg [2013.01.19 19:12:06 | 000,773,686 | ---- | C] () -- C:\Users\TT Lammers\DSC_0098.jpg [2013.01.19 19:11:55 | 000,802,374 | ---- | C] () -- C:\Users\TT Lammers\DSC_0099.jpg [2013.01.19 19:11:45 | 000,768,366 | ---- | C] () -- C:\Users\TT Lammers\DSC_0100.jpg [2013.01.19 19:11:34 | 000,810,485 | ---- | C] () -- C:\Users\TT Lammers\DSC_0101.jpg [2013.01.19 19:11:23 | 000,807,414 | ---- | C] () -- C:\Users\TT Lammers\DSC_0102.jpg [2013.01.19 19:11:14 | 000,709,272 | ---- | C] () -- C:\Users\TT Lammers\DSC_0103.jpg [2013.01.19 19:11:02 | 000,762,727 | ---- | C] () -- C:\Users\TT Lammers\DSC_0104.jpg [2013.01.19 19:10:43 | 000,856,648 | ---- | C] () -- C:\Users\TT Lammers\DSC_0105.jpg [2013.01.19 19:10:29 | 000,857,996 | ---- | C] () -- C:\Users\TT Lammers\DSC_0106.jpg [2013.01.19 19:10:18 | 000,873,588 | ---- | C] () -- C:\Users\TT Lammers\DSC_0107.jpg [2013.01.19 19:10:01 | 000,851,378 | ---- | C] () -- C:\Users\TT Lammers\DSC_0108.jpg [2013.01.19 19:09:47 | 000,868,921 | ---- | C] () -- C:\Users\TT Lammers\DSC_0109.jpg [2013.01.19 19:09:35 | 000,866,634 | ---- | C] () -- C:\Users\TT Lammers\DSC_0110.jpg [2013.01.19 19:09:13 | 000,860,071 | ---- | C] () -- C:\Users\TT Lammers\DSC_0111.jpg [2013.01.19 19:09:00 | 000,828,584 | ---- | C] () -- C:\Users\TT Lammers\DSC_0112.jpg [2013.01.19 19:08:48 | 000,849,543 | ---- | C] () -- C:\Users\TT Lammers\DSC_0113.jpg [2013.01.19 19:08:28 | 000,878,321 | ---- | C] () -- C:\Users\TT Lammers\DSC_0114.jpg [2013.01.19 19:08:17 | 000,848,261 | ---- | C] () -- C:\Users\TT Lammers\DSC_0115.jpg [2013.01.19 19:08:07 | 000,836,748 | ---- | C] () -- C:\Users\TT Lammers\DSC_0116.jpg [2013.01.19 19:07:52 | 000,849,893 | ---- | C] () -- C:\Users\TT Lammers\DSC_0117.jpg [2013.01.19 19:07:39 | 000,824,595 | ---- | C] () -- C:\Users\TT Lammers\DSC_0118.jpg [2013.01.19 19:07:25 | 000,823,322 | ---- | C] () -- C:\Users\TT Lammers\DSC_0119.jpg [2012.10.18 17:04:37 | 000,000,032 | ---- | C] () -- C:\Users\TT Lammers\.simfy [2012.08.26 18:22:17 | 000,003,584 | ---- | C] () -- C:\Users\TT Lammers\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.04.23 16:07:53 | 000,019,088 | ---- | C] () -- C:\Users\TT Lammers\AppData\Roaming\UserTile.png ========== ZeroAccess Check ========== [2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2013.07.26 04:24:57 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2013.07.26 03:55:59 | 012,872,704 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2014.04.01 20:45:43 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\337 [2014.04.01 20:52:54 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\337 Wallpaper [2012.12.02 15:32:16 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\Babylon [2013.08.05 21:06:13 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\Dealply [2013.08.15 18:46:25 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\Desk 365 [2013.08.05 21:04:44 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\eIntaller [2012.04.17 19:14:39 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\GetRightToGo [2012.12.17 22:44:27 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\ICQ [2012.09.28 18:25:47 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\ICQ Search [2014.03.15 18:42:33 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\IminentToolbar [2014.05.13 19:26:12 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\newnext.me [2014.04.01 20:50:47 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\Omiga Plus [2014.02.21 19:50:46 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\Opera Software [2012.12.23 16:59:36 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\PerformerSoft [2012.10.18 17:04:36 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\Simfy [2013.01.13 17:34:47 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\Sony [2012.12.02 15:32:55 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\UltraMixer [2014.01.24 23:02:28 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\ValueApps [2012.04.17 19:14:58 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\Webcammax [2012.04.19 21:49:51 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\Windows SideBar [2014.01.26 22:52:58 | 000,000,000 | ---D | M] -- C:\Users\TT Lammers\AppData\Roaming\WinZipper ========== Purity Check ========== ========== Files - Unicode (All) ========== [2013.11.21 16:11:17 | 105,514,518 | ---- | M] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\꒳曬Ḽ˜ [2013.11.21 16:11:17 | 105,514,518 | ---- | C] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\꒳曬Ḽ˜ [2013.11.20 18:29:31 | 105,361,780 | ---- | M] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\㎡花Ḽ– [2013.11.20 18:29:31 | 105,361,780 | ---- | C] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\㎡花Ḽ– [2013.11.12 21:01:02 | 103,974,937 | ---- | M] ()(C:\Windows\SysWow64\???) -- C:\Windows\SysWow64\麨Ḽ [2013.11.12 21:01:02 | 103,974,937 | ---- | C] ()(C:\Windows\SysWow64\???) -- C:\Windows\SysWow64\麨Ḽ [2013.11.02 12:33:50 | 104,569,497 | ---- | M] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\後쓺Ḽ‰ [2013.11.02 12:33:50 | 104,569,497 | ---- | C] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\後쓺Ḽ‰ [2013.10.29 19:14:44 | 103,932,228 | ---- | M] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\㭅Ḽ’ [2013.10.29 19:14:44 | 103,932,228 | ---- | C] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\㭅Ḽ’ < End of report > |
|
13.05.2014, 20:04
| #2 |
| /// the machine /// TB-Ausbilder    |  Im Internetbrowser öffnen sich immer wieder neue Seiten mit Werbung :( hi,
__________________ So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
13.05.2014, 20:37
| #3 |
| | Im Internetbrowser öffnen sich immer wieder neue Seiten mit Werbung :( FRST Logfile:
__________________FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-05-2014 01 Ran by TT Lammers (administrator) on TTLAMMERS-PC on 13-05-2014 21:26:31 Running from C:\Users\TT Lammers\Downloads Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\System32\atiesrxx.exe (Hewlett-Packard Company) C:\Windows\System32\hpservice.exe (AMD) C:\Windows\System32\atieclxx.exe (Taiwan Shui Mu Chih Ching Technology Limited.) C:\Program Files (x86)\WinZipper\winzipersvc.exe (Cherished Technololgy LIMITED) C:\ProgramData\WPM\wprotectmanager.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe () C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe () C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe () C:\Program Files (x86)\Iminent\WinkHandler.exe () C:\Program Files (x86)\Iminent\WinkHandler.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe (ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe () C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_206.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_206.exe (OldTimer Tools) C:\Users\TT Lammers\Desktop\otl.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 5520 series\Bin\HPNetworkCommunicator.exe ==================== Registry (Whitelisted) ================== HKLM-x32\...\Run: [ArcSoft Connection Service] => C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.) HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2011-10-24] (Apple Inc.) HKLM-x32\...\Run: [Guard.Mail.ru.gui] => C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [1564368 2012-09-28] () HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-21] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard) HKLM-x32\...\Run: [mobilegeni daemon] => C:\Program Files (x86)\Mobogenie\DaemonProcess.exe HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [189480 2014-02-06] (Geek Software GmbH) HKLM-x32\...\Run: [Iminent] => C:\Program Files (x86)\Iminent\Iminent.exe /warmup "F77F87E5-A6BD-4922-A530-EDF63D7E9F8C" HKLM-x32\...\Run: [IminentMessenger] => C:\Program Files (x86)\Iminent\Iminent.Messengers.exe HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) Winlogon\Notify\ScCertProp: wlnotify.dll [X] HKU\S-1-5-21-169882981-2974695269-2748925970-1001\...\Run: [EA Core] => "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent HKU\S-1-5-21-169882981-2974695269-2748925970-1001\...\Run: [HP Photosmart 5520 series (NET)] => C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.) HKU\S-1-5-21-169882981-2974695269-2748925970-1001\...\Run: [lollipop_10271122] => lollipop_10271122 HKU\S-1-5-21-169882981-2974695269-2748925970-1001\...\Run: [NextLive] => C:\Windows\SysWOW64\rundll32.exe "C:\Users\TT Lammers\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l HKU\S-1-5-21-169882981-2974695269-2748925970-1001\...\MountPoints2: F - F:\Startme.exe HKU\S-1-5-21-169882981-2974695269-2748925970-1001\...\MountPoints2: {26969bd7-5590-11e2-86ff-00247e5b77a2} - E:\Startme.exe HKU\S-1-5-21-169882981-2974695269-2748925970-1001\...\MountPoints2: {430916fa-809c-11e1-8051-00247e5b77a2} - E:\Startme.exe HKU\S-1-5-21-169882981-2974695269-2748925970-1001\...\MountPoints2: {4e7c47c4-f87d-11e2-9b2f-00247e5b77a2} - E:\iLinker.exe HKU\S-1-5-21-169882981-2974695269-2748925970-1001\...\MountPoints2: {90792bbe-5d80-11e2-8a77-00247e5b77a2} - E:\Startme.exe HKU\S-1-5-21-169882981-2974695269-2748925970-1001\...\MountPoints2: {90792bcd-5d80-11e2-8a77-00247e5b77a2} - E:\Startme.exe GroupPolicy: Group Policy on Chrome detected <======= ATTENTION ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZDr--M9JXGUna1oWD0CV0Ozk-Rt4Oo0TEUiVWXd0ZSG5UP7CRZI870OiFjQw_sO7nty0GkxMhekZhTIFyg1S9VYwce7WannCp0b8ZzsPpYpN1KC4R0c18jdbnuAz43KsGIg2gz4qf8EGA,,&q={searchTerms} HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZDr--M9JXGUna1oWD0CV0Ozk-Rt4Oo0TEUiVWXd0ZSG5UP7CRZI870OiFjQw_sO7nty0GkxMhekZhTE0LPl7nfnBSc0ax5uDcscDZ4nZ2-hTHC4FiHP0Ir17U635wZtwgHiz3MJxyBGSw,, HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xEAB4E7844413CD01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE HKCU\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://www.claro-search.com/?affID=114506&tt=4812_5&babsrc=HP_clro&mntrId=7cbab5d900000000000000216a3bc6ad HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.awesomehp.com/?type=hp&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZDr--M9JXGUna1oWD0CV0Ozk-Rt4Oo0TEUiVWXd0ZSG5UP7CRZI870OiFjQw_sO7nty0GkxMhekZhTIFyg1S9VYwce7WannCp0b8ZzsPpYpN1KC4R0c18jdbnuAz43KsGIg2gz4qf8EGA,,&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.awesomehp.com/web/?type=ds&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.awesomehp.com/?type=hp&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.awesomehp.com/?type=hp&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.awesomehp.com/web/?type=ds&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.awesomehp.com/web/?type=ds&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.awesomehp.com/?type=hp&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.awesomehp.com/?type=hp&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.awesomehp.com/web/?type=ds&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT&q={searchTerms} StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.qvo6.com/?utm_source=b&utm_medium=amt&from=amt&uid=ST9250421AS_5TH0HAPT&ts=1375729497 SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = SearchScopes: HKLM - {460C3D19-B3D4-4964-A550-77D263B0CCCB} URL = hxxp://www.awesomehp.com/web/?type=ds&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT&q={searchTerms} SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZDr--M9JXGUna1oWD0CV0Ozk-Rt4Oo0TEUiVWXd0ZSG5UP7CRZI870OiFjQw_sO7nty0GkxMhekZhTIFyg1S9VYwce7WannCp0b8ZzsPpYpN1KC4R0c18jdbnuAz43KsGIg2gz4qf8EHw,,&q={searchTerms} SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZDr--M9JXGUna1oWD0CV0Ozk-Rt4Oo0TEUiVWXd0ZSG5UP7CRZI870OiFjQw_sO7nty0GkxMhekZhTIFyg1S9VYwce7WannCp0b8ZzsPpYpN1KC4R0c18jdbnuAz43KsGIg2gz4qf8EHw,,&q={searchTerms} SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZDr--M9JXGUna1oWD0CV0Ozk-Rt4Oo0TEUiVWXd0ZSG5UP7CRZI870OiFjQw_sO7nty0GkxMhekZhTIFyg1S9VYwce7WannCp0b8ZzsPpYpN1KC4R0c18jdbnuAz43KsGIg2gz4qf8EGA,,&q={searchTerms} SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZDr--M9JXGUna1oWD0CV0Ozk-Rt4Oo0TEUiVWXd0ZSG5UP7CRZI870OiFjQw_sO7nty0GkxMhekZhTIFyg1S9VYwce7WannCp0b8ZzsPpYpN1KC4R0c18jdbnuAz43KsGIg2gz4qf8EGA,,&q={searchTerms} BHO: ValueApps - {93DBF2BB-A2B3-4683-A92E-57E60751F346} - C:\Program Files\Conduit\ValueApps\IE\ValueAppsLoader.dll (Conduit Ltd.) BHO: IMinent WebBooster (BHO) - {A09AB6EB-31B5-454C-97EC-9B294D92EE2A} - C:\Program Files (x86)\Iminent\Minibar.InternetExplorer.BHOx64.dll No File BHO-x32: No Name - {112BA211-334C-4A90-90EC-2AD1CDAB287C} - No File BHO-x32: flash-Enhancer - {5A60B6BB-FA81-4EFA-AB9C-A820E2143736} - C:\Program Files (x86)\AmiExt\flashEnhancer\ie\flashEnhancer.dll () BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: No Name - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - No File BHO-x32: ValueApps - {93DBF2BB-A2B3-4683-A92E-57E60751F346} - C:\Program Files (x86)\Conduit\ValueApps\IE\ValueAppsLoader.dll No File BHO-x32: No Name - {A09AB6EB-31B5-454C-97EC-9B294D92EE2A} - No File BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File Toolbar: HKLM-x32 - ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ) Toolbar: HKLM-x32 - No Name - {1FAFD711-ABF9-4F6A-8130-5166C7371427} - No File Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\TT Lammers\AppData\Roaming\Mozilla\Firefox\Profiles\5c32r3dn.default FF DefaultSearchEngine: Ask Web Search FF SelectedSearchEngine: Ask Web Search FF Homepage: hxxp://home.tb.ask.com/index.jhtml?ptb=3647B52E-61F9-4842-811C-226D62F0ED52&n=780bd8c7&p2=^AYY^xdm070^YYA^de&si=flvrunner FF Keyword.URL: hxxp://search.tb.ask.com/search/GGmain.jhtml?st=kwd&ptb=3647B52E-61F9-4842-811C-226D62F0ED52&n=780bd8c7&ind=2014042311&p2=^AYY^xdm070^YYA^de&si=flvrunner&searchfor= FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll () FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll () FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @videolan.org/vlc,version=2.0.5 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @lightspark.github.com/Lightspark;version=1 - C:\Program Files (x86)\Lightspark 0.5.3-git\nplightsparkplugin.dll No File FF SearchPlugin: C:\Users\TT Lammers\AppData\Roaming\Mozilla\Firefox\Profiles\5c32r3dn.default\searchplugins\11-suche.xml FF SearchPlugin: C:\Users\TT Lammers\AppData\Roaming\Mozilla\Firefox\Profiles\5c32r3dn.default\searchplugins\ask-search.xml FF SearchPlugin: C:\Users\TT Lammers\AppData\Roaming\Mozilla\Firefox\Profiles\5c32r3dn.default\searchplugins\ask-web-search.xml FF SearchPlugin: C:\Users\TT Lammers\AppData\Roaming\Mozilla\Firefox\Profiles\5c32r3dn.default\searchplugins\englische-ergebnisse.xml FF SearchPlugin: C:\Users\TT Lammers\AppData\Roaming\Mozilla\Firefox\Profiles\5c32r3dn.default\searchplugins\gmx-suche.xml FF SearchPlugin: C:\Users\TT Lammers\AppData\Roaming\Mozilla\Firefox\Profiles\5c32r3dn.default\searchplugins\lastminute.xml FF SearchPlugin: C:\Users\TT Lammers\AppData\Roaming\Mozilla\Firefox\Profiles\5c32r3dn.default\searchplugins\webde-suche.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\StartWeb.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: No Name - C:\Users\TT Lammers\AppData\Roaming\Mozilla\Firefox\Profiles\5c32r3dn.default\Extensions\0c822a17-a68f-4066-9257-d229458d21ca@9c178d17-dc61-4aaf-b2da-1425ac7300ac.com [2014-05-02] FF Extension: Allin1Convert - C:\Users\TT Lammers\AppData\Roaming\Mozilla\Firefox\Profiles\5c32r3dn.default\Extensions\8hffxtbr@Allin1Convert_8h.com [2014-05-08] FF Extension: Adblock Plus - C:\Users\TT Lammers\AppData\Roaming\Mozilla\Firefox\Profiles\5c32r3dn.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-03-16] FF HKLM-x32\...\Firefox\Extensions: [xz123@ya456.com] - C:\Program Files (x86)\BetterSurf\ff FF HKLM-x32\...\Firefox\Extensions: [12x3q4@3244516.com] - C:\Program Files (x86)\Better-Surf\ff FF HKLM-x32\...\Firefox\Extensions: [ext@bettersurfplus.com] - C:\Program Files (x86)\BetterSurf\BetterSurfPlus\ff FF HKLM-x32\...\Firefox\Extensions: [ext@WebexpEnhancedV1alpha483.net] - C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha483\ff FF Extension: Webexp Enhanced - C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha483\ff [2013-12-21] FF HKLM-x32\...\Firefox\Extensions: [ext@flashenhancer.com] - C:\Program Files (x86)\AmiExt\flashEnhancer\ff FF Extension: flash-Enhancer - C:\Program Files (x86)\AmiExt\flashEnhancer\ff [2014-01-24] FF HKLM-x32\...\Firefox\Extensions: [ext@MediaPlayerV1alpha62.net] - C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha62\ff FF Extension: Media Player - C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha62\ff [2014-01-29] FF HKLM-x32\...\Firefox\Extensions: [ext@MediaViewerV1alpha1336.net] - C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha1336\ff FF Extension: Media Viewer - C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha1336\ff [2014-02-24] FF HKLM-x32\...\Firefox\Extensions: [ext@MediaViewV1alpha1029.net] - C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha1029\ff FF Extension: Media View - C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha1029\ff [2014-03-01] FF HKLM-x32\...\Firefox\Extensions: [ext@MediaViewV1alpha5026.net] - C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha5026\ff FF Extension: Media View - C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha5026\ff [2014-03-16] FF HKLM-x32\...\Firefox\Extensions: [ext@MediaWatchV1home30.net] - C:\Program Files (x86)\MediaWatchV1\MediaWatchV1home30\ff FF Extension: Media Watch - C:\Program Files (x86)\MediaWatchV1\MediaWatchV1home30\ff [2014-03-23] FF HKLM-x32\...\Firefox\Extensions: [ext@MediaBuzzV1mode146.net] - C:\Program Files (x86)\MediaBuzzV1\MediaBuzzV1mode146\ff FF Extension: Media Buzz - C:\Program Files (x86)\MediaBuzzV1\MediaBuzzV1mode146\ff [2014-04-27] FF HKLM-x32\...\Firefox\Extensions: [ext@RichMediaViewV1release866.net] - C:\Program Files (x86)\RichMediaViewV1\RichMediaViewV1release866\ff FF Extension: Rich Media View - C:\Program Files (x86)\RichMediaViewV1\RichMediaViewV1release866\ff [2014-05-13] Chrome: ======= CHR HomePage: hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZDr--M9JXGUna1oWD0CV0Ozk-Rt4Oo0TEUiVWXd0ZSG5UP7CRZI870OiFjQw_sO7nty0GkxMhekZhTE0LPl7nfnBSc0ax5uDcscDZ4nZ2-hTHC4FiHP0Ir17U635wZtwgHiz3MJxyBGTA,, CHR StartupUrls: "hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZDr--M9JXGUna1oWD0CV0Ozk-Rt4Oo0TEUiVWXd0ZSG5UP7CRZI870OiFjQw_sO7nty0GkxMhekZhTE0LPl7nfnBSc0ax5uDcscDZ4nZ2-hTHC4FiHP0Ir17U635wZtwgHiz3MJxyBGTA,," CHR DefaultSearchKeyword: search.snapdo.com CHR DefaultSearchProvider: Web CHR DefaultSearchURL: hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZDr--M9JXGUna1oWD0CV0Ozk-Rt4Oo0TEUiVWXd0ZSG5UP7CRZI870OiFjQw_sO7nty0GkxMhekZhTIFyg1S9VYwce7WannCp0b8ZzsPpYpN1KC4R0c18jdbnuAz43KsGIg2gz4qf8EHw,,&q={searchTerms} CHR DefaultNewTabURL: CHR Plugin: (Shockwave Flash) - C:\Users\TT Lammers\AppData\Local\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll No File CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\gcswf32.dll No File CHR Plugin: (Remoting Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll No File CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\pdf.dll No File CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll No File CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll (Apple Inc.) CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) CHR Plugin: (Facebook Video Calling Plugin) - C:\Users\TT Lammers\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll No File CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File CHR Extension: (McAfee Security Scan+) - C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\bopakagnckmlgajfccecajhnimjiiedh [2014-02-22] CHR Extension: (Extended Protection) - C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml [2014-01-24] CHR Extension: (flash-Enhancer) - C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\cgbealecnakbhfoeeipcnoboempfkbjd [2014-01-24] CHR Extension: (Media Viewer) - C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\eagngmbbjpiegdiojneaoolbllnappjo [2014-02-24] CHR Extension: (Stylish) - C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe [2012-09-17] CHR Extension: (Click&Clean) - C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgabhipcejejjmhhchfonmamedcbeod [2012-09-17] CHR Extension: (DealPly UK) - C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\hggpkhijoeadmdfmlbdepfbngmhaldci [2013-08-05] CHR Extension: (Video Player) - C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnghlghflihkfiopikcjmaiajgbieegb [2014-01-09] CHR Extension: (Wajam) - C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp [2013-08-05] CHR Extension: (Media Watch) - C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lamhhbmgfmocmpeljkaablpohealeplo [2014-03-23] CHR Extension: (Value apps) - C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon [2014-01-24] CHR Extension: (media enhance) - C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo [2014-03-17] CHR Extension: (Media View) - C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\mglkejdgkcfeeecbbancdeeidmfpjkco [2014-03-16] CHR Extension: (Helper extension) - C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\nchpfiddbhbdnagofhkjlaiaejmkdcla [2013-08-18] CHR Extension: (Media View) - C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\nkmdmgjelehbgmopdfpjadcnihhpneop [2014-03-03] CHR Extension: (Google Wallet) - C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-03] CHR Extension: (Webexp Enhanced) - C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\obohmgehnpafmnikhnbehbefaheahaho [2013-12-21] CHR Extension: (Lightning speedDial) - C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkndmigholgfjlniaohblojbhgjbkakn [2014-01-24] CHR HKLM-x32\...\Chrome\Extension: [cgbealecnakbhfoeeipcnoboempfkbjd] - C:\Program Files (x86)\AmiExt\flashEnhancer\ch\flashEnhancer.crx [2014-01-12] CHR HKLM-x32\...\Chrome\Extension: [dedmngkbaffkenlfdcbganndoghblmap] - C:\Program Files (x86)\BetterSurf\ch\Chrome.crx [2014-01-12] CHR HKLM-x32\...\Chrome\Extension: [eagngmbbjpiegdiojneaoolbllnappjo] - C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha1336\ch\MediaViewerV1alpha1336.crx [2014-02-23] CHR HKLM-x32\...\Chrome\Extension: [hgdnflefohjalljihdmibbblffdjbaph] - C:\Program Files (x86)\MediaBuzzV1\MediaBuzzV1mode146\ch\MediaBuzzV1mode146.crx [2014-04-23] CHR HKLM-x32\...\Chrome\Extension: [igdhbblpcellaljokkpfhcjlagemhgjl] - "C:\Program Files (x86)\Iminent\Iminent.crx" [2014-04-23] CHR HKLM-x32\...\Chrome\Extension: [jpmbfleldcgkldadpdinhjjopdfpjfjp] - C:\Users\TT Lammers\AppData\Local\Wajam\Chrome\wajam.crx [2013-05-02] CHR HKLM-x32\...\Chrome\Extension: [lamhhbmgfmocmpeljkaablpohealeplo] - C:\Program Files (x86)\MediaWatchV1\MediaWatchV1home30\ch\MediaWatchV1home30.crx [2014-03-20] CHR HKLM-x32\...\Chrome\Extension: [lmpfnkohfgifngknnjnhhckblkdimckn] - C:\Program Files (x86)\RichMediaViewV1\RichMediaViewV1release866\ch\RichMediaViewV1release866.crx [2014-05-13] CHR HKLM-x32\...\Chrome\Extension: [mglkejdgkcfeeecbbancdeeidmfpjkco] - C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha5026\ch\MediaViewV1alpha5026.crx [2014-02-27] CHR HKLM-x32\...\Chrome\Extension: [mmifolfpllfdhilecpdpmemhelmanajl] - C:\Program Files (x86)\BetterSurf\BetterSurfPlus\ch\BetterSurfPlus.crx [2014-02-27] CHR HKLM-x32\...\Chrome\Extension: [nkmdmgjelehbgmopdfpjadcnihhpneop] - C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha1029\ch\MediaViewV1alpha1029.crx [2014-02-26] CHR HKLM-x32\...\Chrome\Extension: [obohmgehnpafmnikhnbehbefaheahaho] - C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha483\ch\WebexpEnhancedV1alpha483.crx [2013-12-19] CHR HKLM-x32\...\Chrome\Extension: [pkndmigholgfjlniaohblojbhgjbkakn] - C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtabv2.crx [2014-01-24] CHR HKLM-x32\...\Chrome\Extension: [poheodfamflhhhdcmjfeggbgigeefaco] - C:\Program Files (x86)\Better-Surf\ch\Chrome.crx [2014-01-24] ==================== Services (Whitelisted) ================= R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG) R2 Guard.Mail.ru; C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [1564368 2012-09-28] () R2 ICQ Service; C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe [247872 2012-03-20] () R2 WinkHandler; C:\Program Files (x86)\Iminent\WinkHandler.exe [425792 2014-02-25] () R2 winzipersvc; C:\Program Files (x86)\WinZipper\winzipersvc.exe [424104 2013-08-23] (Taiwan Shui Mu Chih Ching Technology Limited.) R2 Wpm; C:\ProgramData\WPM\wprotectmanager.exe [493568 2014-01-24] (Cherished Technololgy LIMITED) ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-19] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-19] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-30] (Avira Operations GmbH & Co. KG) R3 RICOH SmartCard Reader; C:\Windows\System32\DRIVERS\rismcx64.sys [79488 2006-10-03] (RICOH Company, Ltd.) S1 jjwrqayv; \??\C:\Windows\system32\drivers\jjwrqayv.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-05-13 21:26 - 2014-05-13 21:26 - 00027335 _____ () C:\Users\TT Lammers\Downloads\FRST.txt 2014-05-13 21:26 - 2014-05-13 21:26 - 00000000 ____D () C:\FRST 2014-05-13 21:25 - 2014-05-13 21:25 - 02066944 _____ (Farbar) C:\Users\TT Lammers\Downloads\FRST64.exe 2014-05-13 19:57 - 2014-05-13 19:57 - 00042746 _____ () C:\Users\TT Lammers\Desktop\Extras.Txt 2014-05-13 19:56 - 2014-05-13 19:56 - 00117588 _____ () C:\Users\TT Lammers\Desktop\OTL.Txt 2014-05-13 19:36 - 2014-05-13 19:37 - 00602112 _____ (OldTimer Tools) C:\Users\TT Lammers\Desktop\otl.exe 2014-05-13 19:36 - 2014-05-13 19:36 - 00000000 ____D () C:\ProgramData\Oracle 2014-05-13 19:35 - 2014-05-13 19:35 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-05-13 19:35 - 2014-05-13 19:35 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-05-13 19:35 - 2014-05-13 19:35 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-05-13 19:35 - 2014-05-13 19:35 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-05-13 19:35 - 2014-05-13 19:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-05-13 19:35 - 2014-05-13 19:35 - 00000000 ____D () C:\Program Files (x86)\Java 2014-05-13 19:22 - 2014-05-13 19:22 - 00000000 ____D () C:\Program Files (x86)\RichMediaViewV1 2014-05-12 22:25 - 2014-05-12 23:06 - 00011159 _____ () C:\Users\TT Lammers\Desktop\geschriebene Bewerbungen.xlsx 2014-05-12 16:55 - 2014-05-12 16:55 - 11830920 _____ (LULU Software Limited) C:\Users\TT Lammers\Downloads\Soda_PDF_6_Installer.exe 2014-05-10 20:38 - 2014-05-11 20:43 - 00000000 ___SD () C:\Users\TT Lammers\Documents\Eigene Datenquellen 2014-05-06 21:10 - 2014-05-06 21:10 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-05-06 20:10 - 2014-05-06 20:10 - 00610176 _____ () C:\Users\TT Lammers\Downloads\Java(3).exe 2014-05-06 17:58 - 2014-04-14 04:24 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-05-06 17:58 - 2014-04-14 04:19 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-05-04 21:00 - 2014-04-29 16:01 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-05-04 21:00 - 2014-04-29 15:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-05-04 21:00 - 2014-04-29 14:48 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-05-04 21:00 - 2014-04-29 14:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-05-04 14:01 - 2014-05-04 14:01 - 00000000 __SHD () C:\Users\TT Lammers\AppData\Local\EmieUserList 2014-05-04 14:01 - 2014-05-04 14:01 - 00000000 __SHD () C:\Users\TT Lammers\AppData\Local\EmieSiteList 2014-05-03 12:02 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-05-03 12:02 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-05-03 12:02 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-05-03 12:02 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-05-03 12:02 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-05-03 12:02 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-05-03 12:02 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-05-03 12:02 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-05-03 12:02 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-05-03 12:02 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-05-03 12:02 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-05-03 12:02 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-05-03 12:02 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-05-03 12:02 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-05-03 12:02 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-05-03 12:02 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-05-03 12:02 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-05-03 12:02 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-05-03 12:02 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-05-03 12:02 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-05-03 12:02 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-05-03 12:02 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-05-03 12:02 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-05-03 12:02 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-05-03 12:02 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-05-03 12:02 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-05-03 12:02 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-05-03 12:02 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-05-03 12:02 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-05-03 12:02 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-05-03 12:02 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-05-03 12:02 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-05-03 12:02 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-05-03 12:02 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-05-03 12:02 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-05-03 12:02 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-05-03 12:02 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-05-03 12:02 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-05-03 12:02 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-05-03 12:02 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-05-03 12:02 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-05-03 12:02 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-05-03 12:02 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-05-03 12:02 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-04-28 16:18 - 2014-05-10 19:29 - 00011012 _____ () C:\Users\TT Lammers\Documents\geschriebene Bewerbungen.xlsx 2014-04-27 11:43 - 2014-04-27 11:43 - 00000000 ____D () C:\Program Files (x86)\MediaBuzzV1 2014-04-23 11:42 - 2014-04-23 11:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\TT Lammers\Downloads\Bewerbung Anschreiben Vorlage - CHIP-Downloader.exe 2014-04-23 11:42 - 2014-04-23 11:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\TT Lammers\Downloads\Bewerbung Anschreiben Vorlage - CHIP-Downloader(1).exe 2014-04-22 19:11 - 2014-04-22 19:11 - 00274912 _____ () C:\Windows\Minidump\042214-19406-01.dmp 2014-04-20 21:45 - 2014-04-20 21:45 - 00630680 _____ () C:\Users\TT Lammers\Downloads\Java(2).exe 2014-04-15 19:55 - 2014-05-13 19:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BewerbungsMaster 2014-04-15 19:55 - 2014-04-23 11:31 - 00000000 ____D () C:\Users\TT Lammers\AppData\Local\BewerbungsMaster 2014-04-15 19:55 - 2014-04-15 20:15 - 00000000 ____D () C:\Users\TT Lammers\Documents\BewerbungsMaster 2014-04-15 19:54 - 2014-05-13 19:48 - 00000000 ____D () C:\Program Files (x86)\BEWERBUNGSMASTER 2014-04-15 19:54 - 2014-04-15 19:54 - 14299136 _____ () C:\Users\TT Lammers\Downloads\master(2).exe 2014-04-15 19:54 - 2014-04-15 19:54 - 14299136 _____ () C:\Users\TT Lammers\Downloads\master(1).exe 2014-04-15 19:54 - 2014-04-15 19:54 - 00335872 ____N (Microsoft Corporation) C:\Windows\Setup1.exe 2014-04-15 19:54 - 2014-04-15 19:54 - 00074752 _____ (Microsoft Corporation) C:\Windows\ST6UNST.EXE 2014-04-15 19:53 - 2014-04-15 19:54 - 14299136 _____ () C:\Users\TT Lammers\Downloads\master.exe 2014-04-15 19:26 - 2014-04-15 19:26 - 00634288 _____ () C:\Users\TT Lammers\Downloads\Setup_V2.exe 2014-04-15 19:18 - 2014-04-15 19:18 - 00993712 _____ () C:\Users\TT Lammers\Downloads\setup(5).exe 2014-04-15 19:17 - 2014-05-13 21:25 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-04-15 19:17 - 2014-04-28 22:16 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-04-15 19:17 - 2014-04-28 22:16 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-04-15 19:17 - 2014-04-28 22:16 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-04-13 12:37 - 2014-04-13 12:37 - 11373939 _____ () C:\Users\TT Lammers\Downloads\HWK-Prüfungen - Kopie.zip ==================== One Month Modified Files and Folders ======= 2014-05-13 21:26 - 2014-05-13 21:26 - 00027335 _____ () C:\Users\TT Lammers\Downloads\FRST.txt 2014-05-13 21:26 - 2014-05-13 21:26 - 00000000 ____D () C:\FRST 2014-05-13 21:25 - 2014-05-13 21:25 - 02066944 _____ (Farbar) C:\Users\TT Lammers\Downloads\FRST64.exe 2014-05-13 21:25 - 2014-04-15 19:17 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-05-13 21:11 - 2012-03-30 17:54 - 01681995 _____ () C:\Windows\WindowsUpdate.log 2014-05-13 20:04 - 2013-05-16 22:38 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2014-05-13 19:57 - 2014-05-13 19:57 - 00042746 _____ () C:\Users\TT Lammers\Desktop\Extras.Txt 2014-05-13 19:56 - 2014-05-13 19:56 - 00117588 _____ () C:\Users\TT Lammers\Desktop\OTL.Txt 2014-05-13 19:55 - 2014-03-15 15:40 - 00000000 ____D () C:\Users\TT Lammers\Desktop\Musik 2014-05-13 19:55 - 2014-03-15 15:36 - 00000000 ____D () C:\Users\TT Lammers\Desktop\Prüfungsvorbereitung 2014-05-13 19:54 - 2013-07-31 21:48 - 00000000 ____D () C:\Program Files\GIMP 2 2014-05-13 19:48 - 2014-04-15 19:54 - 00000000 ____D () C:\Program Files (x86)\BEWERBUNGSMASTER 2014-05-13 19:47 - 2014-04-15 19:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BewerbungsMaster 2014-05-13 19:37 - 2014-05-13 19:36 - 00602112 _____ (OldTimer Tools) C:\Users\TT Lammers\Desktop\otl.exe 2014-05-13 19:36 - 2014-05-13 19:36 - 00000000 ____D () C:\ProgramData\Oracle 2014-05-13 19:35 - 2014-05-13 19:35 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-05-13 19:35 - 2014-05-13 19:35 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-05-13 19:35 - 2014-05-13 19:35 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-05-13 19:35 - 2014-05-13 19:35 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-05-13 19:35 - 2014-05-13 19:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-05-13 19:35 - 2014-05-13 19:35 - 00000000 ____D () C:\Program Files (x86)\Java 2014-05-13 19:33 - 2009-07-14 06:45 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-05-13 19:33 - 2009-07-14 06:45 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-05-13 19:32 - 2011-04-12 09:43 - 00699682 _____ () C:\Windows\system32\perfh007.dat 2014-05-13 19:32 - 2011-04-12 09:43 - 00149790 _____ () C:\Windows\system32\perfc007.dat 2014-05-13 19:32 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-05-13 19:28 - 2013-08-23 23:49 - 00000000 ____D () C:\Program Files (x86)\WinZipper 2014-05-13 19:26 - 2014-01-24 23:06 - 00000000 ____D () C:\Users\TT Lammers\AppData\Roaming\newnext.me 2014-05-13 19:25 - 2013-08-05 21:04 - 00000376 _____ () C:\Windows\Tasks\AmiUpdXp.job 2014-05-13 19:25 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-05-13 19:25 - 2009-07-14 06:51 - 00168613 _____ () C:\Windows\setupact.log 2014-05-13 19:22 - 2014-05-13 19:22 - 00000000 ____D () C:\Program Files (x86)\RichMediaViewV1 2014-05-13 19:22 - 2014-01-29 19:36 - 00000306 __RSH () C:\ProgramData\ntuser.pol 2014-05-12 23:06 - 2014-05-12 22:25 - 00011159 _____ () C:\Users\TT Lammers\Desktop\geschriebene Bewerbungen.xlsx 2014-05-12 23:01 - 2012-04-05 18:27 - 00003966 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{DA1740FC-9DDA-4425-BBCC-DE77247D9875} 2014-05-12 18:24 - 2014-02-23 16:37 - 00000000 ____D () C:\Users\TT Lammers\Desktop\Bewerbungen 2014-05-12 16:55 - 2014-05-12 16:55 - 11830920 _____ (LULU Software Limited) C:\Users\TT Lammers\Downloads\Soda_PDF_6_Installer.exe 2014-05-11 20:43 - 2014-05-10 20:38 - 00000000 ___SD () C:\Users\TT Lammers\Documents\Eigene Datenquellen 2014-05-11 18:32 - 2012-03-30 18:36 - 00000000 ____D () C:\Users\TT Lammers\AppData\Local\Microsoft Help 2014-05-11 18:24 - 2014-03-29 23:49 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-05-11 18:24 - 2014-03-15 18:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-05-10 19:29 - 2014-04-28 16:18 - 00011012 _____ () C:\Users\TT Lammers\Documents\geschriebene Bewerbungen.xlsx 2014-05-08 22:11 - 2014-02-21 19:50 - 00000000 ____D () C:\Program Files (x86)\Opera 2014-05-06 21:10 - 2014-05-06 21:10 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-05-06 20:47 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache 2014-05-06 20:10 - 2014-05-06 20:10 - 00610176 _____ () C:\Users\TT Lammers\Downloads\Java(3).exe 2014-05-04 14:01 - 2014-05-04 14:01 - 00000000 __SHD () C:\Users\TT Lammers\AppData\Local\EmieUserList 2014-05-04 14:01 - 2014-05-04 14:01 - 00000000 __SHD () C:\Users\TT Lammers\AppData\Local\EmieSiteList 2014-05-03 13:02 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-05-02 12:37 - 2010-11-21 05:47 - 00251942 _____ () C:\Windows\PFRO.log 2014-04-29 16:01 - 2014-05-04 21:00 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-04-29 15:40 - 2014-05-04 21:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-04-29 14:48 - 2014-05-04 21:00 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-04-29 14:34 - 2014-05-04 21:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-04-29 14:24 - 2014-02-09 17:22 - 00055296 ___SH () C:\Users\TT Lammers\Documents\Thumbs.db 2014-04-28 22:16 - 2014-04-15 19:17 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-04-28 22:16 - 2014-04-15 19:17 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-04-28 22:16 - 2014-04-15 19:17 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-04-27 11:43 - 2014-04-27 11:43 - 00000000 ____D () C:\Program Files (x86)\MediaBuzzV1 2014-04-24 23:42 - 2012-12-15 12:10 - 00000000 ____D () C:\Users\TT Lammers\Documents\Ausbildung 2014-04-24 23:36 - 2013-01-07 23:20 - 00366080 ___SH () C:\Users\TT Lammers\Downloads\Thumbs.db 2014-04-24 22:32 - 2014-04-07 17:43 - 00000583 _____ () C:\Users\TT Lammers\Desktop\Buchungsuebersicht.lnk 2014-04-23 11:42 - 2014-04-23 11:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\TT Lammers\Downloads\Bewerbung Anschreiben Vorlage - CHIP-Downloader.exe 2014-04-23 11:42 - 2014-04-23 11:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\TT Lammers\Downloads\Bewerbung Anschreiben Vorlage - CHIP-Downloader(1).exe 2014-04-23 11:31 - 2014-04-15 19:55 - 00000000 ____D () C:\Users\TT Lammers\AppData\Local\BewerbungsMaster 2014-04-22 19:11 - 2014-04-22 19:11 - 00274912 _____ () C:\Windows\Minidump\042214-19406-01.dmp 2014-04-22 19:11 - 2012-10-21 20:59 - 400341788 _____ () C:\Windows\MEMORY.DMP 2014-04-22 19:11 - 2012-10-21 20:59 - 00000000 ____D () C:\Windows\Minidump 2014-04-20 21:45 - 2014-04-20 21:45 - 00630680 _____ () C:\Users\TT Lammers\Downloads\Java(2).exe 2014-04-18 18:28 - 2014-04-07 17:47 - 00000000 ____D () C:\Users\TT Lammers\Desktop\WISO 2014-04-18 18:23 - 2014-02-23 16:38 - 00000000 ____D () C:\Users\TT Lammers\Desktop\lernen 2014-04-18 18:23 - 2013-06-22 20:01 - 00000000 ____D () C:\Users\TT Lammers\Desktop\Vanne 2014-04-15 20:15 - 2014-04-15 19:55 - 00000000 ____D () C:\Users\TT Lammers\Documents\BewerbungsMaster 2014-04-15 19:54 - 2014-04-15 19:54 - 14299136 _____ () C:\Users\TT Lammers\Downloads\master(2).exe 2014-04-15 19:54 - 2014-04-15 19:54 - 14299136 _____ () C:\Users\TT Lammers\Downloads\master(1).exe 2014-04-15 19:54 - 2014-04-15 19:54 - 00335872 ____N (Microsoft Corporation) C:\Windows\Setup1.exe 2014-04-15 19:54 - 2014-04-15 19:54 - 00074752 _____ (Microsoft Corporation) C:\Windows\ST6UNST.EXE 2014-04-15 19:54 - 2014-04-15 19:53 - 14299136 _____ () C:\Users\TT Lammers\Downloads\master.exe 2014-04-15 19:26 - 2014-04-15 19:26 - 00634288 _____ () C:\Users\TT Lammers\Downloads\Setup_V2.exe 2014-04-15 19:18 - 2014-04-15 19:18 - 00993712 _____ () C:\Users\TT Lammers\Downloads\setup(5).exe 2014-04-14 04:24 - 2014-05-06 17:58 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-04-14 04:19 - 2014-05-06 17:58 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-04-13 12:37 - 2014-04-13 12:37 - 11373939 _____ () C:\Users\TT Lammers\Downloads\HWK-Prüfungen - Kopie.zip Some content of TEMP: ==================== C:\Users\TT Lammers\AppData\Local\Temp\APNSetup.exe C:\Users\TT Lammers\AppData\Local\Temp\APNStub.exe C:\Users\TT Lammers\AppData\Local\Temp\AskSLib.dll C:\Users\TT Lammers\AppData\Local\Temp\avgnt.exe C:\Users\TT Lammers\AppData\Local\Temp\BackupSetup.exe C:\Users\TT Lammers\AppData\Local\Temp\bundlesweetimsetup.exe C:\Users\TT Lammers\AppData\Local\Temp\DeltaTB.exe C:\Users\TT Lammers\AppData\Local\Temp\dlLogic.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD1045.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD12F7.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD163E.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD1EE5.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD2338.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD2876.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD2902.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD2E7E.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD315C.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD333F.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD33A.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD3D2E.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD472C.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD48B2.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD4E5D.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD583C.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD5A4F.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD5BB6.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD5DC8.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD5E93.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD6086.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD60D4.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD6180.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD6279.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD6306.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD6354.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD64BA.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD6566.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD6576.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD6650.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD6778.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD6834.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD6882.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD68B0.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD68EF.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD693D.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD69AA.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD6B11.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD6B4F.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD6C87.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD6CB6.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD6D62.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD6D71.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD6DA0.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD6DB0.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD6DCF.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD6E2C.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD6EF7.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD6F16.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD6F64.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD6F84.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD6F85.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD6FE1.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7010.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD70FA.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7177.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD71E4.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7203.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7204.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7232.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7251.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7280.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD733B.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD735A.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD736A.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7399.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD739A.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD73D7.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD73E7.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7444.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7454.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7473.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD74F0.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD751F.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD758C.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD75AB.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD75CA.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD75F9.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7609.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD760A.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD760B.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7618.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7695.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD76A5.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD76B4.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD77EC.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD77ED.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD77FC.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD782B.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7879.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7898.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD78E6.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7905.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7972.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD79EF.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7A3D.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7A8B.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7AAB.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7AF9.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7B37.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7B56.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7B85.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7C11.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7C31.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7C7F.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7DA7.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7DA8.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7E72.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7E91.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7EB0.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7EC0.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7F3D.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7F9A.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD7FF8.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8084.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD80B3.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8111.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD817E.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD81BC.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD81CC.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8229.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8239.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8268.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8297.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD82D5.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD82E5.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8313.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8323.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8342.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8352.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8353.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8361.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD83BF.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8499.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD849A.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD84A9.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD84B9.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8526.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8574.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD85B2.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD85E1.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD869C.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD86EA.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8709.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8738.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8757.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8796.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD87C5.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD88CE.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD88DD.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD88DE.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD890C.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8A15.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8AA2.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8AC1.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8AD1.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8B0F.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8B5D.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8BAB.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8BBB.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8BCA.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8BE9.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8C85.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8D31.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8DFC.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8E2B.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8E69.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8EB7.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8EC7.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8FB1.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8FC0.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD8FD0.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD906C.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD906D.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD908B.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD90D9.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD90DA.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD90F8.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9108.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9137.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9156.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9175.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD91C3.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD925F.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD928E.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD92BD.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD92BE.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD92CC.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9359.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9414.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9415.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9443.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9452.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD94FE.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD954C.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD95A9.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD95E8.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9626.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9645.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD96C2.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD96E1.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD96F1.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9701.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9710.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD97DB.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9819.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9839.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD98B5.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD98F4.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9932.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9933.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9942.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD999F.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD99AF.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9A4B.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9A89.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9AA9.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9B16.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9B83.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9BF0.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9C00.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9C1F.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9C3E.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9CCB.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9CDA.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9CDB.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9CDC.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9D57.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9D76.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9DB5.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9DC4.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9E03.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9E60.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9F3B.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9F79.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9FB7.exe C:\Users\TT Lammers\AppData\Local\Temp\EAD9FD7.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA063.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA064.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA073.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA082.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA0EF.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA0F0.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA11E.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA19B.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA1BA.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA1BB.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA1E9.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA208.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA218.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA227.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA237.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA247.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA2E3.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA3AD.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA3BD.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA478.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA479.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA47A.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA488.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA4F5.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA524.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA543.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA581.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA5A1.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA5C.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA68B.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA68C.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA69A.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA6F8.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA746.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA765.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA7D2.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA7E2.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA7E3.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA7F1.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA87E.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA8EB.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA8FB.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA987.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA988.exe C:\Users\TT Lammers\AppData\Local\Temp\EADA9E5.exe C:\Users\TT Lammers\AppData\Local\Temp\EADAA90.exe C:\Users\TT Lammers\AppData\Local\Temp\EADAAFD.exe C:\Users\TT Lammers\AppData\Local\Temp\EADAB1D.exe C:\Users\TT Lammers\AppData\Local\Temp\EADAB4B.exe C:\Users\TT Lammers\AppData\Local\Temp\EADAB5B.exe C:\Users\TT Lammers\AppData\Local\Temp\EADAB6B.exe C:\Users\TT Lammers\AppData\Local\Temp\EADABA9.exe C:\Users\TT Lammers\AppData\Local\Temp\EADAD1F.exe C:\Users\TT Lammers\AppData\Local\Temp\EADAE09.exe C:\Users\TT Lammers\AppData\Local\Temp\EADAE48.exe C:\Users\TT Lammers\AppData\Local\Temp\EADAEB5.exe C:\Users\TT Lammers\AppData\Local\Temp\EADAF61.exe C:\Users\TT Lammers\AppData\Local\Temp\EADB06A.exe C:\Users\TT Lammers\AppData\Local\Temp\EADB1A2.exe C:\Users\TT Lammers\AppData\Local\Temp\EADB357.exe C:\Users\TT Lammers\AppData\Local\Temp\EADB366.exe C:\Users\TT Lammers\AppData\Local\Temp\EADB450.exe C:\Users\TT Lammers\AppData\Local\Temp\EADB48F.exe C:\Users\TT Lammers\AppData\Local\Temp\EADB490.exe C:\Users\TT Lammers\AppData\Local\Temp\EADB4AE.exe C:\Users\TT Lammers\AppData\Local\Temp\EADB52B.exe C:\Users\TT Lammers\AppData\Local\Temp\EADB54A.exe C:\Users\TT Lammers\AppData\Local\Temp\EADB569.exe C:\Users\TT Lammers\AppData\Local\Temp\EADB653.exe C:\Users\TT Lammers\AppData\Local\Temp\EADB6C0.exe C:\Users\TT Lammers\AppData\Local\Temp\EADB6EF.exe C:\Users\TT Lammers\AppData\Local\Temp\EADB78B.exe C:\Users\TT Lammers\AppData\Local\Temp\EADB79B.exe C:\Users\TT Lammers\AppData\Local\Temp\EADB7E9.exe C:\Users\TT Lammers\AppData\Local\Temp\EADB856.exe C:\Users\TT Lammers\AppData\Local\Temp\EADB921.exe C:\Users\TT Lammers\AppData\Local\Temp\EADB9BD.exe C:\Users\TT Lammers\AppData\Local\Temp\EADBA39.exe C:\Users\TT Lammers\AppData\Local\Temp\EADBAE5.exe C:\Users\TT Lammers\AppData\Local\Temp\EADBB62.exe C:\Users\TT Lammers\AppData\Local\Temp\EADBB71.exe C:\Users\TT Lammers\AppData\Local\Temp\EADBBB0.exe C:\Users\TT Lammers\AppData\Local\Temp\EADBCB9.exe C:\Users\TT Lammers\AppData\Local\Temp\EADBD2.exe C:\Users\TT Lammers\AppData\Local\Temp\EADBEEB.exe C:\Users\TT Lammers\AppData\Local\Temp\EADBF77.exe C:\Users\TT Lammers\AppData\Local\Temp\EADC003.exe C:\Users\TT Lammers\AppData\Local\Temp\EADC1C8.exe C:\Users\TT Lammers\AppData\Local\Temp\EADC2F0.exe C:\Users\TT Lammers\AppData\Local\Temp\EADC300.exe C:\Users\TT Lammers\AppData\Local\Temp\EADC31F.exe C:\Users\TT Lammers\AppData\Local\Temp\EADC4C4.exe C:\Users\TT Lammers\AppData\Local\Temp\EADC4E3.exe C:\Users\TT Lammers\AppData\Local\Temp\EADC63B.exe C:\Users\TT Lammers\AppData\Local\Temp\EADC6B7.exe C:\Users\TT Lammers\AppData\Local\Temp\EADC715.exe C:\Users\TT Lammers\AppData\Local\Temp\EADC8D9.exe C:\Users\TT Lammers\AppData\Local\Temp\EADCA31.exe C:\Users\TT Lammers\AppData\Local\Temp\EADCA40.exe C:\Users\TT Lammers\AppData\Local\Temp\EADCB78.exe C:\Users\TT Lammers\AppData\Local\Temp\EADCBC6.exe C:\Users\TT Lammers\AppData\Local\Temp\EADCCFE.exe C:\Users\TT Lammers\AppData\Local\Temp\EADCD9A.exe C:\Users\TT Lammers\AppData\Local\Temp\EADCD9B.exe C:\Users\TT Lammers\AppData\Local\Temp\EADCE46.exe C:\Users\TT Lammers\AppData\Local\Temp\EADCED2.exe C:\Users\TT Lammers\AppData\Local\Temp\EADCF5F.exe C:\Users\TT Lammers\AppData\Local\Temp\EADD0A.exe C:\Users\TT Lammers\AppData\Local\Temp\EADD152.exe C:\Users\TT Lammers\AppData\Local\Temp\EADD181.exe C:\Users\TT Lammers\AppData\Local\Temp\EADD355.exe C:\Users\TT Lammers\AppData\Local\Temp\EADD383.exe C:\Users\TT Lammers\AppData\Local\Temp\EADD3C2.exe C:\Users\TT Lammers\AppData\Local\Temp\EADD557.exe C:\Users\TT Lammers\AppData\Local\Temp\EADD613.exe C:\Users\TT Lammers\AppData\Local\Temp\EADD7E7.exe C:\Users\TT Lammers\AppData\Local\Temp\EADD9DA.exe C:\Users\TT Lammers\AppData\Local\Temp\EADDDA1.exe C:\Users\TT Lammers\AppData\Local\Temp\EADDDFF.exe C:\Users\TT Lammers\AppData\Local\Temp\EADDE4.exe C:\Users\TT Lammers\AppData\Local\Temp\EADE455.exe C:\Users\TT Lammers\AppData\Local\Temp\EADE5CB.exe C:\Users\TT Lammers\AppData\Local\Temp\EADE6B6.exe C:\Users\TT Lammers\AppData\Local\Temp\EADE703.exe C:\Users\TT Lammers\AppData\Local\Temp\EADE81C.exe C:\Users\TT Lammers\AppData\Local\Temp\EADEB19.exe C:\Users\TT Lammers\AppData\Local\Temp\EADEED0.exe C:\Users\TT Lammers\AppData\Local\Temp\EADF16F.exe C:\Users\TT Lammers\AppData\Local\Temp\EADF5D2.exe C:\Users\TT Lammers\AppData\Local\Temp\EADF99A.exe C:\Users\TT Lammers\AppData\Local\Temp\EADFA26.exe C:\Users\TT Lammers\AppData\Local\Temp\EADFC29.exe C:\Users\TT Lammers\AppData\Local\Temp\EnableExtDll.dll C:\Users\TT Lammers\AppData\Local\Temp\fp_pl_pfs_installer-1.exe C:\Users\TT Lammers\AppData\Local\Temp\fp_pl_pfs_installer.exe C:\Users\TT Lammers\AppData\Local\Temp\GoogleToolbarInstaller_en32_signed.exe C:\Users\TT Lammers\AppData\Local\Temp\ICQInetInstaller.exe C:\Users\TT Lammers\AppData\Local\Temp\icqsetup.exe C:\Users\TT Lammers\AppData\Local\Temp\Iminent.exe C:\Users\TT Lammers\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe C:\Users\TT Lammers\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe C:\Users\TT Lammers\AppData\Local\Temp\OptimizerPro.exe C:\Users\TT Lammers\AppData\Local\Temp\ose00000.exe C:\Users\TT Lammers\AppData\Local\Temp\setup.exe C:\Users\TT Lammers\AppData\Local\Temp\ShoppinHelper2.exe C:\Users\TT Lammers\AppData\Local\Temp\umbrella.exe C:\Users\TT Lammers\AppData\Local\Temp\uninst1.exe C:\Users\TT Lammers\AppData\Local\Temp\UninstallEADM.dll C:\Users\TT Lammers\AppData\Local\Temp\vcredist_x64.exe C:\Users\TT Lammers\AppData\Local\Temp\~SpUnin~.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-05-11 19:49 ==================== End Of Log ============================ --- --- --- --- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-05-2014 01
Ran by TT Lammers at 2014-05-13 21:27:24
Running from C:\Users\TT Lammers\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
HP Photosmart 5520 series - Grundlegende Software für das Gerät (HKLM\...\{4F396B08-301D-4E53-A372-95A7E93ABD04}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
Lollipop (HKCU\...\lollipop_10271122) (Version: - Lollipop Network, S.L.) <==== ATTENTION
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Studie zur Verbesserung von HP Photosmart 5520 series Produkten (HKLM\...\{B99F865A-3ECB-4E65-B6CF-9C60EE0273A3}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
Winamp Erkennungs-Plug-in (HKCU\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc)
==================== Restore Points =========================
27-04-2014 17:45:05 Windows-Sicherung
29-04-2014 12:22:52 Windows Update
30-04-2014 21:52:36 Windows Update
03-05-2014 10:00:38 Windows Update
04-05-2014 18:59:49 Windows Update
05-05-2014 14:58:51 Windows-Sicherung
06-05-2014 19:10:10 Windows Update
10-05-2014 14:58:34 Windows Update
11-05-2014 17:00:08 Windows-Sicherung
13-05-2014 17:32:53 Installed Java 7 Update 55
13-05-2014 17:56:26 Removed iTunes
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {00AC4A09-8D90-4D85-B584-C4E4EB6A1172} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {4356AB41-8A18-4820-A915-4354938881A9} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {4624EC8D-1B09-4A42-8B1F-0032E8F061FA} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {46A566EB-3546-41D7-A46E-692570FD89AB} - System32\Tasks\DealPlyUpdate => C:\Program <==== ATTENTION
Task: {545C69CE-83B6-442E-BD5B-8BE780FFE3C6} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-28] (Adobe Systems Incorporated)
Task: {5F16AC76-2480-4633-813F-CECF6A009AB8} - System32\Tasks\Browser Manager => Sc.exe start Browser Manager
Task: {6BDFC6B4-3E9C-4108-A921-2055D4E7BC46} - System32\Tasks\RegistryDr_Popup => C:\Program Files (x86)\Registry Dr\Splash.exe <==== ATTENTION
Task: {7076A64B-3E2B-4694-B57D-5FDD44E238AE} - System32\Tasks\HPCustParticipation HP Photosmart 5520 series => C:\Program Files\HP\HP Photosmart 5520 series\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)
Task: {877996DB-70AE-492C-B576-727A1F7A41BB} - System32\Tasks\Desk 365 RunAsStdUser => C:\Program Files (x86)\Desk 365\desk365.exe <==== ATTENTION
Task: {918683A2-F013-4656-9949-A5CD4DD02897} - System32\Tasks\AmiUpdXp => C:\Users\TT Lammers\AppData\Local\SwvUpdater\Updater.exe [2013-08-05] (Amonetize ltd.) <==== ATTENTION
Task: {A6AEE327-DA58-43CF-9AD7-0E780193D07D} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {BF881D24-CC3C-453F-8EA2-428C27F7B74F} - System32\Tasks\Omiga Plus RunAsStdUser => C:\Program Files (x86)\Omiga Plus\omigaplus.exe <==== ATTENTION
Task: {D5E5A2D3-316D-42D9-9357-1AF8B81183DE} - System32\Tasks\RegistryDr_Start => C:\Program Files (x86)\Registry Dr\RegistryDr.exe <==== ATTENTION
Task: {FAAC4BDD-824B-40E3-96A7-1399C74AC997} - System32\Tasks\Dealply => C:\Users\TTLAMM~1\AppData\Roaming\Dealply\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\AmiUpdXp.job => C:\Users\TT Lammers\AppData\Local\SwvUpdater\Updater.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\Dealply.job => C:\Users\TTLAMM~1\AppData\Roaming\Dealply\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
==================== Loaded Modules (whitelisted) =============
2012-09-28 18:25 - 2012-09-28 18:25 - 01564368 _____ () C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe
2012-04-07 20:08 - 2012-03-20 11:16 - 00247872 _____ () C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe
2014-03-15 18:42 - 2014-02-25 17:28 - 00425792 ____N () C:\Program Files (x86)\Iminent\WinkHandler.exe
2013-08-23 23:49 - 2013-08-23 23:49 - 00612520 _____ () C:\Program Files (x86)\WinZipper\sqlite3.dll
2013-03-23 13:52 - 2013-03-23 01:35 - 00397704 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2014-03-29 23:49 - 2014-05-10 18:35 - 03839088 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-04-28 22:16 - 2014-04-28 22:16 - 16351920 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== EXE Association (whitelisted) =============
==================== Disabled items from MSCONFIG ==============
==================== Faulty Device Manager Devices =============
Name: Bluetooth-Peripheriegerät
Description: Bluetooth-Peripheriegerät
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Bluetooth-Peripheriegerät
Description: Bluetooth-Peripheriegerät
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Basissystemgerät
Description: Basissystemgerät
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Bluetooth-Peripheriegerät
Description: Bluetooth-Peripheriegerät
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Bluetooth-Peripheriegerät
Description: Bluetooth-Peripheriegerät
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Bluetooth-Peripheriegerät
Description: Bluetooth-Peripheriegerät
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Bluetooth-Peripheriegerät
Description: Bluetooth-Peripheriegerät
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Bluetooth-Peripheriegerät
Description: Bluetooth-Peripheriegerät
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Bluetooth-Peripheriegerät
Description: Bluetooth-Peripheriegerät
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Basissystemgerät
Description: Basissystemgerät
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (05/13/2014 08:08:55 PM) (Source: VSS) (User: ) (EventID: 12298)
Description: Volumeschattenkopie-Dienstfehler: Die E/A-Schreibvorgänge können während des Schattenkopie-Erstellungszeitraums auf Volume "C:\" nicht gespeichert werden.
Der Volumeindex im Schattenkopiesatz ist 0. Fehlerdetails: Offen[0x00000000, Der Vorgang wurde erfolgreich beendet.
], Leerung[0x00000000, Der Vorgang wurde erfolgreich beendet.
], Freigabe[0x80042314, Der Schattenkopieanbieter hat beim Warten auf den Schreibvorgang auf das Volume, von dem eine Schattenkopie erstellt wird, das Zeitlimit überschritten. Ursache hierfür könnte eine durch eine Anwendung oder einen Systemdienst verursachte hohe Aktivität auf dem Volume sein. Wiederholen Sie den Vorgang später, wenn das Volume nicht so stark ausgelastet ist.
], Ausführung[0x00000000, Der Vorgang wurde erfolgreich beendet.
].
Vorgang:
Asynchroner Vorgang wird ausgeführt
Kontext:
Aktueller Status: DoSnapshotSet
Error: (05/13/2014 08:08:55 PM) (Source: VSS) (User: ) (EventID: 12310)
Description: Volumeschattenkopie-Dienstfehler: Die Schattenkopie kann nicht zugesichert werden - Vorgang hat das Zeitlimit überschritten.
Fehlerkontext: DeviceIoControl(\\?\Volume{3bf162d2-7a7f-11e1-857c-806e6f6e6963} - 0000000000000118,0x0053c010,00000000002B18D0,0,00000000002B08C0,4096,[0]).
Vorgang:
Schattenkopien werden übertragen
Kontext:
Ausführungskontext: System Provider
Error: (05/13/2014 07:47:24 PM) (Source: MsiInstaller) (User: TTLammers-PC) (EventID: 10005)
Description: Produkt: Ask Toolbar -- Fehler 25001. Die folgenden Anwendungen sollten geschlossen werden, bevor Sie mit der Deinstallation fortfahren:
Mozilla Firefox
Error: (05/13/2014 07:47:23 PM) (Source: MsiInstaller) (User: TTLammers-PC) (EventID: 10005)
Description: Produkt: Ask Toolbar -- Fehler 25001. Die folgenden Anwendungen sollten geschlossen werden, bevor Sie mit der Deinstallation fortfahren:
Mozilla Firefox
Error: (05/13/2014 07:47:22 PM) (Source: MsiInstaller) (User: TTLammers-PC) (EventID: 10005)
Description: Produkt: Ask Toolbar -- Fehler 25001. Die folgenden Anwendungen sollten geschlossen werden, bevor Sie mit der Deinstallation fortfahren:
Mozilla Firefox
Error: (05/13/2014 07:47:21 PM) (Source: MsiInstaller) (User: TTLammers-PC) (EventID: 10005)
Description: Produkt: Ask Toolbar -- Fehler 25001. Die folgenden Anwendungen sollten geschlossen werden, bevor Sie mit der Deinstallation fortfahren:
Mozilla Firefox
Error: (05/13/2014 07:47:15 PM) (Source: MsiInstaller) (User: TTLammers-PC) (EventID: 10005)
Description: Produkt: Ask Toolbar -- Fehler 25001. Die folgenden Anwendungen sollten geschlossen werden, bevor Sie mit der Deinstallation fortfahren:
Mozilla Firefox
Error: (05/13/2014 07:47:14 PM) (Source: MsiInstaller) (User: TTLammers-PC) (EventID: 10005)
Description: Produkt: Ask Toolbar -- Fehler 25001. Die folgenden Anwendungen sollten geschlossen werden, bevor Sie mit der Deinstallation fortfahren:
Mozilla Firefox
Error: (05/13/2014 07:27:28 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/13/2014 07:27:18 PM) (Source: MsiInstaller) (User: TTLammers-PC) (EventID: 1024)
Description: Produkt: Adobe Reader XI - Deutsch - Update "{AC76BA86-7AD7-0000-2550-7A8C40011007}" konnte nicht installiert werden. Fehlercode 1625. Windows Installer kann Protokolle erstellen, um bei der Problembehandlung betreffend der Installation von Softwarepaketen behilflich zu sein. Verwenden Sie folgenden Link, um Anweisungen zur Aktivierung der Protokollierungsunterstützung zu erhalten: hxxp://go.microsoft.com/fwlink/?LinkId=23127
System errors:
=============
Error: (05/13/2014 07:27:03 PM) (Source: DCOM) (User: NT-AUTORITÄT) (EventID: 10016)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Error: (05/13/2014 07:26:53 PM) (Source: DCOM) (User: NT-AUTORITÄT) (EventID: 10016)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTLOKALER DIENSTS-1-5-19LocalHost (unter Verwendung von LRPC)
Error: (05/13/2014 07:25:43 PM) (Source: atikmdag) (User: ) (EventID: 10261)
Description: Display is not active
Error: (05/13/2014 07:25:43 PM) (Source: atikmdag) (User: ) (EventID: 19468)
Description: CPLIB :: General - Invalid Parameter
Error: (05/13/2014 07:25:02 PM) (Source: Service Control Manager) (User: ) (EventID: 7023)
Description: Der Dienst "Windows Update" wurde mit folgendem Fehler beendet:
%%-2147467243
Error: (05/13/2014 07:22:45 PM) (Source: DCOM) (User: NT-AUTORITÄT) (EventID: 10016)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Error: (05/13/2014 07:22:34 PM) (Source: DCOM) (User: NT-AUTORITÄT) (EventID: 10016)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTLOKALER DIENSTS-1-5-19LocalHost (unter Verwendung von LRPC)
Error: (05/13/2014 07:21:23 PM) (Source: atikmdag) (User: ) (EventID: 10261)
Description: Display is not active
Error: (05/13/2014 07:21:23 PM) (Source: atikmdag) (User: ) (EventID: 19468)
Description: CPLIB :: General - Invalid Parameter
Error: (05/13/2014 07:15:54 PM) (Source: atikmdag) (User: ) (EventID: 10261)
Description: Display is not active
Microsoft Office Sessions:
=========================
Error: (03/21/2014 01:47:14 PM) (Source: Microsoft Office 12 Sessions) (User: ) (EventID: 7001)
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6690.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 7062 seconds with 4560 seconds of active time. This session ended with a crash.
==================== Memory info ===========================
Percentage of memory in use: 50%
Total physical RAM: 4060.27 MB
Available physical RAM: 2003.77 MB
Total Pagefile: 8118.71 MB
Available Pagefile: 5845.8 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:232.79 GB) (Free:150.41 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: 9D3297CD)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=233 GB) - (Type=07 NTFS)
==================== End Of Log ============================
So jetzt nochmal Vielen Dank |
|
14.05.2014, 19:13
| #4 |
| /// the machine /// TB-Ausbilder | Im Internetbrowser öffnen sich immer wieder neue Seiten mit Werbung :( Adware & Co. deinstallieren
Solltest Du ein Programm nicht finden oder nicht deinstallieren können, mache bitte mit dem nächsten Schritt weiter: Scan mit Combofix
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
14.05.2014, 21:11
| #5 |
| |  Im Internetbrowser öffnen sich immer wieder neue Seiten mit Werbung :( Ich hoffe ich hab das jetzt soweit richtig gemacht, vielen Dank !Code:
ATTFilter ComboFix 14-05-13.01 - TT Lammers 14.05.2014 21:59:33.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.4060.1529 [GMT 2:00]
ausgeführt von:: c:\users\TT Lammers\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\END
c:\program files (x86)\AmiExt\flashEnhancer\ie\flAShenhancer.dll
c:\program files (x86)\MediaBuzzV1
c:\program files (x86)\MediaBuzzV1\MediaBuzzV1mode146\ch\MediaBuzzV1mode146.crx
c:\program files (x86)\MediaBuzzV1\MediaBuzzV1mode146\ff\chrome.manifest
c:\program files (x86)\MediaBuzzV1\MediaBuzzV1mode146\ff\chrome\content\ffMediaBuzzV1mode146.js
c:\program files (x86)\MediaBuzzV1\MediaBuzzV1mode146\ff\chrome\content\ffMediaBuzzV1mode146ffaction.js
c:\program files (x86)\MediaBuzzV1\MediaBuzzV1mode146\ff\chrome\content\icons\default\MediaBuzzV1mode146_32.png
c:\program files (x86)\MediaBuzzV1\MediaBuzzV1mode146\ff\chrome\content\icons\Thumbs.db
c:\program files (x86)\MediaBuzzV1\MediaBuzzV1mode146\ff\chrome\content\overlay.xul
c:\program files (x86)\MediaBuzzV1\MediaBuzzV1mode146\ff\install.rdf
c:\program files (x86)\MediaBuzzV1\MediaBuzzV1mode146\uninstall.exe
c:\program files (x86)\MediaPlayerV1
c:\program files (x86)\MediaPlayerV1\MediaPlayerV1alpha62\ch\MediaPlayerV1alpha62.crx
c:\program files (x86)\MediaPlayerV1\MediaPlayerV1alpha62\ff\chrome.manifest
c:\program files (x86)\MediaPlayerV1\MediaPlayerV1alpha62\ff\chrome\content\ffMediaPlayerV1alpha62.js
c:\program files (x86)\MediaPlayerV1\MediaPlayerV1alpha62\ff\chrome\content\ffMediaPlayerV1alpha62ffaction.js
c:\program files (x86)\MediaPlayerV1\MediaPlayerV1alpha62\ff\chrome\content\icons\default\MediaPlayerV1alpha62_32.png
c:\program files (x86)\MediaPlayerV1\MediaPlayerV1alpha62\ff\chrome\content\icons\Thumbs.db
c:\program files (x86)\MediaPlayerV1\MediaPlayerV1alpha62\ff\chrome\content\overlay.xul
c:\program files (x86)\MediaPlayerV1\MediaPlayerV1alpha62\ff\install.rdf
c:\program files (x86)\MediaPlayerV1\MediaPlayerV1alpha62\uninstall.exe
c:\program files (x86)\MediaViewerV1
c:\program files (x86)\MediaViewerV1\MediaViewerV1alpha1336\ch\MediaViewerV1alpha1336.crx
c:\program files (x86)\MediaViewerV1\MediaViewerV1alpha1336\ff\chrome.manifest
c:\program files (x86)\MediaViewerV1\MediaViewerV1alpha1336\ff\chrome\content\ffMediaViewerV1alpha1336.js
c:\program files (x86)\MediaViewerV1\MediaViewerV1alpha1336\ff\chrome\content\ffMediaViewerV1alpha1336ffaction.js
c:\program files (x86)\MediaViewerV1\MediaViewerV1alpha1336\ff\chrome\content\icons\default\MediaViewerV1alpha1336_32.png
c:\program files (x86)\MediaViewerV1\MediaViewerV1alpha1336\ff\chrome\content\icons\Thumbs.db
c:\program files (x86)\MediaViewerV1\MediaViewerV1alpha1336\ff\chrome\content\overlay.xul
c:\program files (x86)\MediaViewerV1\MediaViewerV1alpha1336\ff\install.rdf
c:\program files (x86)\MediaViewerV1\MediaViewerV1alpha1336\uninstall.exe
c:\program files (x86)\MediaViewV1
c:\program files (x86)\MediaViewV1\MediaViewV1alpha1029\ch\MediaViewV1alpha1029.crx
c:\program files (x86)\MediaViewV1\MediaViewV1alpha1029\ff\chrome.manifest
c:\program files (x86)\MediaViewV1\MediaViewV1alpha1029\ff\chrome\content\ffMediaViewV1alpha1029.js
c:\program files (x86)\MediaViewV1\MediaViewV1alpha1029\ff\chrome\content\ffMediaViewV1alpha1029ffaction.js
c:\program files (x86)\MediaViewV1\MediaViewV1alpha1029\ff\chrome\content\icons\default\MediaViewV1alpha1029_32.png
c:\program files (x86)\MediaViewV1\MediaViewV1alpha1029\ff\chrome\content\icons\Thumbs.db
c:\program files (x86)\MediaViewV1\MediaViewV1alpha1029\ff\chrome\content\overlay.xul
c:\program files (x86)\MediaViewV1\MediaViewV1alpha1029\ff\install.rdf
c:\program files (x86)\MediaViewV1\MediaViewV1alpha1029\uninstall.exe
c:\program files (x86)\MediaViewV1\MediaViewV1alpha5026\ch\MediaViewV1alpha5026.crx
c:\program files (x86)\MediaViewV1\MediaViewV1alpha5026\ff\chrome.manifest
c:\program files (x86)\MediaViewV1\MediaViewV1alpha5026\ff\chrome\content\ffMediaViewV1alpha5026.js
c:\program files (x86)\MediaViewV1\MediaViewV1alpha5026\ff\chrome\content\ffMediaViewV1alpha5026ffaction.js
c:\program files (x86)\MediaViewV1\MediaViewV1alpha5026\ff\chrome\content\icons\default\MediaViewV1alpha5026_32.png
c:\program files (x86)\MediaViewV1\MediaViewV1alpha5026\ff\chrome\content\icons\Thumbs.db
c:\program files (x86)\MediaViewV1\MediaViewV1alpha5026\ff\chrome\content\overlay.xul
c:\program files (x86)\MediaViewV1\MediaViewV1alpha5026\ff\install.rdf
c:\program files (x86)\MediaViewV1\MediaViewV1alpha5026\uninstall.exe
c:\program files (x86)\MediaWatchV1
c:\program files (x86)\MediaWatchV1\MediaWatchV1home30\ch\MediaWatchV1home30.crx
c:\program files (x86)\MediaWatchV1\MediaWatchV1home30\ff\chrome.manifest
c:\program files (x86)\MediaWatchV1\MediaWatchV1home30\ff\chrome\content\ffMediaWatchV1home30.js
c:\program files (x86)\MediaWatchV1\MediaWatchV1home30\ff\chrome\content\ffMediaWatchV1home30ffaction.js
c:\program files (x86)\MediaWatchV1\MediaWatchV1home30\ff\chrome\content\icons\default\MediaWatchV1home30_32.png
c:\program files (x86)\MediaWatchV1\MediaWatchV1home30\ff\chrome\content\icons\Thumbs.db
c:\program files (x86)\MediaWatchV1\MediaWatchV1home30\ff\chrome\content\overlay.xul
c:\program files (x86)\MediaWatchV1\MediaWatchV1home30\ff\install.rdf
c:\program files (x86)\MediaWatchV1\MediaWatchV1home30\uninstall.exe
c:\program files (x86)\WebexpEnhancedV1
c:\program files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha483\ch\WebexpEnhancedV1alpha483.crx
c:\program files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha483\ff\chrome.manifest
c:\program files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha483\ff\chrome\content\ffWebexpEnhancedV1alpha483.js
c:\program files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha483\ff\chrome\content\ffWebexpEnhancedV1alpha483ffaction.js
c:\program files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha483\ff\chrome\content\icons\default\WebexpEnhancedV1alpha483_32.png
c:\program files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha483\ff\chrome\content\icons\Thumbs.db
c:\program files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha483\ff\chrome\content\overlay.xul
c:\program files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha483\ff\install.rdf
c:\program files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha483\uninstall.exe
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\bProtector Web Data
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\bProtectorPreferences
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_lekgiimbfodefdaoofhlckefjbgpeilo_0
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_lekgiimbfodefdaoofhlckefjbgpeilo_0\24
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\background.html
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\chromeCoreFilesIndex.txt
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\crossriderManifest.json
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\manifest.xml
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins.json
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\1_base.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\102_dealply_m.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\103_intext_5_m.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\104_jollywallet_m.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\13_CrossriderAppUtils.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\14_CrossriderUtils.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\155_ibario_pops_m.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\17_jQuery.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\177_crossriderDashboard.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\182_openUrl.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\183_tabsWrapper.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\184_noproblemppc_m.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\19_CHAppAPIWrapper.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\190_pops_5_m.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\191_ciuvo_m.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\195_icm_convertmedia_m.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\207_dbWrapper.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\21_debug.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\22_resources.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\220_icm_base_m.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\226_set_campaign_id_m.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\230_revizer_ws_dynamic_b2b_2_m.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\233_revizer_p_dynamic_b2b_2_m.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\246_setup.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\28_initializer.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\4_jquery_1_7_1.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\47_resources_background.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\64_appApiMessage.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\7_hooks.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\72_appApiValidation.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\78_CrossriderInfo.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\80_CHPopupAppAPI.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\9_search_engine_hook.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\91_monetizationLoader.js.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\93_superfish_no_coupons_m.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\plugins\97_resourceApiWrapper.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\userCode\background.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\extensionData\userCode\extension.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\icons\actions\1.png
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\icons\icon128.png
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\icons\icon16.png
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\icons\icon48.png
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\js\api\chrome.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\js\api\cookie.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\js\api\message.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\js\api\monitor.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\js\api\pageAction.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\js\api\pageActionBG.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\js\background.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\js\lib\app_api.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\js\lib\bg_app_api.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\js\lib\consts.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\js\lib\cookie_store.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\js\lib\crossriderAPI.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\js\lib\delegate.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\js\lib\events.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\js\lib\extensionDataStore.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\js\lib\installer.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\js\lib\logFile.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\js\lib\logging.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\js\lib\onBGDocumentLoad.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\js\lib\popupResource\newPopup.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\js\lib\popupResource\popup.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\js\lib\reports.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\js\lib\storageWrapper.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\js\lib\updateManager.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\js\lib\util.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\js\lib\xhr.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\js\main.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\js\platformVersion.js
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\manifest.json
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo\1.26.77_0\popup.html
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lekgiimbfodefdaoofhlckefjbgpeilo
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lekgiimbfodefdaoofhlckefjbgpeilo\000016.ldb
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lekgiimbfodefdaoofhlckefjbgpeilo\000021.ldb
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lekgiimbfodefdaoofhlckefjbgpeilo\000022.log
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lekgiimbfodefdaoofhlckefjbgpeilo\CURRENT
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lekgiimbfodefdaoofhlckefjbgpeilo\LOCK
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lekgiimbfodefdaoofhlckefjbgpeilo\LOG
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lekgiimbfodefdaoofhlckefjbgpeilo\LOG.old
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lekgiimbfodefdaoofhlckefjbgpeilo\MANIFEST-000020
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_lekgiimbfodefdaoofhlckefjbgpeilo_0.localstorage-journal
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_lekgiimbfodefdaoofhlckefjbgpeilo_0.localstorage
c:\users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Preferences
c:\users\TT Lammers\AppData\Local\lollipop
c:\users\TT Lammers\AppData\Local\lollipop\logo.ico
c:\users\TT Lammers\AppData\Local\lollipop\lollipop_10271122.bat
c:\users\TT Lammers\AppData\Local\lollipop\lollipop_10271122.lpd
c:\users\TT Lammers\AppData\Local\lollipop\lollipop_10271122_cfg.lpd
c:\users\TT Lammers\AppData\Local\lollipop\lollipop_10271122_ps.lpd
c:\users\TT Lammers\AppData\Local\nsl2CF0.tmp
c:\users\TT Lammers\AppData\Roaming\337
c:\users\TT Lammers\AppData\Roaming\337\337 Wallpaper\ebase.dll
c:\users\TT Lammers\AppData\Roaming\337\337 Wallpaper\image\default\app_close.png
c:\users\TT Lammers\AppData\Roaming\337\337 Wallpaper\image\default\app_max.png
c:\users\TT Lammers\AppData\Roaming\337\337 Wallpaper\image\default\app_min.png
c:\users\TT Lammers\AppData\Roaming\337\337 Wallpaper\image\default\app_restore.png
c:\users\TT Lammers\AppData\Roaming\337\337 Wallpaper\image\default\wallpaper_resource.xml
c:\users\TT Lammers\AppData\Roaming\337\337 Wallpaper\image\default\window.png
c:\users\TT Lammers\AppData\Roaming\337\337 Wallpaper\language\en_us\wallpaper_lang.ini
c:\users\TT Lammers\AppData\Roaming\337\337 Wallpaper\language\es_es\wallpaper_lang.ini
c:\users\TT Lammers\AppData\Roaming\337\337 Wallpaper\language\pt_br\wallpaper_lang.ini
c:\users\TT Lammers\AppData\Roaming\337\337 Wallpaper\language\tr_tr\wallpaper_lang.ini
c:\users\TT Lammers\AppData\Roaming\337\337 Wallpaper\language\zh_tw\wallpaper_lang.ini
c:\users\TT Lammers\AppData\Roaming\337\337 Wallpaper\layout\default\dp_appwnd.xml
c:\users\TT Lammers\AppData\Roaming\337\337 Wallpaper\layout\default\msgbox.xml
c:\users\TT Lammers\AppData\Roaming\337\337 Wallpaper\libpng.dll
c:\users\TT Lammers\AppData\Roaming\337\337 Wallpaper\main
c:\users\TT Lammers\AppData\Roaming\337\337 Wallpaper\msvcp100.dll
c:\users\TT Lammers\AppData\Roaming\337\337 Wallpaper\msvcr100.dll
c:\users\TT Lammers\AppData\Roaming\337\337 Wallpaper\ouilibnl.dll
c:\users\TT Lammers\AppData\Roaming\337\337 Wallpaper\plusapp.exe
c:\users\TT Lammers\AppData\Roaming\337\337 Wallpaper\style\wallpaper_style.xml
c:\users\TT Lammers\AppData\Roaming\337\337 Wallpaper\TrayDownloader.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-04-14 bis 2014-05-14 ))))))))))))))))))))))))))))))
.
.
2014-05-14 20:05 . 2014-05-14 20:05 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-05-14 18:55 . 2014-05-14 18:55 -------- d-----w- c:\program files (x86)\VS Revo Group
2014-05-14 16:29 . 2014-05-14 16:29 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{B9932801-FD5F-4520-8D05-7F249FFE463C}\offreg.dll
2014-05-14 15:16 . 2014-04-17 03:31 10651704 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{B9932801-FD5F-4520-8D05-7F249FFE463C}\mpengine.dll
2014-05-13 19:26 . 2014-05-13 19:28 -------- d-----w- C:\FRST
2014-05-13 17:36 . 2014-05-13 17:36 -------- d-----w- c:\programdata\Oracle
2014-05-13 17:36 . 2014-05-13 17:36 -------- d-----w- c:\program files (x86)\Common Files\Java
2014-05-13 17:35 . 2014-05-13 17:35 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-05-13 17:35 . 2014-05-13 17:35 -------- d-----w- c:\program files (x86)\Java
2014-05-13 17:22 . 2014-05-13 17:22 -------- d-----w- c:\program files (x86)\RichMediaViewV1
2014-05-10 16:35 . 2014-05-10 16:35 10594416 ----a-w- c:\program files (x86)\Mozilla Firefox\icudt52.dll
2014-05-10 16:35 . 2014-05-10 16:35 965232 ----a-w- c:\program files (x86)\Mozilla Firefox\icuuc52.dll
2014-05-10 16:35 . 2014-05-10 16:35 1266800 ----a-w- c:\program files (x86)\Mozilla Firefox\icuin52.dll
2014-05-06 19:10 . 2014-05-06 19:10 -------- d-s---w- c:\windows\system32\CompatTel
2014-05-06 15:58 . 2014-04-14 02:24 465408 ----a-w- c:\windows\system32\aepdu.dll
2014-05-06 15:58 . 2014-04-14 02:19 424448 ----a-w- c:\windows\system32\aeinv.dll
2014-05-04 19:00 . 2014-04-29 14:01 23547904 ----a-w- c:\windows\system32\mshtml.dll
2014-05-04 19:00 . 2014-04-29 13:40 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2014-05-04 19:00 . 2014-04-29 12:34 2724864 ----a-w- c:\windows\SysWow64\mshtml.tlb
2014-05-04 12:01 . 2014-05-04 12:01 -------- d-sh--w- c:\users\TT Lammers\AppData\Local\EmieUserList
2014-05-04 12:01 . 2014-05-04 12:01 -------- d-sh--w- c:\users\TT Lammers\AppData\Local\EmieSiteList
2014-04-15 17:55 . 2014-04-23 09:31 -------- d-----w- c:\users\TT Lammers\AppData\Local\BewerbungsMaster
2014-04-15 17:54 . 2014-05-13 17:48 -------- d-----w- c:\program files (x86)\BEWERBUNGSMASTER
2014-04-15 17:54 . 2014-04-15 17:54 335872 ------w- c:\windows\Setup1.exe
2014-04-15 17:54 . 2014-04-15 17:54 74752 ----a-w- c:\windows\ST6UNST.EXE
2014-04-15 17:17 . 2014-05-14 15:27 70832 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-04-15 17:17 . 2014-05-14 15:27 692400 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-04-09 18:44 . 2012-04-05 17:24 90655440 ----a-w- c:\windows\system32\MRT.exe
2014-03-31 07:35 . 2010-11-21 03:27 270496 ------w- c:\windows\system32\MpSigStub.exe
2014-03-04 09:44 . 2014-04-09 18:22 362496 ----a-w- c:\windows\system32\wow64win.dll
2014-03-04 09:44 . 2014-04-09 18:22 243712 ----a-w- c:\windows\system32\wow64.dll
2014-03-04 09:44 . 2014-04-09 18:22 13312 ----a-w- c:\windows\system32\wow64cpu.dll
2014-03-04 09:44 . 2014-04-09 18:22 16384 ----a-w- c:\windows\system32\ntvdm64.dll
2014-03-04 09:44 . 2014-04-09 18:22 1163264 ----a-w- c:\windows\system32\kernel32.dll
2014-03-04 09:17 . 2014-04-09 18:22 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll
2014-03-04 09:17 . 2014-04-09 18:22 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2014-03-04 09:16 . 2014-04-09 18:22 25600 ----a-w- c:\windows\SysWow64\setup16.exe
2014-03-04 09:16 . 2014-04-09 18:22 5120 ----a-w- c:\windows\SysWow64\wow32.dll
2014-03-04 08:09 . 2014-04-09 18:22 7680 ----a-w- c:\windows\SysWow64\instnm.exe
2014-03-04 08:09 . 2014-04-09 18:22 2048 ----a-w- c:\windows\SysWow64\user.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"lollipop_10271122"="lollipop_10271122" [X]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"HP Photosmart 5520 series (NET)"="c:\program files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe" [2012-10-17 2573416]
"NextLive"="c:\users\TT Lammers\AppData\Roaming\newnext.me\nengine.dll" [2014-01-06 1283584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ArcSoft Connection Service"="c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
"Guard.Mail.ru.gui"="c:\program files (x86)\Guard-ICQ\GuardICQ.exe" [2012-09-28 1564368]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-02-21 689744]
"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2011-10-28 49208]
"PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2014-02-06 189480]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-12-21 959904]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
R1 jjwrqayv;jjwrqayv;c:\windows\system32\drivers\jjwrqayv.sys;c:\windows\SYSNATIVE\drivers\jjwrqayv.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 ICQ Service;ICQ Service;c:\progra~2\ICQ6TO~1\ICQSER~1.EXE;c:\progra~2\ICQ6TO~1\ICQSER~1.EXE [x]
R2 Wpm;Wpm Service;c:\programdata\WPM\wprotectmanager.exe;c:\programdata\WPM\wprotectmanager.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series - Adaptertreiber für Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys;c:\windows\SYSNATIVE\DRIVERS\netw5v64.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WSDScan;WSD-Scanunterstützung durch UMB;c:\windows\system32\drivers\WSDScan.sys;c:\windows\SYSNATIVE\drivers\WSDScan.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 Guard.Mail.ru;Guard.Mail.ru;c:\program files (x86)\Guard-ICQ\GuardICQ.exe;c:\program files (x86)\Guard-ICQ\GuardICQ.exe [x]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe;c:\windows\SYSNATIVE\Hpservice.exe [x]
S2 WinkHandler;WinkHandler;c:\program files (x86)\Iminent\WinkHandler.exe;c:\program files (x86)\Iminent\WinkHandler.exe [x]
S2 winzipersvc;WinZiper service;c:\program files (x86)\WinZipper\winzipersvc.exe;c:\program files (x86)\WinZipper\winzipersvc.exe [x]
S3 ATSwpWDF;AuthenTec TruePrint USB WBF WDF Driver;c:\windows\system32\Drivers\ATSwpWDF.sys;c:\windows\SYSNATIVE\Drivers\ATSwpWDF.sys [x]
S3 e1yexpress;Intel(R) Gigabit-Netzwerkverbindungstreiber;c:\windows\system32\DRIVERS\e1y60x64.sys;c:\windows\SYSNATIVE\DRIVERS\e1y60x64.sys [x]
S3 NETw5s64;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETw5s64.sys;c:\windows\SYSNATIVE\DRIVERS\NETw5s64.sys [x]
S3 RICOH SmartCard Reader;RICOH SmartCard Reader;c:\windows\system32\DRIVERS\rismcx64.sys;c:\windows\SYSNATIVE\DRIVERS\rismcx64.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2014-05-14 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-15 15:27]
.
2014-05-14 c:\windows\Tasks\AmiUpdXp.job
- c:\users\TT Lammers\AppData\Local\SwvUpdater\Updater.exe [2013-08-05 19:04]
.
.
--------- X64 Entries -----------
.
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZDr--M9JXGUna1oWD0CV0Ozk-Rt4Oo0TEUiVWXd0ZSG5UP7CRZI870OiFjQw_sO7nty0GkxMhekZhTE0LPl7nfnBSc0ax5uDcscDZ4nZ2-hTHC4FiHP0Ir17U635wZtwgHiz3MJxyBGSw,,
mDefault_Search_URL = hxxp://www.awesomehp.com/web/?type=ds&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT&q={searchTerms}
mDefault_Page_URL = hxxp://www.awesomehp.com/?type=hp&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT
mStart Page = hxxp://www.awesomehp.com/?type=hp&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = hxxp://www.awesomehp.com/web/?type=ds&ts=1390597411&from=amt&uid=ST9250421AS_5TH0HAPT&q={searchTerms}
uSearchAssistant = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZDr--M9JXGUna1oWD0CV0Ozk-Rt4Oo0TEUiVWXd0ZSG5UP7CRZI870OiFjQw_sO7nty0GkxMhekZhTIFyg1S9VYwce7WannCp0b8ZzsPpYpN1KC4R0c18jdbnuAz43KsGIg2gz4qf8EGA,,&q={searchTerms}
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\TT Lammers\AppData\Roaming\Mozilla\Firefox\Profiles\5c32r3dn.default\
FF - prefs.js: browser.search.selectedEngine - Ask Web Search
FF - prefs.js: browser.startup.homepage - hxxp://home.tb.ask.com/index.jhtml?ptb=3647B52E-61F9-4842-811C-226D62F0ED52&n=780bd8c7&p2=^AYY^xdm070^YYA^de&si=flvrunner
FF - prefs.js: keyword.URL - hxxp://search.tb.ask.com/search/GGmain.jhtml?st=kwd&ptb=3647B52E-61F9-4842-811C-226D62F0ED52&n=780bd8c7&ind=2014042311&p2=^AYY^xdm070^YYA^de&si=flvrunner&searchfor=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{112BA211-334C-4A90-90EC-2AD1CDAB287C} - (no file)
BHO-{5A60B6BB-FA81-4EFA-AB9C-A820E2143736} - c:\program files (x86)\AmiExt\flashEnhancer\ie\flashEnhancer.dll
BHO-{84FF7BD6-B47F-46F8-9130-01B2696B36CB} - (no file)
BHO-{93DBF2BB-A2B3-4683-A92E-57E60751F346} - c:\program files (x86)\Conduit\ValueApps\IE\ValueAppsLoader.dll
Toolbar-{1FAFD711-ABF9-4F6A-8130-5166C7371427} - (no file)
Wow6432Node-HKCU-Run-EA Core - c:\program files (x86)\Electronic Arts\EADM\Core.exe
Wow6432Node-HKLM-Run-mobilegeni daemon - c:\program files (x86)\Mobogenie\DaemonProcess.exe
Wow6432Node-HKLM-Run-Iminent - c:\program files (x86)\Iminent\Iminent.exe
Wow6432Node-HKLM-Run-IminentMessenger - c:\program files (x86)\Iminent\Iminent.Messengers.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-05-14 22:07:21
ComboFix-quarantined-files.txt 2014-05-14 20:07
.
Vor Suchlauf: 11 Verzeichnis(se), 161.279.229.952 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 172.051.304.448 Bytes frei
.
- - End Of File - - 528E207EE2FE2DBA4E5F046890C2AC9A
A36C5E4F47E84449FF07ED3517B43A31
|
|
15.05.2014, 19:31
| #6 |
| /// the machine /// TB-Ausbilder | Im Internetbrowser öffnen sich immer wieder neue Seiten mit Werbung :( Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ --> Im Internetbrowser öffnen sich immer wieder neue Seiten mit Werbung :( |
|
19.05.2014, 19:56
| #7 |
| |  Im Internetbrowser öffnen sich immer wieder neue Seiten mit Werbung :( Mbam.txt - Datei: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 19.05.2014 Suchlauf-Zeit: 20:20:51 Logdatei: nbam.txt Administrator: Ja Version: 2.00.1.1004 Malware Datenbank: v2014.05.19.09 Rootkit Datenbank: v2014.03.27.01 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Chameleon: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: TT Lammers Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 265866 Verstrichene Zeit: 22 Min, 0 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Shuriken: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 0 (No malicious items detected) Physische Sektoren: 0 (No malicious items detected) (end) AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.210 - Bericht erstellt am 19/05/2014 um 20:34:06
# Aktualisiert 19/05/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : TT Lammers - TTLAMMERS-PC
# Gestartet von : C:\Users\TT Lammers\Downloads\adwcleaner_3.210.exe
# Option : Löschen
***** [ Dienste ] *****
[#] Dienst Gelöscht : BackupStack
Dienst Gelöscht : ICQ Service
Dienst Gelöscht : winzipersvc
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\eSafe
Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar
Ordner Gelöscht : C:\ProgramData\PriceMeterLiveUpdate
Ordner Gelöscht : C:\ProgramData\Systweak
Ordner Gelöscht : C:\ProgramData\Tarma Installer
Ordner Gelöscht : C:\ProgramData\WPM
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZipper
Ordner Gelöscht : C:\Program Files (x86)\AmiExt
Ordner Gelöscht : C:\Program Files (x86)\ICQ6Toolbar
Ordner Gelöscht : C:\Program Files (x86)\Iminent
Ordner Gelöscht : C:\Program Files (x86)\MyPC Backup
Ordner Gelöscht : C:\Program Files (x86)\Omiga Plus
Ordner Gelöscht : C:\Program Files (x86)\Registry Dr
Ordner Gelöscht : C:\Program Files (x86)\Rr Savings
Ordner Gelöscht : C:\Program Files (x86)\SupTab
Ordner Gelöscht : C:\Program Files (x86)\VideoPlayerV3
Ordner Gelöscht : C:\Program Files (x86)\WinZipper
Ordner Gelöscht : C:\Program Files (x86)\Common Files\337
Ordner Gelöscht : C:\Program Files (x86)\Common Files\Umbrella
Ordner Gelöscht : C:\Windows\Installer\{813BA625-B0FA-48D8-9B75-59759C88C219}
Ordner Gelöscht : C:\Program Files\002
Ordner Gelöscht : C:\Program Files\Conduit
Ordner Gelöscht : C:\Users\TTLAMM~1\AppData\Local\Temp\ConstaSurf
Ordner Gelöscht : C:\Users\TT Lammers\AppData\Local\genienext
Ordner Gelöscht : C:\Users\TT Lammers\AppData\Local\Mobogenie
Ordner Gelöscht : C:\Users\TT Lammers\AppData\Local\PriceMeterLiveUpdate
Ordner Gelöscht : C:\Users\TT Lammers\AppData\Local\RegistryDr
Ordner Gelöscht : C:\Users\TT Lammers\AppData\Local\SearchProtect
Ordner Gelöscht : C:\Users\TT Lammers\AppData\Local\SwvUpdater
Ordner Gelöscht : C:\Users\TT Lammers\AppData\Local\Tuguu_SL
Ordner Gelöscht : C:\Users\TT Lammers\AppData\LocalLow\Claro LTD
Ordner Gelöscht : C:\Users\TT Lammers\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\TT Lammers\AppData\Roaming\eIntaller
Ordner Gelöscht : C:\Users\TT Lammers\AppData\Roaming\Omiga Plus
Ordner Gelöscht : C:\Users\TT Lammers\AppData\Roaming\PerformerSoft
Ordner Gelöscht : C:\Users\TT Lammers\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\TT Lammers\AppData\Roaming\ValueApps
Ordner Gelöscht : C:\Users\TT Lammers\AppData\Roaming\VOPackage
Ordner Gelöscht : C:\Users\TT Lammers\AppData\Roaming\WinZipper
Ordner Gelöscht : C:\Users\TT Lammers\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup
Ordner Gelöscht : C:\Users\TT Lammers\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PriceMeter
Ordner Gelöscht : C:\Users\TT Lammers\Documents\Mobogenie
Ordner Gelöscht : C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\bopakagnckmlgajfccecajhnimjiiedh
Ordner Gelöscht : C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\nchpfiddbhbdnagofhkjlaiaejmkdcla
Ordner Gelöscht : C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkndmigholgfjlniaohblojbhgjbkakn
Datei Gelöscht : C:\Users\Public\Desktop\Advanced System Protector.lnk
Datei Gelöscht : C:\Users\Public\Desktop\RegClean Pro.lnk
Datei Gelöscht : C:\Users\TT Lammers\daemonprocess.txt
Datei Gelöscht : C:\Users\TT Lammers\AppData\Roaming\aps.uninstall.scan.results
Datei Gelöscht : C:\Users\TT Lammers\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
Datei Gelöscht : C:\Users\TT Lammers\Desktop\Configure VO Package.lnk
Datei Gelöscht : C:\Users\TT Lammers\Desktop\MyPC Backup.lnk
Datei Gelöscht : C:\Users\TT Lammers\Desktop\Sync Folder.lnk
Datei Gelöscht : C:\Users\TT Lammers\AppData\Roaming\Mozilla\Firefox\Profiles\5c32r3dn.default\searchplugins\11-suche.xml
Datei Gelöscht : C:\Users\TT Lammers\AppData\Roaming\Mozilla\Firefox\Profiles\5c32r3dn.default\searchplugins\ask-search.xml
Datei Gelöscht : C:\Users\TT Lammers\AppData\Roaming\Mozilla\Firefox\Profiles\5c32r3dn.default\searchplugins\ask-web-search.xml
Datei Gelöscht : C:\Users\TT Lammers\AppData\Roaming\Mozilla\Firefox\Profiles\5c32r3dn.default\user.js
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\user.js
Datei Gelöscht : C:\Windows\System32\Tasks\Advanced System Protector
Datei Gelöscht : C:\Windows\System32\Tasks\Advanced System Protector_startup
Datei Gelöscht : C:\Windows\System32\Tasks\Browser Manager
Datei Gelöscht : C:\Windows\System32\Tasks\Dealply
Datei Gelöscht : C:\Windows\System32\Tasks\DealPlyUpdate
Datei Gelöscht : C:\Windows\System32\Tasks\Desk 365 RunAsStdUser
Datei Gelöscht : C:\Windows\System32\Tasks\Omiga Plus RunAsStdUser
Datei Gelöscht : C:\Windows\System32\Tasks\pricemeterdownloader
Datei Gelöscht : C:\Windows\System32\Tasks\pricemetertask
Datei Gelöscht : C:\Windows\System32\Tasks\pricemeterwatcher
Datei Gelöscht : C:\Windows\System32\Tasks\RegClean Pro
***** [ Verknüpfungen ] *****
Verknüpfung Desinfiziert : C:\Users\TT Lammers\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
***** [ Registrierungsdatenbank ] *****
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [xz123@ya456.com]
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\ICQ\ICQToolBar
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ICQ Service.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\I
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ICQToolBar.IEHook
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ICQToolBar.IEHook.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\speedupmypc
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\biclient_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\biclient_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\NewPlayer_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\NewPlayer_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\speedupmypc_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\speedupmypc_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\mypc backup
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@tools.updatepm.com/PriceMeterLiveUpdate Update;version=3
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@tools.updatepm.com/PriceMeterLiveUpdate Update;version=9
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DeskSvc
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\omigaplussvc
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\webcakeupdater
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WsysSvc
Schlüssel Gelöscht : HKCU\Software\5c558c88e639b848
Schlüssel Gelöscht : HKLM\SOFTWARE\5c558c88e639b848
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_arcsoft-webcam-companion_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_arcsoft-webcam-companion_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_ultramixer_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_ultramixer_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{01994268-3C10-4044-A1EA-7A9C1B739A11}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{5D723752-5899-47E8-99B4-62C824EF9E13}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{8E9F2D02-6B06-4EBA-92C2-68438EADED28}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C3110516-8EFC-49D6-8B72-69354F332062}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5C176BA0-6FC0-4EBD-8ACF-24AC592506B6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{99E71BF1-5F51-4AF9-830B-67015D59640D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{9FD0C1D9-180B-4834-B80B-4B7325AF90E1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A2CC3C46-143B-4142-9D5A-B8543F0A6F55}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AF175732-0D59-716D-F757-9F1492D808D9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220422412250}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{462862BE-9A5C-49A5-9CBD-A649EAC63645}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C58D664A-3DBC-4925-AE74-0382007DF113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C776D7F4-BA85-4B75-AAFC-3A0A11FE6E36}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550455415550}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660466416650}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{0113A098-06EA-4776-A011-D75590778F1E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{5563BEFE-3B03-43B1-8041-64A9745DAA56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{8E9F2D02-6B06-4EBA-92C2-68438EADED28}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{A9CAF365-EA35-45DA-BD8B-2EFA09D374AC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{BEAA0C04-ED15-4C17-800B-28716025A4E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440444414450}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{208D4124-3895-4974-B293-A159BD306078}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{5C176BA0-6FC0-4EBD-8ACF-24AC592506B6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{462862BE-9A5C-49A5-9CBD-A649EAC63645}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C58D664A-3DBC-4925-AE74-0382007DF113}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C776D7F4-BA85-4B75-AAFC-3A0A11FE6E36}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550455415550}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660466416650}
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{460C3D19-B3D4-4964-A550-77D263B0CCCB}
Schlüssel Gelöscht : HKCU\Software\AnyProtect
Schlüssel Gelöscht : HKCU\Software\Ciuvo
Schlüssel Gelöscht : HKCU\Software\ICQ\ICQToolbar
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\systweak
Schlüssel Gelöscht : HKCU\Software\V9
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\Software\BetterSurf
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\Software\DealPly
Schlüssel Gelöscht : HKLM\Software\Desksvc
Schlüssel Gelöscht : HKLM\Software\eSafeSecControl
Schlüssel Gelöscht : HKLM\Software\hdcode
Schlüssel Gelöscht : HKLM\Software\ICQ\ICQToolbar
Schlüssel Gelöscht : HKLM\Software\Lightspark Team
Schlüssel Gelöscht : HKLM\Software\MediaPlayerV1
Schlüssel Gelöscht : HKLM\Software\MediaViewerV1
Schlüssel Gelöscht : HKLM\Software\MediaViewV1
Schlüssel Gelöscht : HKLM\Software\MediaWatchV1
Schlüssel Gelöscht : HKLM\Software\omigaplusSvc
Schlüssel Gelöscht : HKLM\Software\SearchProtect
Schlüssel Gelöscht : HKLM\Software\SupTab
Schlüssel Gelöscht : HKLM\Software\supWPM
Schlüssel Gelöscht : HKLM\Software\systweak
Schlüssel Gelöscht : HKLM\Software\Umbrella
Schlüssel Gelöscht : HKLM\Software\Uniblue
Schlüssel Gelöscht : HKLM\Software\V9
Schlüssel Gelöscht : HKLM\Software\winzipersvc
Schlüssel Gelöscht : HKLM\Software\Wpm
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3566FB70-E722-4182-8266-815EAE862998}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VOPackage
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\LevelQualityWatcher
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup
Daten Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll
Daten Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\07BF6653227E2814286618E5EA689289
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\526AB318AF0B8D84B9579557C9882C91
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\07BF6653227E2814286618E5EA689289
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\526AB318AF0B8D84B9579557C9882C91
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17041
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
-\\ Mozilla Firefox v29.0.1 (de)
[ Datei : C:\Users\TT Lammers\AppData\Roaming\Mozilla\Firefox\Profiles\5c32r3dn.default\prefs.js ]
Zeile gelöscht : user_pref("browser.newtab.url", "hxxp://www.trovi.com/?gd=&ctid=CT3324764&octid=EB_ORIGINAL_CTID&ISID=M64323012-9F22-4A3F-A226-17EB44074904&SearchSource=69&CUI=&SSPV=&Lay=1&UM=5&UP=SP99B94EC9-21D5-46B[...]
Zeile gelöscht : user_pref("browser.startup.homepage", "hxxp://www.trovi.com/?gd=&ctid=CT3324764&octid=EB_ORIGINAL_CTID&ISID=M64323012-9F22-4A3F-A226-17EB44074904&SearchSource=55&CUI=&UM=5&UP=SP99B94EC9-21D5-46B8-94D9[...]
Zeile gelöscht : user_pref("browser.uiCustomization.state", "{\"placements\":{\"PanelUI-contents\":[\"edit-controls\",\"zoom-controls\",\"new-window-button\",\"privatebrowsing-button\",\"save-page-button\",\"print-but[...]
Zeile gelöscht : user_pref("extensions.crossrider.bic", "144cc7764b708a5327333b519fd7ab00");
Zeile gelöscht : user_pref("extensions.helperbar.BackPageActive", true);
Zeile gelöscht : user_pref("extensions.helperbar.DockingPositionDown", false);
Zeile gelöscht : user_pref("extensions.helperbar.LastHiddenTime", 23259875);
Zeile gelöscht : user_pref("extensions.helperbar.SmartbarDisabled", true);
Zeile gelöscht : user_pref("extensions.helperbar.SmartbarStateMinimaized", false);
Zeile gelöscht : user_pref("extensions.helperbar.Visibility", true);
Zeile gelöscht : user_pref("extensions.helperbar.backPageCapacity", 3);
Zeile gelöscht : user_pref("extensions.helperbar.backPageCounter", 2);
Zeile gelöscht : user_pref("extensions.helperbar.backPageDay", 22);
Zeile gelöscht : user_pref("extensions.helperbar.backPageLastEvent", "1395514056608");
Zeile gelöscht : user_pref("extensions.helperbar.backPageMinInterval", 15);
Zeile gelöscht : user_pref("extensions.helperbar.barcodeid", "129845");
Zeile gelöscht : user_pref("extensions.helperbar.countryiso", "de");
Zeile gelöscht : user_pref("extensions.helperbar.downloadprovider", "ob_[[pubid]]_ch");
Zeile gelöscht : user_pref("extensions.helperbar.externalJsFiles", "{\"d\":\"[{\\\"ExcludeDomains\\\":[\\\"snap.do\\\",\\\"snapdo.com\\\"],\\\"hxxpInjection\\\":\\\"hxxp:\\\\\\/\\\\\\/i.linkuryjs.info\\\\\\/kury\\\\\\[...]
Zeile gelöscht : user_pref("extensions.helperbar.fromautoupdate", "false");
Zeile gelöscht : user_pref("extensions.helperbar.installationid", "c9cc215d-e7b8-0c12-82de-5025a5d309ce");
Zeile gelöscht : user_pref("extensions.helperbar.installdate", "16/03/2014");
Zeile gelöscht : user_pref("extensions.helperbar.keepAliveLastevent", "1394999777");
Zeile gelöscht : user_pref("extensions.helperbar.lastExternalJsUpdate", "1396122376332");
Zeile gelöscht : user_pref("extensions.helperbar.publisher", "shoppinghelper");
Zeile gelöscht : user_pref("extensions.iminent.admin", false);
Zeile gelöscht : user_pref("extensions.iminent.aflt", "orgnl");
Zeile gelöscht : user_pref("extensions.iminent.appId", "{0E4B2CAB-B859-4C57-B96E-63DDEC692BC4}");
Zeile gelöscht : user_pref("extensions.iminent.autoRvrt", "false");
Zeile gelöscht : user_pref("extensions.iminent.dfltLng", "");
Zeile gelöscht : user_pref("extensions.iminent.excTlbr", false);
Zeile gelöscht : user_pref("extensions.iminent.ffxUnstlRst", false);
Zeile gelöscht : user_pref("extensions.iminent.id", "7cbab5d900000000000000216a3bc6ad");
Zeile gelöscht : user_pref("extensions.iminent.instlDay", "16144");
Zeile gelöscht : user_pref("extensions.iminent.instlRef", "");
Zeile gelöscht : user_pref("extensions.iminent.newTab", false);
Zeile gelöscht : user_pref("extensions.iminent.prdct", "iminent");
Zeile gelöscht : user_pref("extensions.iminent.prtnrId", "iminent");
Zeile gelöscht : user_pref("extensions.iminent.rvrt", "false");
Zeile gelöscht : user_pref("extensions.iminent.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.iminent.tlbrId", "YCPCT");
Zeile gelöscht : user_pref("extensions.iminent.tlbrSrchUrl", "hxxp://start.iminent.com/?ref=toolbarm#q=");
Zeile gelöscht : user_pref("extensions.iminent.vrsn", "1.8.28.3");
Zeile gelöscht : user_pref("extensions.iminent.vrsnTs", "1.8.28.317:42:36");
Zeile gelöscht : user_pref("extensions.iminent.vrsni", "1.8.28.3");
Zeile gelöscht : user_pref("extensions.mywebsearch.prevKwdEnabled", true);
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.BUTTON_STRUCTURE", "[{\"b\":221360012,\"c\":\"mindspark.magnify\",\"p\":\"L.0\"},{\"b\":221360013,\"c\":\"mindspark.entersearchterms\",\"p\":\"L.0.0[...]
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.browser.search.selectedEngine.prev", "StartWeb");
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.browser.search.selectedEngine.savedPrev", "true");
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.browser.search.selectedEngine.tb", "Ask Web Search");
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.browser.startup.homepage.prev", "hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZDr--M9JXGUna1oWD0CV0Ozk[...]
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.browser.startup.homepage.savedPrev", "true");
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.browser.startup.homepage.tb", "hxxp://home.tb.ask.com/index.jhtml?ptb=3647B52E-61F9-4842-811C-226D62F0ED52&n=780bd8c7&p2=^AYY^xdm070^YYA^de&si=flvru[...]
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.browser.startup.page.savedPrev", 1);
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.browser.startup.page.tb", 1);
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.firstKnownVersion", "6.33.3.42841");
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.homepage", "hxxp://home.tb.ask.com/index.jhtml?ptb=3647B52E-61F9-4842-811C-226D62F0ED52&n=780bd8c7&p2=^AYY^xdm070^YYA^de&si=flvrunner");
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.hp.enabled", true);
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.hp.lastGuardTime", 363950291);
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.hp.numGuards", 1);
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.initialized", true);
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installKeysSource", "LocalStorage");
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installType", "XPI");
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installation.contextKey", "");
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installation.installDate", "2014042311");
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installation.partnerId", "^AYY^xdm070^YYA^de");
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installation.partnerSubId", "flvrunner");
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installation.pixelUrl", "hxxp://allin1convert.dl.tb.ask.com/install_pixels.jhtml?partner=^AYY^xdm070^YYA^de&coId=ac0d3211b07a433db95a276c0eacb5b3&ca[...]
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installation.success", true);
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installation.toolbarId", "3647B52E-61F9-4842-811C-226D62F0ED52");
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.isCompliantUninstallImplementation", true);
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.lastActivePing", "1400519653996");
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.lastKnownVersion", "6.33.3.46645");
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.options.defaultSearch", true);
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.options.homePageEnabled", true);
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.options.keywordEnabled", true);
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.options.tabEnabled", true);
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.partnerPixelFired", true);
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.searchHistory", "");
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.successUrl", "hxxp://flvrunner.com/thankyou.php");
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.toolbarCollapsed", false);
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.weather.location", "10001");
Zeile gelöscht : user_pref("extensions.toolbar.mindspark.hp.enabled", true);
Zeile gelöscht : user_pref("extensions.toolbar.mindspark.hp.enabled.guid", "allin1convert@mindspark.com");
Zeile gelöscht : user_pref("extensions.toolbar.mindspark.lastInstalled", "allin1convert@mindspark.com");
Zeile gelöscht : user_pref("iminent.enabledAds", "false");
Zeile gelöscht : user_pref("iminent.newtabredirect", "true");
Zeile gelöscht : user_pref("iminent.nomsi", "true");
Zeile gelöscht : user_pref("iminent.searchindex", "1");
-\\ Google Chrome v
*************************
AdwCleaner[R0].txt - [27249 octets] - [19/05/2014 20:33:15]
AdwCleaner[S0].txt - [26445 octets] - [19/05/2014 20:34:06]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [26506 octets] ##########
[/CODE] Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x64
Ran by TT Lammers on 19.05.2014 at 20:41:50,23
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-169882981-2974695269-2748925970-1001\Software\sweetim
~~~ Files
Successfully deleted: [File] "C:\Users\TT Lammers\appdata\local\google\chrome\user data\default\local storage\http_start.iminent.com_0.localstorage"
Successfully deleted: [File] "C:\Users\TT Lammers\appdata\local\google\chrome\user data\default\local storage\http_start.iminent.com_0.localstorage-journal"
~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\apn"
Successfully deleted: [Folder] "C:\Users\TT Lammers\AppData\Roaming\getrighttogo"
Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"
~~~ FireFox
Successfully deleted the following from C:\Users\TT Lammers\AppData\Roaming\mozilla\firefox\profiles\5c32r3dn.default\prefs.js
user_pref("browser.uiCustomization.state", "{\"placements\":{\"PanelUI-contents\":[\"edit-controls\",\"zoom-controls\",\"new-window-button\",\"privatebrowsing-button\",\"save-
user_pref("keyword.URL", "hxxp://search.tb.ask.com/search/GGmain.jhtml?st=kwd&ptb=3647B52E-61F9-4842-811C-226D62F0ED52&n=780bd8c7&ind=2014042311&p2=^AYY^xdm070^YYA^de&si=flvru
Emptied folder: C:\Users\TT Lammers\AppData\Roaming\mozilla\firefox\profiles\5c32r3dn.default\minidumps [18 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 19.05.2014 at 20:54:44,02
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
20.05.2014, 12:24
| #8 |
| /// the machine /// TB-Ausbilder | Im Internetbrowser öffnen sich immer wieder neue Seiten mit Werbung :(ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
20.05.2014, 20:51
| #9 |
| | Im Internetbrowser öffnen sich immer wieder neue Seiten mit Werbung :(Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=896d39a6a422084e90e7be543e5d6f2c
# engine=18342
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-05-20 07:40:43
# local_time=2014-05-20 09:40:43 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 89662 152244693 0 0
# scanned=180879
# found=1
# cleaned=1
# scan_time=3821
sh=F2FF36231DE8E93FE7AE49A547F06C91EAE50CE9 ft=0 fh=0000000000000000 vn="Variante von WMA/TrojanDownloader.GetCodec.gen Trojaner (Gesäubert - in Quarantäne kopiert)" ac=C fn="E:\Musik\Alles mögliche\isomnia craig david.mp3"
Code:
ATTFilter Results of screen317's Security Check version 0.99.83 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Adobe Flash Player 13.0.0.214 Adobe Reader XI ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbam.exe Avira Antivir avgnt.exe Avira Antivir avguard.exe Malwarebytes Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` Sieht schon alles viel besser aus.. |
|
21.05.2014, 10:39
| #10 |
| /// the machine /// TB-Ausbilder | Im Internetbrowser öffnen sich immer wieder neue Seiten mit Werbung :( Frisches FRST log fehtl noch
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
21.05.2014, 12:46
| #11 |
| |  Im Internetbrowser öffnen sich immer wieder neue Seiten mit Werbung :( Ist das damit gemeint?  FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-05-2014 Ran by TT Lammers (administrator) on TTLAMMERS-PC on 21-05-2014 13:42:40 Running from C:\Users\TT Lammers\Downloads Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\System32\atiesrxx.exe (Hewlett-Packard Company) C:\Windows\System32\hpservice.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe () C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe (AMD) C:\Windows\System32\atieclxx.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe (ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe () C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe ==================== Registry (Whitelisted) ================== HKLM-x32\...\Run: [ArcSoft Connection Service] => C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.) HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2011-10-24] (Apple Inc.) HKLM-x32\...\Run: [Guard.Mail.ru.gui] => C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [1564368 2012-09-28] () HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-21] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard) HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [189480 2014-02-06] (Geek Software GmbH) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) Winlogon\Notify\ScCertProp: wlnotify.dll [X] HKU\S-1-5-21-169882981-2974695269-2748925970-1001\...\Run: [HP Photosmart 5520 series (NET)] => C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.) HKU\S-1-5-21-169882981-2974695269-2748925970-1001\...\Run: [lollipop_10271122] => lollipop_10271122 GroupPolicy: Group Policy on Chrome detected <======= ATTENTION ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xEAB4E7844413CD01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\TT Lammers\AppData\Roaming\Mozilla\Firefox\Profiles\5c32r3dn.default FF DefaultSearchEngine: Trovi search FF SelectedSearchEngine: Trovi search FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll () FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll () FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @videolan.org/vlc,version=2.0.5 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @lightspark.github.com/Lightspark;version=1 - C:\Program Files (x86)\Lightspark 0.5.3-git\nplightsparkplugin.dll No File FF SearchPlugin: C:\Users\TT Lammers\AppData\Roaming\Mozilla\Firefox\Profiles\5c32r3dn.default\searchplugins\englische-ergebnisse.xml FF SearchPlugin: C:\Users\TT Lammers\AppData\Roaming\Mozilla\Firefox\Profiles\5c32r3dn.default\searchplugins\gmx-suche.xml FF SearchPlugin: C:\Users\TT Lammers\AppData\Roaming\Mozilla\Firefox\Profiles\5c32r3dn.default\searchplugins\lastminute.xml FF SearchPlugin: C:\Users\TT Lammers\AppData\Roaming\Mozilla\Firefox\Profiles\5c32r3dn.default\searchplugins\webde-suche.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Adblock Plus - C:\Users\TT Lammers\AppData\Roaming\Mozilla\Firefox\Profiles\5c32r3dn.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-03-16] FF HKLM-x32\...\Firefox\Extensions: [12x3q4@3244516.com] - C:\Program Files (x86)\Better-Surf\ff Chrome: ======= Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION CHR Extension: (No Name) - C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\bopakagnckmlgajfccecajhnimjiiedh [2014-02-22] CHR Extension: (Media Viewer) - C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\eagngmbbjpiegdiojneaoolbllnappjo [2014-02-24] CHR Extension: (Stylish) - C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe [2012-09-17] CHR Extension: (Click&Clean) - C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgabhipcejejjmhhchfonmamedcbeod [2012-09-17] CHR Extension: (DealPly UK) - C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\hggpkhijoeadmdfmlbdepfbngmhaldci [2013-08-05] CHR Extension: (Video Player) - C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnghlghflihkfiopikcjmaiajgbieegb [2014-01-09] CHR Extension: (Media Watch) - C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\lamhhbmgfmocmpeljkaablpohealeplo [2014-03-23] CHR Extension: (Media View) - C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\mglkejdgkcfeeecbbancdeeidmfpjkco [2014-03-16] CHR Extension: (No Name) - C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\nchpfiddbhbdnagofhkjlaiaejmkdcla [2013-08-18] CHR Extension: (Media View) - C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\nkmdmgjelehbgmopdfpjadcnihhpneop [2014-03-03] CHR Extension: (Google Wallet) - C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-03] CHR Extension: (Webexp Enhanced) - C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\obohmgehnpafmnikhnbehbefaheahaho [2013-12-21] CHR Extension: (No Name) - C:\Users\TT Lammers\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkndmigholgfjlniaohblojbhgjbkakn [2014-01-24] CHR HKLM-x32\...\Chrome\Extension: [eagngmbbjpiegdiojneaoolbllnappjo] - C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha1336\ch\MediaViewerV1alpha1336.crx [2014-01-24] CHR HKLM-x32\...\Chrome\Extension: [hgdnflefohjalljihdmibbblffdjbaph] - C:\Program Files (x86)\MediaBuzzV1\MediaBuzzV1mode146\ch\MediaBuzzV1mode146.crx [2014-01-24] CHR HKLM-x32\...\Chrome\Extension: [lamhhbmgfmocmpeljkaablpohealeplo] - C:\Program Files (x86)\MediaWatchV1\MediaWatchV1home30\ch\MediaWatchV1home30.crx [2014-01-24] CHR HKLM-x32\...\Chrome\Extension: [lmpfnkohfgifngknnjnhhckblkdimckn] - C:\Program Files (x86)\RichMediaViewV1\RichMediaViewV1release866\ch\RichMediaViewV1release866.crx [2014-01-24] CHR HKLM-x32\...\Chrome\Extension: [mglkejdgkcfeeecbbancdeeidmfpjkco] - C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha5026\ch\MediaViewV1alpha5026.crx [2014-01-24] CHR HKLM-x32\...\Chrome\Extension: [mmifolfpllfdhilecpdpmemhelmanajl] - C:\Program Files (x86)\BetterSurf\BetterSurfPlus\ch\BetterSurfPlus.crx [2014-01-24] CHR HKLM-x32\...\Chrome\Extension: [nkmdmgjelehbgmopdfpjadcnihhpneop] - C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha1029\ch\MediaViewV1alpha1029.crx [2014-01-24] CHR HKLM-x32\...\Chrome\Extension: [obohmgehnpafmnikhnbehbefaheahaho] - C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha483\ch\WebexpEnhancedV1alpha483.crx [2014-01-24] ==================== Services (Whitelisted) ================= R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG) R2 Guard.Mail.ru; C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [1564368 2012-09-28] () R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation) ==================== Drivers (Whitelisted) ==================== U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-19] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-19] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-30] (Avira Operations GmbH & Co. KG) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-05-21] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation) R1 netfilter64; C:\Windows\System32\drivers\netfilter64.sys [61736 2014-02-28] (NetFilterSDK.com) R3 RICOH SmartCard Reader; C:\Windows\System32\DRIVERS\rismcx64.sys [79488 2006-10-03] (RICOH Company, Ltd.) R1 {0782648b-1717-4fef-ac58-8cb3ce03adb3}w64; C:\Windows\System32\drivers\{0782648b-1717-4fef-ac58-8cb3ce03adb3}w64.sys [61120 2014-05-16] (StdLib) S3 catchme; \??\C:\ComboFix\catchme.sys [X] S1 jjwrqayv; \??\C:\Windows\system32\drivers\jjwrqayv.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-05-20 21:47 - 2014-05-20 21:47 - 00854367 _____ () C:\Users\TT Lammers\Downloads\SecurityCheck.exe 2014-05-20 20:32 - 2014-05-20 20:33 - 02347384 _____ (ESET) C:\Users\TT Lammers\Downloads\esetsmartinstaller_deu.exe 2014-05-20 17:23 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-05-20 17:23 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-05-20 17:23 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-05-20 17:23 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-05-20 17:23 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-05-20 17:23 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-05-19 20:41 - 2014-05-19 20:41 - 01016261 _____ (Thisisu) C:\Users\TT Lammers\Downloads\JRT(4).exe 2014-05-19 20:41 - 2014-05-19 20:41 - 00000000 ____D () C:\Windows\ERUNT 2014-05-19 20:40 - 2014-05-19 20:41 - 01016261 _____ (Thisisu) C:\Users\TT Lammers\Downloads\JRT(3).exe 2014-05-19 20:40 - 2014-05-19 20:40 - 01016261 _____ (Thisisu) C:\Users\TT Lammers\Downloads\JRT(2).exe 2014-05-19 20:40 - 2014-05-19 20:40 - 01016261 _____ (Thisisu) C:\Users\TT Lammers\Downloads\JRT(1).exe 2014-05-19 20:39 - 2014-05-19 20:39 - 01016261 _____ (Thisisu) C:\Users\TT Lammers\Downloads\JRT.exe 2014-05-19 20:33 - 2014-05-19 20:34 - 00000000 ____D () C:\AdwCleaner 2014-05-19 20:33 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll 2014-05-19 20:32 - 2014-05-19 20:32 - 01326389 _____ () C:\Users\TT Lammers\Downloads\adwcleaner_3.210.exe 2014-05-19 19:57 - 2014-05-21 13:37 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-05-19 19:57 - 2014-05-19 19:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-05-19 19:57 - 2014-05-19 19:57 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-05-19 19:57 - 2014-05-19 19:57 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-05-19 19:57 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-05-19 19:57 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-05-19 19:57 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-05-19 19:55 - 2014-05-19 19:56 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\TT Lammers\Downloads\mbam-setup-2.0.1.1004(1).exe 2014-05-19 19:55 - 2014-05-19 19:55 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\TT Lammers\Downloads\mbam-setup-2.0.1.1004.exe 2014-05-19 19:45 - 2012-07-25 12:03 - 00016896 _____ () C:\Windows\system32\sasnative64.exe 2014-05-19 19:23 - 2014-05-19 19:27 - 00000000 ____D () C:\Users\TT Lammers\Desktop\BÜWI Klausur 2014-05-19 19:21 - 2014-05-19 19:21 - 00000000 ____D () C:\Users\TT Lammers\Desktop\2014-04-19 - BüWi2 2014-05-19 19:21 - 2014-05-19 19:21 - 00000000 ____D () C:\Users\TT Lammers\Desktop\2014-04-19 - Büwi1 2014-05-19 19:21 - 2014-05-19 19:21 - 00000000 ____D () C:\Users\TT Lammers\Desktop\2014-04-19 - 2014-05-17 18:50 - 2014-05-16 15:34 - 00061120 _____ (StdLib) C:\Windows\system32\Drivers\{0782648b-1717-4fef-ac58-8cb3ce03adb3}w64.sys 2014-05-15 21:43 - 2014-05-15 21:43 - 00000000 ____D () C:\Users\TT Lammers\Downloads\FRST-OlderVersion 2014-05-15 05:08 - 2014-05-15 05:08 - 00000000 ____D () C:\71bcb22271ebfe659f40 2014-05-14 22:07 - 2014-05-14 22:07 - 00036275 _____ () C:\ComboFix.txt 2014-05-14 21:58 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-05-14 21:58 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-05-14 21:58 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-05-14 21:58 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-05-14 21:58 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-05-14 21:58 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe 2014-05-14 21:58 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe 2014-05-14 21:58 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe 2014-05-14 21:56 - 2014-05-21 13:37 - 00000000 ___RD () C:\Users\TT Lammers\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-05-14 21:56 - 2014-05-21 13:37 - 00000000 ___RD () C:\Users\TT Lammers\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-05-14 21:56 - 2014-05-14 22:07 - 00000000 ____D () C:\Qoobox 2014-05-14 21:56 - 2014-05-14 22:05 - 00000000 ____D () C:\Windows\erdnt 2014-05-14 21:55 - 2014-05-14 21:55 - 05200050 ____R (Swearware) C:\Users\TT Lammers\Downloads\ComboFix.exe 2014-05-14 21:55 - 2014-05-14 21:55 - 00003280 _____ () C:\Windows\System32\Tasks\{925D4BB1-3201-43C9-9DA9-6A9D2DFADDB8} 2014-05-14 20:55 - 2014-05-14 20:55 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\TT Lammers\Downloads\revosetup95(2).exe 2014-05-14 20:55 - 2014-05-14 20:55 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-05-14 20:54 - 2014-05-14 20:54 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\TT Lammers\Downloads\revosetup95.exe 2014-05-14 20:54 - 2014-05-14 20:54 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\TT Lammers\Downloads\revosetup95(1).exe 2014-05-14 17:24 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-05-14 17:24 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-05-14 17:24 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-05-14 17:24 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2014-05-14 17:23 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2014-05-14 17:23 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2014-05-14 17:23 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-05-14 17:23 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2014-05-14 17:23 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2014-05-14 17:23 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2014-05-14 17:23 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2014-05-14 17:23 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2014-05-14 17:23 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2014-05-14 17:23 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2014-05-14 17:23 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-05-14 17:23 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll 2014-05-14 17:23 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll 2014-05-14 17:23 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2014-05-14 17:23 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2014-05-14 17:23 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2014-05-14 17:23 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2014-05-14 17:23 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll 2014-05-14 17:23 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe 2014-05-14 17:23 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll 2014-05-14 17:23 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll 2014-05-14 17:23 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll 2014-05-14 17:23 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll 2014-05-14 17:23 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll 2014-05-14 17:23 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2014-05-14 17:23 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2014-05-14 17:23 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2014-05-14 17:23 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2014-05-14 17:23 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll 2014-05-14 17:23 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2014-05-14 17:23 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2014-05-14 17:23 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2014-05-14 17:23 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2014-05-14 17:23 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll 2014-05-14 17:23 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll 2014-05-14 17:23 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll 2014-05-14 17:23 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll 2014-05-14 17:23 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll 2014-05-14 17:23 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll 2014-05-14 17:23 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2014-05-14 17:23 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll 2014-05-13 21:27 - 2014-05-13 21:28 - 00016622 _____ () C:\Users\TT Lammers\Downloads\Addition.txt 2014-05-13 21:26 - 2014-05-21 13:42 - 00013204 _____ () C:\Users\TT Lammers\Downloads\FRST.txt 2014-05-13 21:26 - 2014-05-21 13:42 - 00000000 ____D () C:\FRST 2014-05-13 21:25 - 2014-05-15 21:43 - 02067456 _____ (Farbar) C:\Users\TT Lammers\Downloads\FRST64.exe 2014-05-13 19:57 - 2014-05-13 19:57 - 00042746 _____ () C:\Users\TT Lammers\Desktop\Extras.Txt 2014-05-13 19:36 - 2014-05-13 19:36 - 00000000 ____D () C:\ProgramData\Oracle 2014-05-13 19:35 - 2014-05-13 19:35 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-05-13 19:35 - 2014-05-13 19:35 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-05-13 19:35 - 2014-05-13 19:35 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-05-13 19:35 - 2014-05-13 19:35 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-05-13 19:35 - 2014-05-13 19:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-05-13 19:35 - 2014-05-13 19:35 - 00000000 ____D () C:\Program Files (x86)\Java 2014-05-13 19:22 - 2014-05-19 20:22 - 00000000 ____D () C:\Program Files (x86)\RichMediaViewV1 2014-05-12 22:25 - 2014-05-19 21:11 - 00011164 _____ () C:\Users\TT Lammers\Desktop\geschriebene Bewerbungen.xlsx 2014-05-12 16:55 - 2014-05-12 16:55 - 11830920 _____ (LULU Software Limited) C:\Users\TT Lammers\Downloads\Soda_PDF_6_Installer.exe 2014-05-10 20:38 - 2014-05-11 20:43 - 00000000 ___SD () C:\Users\TT Lammers\Documents\Eigene Datenquellen 2014-05-06 21:10 - 2014-05-20 22:06 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-05-04 14:01 - 2014-05-04 14:01 - 00000000 __SHD () C:\Users\TT Lammers\AppData\Local\EmieUserList 2014-05-04 14:01 - 2014-05-04 14:01 - 00000000 __SHD () C:\Users\TT Lammers\AppData\Local\EmieSiteList 2014-05-03 12:02 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-05-03 12:02 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-05-03 12:02 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-05-03 12:02 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-05-03 12:02 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-05-03 12:02 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-05-03 12:02 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-05-03 12:02 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-05-03 12:02 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-05-03 12:02 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-05-03 12:02 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-05-03 12:02 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-05-03 12:02 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-05-03 12:02 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-05-03 12:02 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-05-03 12:02 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-05-03 12:02 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-05-03 12:02 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-05-03 12:02 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-05-03 12:02 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-05-03 12:02 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-05-03 12:02 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-05-03 12:02 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-05-03 12:02 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-05-03 12:02 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-05-03 12:02 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-05-03 12:02 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-05-03 12:02 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-05-03 12:02 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-05-03 12:02 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-05-03 12:02 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-05-03 12:02 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-05-03 12:02 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-05-03 12:02 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-05-03 12:02 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-05-03 12:02 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-05-03 12:02 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-05-03 12:02 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-05-03 12:02 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-05-03 12:02 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-05-03 12:02 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-05-03 12:02 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-05-03 12:02 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-05-03 12:02 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-04-28 16:18 - 2014-05-10 19:29 - 00011012 _____ () C:\Users\TT Lammers\Documents\geschriebene Bewerbungen.xlsx 2014-04-23 11:42 - 2014-04-23 11:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\TT Lammers\Downloads\Bewerbung Anschreiben Vorlage - CHIP-Downloader.exe 2014-04-23 11:42 - 2014-04-23 11:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\TT Lammers\Downloads\Bewerbung Anschreiben Vorlage - CHIP-Downloader(1).exe 2014-04-22 19:11 - 2014-04-22 19:11 - 00274912 _____ () C:\Windows\Minidump\042214-19406-01.dmp ==================== One Month Modified Files and Folders ======= 2014-05-21 13:43 - 2014-05-13 21:26 - 00013204 _____ () C:\Users\TT Lammers\Downloads\FRST.txt 2014-05-21 13:43 - 2012-03-30 17:54 - 01049178 _____ () C:\Windows\WindowsUpdate.log 2014-05-21 13:42 - 2014-05-13 21:26 - 00000000 ____D () C:\FRST 2014-05-21 13:42 - 2012-04-05 18:27 - 00003966 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{DA1740FC-9DDA-4425-BBCC-DE77247D9875} 2014-05-21 13:41 - 2011-04-12 09:43 - 00699682 _____ () C:\Windows\system32\perfh007.dat 2014-05-21 13:41 - 2011-04-12 09:43 - 00149790 _____ () C:\Windows\system32\perfc007.dat 2014-05-21 13:41 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-05-21 13:38 - 2009-07-14 06:45 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-05-21 13:38 - 2009-07-14 06:45 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-05-21 13:37 - 2014-05-19 19:57 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-05-21 13:37 - 2014-05-14 21:56 - 00000000 ___RD () C:\Users\TT Lammers\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-05-21 13:37 - 2014-05-14 21:56 - 00000000 ___RD () C:\Users\TT Lammers\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-05-21 13:34 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-05-21 13:34 - 2009-07-14 06:51 - 00169341 _____ () C:\Windows\setupact.log 2014-05-21 13:33 - 2010-11-21 05:47 - 00585174 _____ () C:\Windows\PFRO.log 2014-05-20 22:06 - 2014-05-06 21:10 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-05-20 21:47 - 2014-05-20 21:47 - 00854367 _____ () C:\Users\TT Lammers\Downloads\SecurityCheck.exe 2014-05-20 21:25 - 2014-04-15 19:17 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-05-20 20:33 - 2014-05-20 20:32 - 02347384 _____ (ESET) C:\Users\TT Lammers\Downloads\esetsmartinstaller_deu.exe 2014-05-20 17:34 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp 2014-05-20 17:23 - 2012-03-30 18:36 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-05-20 17:20 - 2013-07-23 21:42 - 00000000 ____D () C:\Windows\system32\MRT 2014-05-20 17:20 - 2012-04-05 19:24 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-05-19 21:11 - 2014-05-12 22:25 - 00011164 _____ () C:\Users\TT Lammers\Desktop\geschriebene Bewerbungen.xlsx 2014-05-19 20:41 - 2014-05-19 20:41 - 01016261 _____ (Thisisu) C:\Users\TT Lammers\Downloads\JRT(4).exe 2014-05-19 20:41 - 2014-05-19 20:41 - 00000000 ____D () C:\Windows\ERUNT 2014-05-19 20:41 - 2014-05-19 20:40 - 01016261 _____ (Thisisu) C:\Users\TT Lammers\Downloads\JRT(3).exe 2014-05-19 20:40 - 2014-05-19 20:40 - 01016261 _____ (Thisisu) C:\Users\TT Lammers\Downloads\JRT(2).exe 2014-05-19 20:40 - 2014-05-19 20:40 - 01016261 _____ (Thisisu) C:\Users\TT Lammers\Downloads\JRT(1).exe 2014-05-19 20:39 - 2014-05-19 20:39 - 01016261 _____ (Thisisu) C:\Users\TT Lammers\Downloads\JRT.exe 2014-05-19 20:34 - 2014-05-19 20:33 - 00000000 ____D () C:\AdwCleaner 2014-05-19 20:34 - 2014-03-29 23:49 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-05-19 20:34 - 2012-04-07 20:08 - 00000000 ____D () C:\ProgramData\ICQ 2014-05-19 20:34 - 2012-03-30 17:57 - 00000000 ____D () C:\Users\TT Lammers 2014-05-19 20:32 - 2014-05-19 20:32 - 01326389 _____ () C:\Users\TT Lammers\Downloads\adwcleaner_3.210.exe 2014-05-19 20:22 - 2014-05-13 19:22 - 00000000 ____D () C:\Program Files (x86)\RichMediaViewV1 2014-05-19 20:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Web 2014-05-19 19:57 - 2014-05-19 19:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-05-19 19:57 - 2014-05-19 19:57 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-05-19 19:57 - 2014-05-19 19:57 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-05-19 19:56 - 2014-05-19 19:55 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\TT Lammers\Downloads\mbam-setup-2.0.1.1004(1).exe 2014-05-19 19:55 - 2014-05-19 19:55 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\TT Lammers\Downloads\mbam-setup-2.0.1.1004.exe 2014-05-19 19:27 - 2014-05-19 19:23 - 00000000 ____D () C:\Users\TT Lammers\Desktop\BÜWI Klausur 2014-05-19 19:21 - 2014-05-19 19:21 - 00000000 ____D () C:\Users\TT Lammers\Desktop\2014-04-19 - BüWi2 2014-05-19 19:21 - 2014-05-19 19:21 - 00000000 ____D () C:\Users\TT Lammers\Desktop\2014-04-19 - Büwi1 2014-05-19 19:21 - 2014-05-19 19:21 - 00000000 ____D () C:\Users\TT Lammers\Desktop\2014-04-19 - 2014-05-19 19:12 - 2009-07-14 04:34 - 00000505 _____ () C:\Windows\win.ini 2014-05-16 15:34 - 2014-05-17 18:50 - 00061120 _____ (StdLib) C:\Windows\system32\Drivers\{0782648b-1717-4fef-ac58-8cb3ce03adb3}w64.sys 2014-05-15 21:43 - 2014-05-15 21:43 - 00000000 ____D () C:\Users\TT Lammers\Downloads\FRST-OlderVersion 2014-05-15 21:43 - 2014-05-13 21:25 - 02067456 _____ (Farbar) C:\Users\TT Lammers\Downloads\FRST64.exe 2014-05-15 05:08 - 2014-05-15 05:08 - 00000000 ____D () C:\71bcb22271ebfe659f40 2014-05-14 22:07 - 2014-05-14 22:07 - 00036275 _____ () C:\ComboFix.txt 2014-05-14 22:07 - 2014-05-14 21:56 - 00000000 ____D () C:\Qoobox 2014-05-14 22:07 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default 2014-05-14 22:05 - 2014-05-14 21:56 - 00000000 ____D () C:\Windows\erdnt 2014-05-14 22:05 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini 2014-05-14 21:55 - 2014-05-14 21:55 - 05200050 ____R (Swearware) C:\Users\TT Lammers\Downloads\ComboFix.exe 2014-05-14 21:55 - 2014-05-14 21:55 - 00003280 _____ () C:\Windows\System32\Tasks\{925D4BB1-3201-43C9-9DA9-6A9D2DFADDB8} 2014-05-14 20:55 - 2014-05-14 20:55 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\TT Lammers\Downloads\revosetup95(2).exe 2014-05-14 20:55 - 2014-05-14 20:55 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-05-14 20:54 - 2014-05-14 20:54 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\TT Lammers\Downloads\revosetup95.exe 2014-05-14 20:54 - 2014-05-14 20:54 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\TT Lammers\Downloads\revosetup95(1).exe 2014-05-14 17:27 - 2014-04-15 19:17 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-05-14 17:27 - 2014-04-15 19:17 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-05-14 17:27 - 2014-04-15 19:17 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-05-14 17:12 - 2014-03-23 13:43 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2014-05-13 21:28 - 2014-05-13 21:27 - 00016622 _____ () C:\Users\TT Lammers\Downloads\Addition.txt 2014-05-13 20:04 - 2013-05-16 22:38 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2014-05-13 19:57 - 2014-05-13 19:57 - 00042746 _____ () C:\Users\TT Lammers\Desktop\Extras.Txt 2014-05-13 19:55 - 2014-03-15 15:40 - 00000000 ____D () C:\Users\TT Lammers\Desktop\Musik 2014-05-13 19:55 - 2014-03-15 15:36 - 00000000 ____D () C:\Users\TT Lammers\Desktop\Prüfungsvorbereitung 2014-05-13 19:54 - 2013-07-31 21:48 - 00000000 ____D () C:\Program Files\GIMP 2 2014-05-13 19:48 - 2014-04-15 19:54 - 00000000 ____D () C:\Program Files (x86)\BEWERBUNGSMASTER 2014-05-13 19:47 - 2014-04-15 19:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BewerbungsMaster 2014-05-13 19:36 - 2014-05-13 19:36 - 00000000 ____D () C:\ProgramData\Oracle 2014-05-13 19:35 - 2014-05-13 19:35 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-05-13 19:35 - 2014-05-13 19:35 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-05-13 19:35 - 2014-05-13 19:35 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-05-13 19:35 - 2014-05-13 19:35 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-05-13 19:35 - 2014-05-13 19:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-05-13 19:35 - 2014-05-13 19:35 - 00000000 ____D () C:\Program Files (x86)\Java 2014-05-13 19:22 - 2014-01-29 19:36 - 00000306 __RSH () C:\ProgramData\ntuser.pol 2014-05-12 18:24 - 2014-02-23 16:37 - 00000000 ____D () C:\Users\TT Lammers\Desktop\Bewerbungen 2014-05-12 16:55 - 2014-05-12 16:55 - 11830920 _____ (LULU Software Limited) C:\Users\TT Lammers\Downloads\Soda_PDF_6_Installer.exe 2014-05-11 20:43 - 2014-05-10 20:38 - 00000000 ___SD () C:\Users\TT Lammers\Documents\Eigene Datenquellen 2014-05-11 18:32 - 2012-03-30 18:36 - 00000000 ____D () C:\Users\TT Lammers\AppData\Local\Microsoft Help 2014-05-11 18:24 - 2014-03-15 18:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-05-10 19:29 - 2014-04-28 16:18 - 00011012 _____ () C:\Users\TT Lammers\Documents\geschriebene Bewerbungen.xlsx 2014-05-09 08:14 - 2014-05-14 17:24 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-05-09 08:11 - 2014-05-14 17:24 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-05-08 22:11 - 2014-02-21 19:50 - 00000000 ____D () C:\Program Files (x86)\Opera 2014-05-06 20:47 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache 2014-05-06 06:40 - 2014-05-20 17:23 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-05-06 06:17 - 2014-05-20 17:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-05-06 05:25 - 2014-05-20 17:23 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-05-06 05:07 - 2014-05-20 17:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-05-06 05:00 - 2014-05-20 17:23 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-05-06 04:10 - 2014-05-20 17:23 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-05-04 14:01 - 2014-05-04 14:01 - 00000000 __SHD () C:\Users\TT Lammers\AppData\Local\EmieUserList 2014-05-04 14:01 - 2014-05-04 14:01 - 00000000 __SHD () C:\Users\TT Lammers\AppData\Local\EmieSiteList 2014-05-03 13:02 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-04-29 14:24 - 2014-02-09 17:22 - 00055296 ___SH () C:\Users\TT Lammers\Documents\Thumbs.db 2014-04-24 23:42 - 2012-12-15 12:10 - 00000000 ____D () C:\Users\TT Lammers\Documents\Ausbildung 2014-04-24 23:36 - 2013-01-07 23:20 - 00366080 ___SH () C:\Users\TT Lammers\Downloads\Thumbs.db 2014-04-24 22:32 - 2014-04-07 17:43 - 00000583 _____ () C:\Users\TT Lammers\Desktop\Buchungsuebersicht.lnk 2014-04-23 11:42 - 2014-04-23 11:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\TT Lammers\Downloads\Bewerbung Anschreiben Vorlage - CHIP-Downloader.exe 2014-04-23 11:42 - 2014-04-23 11:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\TT Lammers\Downloads\Bewerbung Anschreiben Vorlage - CHIP-Downloader(1).exe 2014-04-23 11:31 - 2014-04-15 19:55 - 00000000 ____D () C:\Users\TT Lammers\AppData\Local\BewerbungsMaster 2014-04-22 19:11 - 2014-04-22 19:11 - 00274912 _____ () C:\Windows\Minidump\042214-19406-01.dmp 2014-04-22 19:11 - 2012-10-21 20:59 - 400341788 _____ () C:\Windows\MEMORY.DMP 2014-04-22 19:11 - 2012-10-21 20:59 - 00000000 ____D () C:\Windows\Minidump Some content of TEMP: ==================== C:\Users\TT Lammers\AppData\Local\Temp\032939rr.exe C:\Users\TT Lammers\AppData\Local\Temp\avgnt.exe C:\Users\TT Lammers\AppData\Local\Temp\BackupSetup.exe C:\Users\TT Lammers\AppData\Local\Temp\f.exe C:\Users\TT Lammers\AppData\Local\Temp\nseD0AA.exe C:\Users\TT Lammers\AppData\Local\Temp\nsh1F3C.exe C:\Users\TT Lammers\AppData\Local\Temp\nskD4C1.exe C:\Users\TT Lammers\AppData\Local\Temp\nsn106A.exe C:\Users\TT Lammers\AppData\Local\Temp\nsnC73.exe C:\Users\TT Lammers\AppData\Local\Temp\nsu96A.exe C:\Users\TT Lammers\AppData\Local\Temp\nsuDFD.exe C:\Users\TT Lammers\AppData\Local\Temp\nsx1B07.exe C:\Users\TT Lammers\AppData\Local\Temp\Quarantine.exe C:\Users\TT Lammers\AppData\Local\Temp\SPSetup.exe C:\Users\TT Lammers\AppData\Local\Temp\vcredist_x64.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe [2014-05-14 17:23] - [2014-03-04 11:43] - 0455168 ____A (Microsoft Corporation) 88AB9B72B4BF3963A0DE0820B4B0B06C C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-05-11 19:49 ==================== End Of Log ============================ |
|
22.05.2014, 08:46
| #12 |
| /// the machine /// TB-Ausbilder | Im Internetbrowser öffnen sich immer wieder neue Seiten mit Werbung :( genau Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Im Internetbrowser öffnen sich immer wieder neue Seiten mit Werbung :( |
| alle farben, awesomehp, awesomehp entfernen, browser, explorer, firefox, flash player, google, helper, lightning speeddial, lightning speeddial entfernen, logfile, mobogenie, mobogenie entfernen, mozilla, neue seite, nextlive, registry, senden, software, trojaner "system repair, usb, werbung, werbung auf jeder internetseite, windows, wma/trojandownloader.getcodec.gen |
Revo Uninstaller herunter.
dann auf 
und dann auf 
.
Linear-Darstellung
